# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jul 9 2019 16:03:52 # Log Creation Date: 10.07.2019 08:12:43.431 Process: id = "1" image_name = "lock.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lock.exe" page_root = "0x4cabf000" os_pid = "0x9a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x9a4 [0027.408] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0027.408] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0029.962] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75220000 [0031.036] GetKeyboardType (nTypeFlag=0) returned 4 [0031.053] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe\" " [0031.053] GetStartupInfoA (in: lpStartupInfo=0x18fd18 | out: lpStartupInfo=0x18fd18*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0031.053] GetVersion () returned 0x1db10106 [0031.053] GetVersion () returned 0x1db10106 [0031.053] GetCurrentThreadId () returned 0x9a4 [0031.053] GetEnvironmentVariableA (in: lpName="APPDATA", lpBuffer=0x414b68, nSize=0x100 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x2d [0031.053] GetEnvironmentVariableA (in: lpName="LOCALAPPDATA", lpBuffer=0x414c68, nSize=0x100 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned 0x2b [0031.053] GetEnvironmentVariableA (in: lpName="ProgramFiles", lpBuffer=0x414d68, nSize=0x100 | out: lpBuffer="C:\\Program Files (x86)") returned 0x16 [0031.054] GetEnvironmentVariableA (in: lpName="USERNAME", lpBuffer=0x414e68, nSize=0x100 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0031.054] GetEnvironmentVariableA (in: lpName="USERPROFILE", lpBuffer=0x414f68, nSize=0x100 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned 0x1d [0031.054] LoadLibraryA (lpLibFileName="wininet.dll") returned 0x753d0000 [0032.740] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75fd0000 [0034.369] IsUserAnAdmin () returned 1 [0034.369] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0034.497] LoadLibraryA (lpLibFileName="winmm.dll") returned 0x74b10000 [0034.688] LoadLibraryA (lpLibFileName="srclient.dll") returned 0x74b00000 [0035.490] LoadLibraryA (lpLibFileName="url.dll") returned 0x74950000 [0037.422] GetProcessHeap () returned 0x580000 [0037.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c) returned 0x5a2b68 [0037.422] GetProcessHeap () returned 0x580000 [0037.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd8) returned 0x5a2d58 [0037.423] GetProcessHeap () returned 0x580000 [0037.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18) returned 0x5a1f88 [0037.423] SetErrorMode (uMode=0x8003) returned 0x0 [0037.423] GetProcessHeap () returned 0x580000 [0037.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22) returned 0x59a4e8 [0037.423] GetLocaleInfoA (in: Locale=0x400, LCType=0x5a, lpLCData=0x18fd83, cchData=5 | out: lpLCData="US") returned 3 [0037.426] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59e330 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x59f720 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x59f748 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x59f770 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x59f798 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x59f7c0 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x59a518 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ecc0 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ecd8 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ecf0 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ed08 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x59f7e8 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ed20 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ed38 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ed50 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ed68 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ed80 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ed98 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59edb0 [0037.427] GetProcessHeap () returned 0x580000 [0037.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59edc8 [0037.427] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ede0 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59edf8 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ee10 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ee28 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ee40 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ee58 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x59ee70 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59ee88 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x59eea0 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5a2e50 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5a2e68 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5a2e80 [0037.428] GetProcessHeap () returned 0x580000 [0037.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5a3238 [0037.428] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5a3334, nSize=0x400 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lock.exe")) returned 0x2e [0037.429] SysReAllocStringLen (in: pbstr=0x18ff70*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe", len=0x2e | out: pbstr=0x18ff70*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe") returned 1 [0037.429] SysReAllocStringLen (in: pbstr=0x5a1f8c*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe", len=0x2e | out: pbstr=0x5a1f8c*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lock.exe") returned 1 [0037.429] SysReAllocStringLen (in: pbstr=0x5a1f90*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x5a1f90*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0037.429] SysReAllocStringLen (in: pbstr=0x5a1f94*=0x0, psz="lock.exe", len=0x8 | out: pbstr=0x5a1f94*="lock.exe") returned 1 [0037.429] WideCharToMultiByte (in: CodePage=0x3, dwFlags=0x0, lpWideCharStr="lock.exe", cchWideChar=8, lpMultiByteStr=0x18ed70, cbMultiByte=4095, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="lock.exeþÿÿÿX", lpUsedDefaultChar=0x0) returned 8 [0037.429] GetProcessHeap () returned 0x580000 [0037.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5a1fa8 [0037.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5a1fb0, cbMultiByte=8, lpWideCharStr=0x18ed4c, cchWideChar=2047 | out: lpWideCharStr="lock.exe｠\x18\x08") returned 8 [0037.429] GetProcessHeap () returned 0x580000 [0037.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5a2eb0 [0037.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5a2eb8, cbMultiByte=4, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="lock￾￿X眖ﴏ眕\x01") returned 4 [0037.430] SysReAllocStringLen (in: pbstr=0x5a1f98*=0x0, psz="exe", len=0x3 | out: pbstr=0x5a1f98*="exe") returned 1 [0037.430] GetProcessHeap () returned 0x580000 [0037.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5a2ee0 [0037.430] GetProcessHeap () returned 0x580000 [0037.430] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59ed80 | out: hHeap=0x580000) returned 1 [0037.430] Sleep (dwMilliseconds=0x0) [0037.431] InetIsOffline () returned 0x0 [0038.375] ShellExecuteExW (in: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"vssadmin.exe delete shadows /all /quiet\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"vssadmin.exe delete shadows /all /quiet\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x278)) returned 1 [0038.615] ShellExecuteExW (in: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} recoveryenabled no\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} recoveryenabled no\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2dc)) returned 1 [0038.847] ShellExecuteExW (in: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x18fd28*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="cmd", lpParameters=" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x2e4)) returned 1 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x60) returned 0x5bb4e0 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c31b0 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5c3118, cbMultiByte=9, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="\\windows\\Z") returned 9 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.929] GetProcessHeap () returned 0x580000 [0038.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c31b0 [0038.929] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abc60 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcee8 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcee8 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5abc68, cbMultiByte=6, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="nvidiaws\\Z") returned 6 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcee8 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.930] GetProcessHeap () returned 0x580000 [0038.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.930] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcee8 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abc60 | out: hHeap=0x580000) returned 1 [0038.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcde8, cbMultiByte=5, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="intelaws\\Z") returned 5 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3110 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5abc60 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcee8 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5abc60 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.931] GetProcessHeap () returned 0x580000 [0038.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.931] GetProcessHeap () returned 0x580000 [0038.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dce28 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcee8 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcd68 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dce30, cbMultiByte=4, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr=".syslaws\\Z") returned 4 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcee8 [0038.932] GetProcessHeap () returned 0x580000 [0038.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.932] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcee8 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcd68 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcee8 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcd68 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dce28 | out: hHeap=0x580000) returned 1 [0038.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcef0, cbMultiByte=4, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr=".dlllaws\\Z") returned 4 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3110 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.933] GetProcessHeap () returned 0x580000 [0038.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcd68 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcd68 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcd68 [0038.934] GetProcessHeap () returned 0x580000 [0038.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.934] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcee8 | out: hHeap=0x580000) returned 1 [0038.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcd70, cbMultiByte=4, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr=".exelaws\\Z") returned 4 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf30 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf30 [0038.935] GetProcessHeap () returned 0x580000 [0038.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.935] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.936] GetProcessHeap () returned 0x580000 [0038.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcd68 | out: hHeap=0x580000) returned 1 [0038.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcec0, cbMultiByte=4, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr=".lnklaws\\Z") returned 4 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5bcf08 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3110 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe6) returned 0x5bcf08 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf30 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.937] GetProcessHeap () returned 0x580000 [0038.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.938] GetProcessHeap () returned 0x580000 [0038.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.938] GetProcessHeap () returned 0x580000 [0038.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.954] GetProcessHeap () returned 0x580000 [0038.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.954] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4f0 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc430 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc430 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc438, cbMultiByte=27, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="!!!instruction_rnsmw!!!.txtX") returned 27 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4f0 | out: hHeap=0x580000) returned 1 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5bcf08 [0038.955] GetProcessHeap () returned 0x580000 [0038.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dceb8 [0038.955] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.956] GetProcessHeap () returned 0x580000 [0038.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4f0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc4c0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5d9db8 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4f0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5da0b0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da0b0 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5da0b0 [0038.957] GetProcessHeap () returned 0x580000 [0038.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5da0b8, cbMultiByte=17, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr=".your_last_chancesmw!!!.txtX") returned 17 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9db8 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3110 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5bcf08 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.958] GetProcessHeap () returned 0x580000 [0038.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.958] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc430 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc4c0 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5d9db8 [0038.959] GetProcessHeap () returned 0x580000 [0038.959] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5d9ea8 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9db8 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9ea8 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x8e) returned 0x5bcf08 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da0b0 | out: hHeap=0x580000) returned 1 [0038.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5c3118, cbMultiByte=8, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="boot.inist_chancesmw!!!.txtX") returned 8 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c31b0 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5bcf08 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dceb8 [0038.960] GetProcessHeap () returned 0x580000 [0038.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.960] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dceb8 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.961] GetProcessHeap () returned 0x580000 [0038.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4c0 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc430 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5d9ea8 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5d9db8 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c31b0 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9ea8 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9db8 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x8e) returned 0x5bcf08 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3370 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.962] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3150 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x81) returned 0x5bcf08 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5c3378, cbMultiByte=12, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="ntdetect.comhancesmw!!!.txtX") returned 12 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3150 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5bcf08 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dceb8 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.963] GetProcessHeap () returned 0x580000 [0038.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.963] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc430 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.964] GetProcessHeap () returned 0x580000 [0038.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc4c0 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5d9ea8 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5da128 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9ea8 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da128 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x8e) returned 0x5bcf08 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c31b0 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3110 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x81) returned 0x5bcf08 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3150 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.965] GetProcessHeap () returned 0x580000 [0038.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3110 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x74) returned 0x5bcf08 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5c3158, cbMultiByte=12, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="bootfont.binhancesmw!!!.txtX") returned 12 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3370 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3110 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5bcf08 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdf) returned 0x5bcf08 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.966] GetProcessHeap () returned 0x580000 [0038.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dceb8 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4c0 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.967] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc430 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5d9ea8 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5da1c8 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3110 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9ea8 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da1c8 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3370 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x8e) returned 0x5bcf08 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c31b0 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3370 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x81) returned 0x5bcf08 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3110 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c31b0 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.968] GetProcessHeap () returned 0x580000 [0038.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3370 [0038.968] GetProcessHeap () returned 0x580000 [0038.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x74) returned 0x5bcf08 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dceb8 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x6e) returned 0x5bcf08 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dceb8 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcf20, cbMultiByte=5, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="ntldront.binhancesmw!!!.txtX") returned 5 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3370 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf30 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5bcf08 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.969] GetProcessHeap () returned 0x580000 [0038.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf30 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd9) returned 0x5bcf08 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd4) returned 0x5bcf08 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xcf) returned 0x5bcf08 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcde0 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xca) returned 0x5bcf08 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.970] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xc5) returned 0x5bcf08 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc430 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc4c0 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xa9) returned 0x5bcf08 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5da1c8 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5d9ea8 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x97) returned 0x5bcf08 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3370 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da1c8 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d9ea8 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x8e) returned 0x5bcf08 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3110 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3150 [0038.971] GetProcessHeap () returned 0x580000 [0038.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x81) returned 0x5bcf08 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3370 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3110 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3150 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x74) returned 0x5bcf08 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf00 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x6e) returned 0x5bcf08 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcde0 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x66) returned 0x5bcf08 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcf08 | out: hHeap=0x580000) returned 1 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcde8, cbMultiByte=7, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="bootmgrt.binhancesmw!!!.txtX") returned 7 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf0) returned 0x5b6bf8 [0038.972] GetProcessHeap () returned 0x580000 [0038.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5c3370 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf18 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf00 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eb920 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcf00 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd9) returned 0x5eba08 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd4) returned 0x5bcda0 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.973] GetProcessHeap () returned 0x580000 [0038.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xcf) returned 0x5bcda0 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf18 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xca) returned 0x5bcda0 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf30 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf18 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5dcf00 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xc5) returned 0x5bcda0 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4c0 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf30 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf00 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26) returned 0x5dc430 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5da1c8 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc4c0 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dc430 | out: hHeap=0x580000) returned 1 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c) returned 0x5da178 [0038.974] GetProcessHeap () returned 0x580000 [0038.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.974] GetProcessHeap () returned 0x580000 [0038.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3370 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da1c8 | out: hHeap=0x580000) returned 1 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5da178 | out: hHeap=0x580000) returned 1 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5c3150 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16) returned 0x5c3110 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3370 | out: hHeap=0x580000) returned 1 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bcda0 | out: hHeap=0x580000) returned 1 [0038.975] GetProcessHeap () returned 0x580000 [0038.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcde0 | out: hHeap=0x580000) returned 1 [0038.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dcf38, cbMultiByte=7, lpWideCharStr=0x18ed70, cchWideChar=2047 | out: lpWideCharStr="bootnxtt.binhancesmw!!!.txtX") returned 7 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eba08 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd9) returned 0x5eb920 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd4) returned 0x5b11c8 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a1110 [0038.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xca) returned 0x5a16f8 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xc5) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.976] GetProcessHeap () returned 0x580000 [0038.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5c3150 | out: hHeap=0x580000) returned 1 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eb920 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd9) returned 0x5eba08 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd4) returned 0x5b11c8 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a16f8 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xca) returned 0x5a1110 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xc5) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eba08 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd9) returned 0x5eb920 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd4) returned 0x5b11c8 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a1110 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xca) returned 0x5a16f8 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xc5) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x39) returned 0x5bcda0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eb920 [0038.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd9) returned 0x5eba08 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd4) returned 0x5b11c8 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a16f8 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xca) returned 0x5a1110 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xc5) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x39) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x27) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eba08 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd9) returned 0x5eb920 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd4) returned 0x5b11c8 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a1110 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xca) returned 0x5a16f8 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xc5) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x39) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x27) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x17) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eb920 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd9) returned 0x5eba08 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd4) returned 0x5b11c8 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a16f8 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xca) returned 0x5a1110 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xc5) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x39) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x27) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x17) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x11) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b6bf8, Size=0xe6) returned 0x5ad7b0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ad7b0, Size=0xdf) returned 0x5eba08 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eba08, Size=0xd9) returned 0x5eb920 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5eb920, Size=0xd4) returned 0x5b11c8 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b11c8, Size=0xcf) returned 0x5a1110 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a1110, Size=0xca) returned 0x5a16f8 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a16f8, Size=0xc5) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x97) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x8e) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x81) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x74) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x6e) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x66) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x5e) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x51) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x46) returned 0x5bcda0 [0038.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0x39) returned 0x5bcda0 [0038.981] CreateMutexA (lpMutexAttributes=0x0, bInitialOwner=0, lpName="L3a7Ho3Jg3P62IV7") returned 0x1ec [0038.981] GetLastError () returned 0x0 [0038.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa1c) returned 0x2b4 [0039.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa28) returned 0x2d4 [0039.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa2c) returned 0x27c [0039.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa30) returned 0x298 [0039.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa34) returned 0x2ac [0039.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa38) returned 0x284 [0039.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa3c) returned 0x1f0 [0039.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa40) returned 0x1fc [0039.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa44) returned 0x1f4 [0039.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa48) returned 0x220 [0039.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa4c) returned 0x2b0 [0039.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa50) returned 0x1e8 [0039.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa54) returned 0x288 [0039.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa58) returned 0x280 [0039.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa5c) returned 0x290 [0039.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa60) returned 0x2e0 [0039.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa64) returned 0x2e8 [0039.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa68) returned 0x2ec [0039.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa6c) returned 0x2f0 [0039.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa70) returned 0x2f4 [0039.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa74) returned 0x2f8 [0039.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa78) returned 0x2fc [0039.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa7c) returned 0x300 [0039.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa80) returned 0x304 [0039.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa84) returned 0x308 [0039.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa88) returned 0x30c [0039.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa8c) returned 0x310 [0039.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa90) returned 0x314 [0039.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa94) returned 0x318 [0039.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa98) returned 0x31c [0039.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xa9c) returned 0x320 [0039.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xaa0) returned 0x324 [0039.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xaa4) returned 0x328 [0039.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xaa8) returned 0x32c [0039.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xaac) returned 0x330 [0039.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xab0) returned 0x334 [0039.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xab4) returned 0x338 [0039.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xab8) returned 0x33c [0039.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xabc) returned 0x340 [0039.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xac0) returned 0x344 [0039.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xac4) returned 0x348 [0039.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xac8) returned 0x34c [0039.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xacc) returned 0x350 [0039.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xad0) returned 0x354 [0039.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xad4) returned 0x358 [0039.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xad8) returned 0x35c [0039.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xadc) returned 0x360 [0039.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xae0) returned 0x364 [0039.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xae4) returned 0x368 [0039.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40cbf8, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x41557c | out: lpThreadId=0x41557c*=0xae8) returned 0x36c [0039.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x2800, lpStartAddress=0x40d62c, lpParameter=0x5a2b68, dwCreationFlags=0x0, lpThreadId=0x5a2b6c | out: lpThreadId=0x5a2b6c*=0xaec) returned 0x370 [0039.054] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.054] Sleep (dwMilliseconds=0x1) [0039.063] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.063] Sleep (dwMilliseconds=0x1) [0039.082] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.082] Sleep (dwMilliseconds=0x1) [0039.098] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.098] Sleep (dwMilliseconds=0x1) [0039.126] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.126] Sleep (dwMilliseconds=0x1) [0039.203] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.203] Sleep (dwMilliseconds=0x1) [0039.286] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.287] Sleep (dwMilliseconds=0x1) [0039.412] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.412] Sleep (dwMilliseconds=0x1) [0039.582] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.582] Sleep (dwMilliseconds=0x1) [0039.674] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.722] Sleep (dwMilliseconds=0x1) [0039.742] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.742] Sleep (dwMilliseconds=0x1) [0039.752] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.752] Sleep (dwMilliseconds=0x1) [0039.814] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.865] Sleep (dwMilliseconds=0x1) [0039.919] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.057] Sleep (dwMilliseconds=0x1) [0040.293] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.351] Sleep (dwMilliseconds=0x1) [0040.374] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.374] Sleep (dwMilliseconds=0x1) [0040.507] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.507] Sleep (dwMilliseconds=0x1) [0040.535] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.163] Sleep (dwMilliseconds=0x1) [0042.327] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.353] Sleep (dwMilliseconds=0x1) [0042.470] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.556] Sleep (dwMilliseconds=0x1) [0042.648] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.648] Sleep (dwMilliseconds=0x1) [0042.660] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.700] Sleep (dwMilliseconds=0x1) [0042.794] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.826] Sleep (dwMilliseconds=0x1) [0042.843] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.912] Sleep (dwMilliseconds=0x1) [0042.921] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.921] Sleep (dwMilliseconds=0x1) [0042.998] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0042.998] Sleep (dwMilliseconds=0x1) [0043.013] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.084] Sleep (dwMilliseconds=0x1) [0043.103] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.103] Sleep (dwMilliseconds=0x1) [0043.118] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.118] Sleep (dwMilliseconds=0x1) [0043.142] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.142] Sleep (dwMilliseconds=0x1) [0043.199] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.308] Sleep (dwMilliseconds=0x1) [0043.324] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.324] Sleep (dwMilliseconds=0x1) [0043.339] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.339] Sleep (dwMilliseconds=0x1) [0043.355] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.370] Sleep (dwMilliseconds=0x1) [0043.386] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.386] Sleep (dwMilliseconds=0x1) [0043.401] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.417] Sleep (dwMilliseconds=0x1) [0043.433] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.433] Sleep (dwMilliseconds=0x1) [0043.448] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.448] Sleep (dwMilliseconds=0x1) [0043.464] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.464] Sleep (dwMilliseconds=0x1) [0043.479] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.479] Sleep (dwMilliseconds=0x1) [0043.495] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.542] Sleep (dwMilliseconds=0x1) [0043.558] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.558] Sleep (dwMilliseconds=0x1) [0043.573] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.573] Sleep (dwMilliseconds=0x1) [0043.590] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.590] Sleep (dwMilliseconds=0x1) [0043.696] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.696] Sleep (dwMilliseconds=0x1) [0043.703] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.703] Sleep (dwMilliseconds=0x1) [0043.718] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.718] Sleep (dwMilliseconds=0x1) [0043.744] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.791] Sleep (dwMilliseconds=0x1) [0043.806] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.822] Sleep (dwMilliseconds=0x1) [0043.837] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.853] Sleep (dwMilliseconds=0x1) [0043.869] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.869] Sleep (dwMilliseconds=0x1) [0043.884] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.884] Sleep (dwMilliseconds=0x1) [0043.903] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.903] Sleep (dwMilliseconds=0x1) [0043.915] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.915] Sleep (dwMilliseconds=0x1) [0043.931] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.015] Sleep (dwMilliseconds=0x1) [0044.026] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.026] Sleep (dwMilliseconds=0x1) [0044.040] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.059] Sleep (dwMilliseconds=0x1) [0044.363] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.363] Sleep (dwMilliseconds=0x1) [0044.389] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.430] Sleep (dwMilliseconds=0x1) [0044.446] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.446] Sleep (dwMilliseconds=0x1) [0044.461] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.477] Sleep (dwMilliseconds=0x1) [0044.493] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.493] Sleep (dwMilliseconds=0x1) [0044.508] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.508] Sleep (dwMilliseconds=0x1) [0044.524] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.571] Sleep (dwMilliseconds=0x1) [0044.586] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.586] Sleep (dwMilliseconds=0x1) [0044.602] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.602] Sleep (dwMilliseconds=0x1) [0044.617] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.633] Sleep (dwMilliseconds=0x1) [0044.649] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.649] Sleep (dwMilliseconds=0x1) [0044.664] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.680] Sleep (dwMilliseconds=0x1) [0044.695] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.758] Sleep (dwMilliseconds=0x1) [0044.773] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.773] Sleep (dwMilliseconds=0x1) [0044.789] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.805] Sleep (dwMilliseconds=0x1) [0044.820] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.836] Sleep (dwMilliseconds=0x1) [0044.851] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.851] Sleep (dwMilliseconds=0x1) [0044.867] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.867] Sleep (dwMilliseconds=0x1) [0044.882] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.883] Sleep (dwMilliseconds=0x1) [0044.898] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0044.992] Sleep (dwMilliseconds=0x1) [0045.007] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.007] Sleep (dwMilliseconds=0x1) [0045.023] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.023] Sleep (dwMilliseconds=0x1) [0045.038] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.039] Sleep (dwMilliseconds=0x1) [0045.054] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.054] Sleep (dwMilliseconds=0x1) [0045.070] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.070] Sleep (dwMilliseconds=0x1) [0045.085] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.132] Sleep (dwMilliseconds=0x1) [0045.148] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.148] Sleep (dwMilliseconds=0x1) [0045.163] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.163] Sleep (dwMilliseconds=0x1) [0045.179] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.226] Sleep (dwMilliseconds=0x1) [0045.241] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.288] Sleep (dwMilliseconds=0x1) [0045.305] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.305] Sleep (dwMilliseconds=0x1) [0045.319] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.319] Sleep (dwMilliseconds=0x1) [0045.335] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.335] Sleep (dwMilliseconds=0x1) [0045.350] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.382] Sleep (dwMilliseconds=0x1) [0045.397] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.460] Sleep (dwMilliseconds=0x1) [0045.475] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.475] Sleep (dwMilliseconds=0x1) [0045.493] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.507] Sleep (dwMilliseconds=0x1) [0045.522] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.538] Sleep (dwMilliseconds=0x1) [0045.553] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.585] Sleep (dwMilliseconds=0x1) [0045.651] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.651] Sleep (dwMilliseconds=0x1) [0045.673] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.834] Sleep (dwMilliseconds=0x1) [0045.851] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.851] Sleep (dwMilliseconds=0x1) [0045.865] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.897] Sleep (dwMilliseconds=0x1) [0045.912] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.912] Sleep (dwMilliseconds=0x1) [0045.928] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.944] Sleep (dwMilliseconds=0x1) [0045.959] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.975] Sleep (dwMilliseconds=0x1) [0045.990] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.006] Sleep (dwMilliseconds=0x1) [0046.021] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.037] Sleep (dwMilliseconds=0x1) [0046.053] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.053] Sleep (dwMilliseconds=0x1) [0046.068] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.088] Sleep (dwMilliseconds=0x1) [0046.104] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.104] Sleep (dwMilliseconds=0x1) [0046.120] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.120] Sleep (dwMilliseconds=0x1) [0046.135] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.135] Sleep (dwMilliseconds=0x1) [0046.151] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.151] Sleep (dwMilliseconds=0x1) [0046.166] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.166] Sleep (dwMilliseconds=0x1) [0046.182] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.182] Sleep (dwMilliseconds=0x1) [0046.203] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.203] Sleep (dwMilliseconds=0x1) [0046.213] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.213] Sleep (dwMilliseconds=0x1) [0046.229] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.229] Sleep (dwMilliseconds=0x1) [0046.244] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.244] Sleep (dwMilliseconds=0x1) [0046.260] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.260] Sleep (dwMilliseconds=0x1) [0046.278] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.278] Sleep (dwMilliseconds=0x1) [0046.291] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.291] Sleep (dwMilliseconds=0x1) [0046.307] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.307] Sleep (dwMilliseconds=0x1) [0046.322] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.322] Sleep (dwMilliseconds=0x1) [0046.347] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.347] Sleep (dwMilliseconds=0x1) [0046.353] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.353] Sleep (dwMilliseconds=0x1) [0046.369] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.369] Sleep (dwMilliseconds=0x1) [0046.384] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.385] Sleep (dwMilliseconds=0x1) [0046.400] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.416] Sleep (dwMilliseconds=0x1) [0046.432] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.432] Sleep (dwMilliseconds=0x1) [0046.447] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.447] Sleep (dwMilliseconds=0x1) [0046.462] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.480] Sleep (dwMilliseconds=0x1) [0046.494] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.494] Sleep (dwMilliseconds=0x1) [0046.509] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.556] Sleep (dwMilliseconds=0x1) [0046.572] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.572] Sleep (dwMilliseconds=0x1) [0046.589] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.589] Sleep (dwMilliseconds=0x1) [0046.603] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.603] Sleep (dwMilliseconds=0x1) [0046.619] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.619] Sleep (dwMilliseconds=0x1) [0046.634] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.634] Sleep (dwMilliseconds=0x1) [0046.650] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.650] Sleep (dwMilliseconds=0x1) [0046.666] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.666] Sleep (dwMilliseconds=0x1) [0046.681] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.681] Sleep (dwMilliseconds=0x1) [0046.697] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.697] Sleep (dwMilliseconds=0x1) [0046.712] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.712] Sleep (dwMilliseconds=0x1) [0046.728] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.728] Sleep (dwMilliseconds=0x1) [0046.744] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.744] Sleep (dwMilliseconds=0x1) [0046.759] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.775] Sleep (dwMilliseconds=0x1) [0046.790] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.790] Sleep (dwMilliseconds=0x1) [0046.806] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.806] Sleep (dwMilliseconds=0x1) [0046.821] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.837] Sleep (dwMilliseconds=0x1) [0046.853] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.853] Sleep (dwMilliseconds=0x1) [0046.868] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.868] Sleep (dwMilliseconds=0x1) [0046.884] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.884] Sleep (dwMilliseconds=0x1) [0046.900] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.900] Sleep (dwMilliseconds=0x1) [0046.915] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.915] Sleep (dwMilliseconds=0x1) [0046.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.946] Sleep (dwMilliseconds=0x1) [0046.962] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.962] Sleep (dwMilliseconds=0x1) [0046.977] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.977] Sleep (dwMilliseconds=0x1) [0046.992] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0046.992] Sleep (dwMilliseconds=0x1) [0047.007] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.007] Sleep (dwMilliseconds=0x1) [0047.023] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.023] Sleep (dwMilliseconds=0x1) [0047.039] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.039] Sleep (dwMilliseconds=0x1) [0047.054] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.054] Sleep (dwMilliseconds=0x1) [0047.070] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.070] Sleep (dwMilliseconds=0x1) [0047.085] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.132] Sleep (dwMilliseconds=0x1) [0047.148] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.148] Sleep (dwMilliseconds=0x1) [0047.163] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.179] Sleep (dwMilliseconds=0x1) [0047.201] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.201] Sleep (dwMilliseconds=0x1) [0047.210] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.210] Sleep (dwMilliseconds=0x1) [0047.226] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.226] Sleep (dwMilliseconds=0x1) [0047.241] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.304] Sleep (dwMilliseconds=0x1) [0047.320] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.320] Sleep (dwMilliseconds=0x1) [0047.335] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.335] Sleep (dwMilliseconds=0x1) [0047.358] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.358] Sleep (dwMilliseconds=0x1) [0047.366] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.366] Sleep (dwMilliseconds=0x1) [0047.382] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.382] Sleep (dwMilliseconds=0x1) [0047.397] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.444] Sleep (dwMilliseconds=0x1) [0047.460] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.460] Sleep (dwMilliseconds=0x1) [0047.475] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.475] Sleep (dwMilliseconds=0x1) [0047.491] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.491] Sleep (dwMilliseconds=0x1) [0047.506] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.668] Sleep (dwMilliseconds=0x1) [0047.685] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.685] Sleep (dwMilliseconds=0x1) [0047.694] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.694] Sleep (dwMilliseconds=0x1) [0047.709] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.709] Sleep (dwMilliseconds=0x1) [0047.725] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.725] Sleep (dwMilliseconds=0x1) [0047.740] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.756] Sleep (dwMilliseconds=0x1) [0047.772] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.772] Sleep (dwMilliseconds=0x1) [0047.788] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.788] Sleep (dwMilliseconds=0x1) [0047.806] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.818] Sleep (dwMilliseconds=0x1) [0047.834] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.834] Sleep (dwMilliseconds=0x1) [0047.850] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.928] Sleep (dwMilliseconds=0x1) [0047.943] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.943] Sleep (dwMilliseconds=0x1) [0047.959] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.959] Sleep (dwMilliseconds=0x1) [0047.975] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.975] Sleep (dwMilliseconds=0x1) [0047.990] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.021] Sleep (dwMilliseconds=0x1) [0048.037] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.037] Sleep (dwMilliseconds=0x1) [0048.052] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.068] Sleep (dwMilliseconds=0x1) [0048.084] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.084] Sleep (dwMilliseconds=0x1) [0048.101] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.101] Sleep (dwMilliseconds=0x1) [0048.115] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.130] Sleep (dwMilliseconds=0x1) [0048.146] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.146] Sleep (dwMilliseconds=0x1) [0048.162] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.199] Sleep (dwMilliseconds=0x1) [0048.208] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.224] Sleep (dwMilliseconds=0x1) [0048.240] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.240] Sleep (dwMilliseconds=0x1) [0048.255] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.255] Sleep (dwMilliseconds=0x1) [0048.271] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.271] Sleep (dwMilliseconds=0x1) [0048.286] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.335] Sleep (dwMilliseconds=0x1) [0048.349] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.349] Sleep (dwMilliseconds=0x1) [0048.364] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.380] Sleep (dwMilliseconds=0x1) [0048.403] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.403] Sleep (dwMilliseconds=0x1) [0048.411] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.411] Sleep (dwMilliseconds=0x1) [0048.427] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.427] Sleep (dwMilliseconds=0x1) [0048.443] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.443] Sleep (dwMilliseconds=0x1) [0048.458] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.536] Sleep (dwMilliseconds=0x1) [0048.552] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.552] Sleep (dwMilliseconds=0x1) [0048.567] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.567] Sleep (dwMilliseconds=0x1) [0048.583] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.583] Sleep (dwMilliseconds=0x1) [0048.599] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.599] Sleep (dwMilliseconds=0x1) [0048.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.645] Sleep (dwMilliseconds=0x1) [0048.661] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.661] Sleep (dwMilliseconds=0x1) [0048.676] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.708] Sleep (dwMilliseconds=0x1) [0048.725] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.725] Sleep (dwMilliseconds=0x1) [0048.739] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.739] Sleep (dwMilliseconds=0x1) [0048.754] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.755] Sleep (dwMilliseconds=0x1) [0048.770] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.801] Sleep (dwMilliseconds=0x1) [0048.817] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.817] Sleep (dwMilliseconds=0x1) [0048.833] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.833] Sleep (dwMilliseconds=0x1) [0048.848] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.848] Sleep (dwMilliseconds=0x1) [0048.864] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.864] Sleep (dwMilliseconds=0x1) [0048.879] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.879] Sleep (dwMilliseconds=0x1) [0048.895] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.895] Sleep (dwMilliseconds=0x1) [0048.911] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.911] Sleep (dwMilliseconds=0x1) [0048.926] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.004] Sleep (dwMilliseconds=0x1) [0049.020] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.020] Sleep (dwMilliseconds=0x1) [0049.035] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.129] Sleep (dwMilliseconds=0x1) [0049.145] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.145] Sleep (dwMilliseconds=0x1) [0049.160] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.160] Sleep (dwMilliseconds=0x1) [0049.176] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.176] Sleep (dwMilliseconds=0x1) [0049.197] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.197] Sleep (dwMilliseconds=0x1) [0049.207] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.207] Sleep (dwMilliseconds=0x1) [0049.222] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.250] Sleep (dwMilliseconds=0x1) [0049.265] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.265] Sleep (dwMilliseconds=0x1) [0049.281] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.281] Sleep (dwMilliseconds=0x1) [0049.296] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.297] Sleep (dwMilliseconds=0x1) [0049.312] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.312] Sleep (dwMilliseconds=0x1) [0049.328] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.406] Sleep (dwMilliseconds=0x1) [0049.421] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.421] Sleep (dwMilliseconds=0x1) [0049.439] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.439] Sleep (dwMilliseconds=0x1) [0049.459] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.459] Sleep (dwMilliseconds=0x1) [0049.468] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.468] Sleep (dwMilliseconds=0x1) [0049.484] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.484] Sleep (dwMilliseconds=0x1) [0049.499] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.499] Sleep (dwMilliseconds=0x1) [0049.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.562] Sleep (dwMilliseconds=0x1) [0049.577] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.577] Sleep (dwMilliseconds=0x1) [0049.593] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.593] Sleep (dwMilliseconds=0x1) [0049.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.614] Sleep (dwMilliseconds=0x1) [0049.624] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.624] Sleep (dwMilliseconds=0x1) [0049.640] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.640] Sleep (dwMilliseconds=0x1) [0049.655] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.655] Sleep (dwMilliseconds=0x1) [0049.671] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.718] Sleep (dwMilliseconds=0x1) [0049.733] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.733] Sleep (dwMilliseconds=0x1) [0049.749] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.749] Sleep (dwMilliseconds=0x1) [0049.764] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.764] Sleep (dwMilliseconds=0x1) [0049.780] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.780] Sleep (dwMilliseconds=0x1) [0049.796] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.796] Sleep (dwMilliseconds=0x1) [0049.811] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.811] Sleep (dwMilliseconds=0x1) [0049.829] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.905] Sleep (dwMilliseconds=0x1) [0049.920] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.920] Sleep (dwMilliseconds=0x1) [0049.936] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.936] Sleep (dwMilliseconds=0x1) [0049.952] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.952] Sleep (dwMilliseconds=0x1) [0049.967] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.967] Sleep (dwMilliseconds=0x1) [0049.983] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.983] Sleep (dwMilliseconds=0x1) [0049.998] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0049.999] Sleep (dwMilliseconds=0x1) [0050.014] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.014] Sleep (dwMilliseconds=0x1) [0050.030] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.030] Sleep (dwMilliseconds=0x1) [0050.045] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.045] Sleep (dwMilliseconds=0x1) [0050.061] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.061] Sleep (dwMilliseconds=0x1) [0050.076] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.076] Sleep (dwMilliseconds=0x1) [0050.092] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.092] Sleep (dwMilliseconds=0x1) [0050.108] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.108] Sleep (dwMilliseconds=0x1) [0050.123] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.123] Sleep (dwMilliseconds=0x1) [0050.139] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.170] Sleep (dwMilliseconds=0x1) [0050.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.190] Sleep (dwMilliseconds=0x1) [0050.201] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.201] Sleep (dwMilliseconds=0x1) [0050.219] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.219] Sleep (dwMilliseconds=0x1) [0050.232] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.232] Sleep (dwMilliseconds=0x1) [0050.248] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.248] Sleep (dwMilliseconds=0x1) [0050.264] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.264] Sleep (dwMilliseconds=0x1) [0050.279] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.279] Sleep (dwMilliseconds=0x1) [0050.295] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.311] Sleep (dwMilliseconds=0x1) [0050.326] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.326] Sleep (dwMilliseconds=0x1) [0050.342] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.342] Sleep (dwMilliseconds=0x1) [0050.357] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.357] Sleep (dwMilliseconds=0x1) [0050.373] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.373] Sleep (dwMilliseconds=0x1) [0050.388] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.388] Sleep (dwMilliseconds=0x1) [0050.404] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.404] Sleep (dwMilliseconds=0x1) [0050.420] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.420] Sleep (dwMilliseconds=0x1) [0050.435] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.435] Sleep (dwMilliseconds=0x1) [0050.452] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.452] Sleep (dwMilliseconds=0x1) [0050.477] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.498] Sleep (dwMilliseconds=0x1) [0050.513] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.513] Sleep (dwMilliseconds=0x1) [0050.529] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.546] Sleep (dwMilliseconds=0x1) [0050.560] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.560] Sleep (dwMilliseconds=0x1) [0050.576] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.654] Sleep (dwMilliseconds=0x1) [0050.669] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.669] Sleep (dwMilliseconds=0x1) [0050.685] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.701] Sleep (dwMilliseconds=0x1) [0050.716] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.716] Sleep (dwMilliseconds=0x1) [0050.732] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.782] Sleep (dwMilliseconds=0x1) [0050.798] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.798] Sleep (dwMilliseconds=0x1) [0050.814] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.829] Sleep (dwMilliseconds=0x1) [0050.849] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.849] Sleep (dwMilliseconds=0x1) [0050.860] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.860] Sleep (dwMilliseconds=0x1) [0050.876] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.876] Sleep (dwMilliseconds=0x1) [0050.891] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.907] Sleep (dwMilliseconds=0x1) [0050.923] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.923] Sleep (dwMilliseconds=0x1) [0050.940] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.940] Sleep (dwMilliseconds=0x1) [0050.960] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.960] Sleep (dwMilliseconds=0x1) [0050.970] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0050.985] Sleep (dwMilliseconds=0x1) [0051.001] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.001] Sleep (dwMilliseconds=0x1) [0051.016] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.032] Sleep (dwMilliseconds=0x1) [0051.048] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.048] Sleep (dwMilliseconds=0x1) [0051.063] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.063] Sleep (dwMilliseconds=0x1) [0051.079] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.079] Sleep (dwMilliseconds=0x1) [0051.096] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.096] Sleep (dwMilliseconds=0x1) [0051.110] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.110] Sleep (dwMilliseconds=0x1) [0051.126] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.126] Sleep (dwMilliseconds=0x1) [0051.141] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.157] Sleep (dwMilliseconds=0x1) [0051.173] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.173] Sleep (dwMilliseconds=0x1) [0051.194] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.219] Sleep (dwMilliseconds=0x1) [0051.235] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.235] Sleep (dwMilliseconds=0x1) [0051.251] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.251] Sleep (dwMilliseconds=0x1) [0051.266] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.266] Sleep (dwMilliseconds=0x1) [0051.282] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.297] Sleep (dwMilliseconds=0x1) [0051.313] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.313] Sleep (dwMilliseconds=0x1) [0051.330] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.422] Sleep (dwMilliseconds=0x1) [0051.438] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.438] Sleep (dwMilliseconds=0x1) [0051.453] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.453] Sleep (dwMilliseconds=0x1) [0051.469] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.469] Sleep (dwMilliseconds=0x1) [0051.484] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.485] Sleep (dwMilliseconds=0x1) [0051.507] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.531] Sleep (dwMilliseconds=0x1) [0051.547] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.547] Sleep (dwMilliseconds=0x1) [0051.562] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.562] Sleep (dwMilliseconds=0x1) [0051.578] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.578] Sleep (dwMilliseconds=0x1) [0051.594] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.609] Sleep (dwMilliseconds=0x1) [0051.635] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.635] Sleep (dwMilliseconds=0x1) [0051.645] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.658] Sleep (dwMilliseconds=0x1) [0051.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.672] Sleep (dwMilliseconds=0x1) [0051.701] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.701] Sleep (dwMilliseconds=0x1) [0051.716] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.779] Sleep (dwMilliseconds=0x1) [0051.794] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.857] Sleep (dwMilliseconds=0x1) [0051.872] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.935] Sleep (dwMilliseconds=0x1) [0051.950] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.138] Sleep (dwMilliseconds=0x1) [0052.153] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.153] Sleep (dwMilliseconds=0x1) [0052.169] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.278] Sleep (dwMilliseconds=0x1) [0052.294] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.294] Sleep (dwMilliseconds=0x1) [0052.309] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.325] Sleep (dwMilliseconds=0x1) [0052.340] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.389] Sleep (dwMilliseconds=0x1) [0052.405] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.405] Sleep (dwMilliseconds=0x1) [0052.420] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.452] Sleep (dwMilliseconds=0x1) [0052.467] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.467] Sleep (dwMilliseconds=0x1) [0052.483] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.483] Sleep (dwMilliseconds=0x1) [0052.501] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.501] Sleep (dwMilliseconds=0x1) [0052.514] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.514] Sleep (dwMilliseconds=0x1) [0052.530] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.530] Sleep (dwMilliseconds=0x1) [0052.552] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.552] Sleep (dwMilliseconds=0x1) [0052.561] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.561] Sleep (dwMilliseconds=0x1) [0052.576] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.577] Sleep (dwMilliseconds=0x1) [0052.592] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.623] Sleep (dwMilliseconds=0x1) [0052.639] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.639] Sleep (dwMilliseconds=0x1) [0052.654] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.654] Sleep (dwMilliseconds=0x1) [0052.670] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.670] Sleep (dwMilliseconds=0x1) [0052.686] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.701] Sleep (dwMilliseconds=0x1) [0052.717] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.717] Sleep (dwMilliseconds=0x1) [0052.732] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.810] Sleep (dwMilliseconds=0x1) [0052.827] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.827] Sleep (dwMilliseconds=0x1) [0052.842] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.873] Sleep (dwMilliseconds=0x1) [0052.889] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.889] Sleep (dwMilliseconds=0x1) [0052.904] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.904] Sleep (dwMilliseconds=0x1) [0052.920] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.920] Sleep (dwMilliseconds=0x1) [0052.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.935] Sleep (dwMilliseconds=0x1) [0052.951] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.951] Sleep (dwMilliseconds=0x1) [0052.967] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.967] Sleep (dwMilliseconds=0x1) [0052.982] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.060] Sleep (dwMilliseconds=0x1) [0053.076] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.076] Sleep (dwMilliseconds=0x1) [0053.091] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.122] Sleep (dwMilliseconds=0x1) [0053.138] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.138] Sleep (dwMilliseconds=0x1) [0053.154] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.154] Sleep (dwMilliseconds=0x1) [0053.169] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.169] Sleep (dwMilliseconds=0x1) [0053.185] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.185] Sleep (dwMilliseconds=0x1) [0053.205] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.205] Sleep (dwMilliseconds=0x1) [0053.217] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.247] Sleep (dwMilliseconds=0x1) [0053.263] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.263] Sleep (dwMilliseconds=0x1) [0053.278] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.278] Sleep (dwMilliseconds=0x1) [0053.294] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.294] Sleep (dwMilliseconds=0x1) [0053.310] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.310] Sleep (dwMilliseconds=0x1) [0053.325] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.325] Sleep (dwMilliseconds=0x1) [0053.341] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.341] Sleep (dwMilliseconds=0x1) [0053.366] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.366] Sleep (dwMilliseconds=0x1) [0053.372] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.372] Sleep (dwMilliseconds=0x1) [0053.388] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.388] Sleep (dwMilliseconds=0x1) [0053.403] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.403] Sleep (dwMilliseconds=0x1) [0053.419] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.419] Sleep (dwMilliseconds=0x1) [0053.435] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.435] Sleep (dwMilliseconds=0x1) [0053.450] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.481] Sleep (dwMilliseconds=0x1) [0053.497] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.497] Sleep (dwMilliseconds=0x1) [0053.512] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.715] Sleep (dwMilliseconds=0x1) [0053.731] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.731] Sleep (dwMilliseconds=0x1) [0053.747] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.747] Sleep (dwMilliseconds=0x1) [0053.762] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.793] Sleep (dwMilliseconds=0x1) [0053.809] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.809] Sleep (dwMilliseconds=0x1) [0053.825] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.825] Sleep (dwMilliseconds=0x1) [0053.840] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.903] Sleep (dwMilliseconds=0x1) [0053.918] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.965] Sleep (dwMilliseconds=0x1) [0053.981] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.981] Sleep (dwMilliseconds=0x1) [0053.996] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0053.996] Sleep (dwMilliseconds=0x1) [0054.012] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.012] Sleep (dwMilliseconds=0x1) [0054.027] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.043] Sleep (dwMilliseconds=0x1) [0054.059] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.059] Sleep (dwMilliseconds=0x1) [0054.074] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.074] Sleep (dwMilliseconds=0x1) [0054.091] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.091] Sleep (dwMilliseconds=0x1) [0054.105] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.121] Sleep (dwMilliseconds=0x1) [0054.137] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.137] Sleep (dwMilliseconds=0x1) [0054.152] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.152] Sleep (dwMilliseconds=0x1) [0054.168] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.168] Sleep (dwMilliseconds=0x1) [0054.183] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.203] Sleep (dwMilliseconds=0x1) [0054.215] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.215] Sleep (dwMilliseconds=0x1) [0054.230] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.277] Sleep (dwMilliseconds=0x1) [0054.293] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.293] Sleep (dwMilliseconds=0x1) [0054.308] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.355] Sleep (dwMilliseconds=0x1) [0054.371] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.371] Sleep (dwMilliseconds=0x1) [0054.386] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.402] Sleep (dwMilliseconds=0x1) [0054.418] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.418] Sleep (dwMilliseconds=0x1) [0054.433] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.464] Sleep (dwMilliseconds=0x1) [0054.480] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.480] Sleep (dwMilliseconds=0x1) [0054.495] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.495] Sleep (dwMilliseconds=0x1) [0054.511] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.511] Sleep (dwMilliseconds=0x1) [0054.527] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.527] Sleep (dwMilliseconds=0x1) [0054.542] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.542] Sleep (dwMilliseconds=0x1) [0054.566] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.566] Sleep (dwMilliseconds=0x1) [0054.574] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.574] Sleep (dwMilliseconds=0x1) [0054.589] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.605] Sleep (dwMilliseconds=0x1) [0054.620] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.620] Sleep (dwMilliseconds=0x1) [0054.636] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.636] Sleep (dwMilliseconds=0x1) [0054.652] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.652] Sleep (dwMilliseconds=0x1) [0054.667] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.667] Sleep (dwMilliseconds=0x1) [0054.682] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.698] Sleep (dwMilliseconds=0x1) [0054.714] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.714] Sleep (dwMilliseconds=0x1) [0054.730] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.730] Sleep (dwMilliseconds=0x1) [0054.745] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.776] Sleep (dwMilliseconds=0x1) [0054.792] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.792] Sleep (dwMilliseconds=0x1) [0054.807] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.807] Sleep (dwMilliseconds=0x1) [0054.823] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.823] Sleep (dwMilliseconds=0x1) [0054.839] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.839] Sleep (dwMilliseconds=0x1) [0054.854] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.870] Sleep (dwMilliseconds=0x1) [0054.886] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.886] Sleep (dwMilliseconds=0x1) [0054.901] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.932] Sleep (dwMilliseconds=0x1) [0054.948] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.948] Sleep (dwMilliseconds=0x1) [0054.963] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.964] Sleep (dwMilliseconds=0x1) [0054.979] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.979] Sleep (dwMilliseconds=0x1) [0054.995] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0054.995] Sleep (dwMilliseconds=0x1) [0055.010] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.010] Sleep (dwMilliseconds=0x1) [0055.026] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.026] Sleep (dwMilliseconds=0x1) [0055.042] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.042] Sleep (dwMilliseconds=0x1) [0055.057] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.057] Sleep (dwMilliseconds=0x1) [0055.073] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.073] Sleep (dwMilliseconds=0x1) [0055.088] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.088] Sleep (dwMilliseconds=0x1) [0055.104] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.104] Sleep (dwMilliseconds=0x1) [0055.119] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.135] Sleep (dwMilliseconds=0x1) [0055.151] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.151] Sleep (dwMilliseconds=0x1) [0055.166] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.166] Sleep (dwMilliseconds=0x1) [0055.182] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.182] Sleep (dwMilliseconds=0x1) [0055.202] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.202] Sleep (dwMilliseconds=0x1) [0055.213] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.213] Sleep (dwMilliseconds=0x1) [0055.228] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.244] Sleep (dwMilliseconds=0x1) [0055.260] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.260] Sleep (dwMilliseconds=0x1) [0055.275] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.322] Sleep (dwMilliseconds=0x1) [0055.338] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.338] Sleep (dwMilliseconds=0x1) [0055.354] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.354] Sleep (dwMilliseconds=0x1) [0055.369] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.369] Sleep (dwMilliseconds=0x1) [0055.385] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.385] Sleep (dwMilliseconds=0x1) [0055.400] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.400] Sleep (dwMilliseconds=0x1) [0055.416] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.416] Sleep (dwMilliseconds=0x1) [0055.433] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.433] Sleep (dwMilliseconds=0x1) [0055.447] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.447] Sleep (dwMilliseconds=0x1) [0055.463] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.463] Sleep (dwMilliseconds=0x1) [0055.478] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.478] Sleep (dwMilliseconds=0x1) [0055.494] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.494] Sleep (dwMilliseconds=0x1) [0055.544] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.544] Sleep (dwMilliseconds=0x1) [0055.596] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.596] Sleep (dwMilliseconds=0x1) [0055.653] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.700] Sleep (dwMilliseconds=0x1) [0055.745] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.745] Sleep (dwMilliseconds=0x1) [0055.789] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.789] Sleep (dwMilliseconds=0x1) [0055.841] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.841] Sleep (dwMilliseconds=0x1) [0055.850] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.850] Sleep (dwMilliseconds=0x1) [0055.866] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.866] Sleep (dwMilliseconds=0x1) [0055.896] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0055.896] Sleep (dwMilliseconds=0x1) [0056.161] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0056.161] Sleep (dwMilliseconds=0x1) [0056.442] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0056.442] Sleep (dwMilliseconds=0x1) [0056.770] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0056.770] Sleep (dwMilliseconds=0x1) [0057.051] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0057.051] Sleep (dwMilliseconds=0x1) [0057.550] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0057.550] Sleep (dwMilliseconds=0x1) [0058.018] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0058.649] Sleep (dwMilliseconds=0x1) [0059.343] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0059.343] Sleep (dwMilliseconds=0x1) [0060.092] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0060.092] Sleep (dwMilliseconds=0x1) [0061.341] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0061.341] Sleep (dwMilliseconds=0x1) [0062.516] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0062.516] Sleep (dwMilliseconds=0x1) [0063.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0063.614] Sleep (dwMilliseconds=0x1) [0064.472] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0064.472] Sleep (dwMilliseconds=0x1) [0065.335] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0065.335] Sleep (dwMilliseconds=0x1) [0066.097] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0066.097] Sleep (dwMilliseconds=0x1) [0066.646] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0066.646] Sleep (dwMilliseconds=0x1) [0067.034] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0067.034] Sleep (dwMilliseconds=0x1) [0068.199] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0068.199] Sleep (dwMilliseconds=0x1) [0069.142] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0069.142] Sleep (dwMilliseconds=0x1) [0070.291] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0070.291] Sleep (dwMilliseconds=0x1) [0071.442] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0071.442] Sleep (dwMilliseconds=0x1) [0072.232] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0072.232] Sleep (dwMilliseconds=0x1) [0073.208] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.208] Sleep (dwMilliseconds=0x1) [0073.894] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0073.894] Sleep (dwMilliseconds=0x1) [0074.355] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0074.355] Sleep (dwMilliseconds=0x1) [0075.029] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.030] Sleep (dwMilliseconds=0x1) [0075.739] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0075.739] Sleep (dwMilliseconds=0x1) [0076.332] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0076.333] Sleep (dwMilliseconds=0x1) [0077.060] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.060] Sleep (dwMilliseconds=0x1) [0077.769] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0077.769] Sleep (dwMilliseconds=0x1) [0078.391] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.203] Sleep (dwMilliseconds=0x1) [0079.781] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.781] Sleep (dwMilliseconds=0x1) [0079.973] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0079.973] Sleep (dwMilliseconds=0x1) [0080.236] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.243] Sleep (dwMilliseconds=0x1) [0080.439] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.439] Sleep (dwMilliseconds=0x1) [0080.819] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0080.819] Sleep (dwMilliseconds=0x1) [0081.152] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.152] Sleep (dwMilliseconds=0x1) [0081.403] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.403] Sleep (dwMilliseconds=0x1) [0081.526] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.526] Sleep (dwMilliseconds=0x1) [0081.559] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.559] Sleep (dwMilliseconds=0x1) [0081.577] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0081.579] Sleep (dwMilliseconds=0x1) [0082.053] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.055] Sleep (dwMilliseconds=0x1) [0082.292] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.292] Sleep (dwMilliseconds=0x1) [0082.575] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.578] Sleep (dwMilliseconds=0x1) [0082.853] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0082.853] Sleep (dwMilliseconds=0x1) [0083.057] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.057] Sleep (dwMilliseconds=0x1) [0083.280] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.280] Sleep (dwMilliseconds=0x1) [0083.494] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.494] Sleep (dwMilliseconds=0x1) [0083.673] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.673] Sleep (dwMilliseconds=0x1) [0083.807] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.807] Sleep (dwMilliseconds=0x1) [0083.916] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0083.916] Sleep (dwMilliseconds=0x1) [0084.046] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.046] Sleep (dwMilliseconds=0x1) [0084.170] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.170] Sleep (dwMilliseconds=0x1) [0084.240] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.240] Sleep (dwMilliseconds=0x1) [0084.296] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.296] Sleep (dwMilliseconds=0x1) [0084.320] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.351] Sleep (dwMilliseconds=0x1) [0084.754] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0084.754] Sleep (dwMilliseconds=0x1) [0085.131] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.131] Sleep (dwMilliseconds=0x1) [0085.401] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.401] Sleep (dwMilliseconds=0x1) [0085.661] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.661] Sleep (dwMilliseconds=0x1) [0085.910] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0085.910] Sleep (dwMilliseconds=0x1) [0086.167] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.167] Sleep (dwMilliseconds=0x1) [0086.197] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0086.644] Sleep (dwMilliseconds=0x1) [0087.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0087.190] Sleep (dwMilliseconds=0x1) [0087.719] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0087.719] Sleep (dwMilliseconds=0x1) [0088.596] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0088.596] Sleep (dwMilliseconds=0x1) [0089.545] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0089.545] Sleep (dwMilliseconds=0x1) [0090.371] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0090.371] Sleep (dwMilliseconds=0x1) [0090.950] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0090.950] Sleep (dwMilliseconds=0x1) [0091.289] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0091.289] Sleep (dwMilliseconds=0x1) [0091.468] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0091.468] Sleep (dwMilliseconds=0x1) [0092.686] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0092.687] Sleep (dwMilliseconds=0x1) [0093.758] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0093.758] Sleep (dwMilliseconds=0x1) [0095.270] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0095.270] Sleep (dwMilliseconds=0x1) [0096.767] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0096.767] Sleep (dwMilliseconds=0x1) [0097.971] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0097.971] Sleep (dwMilliseconds=0x1) [0098.901] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0098.901] Sleep (dwMilliseconds=0x1) [0099.697] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0099.697] Sleep (dwMilliseconds=0x1) [0100.222] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0100.222] Sleep (dwMilliseconds=0x1) [0100.732] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0100.732] Sleep (dwMilliseconds=0x1) [0101.192] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0101.192] Sleep (dwMilliseconds=0x1) [0101.978] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0101.978] Sleep (dwMilliseconds=0x1) [0102.767] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0102.767] Sleep (dwMilliseconds=0x1) [0103.376] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0103.376] Sleep (dwMilliseconds=0x1) [0103.930] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0103.930] Sleep (dwMilliseconds=0x1) [0104.658] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0104.658] Sleep (dwMilliseconds=0x1) [0105.348] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0105.348] Sleep (dwMilliseconds=0x1) [0105.858] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0105.858] Sleep (dwMilliseconds=0x1) [0106.149] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0106.149] Sleep (dwMilliseconds=0x1) [0106.451] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0106.452] Sleep (dwMilliseconds=0x1) [0106.678] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0106.678] Sleep (dwMilliseconds=0x1) [0106.885] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0106.885] Sleep (dwMilliseconds=0x1) [0106.988] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0106.988] Sleep (dwMilliseconds=0x1) [0107.213] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0107.214] Sleep (dwMilliseconds=0x1) [0107.929] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0107.929] Sleep (dwMilliseconds=0x1) [0108.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0108.672] Sleep (dwMilliseconds=0x1) [0109.404] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0109.404] Sleep (dwMilliseconds=0x1) [0110.230] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0110.230] Sleep (dwMilliseconds=0x1) [0111.057] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.057] Sleep (dwMilliseconds=0x1) [0111.542] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.542] Sleep (dwMilliseconds=0x1) [0111.698] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.698] Sleep (dwMilliseconds=0x1) [0111.778] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.778] Sleep (dwMilliseconds=0x1) [0111.844] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.844] Sleep (dwMilliseconds=0x1) [0111.867] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.867] Sleep (dwMilliseconds=0x1) [0111.870] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.870] Sleep (dwMilliseconds=0x1) [0111.893] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.893] Sleep (dwMilliseconds=0x1) [0111.918] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0111.918] Sleep (dwMilliseconds=0x1) [0112.012] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.012] Sleep (dwMilliseconds=0x1) [0112.054] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.054] Sleep (dwMilliseconds=0x1) [0112.066] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.066] Sleep (dwMilliseconds=0x1) [0112.082] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.082] Sleep (dwMilliseconds=0x1) [0112.097] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.097] Sleep (dwMilliseconds=0x1) [0112.105] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.105] Sleep (dwMilliseconds=0x1) [0112.136] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.136] Sleep (dwMilliseconds=0x1) [0112.164] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.171] Sleep (dwMilliseconds=0x1) [0112.189] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.189] Sleep (dwMilliseconds=0x1) [0112.209] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.209] Sleep (dwMilliseconds=0x1) [0112.223] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.223] Sleep (dwMilliseconds=0x1) [0112.245] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.245] Sleep (dwMilliseconds=0x1) [0112.266] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.267] Sleep (dwMilliseconds=0x1) [0112.278] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.278] Sleep (dwMilliseconds=0x1) [0112.323] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.323] Sleep (dwMilliseconds=0x1) [0112.341] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.341] Sleep (dwMilliseconds=0x1) [0112.359] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.360] Sleep (dwMilliseconds=0x1) [0112.388] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.388] Sleep (dwMilliseconds=0x1) [0112.481] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.481] Sleep (dwMilliseconds=0x1) [0112.680] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.680] Sleep (dwMilliseconds=0x1) [0112.901] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0112.901] Sleep (dwMilliseconds=0x1) [0113.027] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.027] Sleep (dwMilliseconds=0x1) [0113.089] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.089] Sleep (dwMilliseconds=0x1) [0113.132] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.132] Sleep (dwMilliseconds=0x1) [0113.179] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.179] Sleep (dwMilliseconds=0x1) [0113.228] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.228] Sleep (dwMilliseconds=0x1) [0113.501] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.501] Sleep (dwMilliseconds=0x1) [0113.680] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.680] Sleep (dwMilliseconds=0x1) [0113.803] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0113.803] Sleep (dwMilliseconds=0x1) [0113.985] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0114.038] Sleep (dwMilliseconds=0x1) [0115.263] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0115.263] Sleep (dwMilliseconds=0x1) [0116.820] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0116.820] Sleep (dwMilliseconds=0x1) [0117.487] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0117.827] Sleep (dwMilliseconds=0x1) [0118.102] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.102] Sleep (dwMilliseconds=0x1) [0118.239] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.239] Sleep (dwMilliseconds=0x1) [0118.316] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.316] Sleep (dwMilliseconds=0x1) [0118.341] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.341] Sleep (dwMilliseconds=0x1) [0118.364] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.364] Sleep (dwMilliseconds=0x1) [0118.460] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0118.460] Sleep (dwMilliseconds=0x1) [0119.186] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.187] Sleep (dwMilliseconds=0x1) [0119.548] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.548] Sleep (dwMilliseconds=0x1) [0119.686] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.686] Sleep (dwMilliseconds=0x1) [0119.784] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.784] Sleep (dwMilliseconds=0x1) [0119.873] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.873] Sleep (dwMilliseconds=0x1) [0119.942] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0119.942] Sleep (dwMilliseconds=0x1) [0120.008] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0120.009] Sleep (dwMilliseconds=0x1) [0120.465] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0120.465] Sleep (dwMilliseconds=0x1) [0120.965] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0120.965] Sleep (dwMilliseconds=0x1) [0121.168] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0121.168] Sleep (dwMilliseconds=0x1) [0121.445] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0121.445] Sleep (dwMilliseconds=0x1) [0121.704] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0121.729] Sleep (dwMilliseconds=0x1) [0122.014] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0122.014] Sleep (dwMilliseconds=0x1) [0122.225] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0122.225] Sleep (dwMilliseconds=0x1) [0122.714] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0122.714] Sleep (dwMilliseconds=0x1) [0123.046] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0123.046] Sleep (dwMilliseconds=0x1) [0123.335] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0123.335] Sleep (dwMilliseconds=0x1) [0123.694] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0123.694] Sleep (dwMilliseconds=0x1) [0123.977] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0123.977] Sleep (dwMilliseconds=0x1) [0124.225] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0124.225] Sleep (dwMilliseconds=0x1) [0124.456] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0124.456] Sleep (dwMilliseconds=0x1) [0124.462] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0124.462] Sleep (dwMilliseconds=0x1) [0124.696] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0124.696] Sleep (dwMilliseconds=0x1) [0124.764] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0124.764] Sleep (dwMilliseconds=0x1) [0125.374] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0125.389] Sleep (dwMilliseconds=0x1) [0126.129] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0126.129] Sleep (dwMilliseconds=0x1) [0126.596] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0126.596] Sleep (dwMilliseconds=0x1) [0126.907] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0126.907] Sleep (dwMilliseconds=0x1) [0127.382] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0127.382] Sleep (dwMilliseconds=0x1) [0127.819] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0127.819] Sleep (dwMilliseconds=0x1) [0128.047] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.047] Sleep (dwMilliseconds=0x1) [0128.273] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.273] Sleep (dwMilliseconds=0x1) [0128.410] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.410] Sleep (dwMilliseconds=0x1) [0128.556] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.556] Sleep (dwMilliseconds=0x1) [0128.618] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.618] Sleep (dwMilliseconds=0x1) [0128.737] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.778] Sleep (dwMilliseconds=0x1) [0128.920] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.920] Sleep (dwMilliseconds=0x1) [0128.966] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0128.966] Sleep (dwMilliseconds=0x1) [0129.078] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0129.078] Sleep (dwMilliseconds=0x1) [0129.286] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0129.286] Sleep (dwMilliseconds=0x1) [0129.356] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0129.356] Sleep (dwMilliseconds=0x1) [0129.746] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0129.746] Sleep (dwMilliseconds=0x1) [0131.165] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0131.165] Sleep (dwMilliseconds=0x1) [0131.992] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0131.992] Sleep (dwMilliseconds=0x1) [0132.991] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0132.991] Sleep (dwMilliseconds=0x1) [0133.833] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0133.833] Sleep (dwMilliseconds=0x1) [0134.444] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0134.444] Sleep (dwMilliseconds=0x1) [0135.857] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0135.857] Sleep (dwMilliseconds=0x1) [0136.953] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0136.953] Sleep (dwMilliseconds=0x1) [0137.603] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0137.603] Sleep (dwMilliseconds=0x1) [0137.889] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0137.889] Sleep (dwMilliseconds=0x1) [0138.123] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.123] Sleep (dwMilliseconds=0x1) [0138.298] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.298] Sleep (dwMilliseconds=0x1) [0138.334] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.334] Sleep (dwMilliseconds=0x1) [0138.435] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.435] Sleep (dwMilliseconds=0x1) [0138.533] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.533] Sleep (dwMilliseconds=0x1) [0138.591] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.591] Sleep (dwMilliseconds=0x1) [0138.758] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.758] Sleep (dwMilliseconds=0x1) [0138.966] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0138.966] Sleep (dwMilliseconds=0x1) [0139.199] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.199] Sleep (dwMilliseconds=0x1) [0139.400] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.400] Sleep (dwMilliseconds=0x1) [0139.540] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.540] Sleep (dwMilliseconds=0x1) [0139.683] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.683] Sleep (dwMilliseconds=0x1) [0139.782] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.782] Sleep (dwMilliseconds=0x1) [0139.799] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0139.799] Sleep (dwMilliseconds=0x1) [0140.024] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.024] Sleep (dwMilliseconds=0x1) [0140.374] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.374] Sleep (dwMilliseconds=0x1) [0140.656] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.656] Sleep (dwMilliseconds=0x1) [0140.757] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.757] Sleep (dwMilliseconds=0x1) [0140.777] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0140.777] Sleep (dwMilliseconds=0x1) [0141.051] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0141.051] Sleep (dwMilliseconds=0x1) [0141.233] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0141.233] Sleep (dwMilliseconds=0x1) [0141.423] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0141.423] Sleep (dwMilliseconds=0x1) [0142.148] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0142.148] Sleep (dwMilliseconds=0x1) [0142.663] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0142.663] Sleep (dwMilliseconds=0x1) [0143.066] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.066] Sleep (dwMilliseconds=0x1) [0143.295] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.295] Sleep (dwMilliseconds=0x1) [0143.602] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.602] Sleep (dwMilliseconds=0x1) [0143.852] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.852] Sleep (dwMilliseconds=0x1) [0143.973] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0143.973] Sleep (dwMilliseconds=0x1) [0144.028] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0144.028] Sleep (dwMilliseconds=0x1) [0144.691] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0144.691] Sleep (dwMilliseconds=0x1) [0145.147] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.147] Sleep (dwMilliseconds=0x1) [0145.661] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0145.661] Sleep (dwMilliseconds=0x1) [0146.096] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0146.096] Sleep (dwMilliseconds=0x1) [0146.970] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0146.970] Sleep (dwMilliseconds=0x1) [0147.714] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0147.714] Sleep (dwMilliseconds=0x1) [0148.223] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0148.223] Sleep (dwMilliseconds=0x1) [0149.044] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0149.044] Sleep (dwMilliseconds=0x1) [0149.777] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0149.777] Sleep (dwMilliseconds=0x1) [0150.292] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0150.292] Sleep (dwMilliseconds=0x1) [0151.127] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0151.128] Sleep (dwMilliseconds=0x1) [0151.618] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0151.618] Sleep (dwMilliseconds=0x1) [0151.870] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0151.870] Sleep (dwMilliseconds=0x1) [0152.304] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0152.304] Sleep (dwMilliseconds=0x1) [0153.900] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0153.900] Sleep (dwMilliseconds=0x1) [0154.675] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0154.675] Sleep (dwMilliseconds=0x1) [0155.155] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0155.155] Sleep (dwMilliseconds=0x1) [0156.330] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0156.330] Sleep (dwMilliseconds=0x1) [0157.159] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0157.159] Sleep (dwMilliseconds=0x1) [0157.769] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0157.769] Sleep (dwMilliseconds=0x1) [0158.180] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0158.180] Sleep (dwMilliseconds=0x1) [0159.593] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0159.593] Sleep (dwMilliseconds=0x1) [0161.149] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0161.149] Sleep (dwMilliseconds=0x1) [0162.259] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0162.259] Sleep (dwMilliseconds=0x1) [0163.352] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0163.352] Sleep (dwMilliseconds=0x1) [0164.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0164.191] Sleep (dwMilliseconds=0x1) [0165.041] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0165.041] Sleep (dwMilliseconds=0x1) [0165.416] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0165.416] Sleep (dwMilliseconds=0x1) [0165.748] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0165.748] Sleep (dwMilliseconds=0x1) [0165.970] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0165.970] Sleep (dwMilliseconds=0x1) [0166.874] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0166.874] Sleep (dwMilliseconds=0x1) [0167.607] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0167.607] Sleep (dwMilliseconds=0x1) [0168.163] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0168.163] Sleep (dwMilliseconds=0x1) [0168.651] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0168.651] Sleep (dwMilliseconds=0x1) [0168.964] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0168.965] Sleep (dwMilliseconds=0x1) [0169.110] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0169.110] Sleep (dwMilliseconds=0x1) [0169.198] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0169.198] Sleep (dwMilliseconds=0x1) [0170.324] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0170.324] Sleep (dwMilliseconds=0x1) [0171.170] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0171.170] Sleep (dwMilliseconds=0x1) [0171.804] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0171.804] Sleep (dwMilliseconds=0x1) [0172.380] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0172.380] Sleep (dwMilliseconds=0x1) [0173.660] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0173.660] Sleep (dwMilliseconds=0x1) [0174.128] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0174.128] Sleep (dwMilliseconds=0x1) [0174.221] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0174.221] Sleep (dwMilliseconds=0x1) [0174.815] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0174.815] Sleep (dwMilliseconds=0x1) [0175.360] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0175.360] Sleep (dwMilliseconds=0x1) [0176.141] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0176.141] Sleep (dwMilliseconds=0x1) [0176.936] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0176.936] Sleep (dwMilliseconds=0x1) [0177.386] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0177.386] Sleep (dwMilliseconds=0x1) [0177.747] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0177.747] Sleep (dwMilliseconds=0x1) [0178.184] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0178.184] Sleep (dwMilliseconds=0x1) [0178.532] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0178.532] Sleep (dwMilliseconds=0x1) [0178.810] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0178.811] Sleep (dwMilliseconds=0x1) [0179.188] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0179.229] Sleep (dwMilliseconds=0x1) [0179.828] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0179.828] Sleep (dwMilliseconds=0x1) [0180.826] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0180.826] Sleep (dwMilliseconds=0x1) [0181.615] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0181.615] Sleep (dwMilliseconds=0x1) [0181.907] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0181.907] Sleep (dwMilliseconds=0x1) [0182.073] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0182.074] Sleep (dwMilliseconds=0x1) [0182.415] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0182.415] Sleep (dwMilliseconds=0x1) [0182.903] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0182.903] Sleep (dwMilliseconds=0x1) [0183.021] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0183.021] Sleep (dwMilliseconds=0x1) [0183.808] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0183.808] Sleep (dwMilliseconds=0x1) [0184.483] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0184.483] Sleep (dwMilliseconds=0x1) [0184.794] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0184.794] Sleep (dwMilliseconds=0x1) [0184.926] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0184.926] Sleep (dwMilliseconds=0x1) [0185.017] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0185.017] Sleep (dwMilliseconds=0x1) [0185.088] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0185.089] Sleep (dwMilliseconds=0x1) [0185.282] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0185.282] Sleep (dwMilliseconds=0x1) [0185.891] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0185.891] Sleep (dwMilliseconds=0x1) [0187.420] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0187.420] Sleep (dwMilliseconds=0x1) [0187.967] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0187.967] Sleep (dwMilliseconds=0x1) [0188.652] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0188.652] Sleep (dwMilliseconds=0x1) [0189.283] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0189.283] Sleep (dwMilliseconds=0x1) [0189.772] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0189.772] Sleep (dwMilliseconds=0x1) [0190.281] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0190.281] Sleep (dwMilliseconds=0x1) [0190.730] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0190.730] Sleep (dwMilliseconds=0x1) [0191.791] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0191.791] Sleep (dwMilliseconds=0x1) [0192.560] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0192.560] Sleep (dwMilliseconds=0x1) [0193.093] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0193.093] Sleep (dwMilliseconds=0x1) [0194.403] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0194.403] Sleep (dwMilliseconds=0x1) [0195.485] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0195.485] Sleep (dwMilliseconds=0x1) [0196.025] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0196.025] Sleep (dwMilliseconds=0x1) [0196.207] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0196.207] Sleep (dwMilliseconds=0x1) [0196.445] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0196.445] Sleep (dwMilliseconds=0x1) [0197.233] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0197.233] Sleep (dwMilliseconds=0x1) [0197.639] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0197.639] Sleep (dwMilliseconds=0x1) [0197.771] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0197.771] Sleep (dwMilliseconds=0x1) [0197.802] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0197.802] Sleep (dwMilliseconds=0x1) [0198.277] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.277] Sleep (dwMilliseconds=0x1) [0198.614] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.614] Sleep (dwMilliseconds=0x1) [0198.800] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.800] Sleep (dwMilliseconds=0x1) [0198.860] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.860] Sleep (dwMilliseconds=0x1) [0198.890] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0198.890] Sleep (dwMilliseconds=0x1) [0199.026] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0199.026] Sleep (dwMilliseconds=0x1) [0199.678] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0199.678] Sleep (dwMilliseconds=0x1) [0200.134] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0200.134] Sleep (dwMilliseconds=0x1) [0200.463] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0200.463] Sleep (dwMilliseconds=0x1) [0200.787] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0200.805] Sleep (dwMilliseconds=0x1) [0201.147] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.147] Sleep (dwMilliseconds=0x1) [0201.271] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.271] Sleep (dwMilliseconds=0x1) [0201.305] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.305] Sleep (dwMilliseconds=0x1) [0201.595] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.596] Sleep (dwMilliseconds=0x1) [0201.908] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0201.908] Sleep (dwMilliseconds=0x1) [0203.186] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0203.186] Sleep (dwMilliseconds=0x1) [0204.765] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0204.765] Sleep (dwMilliseconds=0x1) [0206.065] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0206.065] Sleep (dwMilliseconds=0x1) [0207.368] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0207.368] Sleep (dwMilliseconds=0x1) [0208.488] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0208.489] Sleep (dwMilliseconds=0x1) [0209.457] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0209.457] Sleep (dwMilliseconds=0x1) [0209.959] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0209.959] Sleep (dwMilliseconds=0x1) [0210.027] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.027] Sleep (dwMilliseconds=0x1) [0210.052] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.052] Sleep (dwMilliseconds=0x1) [0210.062] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.062] Sleep (dwMilliseconds=0x1) [0210.086] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.086] Sleep (dwMilliseconds=0x1) [0210.786] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0210.786] Sleep (dwMilliseconds=0x1) [0211.496] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0211.496] Sleep (dwMilliseconds=0x1) [0212.227] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0212.227] Sleep (dwMilliseconds=0x1) [0212.945] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0212.945] Sleep (dwMilliseconds=0x1) [0213.769] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0213.769] Sleep (dwMilliseconds=0x1) [0214.248] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0214.248] Sleep (dwMilliseconds=0x1) [0214.521] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0214.521] Sleep (dwMilliseconds=0x1) [0215.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0215.672] Sleep (dwMilliseconds=0x1) [0216.672] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0216.672] Sleep (dwMilliseconds=0x1) [0217.971] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0217.971] Sleep (dwMilliseconds=0x1) [0218.997] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0218.997] Sleep (dwMilliseconds=0x1) [0219.884] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0219.884] Sleep (dwMilliseconds=0x1) [0220.650] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0220.651] Sleep (dwMilliseconds=0x1) [0220.839] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0220.839] Sleep (dwMilliseconds=0x1) [0220.937] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0220.937] Sleep (dwMilliseconds=0x1) [0220.996] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0220.996] Sleep (dwMilliseconds=0x1) [0221.179] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0221.179] Sleep (dwMilliseconds=0x1) [0221.241] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0221.241] Sleep (dwMilliseconds=0x1) [0222.075] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0222.075] Sleep (dwMilliseconds=0x1) [0222.361] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0222.361] Sleep (dwMilliseconds=0x1) [0222.530] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0222.530] Sleep (dwMilliseconds=0x1) [0222.816] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0222.968] Sleep (dwMilliseconds=0x1) [0223.113] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0223.113] Sleep (dwMilliseconds=0x1) [0223.189] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0223.189] Sleep (dwMilliseconds=0x1) [0223.293] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0223.310] Sleep (dwMilliseconds=0x1) [0223.895] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0223.895] Sleep (dwMilliseconds=0x1) [0224.268] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0224.268] Sleep (dwMilliseconds=0x1) [0224.814] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0224.814] Sleep (dwMilliseconds=0x1) [0225.241] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0225.241] Sleep (dwMilliseconds=0x1) [0226.846] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0226.846] Sleep (dwMilliseconds=0x1) [0228.349] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0228.349] Sleep (dwMilliseconds=0x1) [0229.581] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0229.581] Sleep (dwMilliseconds=0x1) [0231.730] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0231.730] Sleep (dwMilliseconds=0x1) [0233.782] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0233.782] Sleep (dwMilliseconds=0x1) [0235.485] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0235.485] Sleep (dwMilliseconds=0x1) [0236.733] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0236.733] Sleep (dwMilliseconds=0x1) [0237.667] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0237.667] Sleep (dwMilliseconds=0x1) [0238.322] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.322] Sleep (dwMilliseconds=0x1) [0238.525] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.525] Sleep (dwMilliseconds=0x1) [0238.649] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.649] Sleep (dwMilliseconds=0x1) [0238.807] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.807] Sleep (dwMilliseconds=0x1) [0238.844] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.844] Sleep (dwMilliseconds=0x1) [0238.853] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.853] Sleep (dwMilliseconds=0x1) [0238.884] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.884] Sleep (dwMilliseconds=0x1) [0238.922] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.922] Sleep (dwMilliseconds=0x1) [0238.933] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.933] Sleep (dwMilliseconds=0x1) [0238.954] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.954] Sleep (dwMilliseconds=0x1) [0238.961] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.962] Sleep (dwMilliseconds=0x1) [0238.977] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.977] Sleep (dwMilliseconds=0x1) [0238.993] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0238.993] Sleep (dwMilliseconds=0x1) [0239.008] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.008] Sleep (dwMilliseconds=0x1) [0239.024] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.024] Sleep (dwMilliseconds=0x1) [0239.039] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.039] Sleep (dwMilliseconds=0x1) [0239.055] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.055] Sleep (dwMilliseconds=0x1) [0239.071] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.071] Sleep (dwMilliseconds=0x1) [0239.107] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.107] Sleep (dwMilliseconds=0x1) [0239.339] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.339] Sleep (dwMilliseconds=0x1) [0239.413] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.413] Sleep (dwMilliseconds=0x1) [0239.528] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.570] Sleep (dwMilliseconds=0x1) [0239.873] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0239.873] Sleep (dwMilliseconds=0x1) [0240.147] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0240.147] Sleep (dwMilliseconds=0x1) [0240.459] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0240.459] Sleep (dwMilliseconds=0x1) [0241.192] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0241.192] Sleep (dwMilliseconds=0x1) [0242.228] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0242.228] Sleep (dwMilliseconds=0x1) [0242.910] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0242.910] Sleep (dwMilliseconds=0x1) [0243.479] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0243.479] Sleep (dwMilliseconds=0x1) [0243.923] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0243.923] Sleep (dwMilliseconds=0x1) [0244.230] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0244.230] Sleep (dwMilliseconds=0x1) [0244.419] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0244.419] Sleep (dwMilliseconds=0x1) [0244.536] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0244.536] Sleep (dwMilliseconds=0x1) [0244.564] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0244.564] Sleep (dwMilliseconds=0x1) [0245.400] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0245.400] Sleep (dwMilliseconds=0x1) [0246.061] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0246.061] Sleep (dwMilliseconds=0x1) [0246.747] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0246.747] Sleep (dwMilliseconds=0x1) [0247.355] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0247.355] Sleep (dwMilliseconds=0x1) [0247.920] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0247.920] Sleep (dwMilliseconds=0x1) [0248.207] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0248.207] Sleep (dwMilliseconds=0x1) [0248.247] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0248.247] Sleep (dwMilliseconds=0x1) [0249.021] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0249.021] Sleep (dwMilliseconds=0x1) [0250.053] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0250.053] Sleep (dwMilliseconds=0x1) [0250.896] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0250.896] Sleep (dwMilliseconds=0x1) [0251.597] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0251.597] Sleep (dwMilliseconds=0x1) [0252.190] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0252.190] Sleep (dwMilliseconds=0x1) [0252.665] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0252.665] Sleep (dwMilliseconds=0x1) [0252.898] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0252.898] Sleep (dwMilliseconds=0x1) [0252.916] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0252.916] Sleep (dwMilliseconds=0x1) [0253.797] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0253.797] Sleep (dwMilliseconds=0x1) [0254.515] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0254.515] Sleep (dwMilliseconds=0x1) [0255.604] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0255.604] Sleep (dwMilliseconds=0x1) [0256.480] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0256.480] Sleep (dwMilliseconds=0x1) [0257.276] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0257.276] Sleep (dwMilliseconds=0x1) [0257.869] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0257.869] Sleep (dwMilliseconds=0x1) [0258.139] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0258.140] Sleep (dwMilliseconds=0x1) [0258.314] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0258.314] Sleep (dwMilliseconds=0x1) [0258.433] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0258.433] Sleep (dwMilliseconds=0x1) [0258.692] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0258.692] Sleep (dwMilliseconds=0x1) [0260.817] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0260.817] Sleep (dwMilliseconds=0x1) [0262.581] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0262.581] Sleep (dwMilliseconds=0x1) [0264.036] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0264.036] Sleep (dwMilliseconds=0x1) [0265.388] PeekMessageA (in: lpMsg=0x415560, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x415560) returned 0 [0265.388] Sleep (dwMilliseconds=0x1) Thread: id = 2 os_tid = 0x9dc Thread: id = 3 os_tid = 0x9e0 Thread: id = 4 os_tid = 0x9e4 Thread: id = 5 os_tid = 0x9e8 Thread: id = 7 os_tid = 0x9f4 Thread: id = 9 os_tid = 0xa00 Thread: id = 11 os_tid = 0xa1c [0039.059] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.108] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.203] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.111] Sleep (dwMilliseconds=0x1) [0043.133] Sleep (dwMilliseconds=0x1) [0043.143] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.696] Sleep (dwMilliseconds=0x1) [0043.712] Sleep (dwMilliseconds=0x1) [0043.727] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.673] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x2c8ff84*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.673] GetProcessHeap () returned 0x580000 [0059.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596c88 [0059.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0059.673] CloseHandle (hObject=0x404) returned 1 [0059.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.674] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0059.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.674] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0059.674] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.674] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0059.674] GetProcessHeap () returned 0x580000 [0059.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6d33678 [0059.675] GetProcessHeap () returned 0x580000 [0059.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6c56108 [0059.675] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.675] ReadFile (in: hFile=0x404, lpBuffer=0x6d33678, nNumberOfBytesToRead=0x7c0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesRead=0x2c8ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0059.683] GetProcessHeap () returned 0x580000 [0059.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.683] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.683] WriteFile (in: hFile=0x404, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x2c8ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0059.683] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.683] WriteFile (in: hFile=0x404, lpBuffer=0x6c568c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c568c7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.683] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.683] WriteFile (in: hFile=0x404, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.684] CloseHandle (hObject=0x404) returned 1 [0059.684] GetProcessHeap () returned 0x580000 [0059.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0059.684] GetProcessHeap () returned 0x580000 [0059.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0059.684] GetProcessHeap () returned 0x580000 [0059.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.685] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b5eb0e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x2c8fd28, dwReserved1=0x6d33678, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0059.685] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.686] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", len=0x4b | out: pbstr=0x2c8ff84*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 1 [0059.686] GetProcessHeap () returned 0x580000 [0059.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b96b0 [0059.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0059.688] CloseHandle (hObject=0x434) returned 1 [0059.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.688] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id_1622540890_.your_last_chance")) returned 1 [0059.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.688] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x45, dwReserved1=0x0, cFileName="VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~1.YOU")) returned 0x5b9630 [0059.689] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.689] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0059.689] GetProcessHeap () returned 0x580000 [0059.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x6d0c508 [0059.689] GetProcessHeap () returned 0x580000 [0059.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x622c10 [0059.689] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.689] ReadFile (in: hFile=0x434, lpBuffer=0x6d0c508, nNumberOfBytesToRead=0x2500, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0c508*, lpNumberOfBytesRead=0x2c8ff14*=0x2500, lpOverlapped=0x0) returned 1 [0060.363] GetProcessHeap () returned 0x580000 [0060.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0060.363] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.363] WriteFile (in: hFile=0x434, lpBuffer=0x622c10*, nNumberOfBytesToWrite=0x2500, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x622c10*, lpNumberOfBytesWritten=0x2c8ff14*=0x2500, lpOverlapped=0x0) returned 1 [0061.804] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.804] WriteFile (in: hFile=0x434, lpBuffer=0x62510f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62510f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.804] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.804] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.804] CloseHandle (hObject=0x434) returned 1 [0061.806] GetProcessHeap () returned 0x580000 [0061.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x622c10 | out: hHeap=0x580000) returned 1 [0061.806] GetProcessHeap () returned 0x580000 [0061.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0c508 | out: hHeap=0x580000) returned 1 [0061.806] GetProcessHeap () returned 0x580000 [0061.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0061.806] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x5ca26be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2543, dwReserved0=0x2c8fd28, dwReserved1=0x6d0c508, cFileName="VisioMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~1.YOU")) returned 0x5b9630 [0061.806] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0062.932] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", len=0x58 | out: pbstr=0x2c8ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 1 [0062.932] GetProcessHeap () returned 0x580000 [0062.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x2c) returned 0x5b5bc8 [0062.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0062.933] CloseHandle (hObject=0x418) returned 1 [0062.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0062.933] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id_1622540890_.your_last_chance")) returned 1 [0065.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0065.412] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="branding.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b9630 [0065.412] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0065.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0065.412] GetProcessHeap () returned 0x580000 [0065.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c57108 [0065.413] GetProcessHeap () returned 0x580000 [0065.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c68938 [0065.413] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.413] ReadFile (in: hFile=0x418, lpBuffer=0x6c57108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0069.180] GetProcessHeap () returned 0x580000 [0069.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0069.180] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.180] WriteFile (in: hFile=0x418, lpBuffer=0x6c68938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68938*, lpNumberOfBytesWritten=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0070.029] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.029] WriteFile (in: hFile=0x418, lpBuffer=0x6c7a137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a137*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0070.048] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.049] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0070.049] CloseHandle (hObject=0x418) returned 1 [0070.136] GetProcessHeap () returned 0x580000 [0070.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c68938 | out: hHeap=0x580000) returned 1 [0070.136] GetProcessHeap () returned 0x580000 [0070.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0070.140] GetProcessHeap () returned 0x580000 [0070.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0072.141] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0x61867f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91999, dwReserved0=0x2c8fd34, dwReserved1=0x7718ba87, cFileName="branding.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b9770 [0072.141] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.151] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", len=0x52 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 1 [0072.151] GetProcessHeap () returned 0x580000 [0072.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x5c) returned 0x5b5d08 [0072.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.003] Sleep (dwMilliseconds=0x1) [0073.075] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", len=0x3d | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 1 [0073.075] GetProcessHeap () returned 0x580000 [0073.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x30) returned 0x5b5d08 [0073.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.657] CloseHandle (hObject=0x464) returned 1 [0074.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id_1622540890_.your_last_chance")) returned 1 [0074.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPNGI~1.YOU")) returned 0x5b9730 [0074.658] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.659] GetProcessHeap () returned 0x580000 [0074.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6f094f0 [0074.659] GetProcessHeap () returned 0x580000 [0074.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6f09ba0 [0074.659] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.659] ReadFile (in: hFile=0x464, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x2c8ff14*=0x680, lpOverlapped=0x0) returned 1 [0074.666] GetProcessHeap () returned 0x580000 [0074.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0074.666] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.666] WriteFile (in: hFile=0x464, lpBuffer=0x6f09ba0*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09ba0*, lpNumberOfBytesWritten=0x2c8ff14*=0x680, lpOverlapped=0x0) returned 1 [0074.666] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.666] WriteFile (in: hFile=0x464, lpBuffer=0x6f0a21f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a21f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.666] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.666] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.666] CloseHandle (hObject=0x464) returned 1 [0074.666] GetProcessHeap () returned 0x580000 [0074.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ba0 | out: hHeap=0x580000) returned 1 [0074.666] GetProcessHeap () returned 0x580000 [0074.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0074.666] GetProcessHeap () returned 0x580000 [0074.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0077.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x64236180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x2c8fd28, dwReserved1=0x6f094f0, cFileName="MS.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPNGI~1.YOU")) returned 0x5b96f0 [0078.172] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.676] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 1 [0080.677] GetProcessHeap () returned 0x580000 [0080.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f458, Size=0x28) returned 0x5dc340 [0080.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.677] CloseHandle (hObject=0x458) returned 1 [0080.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0080.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0080.678] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.678] GetProcessHeap () returned 0x580000 [0080.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x66fcd0 [0080.679] GetProcessHeap () returned 0x580000 [0080.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x672180 [0080.679] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.679] ReadFile (in: hFile=0x458, lpBuffer=0x66fcd0, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x66fcd0*, lpNumberOfBytesRead=0x2c8ff14*=0x2480, lpOverlapped=0x0) returned 1 [0080.713] GetProcessHeap () returned 0x580000 [0080.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0080.713] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.713] WriteFile (in: hFile=0x458, lpBuffer=0x672180*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x672180*, lpNumberOfBytesWritten=0x2c8ff14*=0x2480, lpOverlapped=0x0) returned 1 [0080.713] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.714] WriteFile (in: hFile=0x458, lpBuffer=0x6745ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6745ff*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0080.714] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.714] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0080.714] CloseHandle (hObject=0x458) returned 1 [0080.714] GetProcessHeap () returned 0x580000 [0080.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x672180 | out: hHeap=0x580000) returned 1 [0080.714] GetProcessHeap () returned 0x580000 [0080.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x66fcd0 | out: hHeap=0x580000) returned 1 [0080.714] GetProcessHeap () returned 0x580000 [0080.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0081.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x67b7d2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24ac, dwReserved0=0x2c8fd28, dwReserved1=0x66fcd0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0081.559] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.590] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 1 [0081.590] GetProcessHeap () returned 0x580000 [0081.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.595] CloseHandle (hObject=0x444) returned 1 [0081.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.596] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.596] GetProcessHeap () returned 0x580000 [0081.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6f094f0 [0081.596] GetProcessHeap () returned 0x580000 [0081.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6d0e508 [0081.596] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.597] ReadFile (in: hFile=0x444, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x2c8ff14*=0x920, lpOverlapped=0x0) returned 1 [0081.606] GetProcessHeap () returned 0x580000 [0081.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.606] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.606] WriteFile (in: hFile=0x444, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x2c8ff14*=0x920, lpOverlapped=0x0) returned 1 [0081.607] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.607] WriteFile (in: hFile=0x444, lpBuffer=0x6d0ee27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ee27*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.607] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.607] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.607] CloseHandle (hObject=0x444) returned 1 [0081.607] GetProcessHeap () returned 0x580000 [0081.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.607] GetProcessHeap () returned 0x580000 [0081.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.607] GetProcessHeap () returned 0x580000 [0081.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6841e2a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95e, dwReserved0=0x2c8fd28, dwReserved1=0x6f094f0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.607] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.635] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 1 [0081.635] GetProcessHeap () returned 0x580000 [0081.635] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.636] CloseHandle (hObject=0x488) returned 1 [0081.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.637] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.637] GetProcessHeap () returned 0x580000 [0081.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6f094f0 [0081.637] GetProcessHeap () returned 0x580000 [0081.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6f09ce0 [0081.637] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.637] ReadFile (in: hFile=0x488, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x7c0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x2c8ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0081.645] GetProcessHeap () returned 0x580000 [0081.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.645] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.645] WriteFile (in: hFile=0x488, lpBuffer=0x6f09ce0*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09ce0*, lpNumberOfBytesWritten=0x2c8ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0081.645] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.645] WriteFile (in: hFile=0x488, lpBuffer=0x6f0a49f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a49f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.646] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.646] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.646] CloseHandle (hObject=0x488) returned 1 [0081.646] GetProcessHeap () returned 0x580000 [0081.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ce0 | out: hHeap=0x580000) returned 1 [0081.646] GetProcessHeap () returned 0x580000 [0081.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.646] GetProcessHeap () returned 0x580000 [0081.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6846a560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x2c8fd28, dwReserved1=0x6f094f0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.646] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.651] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", len=0x6c | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 1 [0081.651] GetProcessHeap () returned 0x580000 [0081.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.651] CloseHandle (hObject=0x488) returned 1 [0081.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id_1622540890_.your_last_chance")) returned 1 [0081.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x4c004d, dwReserved1=0x69002e, cFileName="OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b96f0 [0081.652] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.652] GetProcessHeap () returned 0x580000 [0081.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f0c4f8 [0081.652] GetProcessHeap () returned 0x580000 [0081.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f094f0 [0081.652] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.652] ReadFile (in: hFile=0x488, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x2c8ff14*=0x640, lpOverlapped=0x0) returned 1 [0081.659] GetProcessHeap () returned 0x580000 [0081.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.659] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.659] WriteFile (in: hFile=0x488, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x2c8ff14*=0x640, lpOverlapped=0x0) returned 1 [0081.659] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.659] WriteFile (in: hFile=0x488, lpBuffer=0x6f09b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b2f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.660] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.660] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.660] CloseHandle (hObject=0x488) returned 1 [0081.660] GetProcessHeap () returned 0x580000 [0081.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.660] GetProcessHeap () returned 0x580000 [0081.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0081.660] GetProcessHeap () returned 0x580000 [0081.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x684906c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x2c8fd28, dwReserved1=0x6f0c4f8, cFileName="OneNoteMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b96f0 [0081.660] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.673] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", len=0x63 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 1 [0083.673] GetProcessHeap () returned 0x580000 [0083.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0083.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.673] CloseHandle (hObject=0x444) returned 1 [0083.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id_1622540890_.your_last_chance")) returned 1 [0083.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~1.YOU")) returned 0x5b96f0 [0083.675] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.675] GetProcessHeap () returned 0x580000 [0083.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x67b660 [0083.675] GetProcessHeap () returned 0x580000 [0083.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x67d890 [0083.675] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.675] ReadFile (in: hFile=0x444, lpBuffer=0x67b660, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67b660*, lpNumberOfBytesRead=0x2c8ff14*=0x2200, lpOverlapped=0x0) returned 1 [0083.853] GetProcessHeap () returned 0x580000 [0083.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.853] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.853] WriteFile (in: hFile=0x444, lpBuffer=0x67d890*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67d890*, lpNumberOfBytesWritten=0x2c8ff14*=0x2200, lpOverlapped=0x0) returned 1 [0083.853] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.853] WriteFile (in: hFile=0x444, lpBuffer=0x67fa8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fa8f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.854] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.854] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.854] CloseHandle (hObject=0x444) returned 1 [0083.854] GetProcessHeap () returned 0x580000 [0083.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67d890 | out: hHeap=0x580000) returned 1 [0083.854] GetProcessHeap () returned 0x580000 [0083.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67b660 | out: hHeap=0x580000) returned 1 [0083.856] GetProcessHeap () returned 0x580000 [0083.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6998a8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2237, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="VisiorWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~1.YOU")) returned 0x5b96b0 [0083.857] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.051] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", len=0x41 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 1 [0084.051] GetProcessHeap () returned 0x580000 [0084.051] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0084.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0084.601] CloseHandle (hObject=0x444) returned 1 [0084.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id_1622540890_.your_last_chance")) returned 1 [0084.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~2.YOU")) returned 0x5b9630 [0084.602] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0084.602] GetProcessHeap () returned 0x580000 [0084.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cf6cd8 [0084.602] GetProcessHeap () returned 0x580000 [0084.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0084.603] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.603] ReadFile (in: hFile=0x444, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.080] GetProcessHeap () returned 0x580000 [0086.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0086.081] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.081] WriteFile (in: hFile=0x444, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.081] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.081] WriteFile (in: hFile=0x444, lpBuffer=0x64816f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x64816f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.180] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.180] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.180] CloseHandle (hObject=0x444) returned 1 [0086.180] GetProcessHeap () returned 0x580000 [0086.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0086.180] GetProcessHeap () returned 0x580000 [0086.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0086.180] GetProcessHeap () returned 0x580000 [0086.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0086.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6afb5580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x609a7, dwReserved0=0x2c8fd28, dwReserved1=0x6cf6cd8, cFileName="MSWDS_ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~2.YOU")) returned 0x5b96f0 [0086.180] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.224] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", len=0x4c | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 1 [0088.224] GetProcessHeap () returned 0x580000 [0088.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f7a0 [0088.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0088.290] CloseHandle (hObject=0x4a0) returned 1 [0088.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.328] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0088.328] GetProcessHeap () returned 0x580000 [0088.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6f03bc8 [0088.328] GetProcessHeap () returned 0x580000 [0088.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x67bc40 [0088.328] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.329] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f03bc8, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bc8*, lpNumberOfBytesRead=0x2c8ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0088.388] GetProcessHeap () returned 0x580000 [0088.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.389] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.389] WriteFile (in: hFile=0x4a0, lpBuffer=0x67bc40*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67bc40*, lpNumberOfBytesWritten=0x2c8ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0088.389] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.389] WriteFile (in: hFile=0x4a0, lpBuffer=0x67c41f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c41f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.389] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.389] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.389] CloseHandle (hObject=0x4a0) returned 1 [0088.389] GetProcessHeap () returned 0x580000 [0088.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67bc40 | out: hHeap=0x580000) returned 1 [0088.389] GetProcessHeap () returned 0x580000 [0088.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bc8 | out: hHeap=0x580000) returned 1 [0088.389] GetProcessHeap () returned 0x580000 [0088.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c4af760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x2c8fd28, dwReserved1=0x6f03bc8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.389] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.995] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 1 [0091.996] GetProcessHeap () returned 0x580000 [0091.996] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0091.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0091.996] CloseHandle (hObject=0x414) returned 1 [0091.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0092.046] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0092.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0092.047] GetProcessHeap () returned 0x580000 [0092.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc01) returned 0x6cea0d8 [0092.047] GetProcessHeap () returned 0x580000 [0092.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc01) returned 0x6e26740 [0092.047] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.047] ReadFile (in: hFile=0x414, lpBuffer=0x6cea0d8, nNumberOfBytesToRead=0xbbe0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cea0d8*, lpNumberOfBytesRead=0x2c8ff14*=0xbbe0, lpOverlapped=0x0) returned 1 [0096.927] GetProcessHeap () returned 0x580000 [0096.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0096.927] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x414, lpBuffer=0x6e26740*, nNumberOfBytesToWrite=0xbbe0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e26740*, lpNumberOfBytesWritten=0x2c8ff14*=0xbbe0, lpOverlapped=0x0) returned 1 [0096.928] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x414, lpBuffer=0x6e3231f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3231f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0096.928] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0096.928] CloseHandle (hObject=0x414) returned 1 [0096.928] GetProcessHeap () returned 0x580000 [0096.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e26740 | out: hHeap=0x580000) returned 1 [0096.929] GetProcessHeap () returned 0x580000 [0096.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cea0d8 | out: hHeap=0x580000) returned 1 [0096.929] GetProcessHeap () returned 0x580000 [0096.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0096.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x716368e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbc17, dwReserved0=0x2c8fd28, dwReserved1=0x6cea0d8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0096.929] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.404] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 1 [0101.404] GetProcessHeap () returned 0x580000 [0101.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0101.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0103.877] CloseHandle (hObject=0x4a4) returned 1 [0103.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0103.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0103.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0103.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0103.878] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0103.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0103.878] GetProcessHeap () returned 0x580000 [0103.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e1) returned 0x6f0c4f8 [0103.878] GetProcessHeap () returned 0x580000 [0103.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e1) returned 0x6c676b8 [0103.878] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.879] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x6c0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x2c8ff14*=0x6c0, lpOverlapped=0x0) returned 1 [0103.889] GetProcessHeap () returned 0x580000 [0103.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.889] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.889] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x2c8ff14*=0x6c0, lpOverlapped=0x0) returned 1 [0103.889] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.889] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c67d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67d77*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.889] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.889] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.889] CloseHandle (hObject=0x4a4) returned 1 [0103.890] GetProcessHeap () returned 0x580000 [0103.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0103.890] GetProcessHeap () returned 0x580000 [0103.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0103.890] GetProcessHeap () returned 0x580000 [0103.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75890e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6ed, dwReserved0=0x2c8fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0103.890] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.669] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", len=0x34 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 1 [0109.669] GetProcessHeap () returned 0x580000 [0109.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f420, Size=0x2c) returned 0x61f7a0 [0109.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.708] Sleep (dwMilliseconds=0x1) [0109.718] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", len=0x41 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 1 [0109.718] GetProcessHeap () returned 0x580000 [0109.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94c8 | out: hHeap=0x580000) returned 1 [0109.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0109.719] CloseHandle (hObject=0x488) returned 1 [0109.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0109.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id_1622540890_.your_last_chance")) returned 1 [0109.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0109.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOEE~1.YOU")) returned 0x5b9630 [0109.720] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0109.720] GetProcessHeap () returned 0x580000 [0109.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f61) returned 0x6f3ef08 [0109.720] GetProcessHeap () returned 0x580000 [0109.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f61) returned 0x6cf6cd8 [0109.721] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.721] ReadFile (in: hFile=0x488, lpBuffer=0x6f3ef08, nNumberOfBytesToRead=0x3f40, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef08*, lpNumberOfBytesRead=0x2c8ff14*=0x3f40, lpOverlapped=0x0) returned 1 [0110.536] GetProcessHeap () returned 0x580000 [0110.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0110.537] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.537] WriteFile (in: hFile=0x488, lpBuffer=0x6cf6cd8*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesWritten=0x2c8ff14*=0x3f40, lpOverlapped=0x0) returned 1 [0110.537] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.537] WriteFile (in: hFile=0x488, lpBuffer=0x6cfac17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfac17*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0110.537] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.537] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0110.537] CloseHandle (hObject=0x488) returned 1 [0110.537] GetProcessHeap () returned 0x580000 [0110.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0110.537] GetProcessHeap () returned 0x580000 [0110.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef08 | out: hHeap=0x580000) returned 1 [0110.537] GetProcessHeap () returned 0x580000 [0110.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0110.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x797f17e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3f74, dwReserved0=0x2c8fd28, dwReserved1=0x6f3ef08, cFileName="vstoee100.tlb.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOEE~1.YOU")) returned 0x5b96f0 [0110.538] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.914] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", len=0x54 | out: pbstr=0x2c8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 1 [0111.914] GetProcessHeap () returned 0x580000 [0111.914] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.914] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.946] Sleep (dwMilliseconds=0x1) [0112.023] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.047] Sleep (dwMilliseconds=0x1) [0112.164] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", len=0x47 | out: pbstr=0x2c8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 1 [0112.164] GetProcessHeap () returned 0x580000 [0112.164] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.189] Sleep (dwMilliseconds=0x1) [0112.341] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", len=0x47 | out: pbstr=0x2c8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 1 [0112.341] GetProcessHeap () returned 0x580000 [0112.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.341] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.341] Sleep (dwMilliseconds=0x1) [0112.359] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", len=0x4a | out: pbstr=0x2c8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png") returned 1 [0112.359] GetProcessHeap () returned 0x580000 [0112.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x48) returned 0x596cd8 [0112.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.383] Sleep (dwMilliseconds=0x1) [0113.342] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", len=0x3f | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 1 [0113.342] GetProcessHeap () returned 0x580000 [0113.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x64) returned 0x6f0ceb8 [0113.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.357] CloseHandle (hObject=0x488) returned 1 [0113.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.357] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id_1622540890_.your_last_chance")) returned 1 [0113.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~1.YOU")) returned 0x5b9630 [0113.358] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.358] GetProcessHeap () returned 0x580000 [0113.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x6f3ef08 [0113.359] GetProcessHeap () returned 0x580000 [0113.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x6f40a78 [0113.359] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.359] ReadFile (in: hFile=0x488, lpBuffer=0x6f3ef08, nNumberOfBytesToRead=0x1b40, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef08*, lpNumberOfBytesRead=0x2c8ff14*=0x1b40, lpOverlapped=0x0) returned 1 [0113.384] GetProcessHeap () returned 0x580000 [0113.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0113.384] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.384] WriteFile (in: hFile=0x488, lpBuffer=0x6f40a78*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f40a78*, lpNumberOfBytesWritten=0x2c8ff14*=0x1b40, lpOverlapped=0x0) returned 1 [0113.384] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.384] WriteFile (in: hFile=0x488, lpBuffer=0x6f425b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f425b7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.384] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.385] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.385] CloseHandle (hObject=0x488) returned 1 [0113.385] GetProcessHeap () returned 0x580000 [0113.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f40a78 | out: hHeap=0x580000) returned 1 [0113.385] GetProcessHeap () returned 0x580000 [0113.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef08 | out: hHeap=0x580000) returned 1 [0113.385] GetProcessHeap () returned 0x580000 [0113.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0113.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b32b380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x2c8fd28, dwReserved1=0x6f3ef08, cFileName="AG00163_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~1.YOU")) returned 0x5b9630 [0113.385] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0113.829] CloseHandle (hObject=0x45c) returned 1 [0113.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS0163~1.YOU")) returned 0x5b9630 [0113.831] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0113.831] GetProcessHeap () returned 0x580000 [0113.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3aa1) returned 0x6f10048 [0113.831] GetProcessHeap () returned 0x580000 [0113.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3aa1) returned 0x6f13af8 [0113.831] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.831] ReadFile (in: hFile=0x45c, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x3a80, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x2c8ff14*=0x3a80, lpOverlapped=0x0) returned 1 [0115.213] GetProcessHeap () returned 0x580000 [0115.213] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.213] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.213] WriteFile (in: hFile=0x45c, lpBuffer=0x6f13af8*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f13af8*, lpNumberOfBytesWritten=0x2c8ff14*=0x3a80, lpOverlapped=0x0) returned 1 [0115.213] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.213] WriteFile (in: hFile=0x45c, lpBuffer=0x6f17577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f17577*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.213] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.213] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.213] CloseHandle (hObject=0x45c) returned 1 [0115.213] GetProcessHeap () returned 0x580000 [0115.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f13af8 | out: hHeap=0x580000) returned 1 [0115.214] GetProcessHeap () returned 0x580000 [0115.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0115.214] GetProcessHeap () returned 0x580000 [0115.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c493460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ab8, dwReserved0=0x2c8fd28, dwReserved1=0x6f10048, cFileName="BS01635_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS0163~1.YOU")) returned 0x5b9630 [0116.333] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0116.370] CloseHandle (hObject=0x470) returned 1 [0116.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0026~1.YOU")) returned 0x5b9630 [0116.371] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0116.371] GetProcessHeap () returned 0x580000 [0116.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf61) returned 0x6d10048 [0116.371] GetProcessHeap () returned 0x580000 [0116.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf61) returned 0x6f19958 [0116.371] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.371] ReadFile (in: hFile=0x470, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x2c8ff14*=0xf40, lpOverlapped=0x0) returned 1 [0116.463] GetProcessHeap () returned 0x580000 [0116.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.463] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.463] WriteFile (in: hFile=0x470, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x2c8ff14*=0xf40, lpOverlapped=0x0) returned 1 [0116.463] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.463] WriteFile (in: hFile=0x470, lpBuffer=0x6f1a897*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a897*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.463] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.463] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.463] CloseHandle (hObject=0x470) returned 1 [0116.463] GetProcessHeap () returned 0x580000 [0116.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0116.463] GetProcessHeap () returned 0x580000 [0116.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0116.463] GetProcessHeap () returned 0x580000 [0116.463] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d07a260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf80, dwReserved0=0x2c8fd28, dwReserved1=0x6d10048, cFileName="SL00268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0026~1.YOU")) returned 0x5b9630 [0116.463] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.934] CloseHandle (hObject=0x49c) returned 1 [0117.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUBBY~1.YOU")) returned 0x5b9630 [0117.936] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.936] GetProcessHeap () returned 0x580000 [0117.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x677cd0 [0117.936] GetProcessHeap () returned 0x580000 [0117.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x6df5db0 [0117.936] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.936] ReadFile (in: hFile=0x49c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x2c8ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0117.994] GetProcessHeap () returned 0x580000 [0117.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0117.994] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.994] WriteFile (in: hFile=0x49c, lpBuffer=0x6df5db0*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df5db0*, lpNumberOfBytesWritten=0x2c8ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0117.994] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.994] WriteFile (in: hFile=0x49c, lpBuffer=0x6df696f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df696f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.994] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.994] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.995] CloseHandle (hObject=0x49c) returned 1 [0117.995] GetProcessHeap () returned 0x580000 [0117.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df5db0 | out: hHeap=0x580000) returned 1 [0117.995] GetProcessHeap () returned 0x580000 [0117.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0117.995] GetProcessHeap () returned 0x580000 [0117.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0117.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7df0e920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbfa, dwReserved0=0x2c8fd28, dwReserved1=0x677cd0, cFileName="STUBBY1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUBBY~1.YOU")) returned 0x5b9630 [0117.995] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0118.748] CloseHandle (hObject=0x488) returned 1 [0118.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~4.YOU")) returned 0x5b9730 [0118.749] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0118.749] GetProcessHeap () returned 0x580000 [0118.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b81) returned 0x6c6a0f8 [0118.749] GetProcessHeap () returned 0x580000 [0118.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b81) returned 0x6c50818 [0118.749] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.749] ReadFile (in: hFile=0x488, lpBuffer=0x6c6a0f8, nNumberOfBytesToRead=0x4b60, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesRead=0x2c8ff14*=0x4b60, lpOverlapped=0x0) returned 1 [0119.357] GetProcessHeap () returned 0x580000 [0119.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0119.358] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.358] WriteFile (in: hFile=0x488, lpBuffer=0x6c50818*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c50818*, lpNumberOfBytesWritten=0x2c8ff14*=0x4b60, lpOverlapped=0x0) returned 1 [0119.358] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.358] WriteFile (in: hFile=0x488, lpBuffer=0x6c55377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55377*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.358] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.358] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.358] CloseHandle (hObject=0x488) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c50818 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0120.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ec26220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4b9e, dwReserved0=0x2c8fd28, dwReserved1=0x6c6a0f8, cFileName="SO02794_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~4.YOU")) returned 0x5b96f0 [0120.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.157] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", len=0x4c | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 1 [0120.157] GetProcessHeap () returned 0x580000 [0120.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1790) returned 0x6d06ca8 [0120.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.165] CloseHandle (hObject=0x470) returned 1 [0121.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.id_1622540890_.your_last_chance")) returned 1 [0121.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03C10~1.YOU")) returned 0x5b9730 [0121.167] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.167] GetProcessHeap () returned 0x580000 [0121.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0121.167] GetProcessHeap () returned 0x580000 [0121.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c676b8 [0121.167] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.167] ReadFile (in: hFile=0x470, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x2c8ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0121.174] GetProcessHeap () returned 0x580000 [0121.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.174] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.174] WriteFile (in: hFile=0x470, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x2c8ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0121.174] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.174] WriteFile (in: hFile=0x470, lpBuffer=0x6c67d57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67d57*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.174] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.174] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.174] CloseHandle (hObject=0x470) returned 1 [0121.174] GetProcessHeap () returned 0x580000 [0121.174] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0121.174] GetProcessHeap () returned 0x580000 [0121.174] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0121.174] GetProcessHeap () returned 0x580000 [0121.174] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fd681a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6d1, dwReserved0=0x2c8fd28, dwReserved1=0x6c79898, cFileName="J0143754.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03C10~1.YOU")) returned 0x5b9730 [0121.912] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.445] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", len=0x4d | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned 1 [0122.445] GetProcessHeap () returned 0x580000 [0122.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1960) returned 0x6f42f08 [0122.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0123.974] CloseHandle (hObject=0x4a4) returned 1 [0123.974] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0123.974] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.id_1622540890_.your_last_chance")) returned 1 [0125.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0125.443] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0125.444] GetProcessHeap () returned 0x580000 [0125.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6f66848 [0125.444] GetProcessHeap () returned 0x580000 [0125.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6c29878 [0125.444] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.444] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f66848, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66848*, lpNumberOfBytesRead=0x2c8ff14*=0xde0, lpOverlapped=0x0) returned 1 [0125.457] GetProcessHeap () returned 0x580000 [0125.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.457] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.457] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2c8ff14*=0xde0, lpOverlapped=0x0) returned 1 [0125.457] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c2a657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a657*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.458] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.458] CloseHandle (hObject=0x4a4) returned 1 [0125.458] GetProcessHeap () returned 0x580000 [0125.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.458] GetProcessHeap () returned 0x580000 [0125.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f66848 | out: hHeap=0x580000) returned 1 [0125.458] GetProcessHeap () returned 0x580000 [0125.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82651bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x2c8fd28, dwReserved1=0x6f66848, cFileName="Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0125.458] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.474] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", len=0x3d | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned 1 [0125.474] GetProcessHeap () returned 0x580000 [0125.474] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f8) returned 0x667250 [0125.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0128.615] CloseHandle (hObject=0x430) returned 1 [0128.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03054~1.YOU")) returned 0x5b9730 [0130.667] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0130.667] GetProcessHeap () returned 0x580000 [0130.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3381) returned 0x6d98c08 [0130.668] GetProcessHeap () returned 0x580000 [0130.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3381) returned 0x6e28f70 [0130.668] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.668] ReadFile (in: hFile=0x430, lpBuffer=0x6d98c08, nNumberOfBytesToRead=0x3360, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98c08*, lpNumberOfBytesRead=0x2c8ff14*=0x3360, lpOverlapped=0x0) returned 1 [0131.710] GetProcessHeap () returned 0x580000 [0131.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0131.710] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.710] WriteFile (in: hFile=0x430, lpBuffer=0x6e28f70*, nNumberOfBytesToWrite=0x3360, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e28f70*, lpNumberOfBytesWritten=0x2c8ff14*=0x3360, lpOverlapped=0x0) returned 1 [0131.711] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.711] WriteFile (in: hFile=0x430, lpBuffer=0x6e2c2cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2c2cf*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.711] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.711] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.711] CloseHandle (hObject=0x430) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e28f70 | out: hHeap=0x580000) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98c08 | out: hHeap=0x580000) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0135.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x861fa320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3396, dwReserved0=0x2c8fd28, dwReserved1=0x6d98c08, cFileName="J0305493.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03054~1.YOU")) returned 0x5b96b0 [0135.440] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.553] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", len=0x4e | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned 1 [0135.553] GetProcessHeap () returned 0x580000 [0135.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0135.554] CloseHandle (hObject=0x4a8) returned 1 [0135.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.id_1622540890_.your_last_chance")) returned 1 [0135.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b96b0 [0135.555] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0135.555] GetProcessHeap () returned 0x580000 [0135.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x6dc0a00 [0135.555] GetProcessHeap () returned 0x580000 [0135.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x6dc4770 [0135.555] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.555] ReadFile (in: hFile=0x4a8, lpBuffer=0x6dc0a00, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesRead=0x2c8ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0136.868] GetProcessHeap () returned 0x580000 [0136.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0136.868] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.868] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dc4770*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc4770*, lpNumberOfBytesWritten=0x2c8ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0138.434] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.434] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dc84af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc84af*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.442] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.442] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.443] CloseHandle (hObject=0x4a8) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc4770 | out: hHeap=0x580000) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0138.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d7b, dwReserved0=0x2c8fd28, dwReserved1=0x6dc0a00, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b96b0 [0138.443] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.455] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", len=0x43 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned 1 [0138.455] GetProcessHeap () returned 0x580000 [0138.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0138.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.001] CloseHandle (hObject=0x3b4) returned 1 [0140.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97933d00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97933d00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCB0F~1.YOU")) returned 0x5b9770 [0140.002] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.002] GetProcessHeap () returned 0x580000 [0140.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6c758b0 [0140.002] GetProcessHeap () returned 0x580000 [0140.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6c75f78 [0140.002] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.002] ReadFile (in: hFile=0x3b4, lpBuffer=0x6c758b0, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c758b0*, lpNumberOfBytesRead=0x2c8ff14*=0x660, lpOverlapped=0x0) returned 1 [0140.009] GetProcessHeap () returned 0x580000 [0140.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.009] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.009] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c75f78*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75f78*, lpNumberOfBytesWritten=0x2c8ff14*=0x660, lpOverlapped=0x0) returned 1 [0140.010] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.010] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c765d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c765d7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.010] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.010] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.010] CloseHandle (hObject=0x3b4) returned 1 [0140.010] GetProcessHeap () returned 0x580000 [0140.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75f78 | out: hHeap=0x580000) returned 1 [0140.010] GetProcessHeap () returned 0x580000 [0140.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c758b0 | out: hHeap=0x580000) returned 1 [0140.010] GetProcessHeap () returned 0x580000 [0140.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97933d00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b0f9d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x688, dwReserved0=0x2c8fd28, dwReserved1=0x6c758b0, cFileName="BD21320_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCB0F~1.YOU")) returned 0x5b9770 [0140.407] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.443] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", len=0x58 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned 1 [0140.443] GetProcessHeap () returned 0x580000 [0140.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.443] CloseHandle (hObject=0x3a8) returned 1 [0140.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0140.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0140.444] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.445] GetProcessHeap () returned 0x580000 [0140.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0140.445] GetProcessHeap () returned 0x580000 [0140.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6c29878 [0140.445] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.445] ReadFile (in: hFile=0x3a8, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2c8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0140.464] GetProcessHeap () returned 0x580000 [0140.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.464] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.464] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2c8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0140.464] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.464] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c2a517*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a517*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.464] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.464] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.464] CloseHandle (hObject=0x3a8) returned 1 [0140.464] GetProcessHeap () returned 0x580000 [0140.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.464] GetProcessHeap () returned 0x580000 [0140.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0140.464] GetProcessHeap () returned 0x580000 [0140.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b570680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xce1, dwReserved0=0x2c8fd28, dwReserved1=0x635768, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9730 [0140.684] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.013] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT", len=0x40 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 1 [0141.013] GetProcessHeap () returned 0x580000 [0141.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd8) returned 0x6f14048 [0141.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.114] CloseHandle (hObject=0x4a4) returned 1 [0144.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0144.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~3.YOU")) returned 0x5b96f0 [0144.115] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.115] GetProcessHeap () returned 0x580000 [0144.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0144.115] GetProcessHeap () returned 0x580000 [0144.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0144.115] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x4a4, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x2c8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.117] GetProcessHeap () returned 0x580000 [0144.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.117] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.117] WriteFile (in: hFile=0x4a4, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x2c8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.117] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.117] WriteFile (in: hFile=0x4a4, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.117] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.117] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.117] CloseHandle (hObject=0x4a4) returned 1 [0144.117] GetProcessHeap () returned 0x580000 [0144.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0144.117] GetProcessHeap () returned 0x580000 [0144.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0144.117] GetProcessHeap () returned 0x580000 [0144.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d840840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x2c8fd28, dwReserved1=0x5ad8a0, cFileName="INFOPATH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~3.YOU")) returned 0x5b96f0 [0146.863] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.877] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", len=0x44 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned 1 [0146.877] GetProcessHeap () returned 0x580000 [0146.877] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.411] CloseHandle (hObject=0x4a4) returned 1 [0152.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd51e200, ftCreationTime.dwHighDateTime=0x1bdb5da, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd51e200, ftLastWriteTime.dwHighDateTime=0x1bdb5da, nFileSizeHigh=0x0, nFileSizeLow=0x3187, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR25~1.YOU")) returned 0x5b9730 [0152.412] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.412] GetProcessHeap () returned 0x580000 [0152.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31a1) returned 0x6d991c8 [0152.412] GetProcessHeap () returned 0x580000 [0152.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31a1) returned 0x6f62ab8 [0152.412] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.412] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d991c8, nNumberOfBytesToRead=0x3180, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d991c8*, lpNumberOfBytesRead=0x2c8ff14*=0x3180, lpOverlapped=0x0) returned 1 [0152.458] GetProcessHeap () returned 0x580000 [0152.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.458] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f62ab8*, nNumberOfBytesToWrite=0x3180, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62ab8*, lpNumberOfBytesWritten=0x2c8ff14*=0x3180, lpOverlapped=0x0) returned 1 [0152.459] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.459] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f65c37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f65c37*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.459] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.459] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.459] CloseHandle (hObject=0x4a4) returned 1 [0152.459] GetProcessHeap () returned 0x580000 [0152.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f62ab8 | out: hHeap=0x580000) returned 1 [0152.459] GetProcessHeap () returned 0x580000 [0152.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d991c8 | out: hHeap=0x580000) returned 1 [0152.459] GetProcessHeap () returned 0x580000 [0152.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd51e200, ftCreationTime.dwHighDateTime=0x1bdb5da, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x927b2680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x31ab, dwReserved0=0x2c8fd28, dwReserved1=0x6d991c8, cFileName="PDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR25~1.YOU")) returned 0x5b9630 [0153.664] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0155.689] CloseHandle (hObject=0x430) returned 1 [0155.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.id_1622540890_.your_last_chance")) returned 1 [0155.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x3283, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLATE_~2.YOU")) returned 0x5b9730 [0155.690] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_complete.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0155.691] GetProcessHeap () returned 0x580000 [0155.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32a1) returned 0x6d21878 [0155.691] GetProcessHeap () returned 0x580000 [0155.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32a1) returned 0x702b718 [0155.691] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.691] ReadFile (in: hFile=0x430, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x3280, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x2c8ff14*=0x3280, lpOverlapped=0x0) returned 1 [0156.662] GetProcessHeap () returned 0x580000 [0156.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0156.662] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.662] WriteFile (in: hFile=0x430, lpBuffer=0x702b718*, nNumberOfBytesToWrite=0x3280, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x702b718*, lpNumberOfBytesWritten=0x2c8ff14*=0x3280, lpOverlapped=0x0) returned 1 [0156.662] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.662] WriteFile (in: hFile=0x430, lpBuffer=0x702e997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x702e997*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0156.662] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.662] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0156.662] CloseHandle (hObject=0x430) returned 1 [0156.662] GetProcessHeap () returned 0x580000 [0156.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702b718 | out: hHeap=0x580000) returned 1 [0156.662] GetProcessHeap () returned 0x580000 [0156.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0156.663] GetProcessHeap () returned 0x580000 [0156.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0156.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94fdd9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32a7, dwReserved0=0x2c8fd28, dwReserved1=0x6d21878, cFileName="Xlate_Complete.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLATE_~2.YOU")) returned 0x5b9630 [0156.663] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0157.452] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", len=0x3e | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 1 [0157.452] GetProcessHeap () returned 0x580000 [0157.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0157.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0158.375] CloseHandle (hObject=0x44c) returned 1 [0158.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS5FE9~1.YOU")) returned 0x5b9630 [0158.594] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0158.594] GetProcessHeap () returned 0x580000 [0158.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2461) returned 0x6e668d0 [0158.595] GetProcessHeap () returned 0x580000 [0158.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2461) returned 0x6de7e40 [0158.595] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.595] ReadFile (in: hFile=0x44c, lpBuffer=0x6e668d0, nNumberOfBytesToRead=0x2440, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e668d0*, lpNumberOfBytesRead=0x2c8ff14*=0x2440, lpOverlapped=0x0) returned 1 [0160.052] GetProcessHeap () returned 0x580000 [0160.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0160.052] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.053] WriteFile (in: hFile=0x44c, lpBuffer=0x6de7e40*, nNumberOfBytesToWrite=0x2440, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de7e40*, lpNumberOfBytesWritten=0x2c8ff14*=0x2440, lpOverlapped=0x0) returned 1 [0160.053] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.053] WriteFile (in: hFile=0x44c, lpBuffer=0x6dea27f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea27f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0160.053] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.053] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0160.053] CloseHandle (hObject=0x44c) returned 1 [0160.883] GetProcessHeap () returned 0x580000 [0160.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de7e40 | out: hHeap=0x580000) returned 1 [0160.883] GetProcessHeap () returned 0x580000 [0160.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e668d0 | out: hHeap=0x580000) returned 1 [0160.884] GetProcessHeap () returned 0x580000 [0160.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0164.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97026420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2470, dwReserved0=0x2c8fd28, dwReserved1=0x6e668d0, cFileName="MSART10.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS5FE9~1.YOU")) returned 0x5b9730 [0164.568] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.508] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", len=0x41 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 1 [0166.508] GetProcessHeap () returned 0x580000 [0166.508] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2250) returned 0x6f14048 [0166.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0169.206] CloseHandle (hObject=0x430) returned 1 [0169.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.219] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id_1622540890_.your_last_chance")) returned 1 [0169.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~3.YOU")) returned 0x5b96b0 [0169.220] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.220] GetProcessHeap () returned 0x580000 [0169.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0169.220] GetProcessHeap () returned 0x580000 [0169.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0169.220] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.220] ReadFile (in: hFile=0x450, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x2c8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.232] GetProcessHeap () returned 0x580000 [0169.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.232] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.232] WriteFile (in: hFile=0x450, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x2c8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.232] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.233] WriteFile (in: hFile=0x450, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.233] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.233] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.233] CloseHandle (hObject=0x450) returned 1 [0169.233] GetProcessHeap () returned 0x580000 [0169.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0169.233] GetProcessHeap () returned 0x580000 [0169.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0169.233] GetProcessHeap () returned 0x580000 [0169.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7c6e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x2c8fd28, dwReserved1=0x65f268, cFileName="EXITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~3.YOU")) returned 0x5b9770 [0172.813] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.861] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", len=0x40 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 1 [0172.861] GetProcessHeap () returned 0x580000 [0172.861] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2264) returned 0x6f14048 [0172.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0172.931] CloseHandle (hObject=0x4a4) returned 1 [0172.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURE~1.YOU")) returned 0x5b9770 [0172.937] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0172.937] GetProcessHeap () returned 0x580000 [0172.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0172.937] GetProcessHeap () returned 0x580000 [0172.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0172.938] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.938] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x2c8ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.941] GetProcessHeap () returned 0x580000 [0172.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.941] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x2c8ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.941] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.941] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.941] CloseHandle (hObject=0x4a4) returned 1 [0172.942] GetProcessHeap () returned 0x580000 [0172.942] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0172.942] GetProcessHeap () returned 0x580000 [0172.942] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0172.942] GetProcessHeap () returned 0x580000 [0172.942] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb093e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x2c8fd28, dwReserved1=0x6c4a820, cFileName="SECURE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURE~1.YOU")) returned 0x5b9770 [0173.244] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.254] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", len=0x3e | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 1 [0173.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0173.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.300] CloseHandle (hObject=0x43c) returned 1 [0173.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECLIC~1.YOU")) returned 0x5b9770 [0173.304] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0173.305] GetProcessHeap () returned 0x580000 [0173.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0173.305] GetProcessHeap () returned 0x580000 [0173.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0173.305] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.305] ReadFile (in: hFile=0x48c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x2c8ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.357] GetProcessHeap () returned 0x580000 [0173.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.357] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.357] WriteFile (in: hFile=0x48c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x2c8ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.357] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.357] WriteFile (in: hFile=0x48c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.358] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.358] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.358] CloseHandle (hObject=0x48c) returned 1 [0173.358] GetProcessHeap () returned 0x580000 [0173.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0173.358] GetProcessHeap () returned 0x580000 [0173.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0173.358] GetProcessHeap () returned 0x580000 [0173.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef0d900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2c8fd28, dwReserved1=0x5cf780, cFileName="RECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECLIC~1.YOU")) returned 0x5b9770 [0173.358] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.390] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", len=0x3e | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 1 [0173.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0173.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0174.829] CloseHandle (hObject=0x48c) returned 1 [0174.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id_1622540890_.your_last_chance")) returned 1 [0174.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTECF~1.YOU")) returned 0x5b96f0 [0174.831] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0174.831] GetProcessHeap () returned 0x580000 [0174.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0174.831] GetProcessHeap () returned 0x580000 [0174.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0174.831] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.831] ReadFile (in: hFile=0x48c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x2c8ff14*=0x300, lpOverlapped=0x0) returned 1 [0174.835] GetProcessHeap () returned 0x580000 [0174.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.835] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.835] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x2c8ff14*=0x300, lpOverlapped=0x0) returned 1 [0174.836] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.836] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.836] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.836] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.836] CloseHandle (hObject=0x48c) returned 1 [0174.836] GetProcessHeap () returned 0x580000 [0174.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0174.836] GetProcessHeap () returned 0x580000 [0174.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0174.836] GetProcessHeap () returned 0x580000 [0174.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd2fba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x2c8fd28, dwReserved1=0x6df6780, cFileName="NOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTECF~1.YOU")) returned 0x5b96f0 [0176.808] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.845] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", len=0x3b | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 1 [0176.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0176.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.533] CloseHandle (hObject=0x41c) returned 1 [0179.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id_1622540890_.your_last_chance")) returned 1 [0179.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x61204, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SE718F~1.YOU")) returned 0x5b96f0 [0179.534] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.534] GetProcessHeap () returned 0x580000 [0179.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0179.534] GetProcessHeap () returned 0x580000 [0179.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0179.535] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.535] ReadFile (in: hFile=0x41c, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0182.295] GetProcessHeap () returned 0x580000 [0182.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0182.295] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.295] WriteFile (in: hFile=0x41c, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0182.296] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.296] WriteFile (in: hFile=0x41c, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.790] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.791] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.791] CloseHandle (hObject=0x41c) returned 1 [0182.791] GetProcessHeap () returned 0x580000 [0182.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0182.797] GetProcessHeap () returned 0x580000 [0182.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0182.798] GetProcessHeap () returned 0x580000 [0182.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa490f8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x61228, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="SETLANG.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SE718F~1.YOU")) returned 0x5b9770 [0183.804] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.818] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", len=0x6f | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned 1 [0183.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0183.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0186.639] CloseHandle (hObject=0x45c) returned 1 [0186.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.639] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x2e0058, dwReserved1=0x50004a, cFileName="COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMBOB~1.YOU")) returned 0x5b96b0 [0186.640] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0186.640] GetProcessHeap () returned 0x580000 [0186.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x43c1) returned 0x6ffee18 [0186.641] GetProcessHeap () returned 0x580000 [0186.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x43c1) returned 0x70031e8 [0186.641] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.641] ReadFile (in: hFile=0x45c, lpBuffer=0x6ffee18, nNumberOfBytesToRead=0x43a0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffee18*, lpNumberOfBytesRead=0x2c8ff14*=0x43a0, lpOverlapped=0x0) returned 1 [0187.701] GetProcessHeap () returned 0x580000 [0187.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0df38 [0187.701] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.701] WriteFile (in: hFile=0x45c, lpBuffer=0x70031e8*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70031e8*, lpNumberOfBytesWritten=0x2c8ff14*=0x43a0, lpOverlapped=0x0) returned 1 [0187.701] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.702] WriteFile (in: hFile=0x45c, lpBuffer=0x7007587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007587*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.702] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.702] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.702] CloseHandle (hObject=0x45c) returned 1 [0188.277] GetProcessHeap () returned 0x580000 [0188.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70031e8 | out: hHeap=0x580000) returned 1 [0188.277] GetProcessHeap () returned 0x580000 [0188.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ffee18 | out: hHeap=0x580000) returned 1 [0188.277] GetProcessHeap () returned 0x580000 [0188.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0df38 | out: hHeap=0x580000) returned 1 [0191.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa77eca00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0x2c8fd28, dwReserved1=0x6ffee18, cFileName="COMBOBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMBOB~1.YOU")) returned 0x5b9770 [0191.191] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.276] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", len=0x45 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned 1 [0191.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0191.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0191.277] CloseHandle (hObject=0x268) returned 1 [0191.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x875e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1205~1.YOU")) returned 0x5b9770 [0191.278] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0191.278] GetProcessHeap () returned 0x580000 [0191.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8761) returned 0x6fa5ca8 [0191.278] GetProcessHeap () returned 0x580000 [0191.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8761) returned 0x715c008 [0191.278] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.278] ReadFile (in: hFile=0x268, lpBuffer=0x6fa5ca8, nNumberOfBytesToRead=0x8740, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5ca8*, lpNumberOfBytesRead=0x2c8ff14*=0x8740, lpOverlapped=0x0) returned 1 [0194.340] GetProcessHeap () returned 0x580000 [0194.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0194.340] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.340] WriteFile (in: hFile=0x268, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x8740, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x2c8ff14*=0x8740, lpOverlapped=0x0) returned 1 [0194.340] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.340] WriteFile (in: hFile=0x268, lpBuffer=0x7164747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7164747*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.341] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.341] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.341] CloseHandle (hObject=0x268) returned 1 [0194.341] GetProcessHeap () returned 0x580000 [0194.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0194.341] GetProcessHeap () returned 0x580000 [0194.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa5ca8 | out: hHeap=0x580000) returned 1 [0194.341] GetProcessHeap () returned 0x580000 [0194.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0194.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab727260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8782, dwReserved0=0x2c8fd28, dwReserved1=0x6fa5ca8, cFileName="ZPDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1205~1.YOU")) returned 0x5b97b0 [0194.341] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.620] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", len=0x77 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned 1 [0196.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0196.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.621] CloseHandle (hObject=0x4ac) returned 1 [0196.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5c0065, dwReserved1=0x610074, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.622] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.622] GetProcessHeap () returned 0x580000 [0196.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.622] GetProcessHeap () returned 0x580000 [0196.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.622] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.622] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x2c8ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.624] GetProcessHeap () returned 0x580000 [0196.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.624] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.624] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x2c8ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.624] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.624] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.624] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.625] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.625] CloseHandle (hObject=0x4ac) returned 1 [0196.625] GetProcessHeap () returned 0x580000 [0196.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.625] GetProcessHeap () returned 0x580000 [0196.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.625] GetProcessHeap () returned 0x580000 [0196.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd05c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x2c8fd28, dwReserved1=0x6dec6f8, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.625] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.662] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x73 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0196.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0196.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.662] CloseHandle (hObject=0x4ac) returned 1 [0196.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0196.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.786] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.786] GetProcessHeap () returned 0x580000 [0196.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0196.787] GetProcessHeap () returned 0x580000 [0196.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0196.787] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.787] ReadFile (in: hFile=0x4ac, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x2c8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.788] GetProcessHeap () returned 0x580000 [0196.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0196.788] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x4ac, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x2c8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.788] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x4ac, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.788] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.789] CloseHandle (hObject=0x4ac) returned 1 [0196.789] GetProcessHeap () returned 0x580000 [0196.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0196.789] GetProcessHeap () returned 0x580000 [0196.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0196.789] GetProcessHeap () returned 0x580000 [0196.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0196.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xace82a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x2c8fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.789] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.794] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", len=0x44 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned 1 [0196.795] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fdc) returned 0x6f14048 [0196.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.807] CloseHandle (hObject=0x450) returned 1 [0197.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP7914~1.YOU")) returned 0x5b9830 [0197.808] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0197.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.808] GetProcessHeap () returned 0x580000 [0197.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b81) returned 0x6dee6e0 [0197.809] GetProcessHeap () returned 0x580000 [0197.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b81) returned 0x6cba390 [0197.809] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.809] ReadFile (in: hFile=0x450, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1b60, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x2c8ff14*=0x1b60, lpOverlapped=0x0) returned 1 [0197.834] GetProcessHeap () returned 0x580000 [0197.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0197.834] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.834] WriteFile (in: hFile=0x450, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x2c8ff14*=0x1b60, lpOverlapped=0x0) returned 1 [0197.834] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.834] WriteFile (in: hFile=0x450, lpBuffer=0x6cbbeef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbbeef*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.834] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.834] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.834] CloseHandle (hObject=0x450) returned 1 [0197.834] GetProcessHeap () returned 0x580000 [0197.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0197.834] GetProcessHeap () returned 0x580000 [0197.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0197.834] GetProcessHeap () returned 0x580000 [0197.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad87a660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b99, dwReserved0=0x2c8fd28, dwReserved1=0x6dee6e0, cFileName="ZPDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP7914~1.YOU")) returned 0x5b96b0 [0199.652] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.959] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", len=0x5f | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned 1 [0200.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd0) returned 0x6f14048 [0200.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.781] CloseHandle (hObject=0x488) returned 1 [0201.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.id_1622540890_.your_last_chance")) returned 1 [0201.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x23ed, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b97b0 [0201.782] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.782] GetProcessHeap () returned 0x580000 [0201.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x6d06ca8 [0201.783] GetProcessHeap () returned 0x580000 [0201.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x6d090b8 [0201.783] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.783] ReadFile (in: hFile=0x488, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x23e0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x2c8ff14*=0x23e0, lpOverlapped=0x0) returned 1 [0201.815] GetProcessHeap () returned 0x580000 [0201.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.815] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.815] WriteFile (in: hFile=0x488, lpBuffer=0x6d090b8*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d090b8*, lpNumberOfBytesWritten=0x2c8ff14*=0x23e0, lpOverlapped=0x0) returned 1 [0201.815] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.815] WriteFile (in: hFile=0x488, lpBuffer=0x6d0b497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0b497*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.816] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.816] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.816] CloseHandle (hObject=0x488) returned 1 [0201.816] GetProcessHeap () returned 0x580000 [0201.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d090b8 | out: hHeap=0x580000) returned 1 [0201.816] GetProcessHeap () returned 0x580000 [0201.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0201.816] GetProcessHeap () returned 0x580000 [0201.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafe6a500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2411, dwReserved0=0x2c8fd28, dwReserved1=0x6d06ca8, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b9770 [0202.701] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.769] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS", len=0x45 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS") returned 1 [0202.769] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0202.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0203.009] CloseHandle (hObject=0x4a4) returned 1 [0203.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css.id_1622540890_.your_last_chance")) returned 1 [0203.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7D55~1.YOU")) returned 0x5b9770 [0203.010] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0203.011] GetProcessHeap () returned 0x580000 [0203.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c51a8 [0203.011] GetProcessHeap () returned 0x580000 [0203.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d69d8 [0203.012] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.012] ReadFile (in: hFile=0x4a4, lpBuffer=0x72c51a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c51a8*, lpNumberOfBytesRead=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.954] GetProcessHeap () returned 0x580000 [0209.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0209.955] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.955] WriteFile (in: hFile=0x4a4, lpBuffer=0x72d69d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d69d8*, lpNumberOfBytesWritten=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.955] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.955] WriteFile (in: hFile=0x4a4, lpBuffer=0x72e81d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e81d7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.955] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.955] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.955] CloseHandle (hObject=0x4a4) returned 1 [0209.956] GetProcessHeap () returned 0x580000 [0209.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d69d8 | out: hHeap=0x580000) returned 1 [0209.956] GetProcessHeap () returned 0x580000 [0209.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c51a8 | out: hHeap=0x580000) returned 1 [0209.957] GetProcessHeap () returned 0x580000 [0209.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c132c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d1da, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="SCHEME26.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7D55~1.YOU")) returned 0x5b97b0 [0210.679] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.560] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", len=0x68 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned 1 [0214.560] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0214.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0214.569] CloseHandle (hObject=0x464) returned 1 [0214.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.id_1622540890_.your_last_chance")) returned 1 [0214.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b97f0 [0214.571] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0214.571] GetProcessHeap () returned 0x580000 [0214.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x6ece008 [0214.571] GetProcessHeap () returned 0x580000 [0214.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x6f19958 [0214.571] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.571] ReadFile (in: hFile=0x464, lpBuffer=0x6ece008, nNumberOfBytesToRead=0xfa0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesRead=0x2c8ff14*=0xfa0, lpOverlapped=0x0) returned 1 [0214.586] GetProcessHeap () returned 0x580000 [0214.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.586] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.586] WriteFile (in: hFile=0x464, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x2c8ff14*=0xfa0, lpOverlapped=0x0) returned 1 [0214.587] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.587] WriteFile (in: hFile=0x464, lpBuffer=0x6f1a8f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a8f7*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.587] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.587] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.587] CloseHandle (hObject=0x464) returned 1 [0214.587] GetProcessHeap () returned 0x580000 [0214.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0214.587] GetProcessHeap () returned 0x580000 [0214.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0214.587] GetProcessHeap () returned 0x580000 [0214.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0216.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7842b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfd4, dwReserved0=0x2c8fd28, dwReserved1=0x6ece008, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b97b0 [0217.153] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.168] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", len=0x66 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned 1 [0217.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0217.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.169] CloseHandle (hObject=0x4a4) returned 1 [0217.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.id_1622540890_.your_last_chance")) returned 1 [0217.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadd, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b97b0 [0217.170] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.170] GetProcessHeap () returned 0x580000 [0217.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x677cd0 [0217.170] GetProcessHeap () returned 0x580000 [0217.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x6e0d050 [0217.170] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.170] ReadFile (in: hFile=0x4a4, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xac0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x2c8ff14*=0xac0, lpOverlapped=0x0) returned 1 [0217.181] GetProcessHeap () returned 0x580000 [0217.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.181] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.181] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e0d050*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0d050*, lpNumberOfBytesWritten=0x2c8ff14*=0xac0, lpOverlapped=0x0) returned 1 [0217.181] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.181] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e0db0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0db0f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.181] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.181] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.182] CloseHandle (hObject=0x4a4) returned 1 [0217.182] GetProcessHeap () returned 0x580000 [0217.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0d050 | out: hHeap=0x580000) returned 1 [0217.182] GetProcessHeap () returned 0x580000 [0217.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0217.182] GetProcessHeap () returned 0x580000 [0217.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90f4f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb01, dwReserved0=0x2c8fd28, dwReserved1=0x677cd0, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b9770 [0221.057] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.075] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", len=0x65 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned 1 [0221.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0221.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.076] CloseHandle (hObject=0x3e4) returned 1 [0221.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.id_1622540890_.your_last_chance")) returned 1 [0221.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9770 [0221.077] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.077] GetProcessHeap () returned 0x580000 [0221.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6599e8 [0221.077] GetProcessHeap () returned 0x580000 [0221.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x659d90 [0221.077] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.077] ReadFile (in: hFile=0x3e4, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x2c8ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.182] GetProcessHeap () returned 0x580000 [0221.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.183] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.183] WriteFile (in: hFile=0x3e4, lpBuffer=0x659d90*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x659d90*, lpNumberOfBytesWritten=0x2c8ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.183] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.183] WriteFile (in: hFile=0x3e4, lpBuffer=0x65a0ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a0ef*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.183] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.183] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.183] CloseHandle (hObject=0x3e4) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659d90 | out: hHeap=0x580000) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0223.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7310c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x2c8fd28, dwReserved1=0x6599e8, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b96f0 [0223.311] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.423] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned 1 [0223.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0223.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0223.428] CloseHandle (hObject=0x414) returned 1 [0223.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.id_1622540890_.your_last_chance")) returned 1 [0223.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b96f0 [0223.429] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0223.429] GetProcessHeap () returned 0x580000 [0223.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a110 [0223.429] GetProcessHeap () returned 0x580000 [0223.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a558 [0223.429] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.429] ReadFile (in: hFile=0x414, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x2c8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0223.451] GetProcessHeap () returned 0x580000 [0223.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.451] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.451] WriteFile (in: hFile=0x414, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x2c8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0223.451] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.451] WriteFile (in: hFile=0x414, lpBuffer=0x6c6a937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a937*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.451] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.451] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.451] CloseHandle (hObject=0x414) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccc3820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x2c8fd28, dwReserved1=0x6c6a110, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9630 [0226.000] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.017] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC", len=0x46 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 1 [0226.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc4) returned 0x6dee6e0 [0226.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.049] CloseHandle (hObject=0x488) returned 1 [0226.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0226.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INE65F~1.YOU")) returned 0x5b9630 [0226.051] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.051] GetProcessHeap () returned 0x580000 [0226.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4e820 [0226.051] GetProcessHeap () returned 0x580000 [0226.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4eae8 [0226.051] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.051] ReadFile (in: hFile=0x488, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x2c8ff14*=0x280, lpOverlapped=0x0) returned 1 [0226.093] GetProcessHeap () returned 0x580000 [0226.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.093] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.093] WriteFile (in: hFile=0x488, lpBuffer=0x6c4eae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4eae8*, lpNumberOfBytesWritten=0x2c8ff14*=0x280, lpOverlapped=0x0) returned 1 [0226.094] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.094] WriteFile (in: hFile=0x488, lpBuffer=0x6c4ed67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ed67*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.094] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.094] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.094] CloseHandle (hObject=0x488) returned 1 [0226.094] GetProcessHeap () returned 0x580000 [0226.094] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4eae8 | out: hHeap=0x580000) returned 1 [0226.094] GetProcessHeap () returned 0x580000 [0226.094] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0226.094] GetProcessHeap () returned 0x580000 [0226.094] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe491420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2be, dwReserved0=0x2c8fd28, dwReserved1=0x6c4e820, cFileName="INFOPATHEDITOR_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INE65F~1.YOU")) returned 0x5b9630 [0226.110] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.160] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK", len=0x40 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 1 [0226.160] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0226.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.161] CloseHandle (hObject=0x454) returned 1 [0226.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0226.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~3.YOU")) returned 0x5b9630 [0226.163] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.163] GetProcessHeap () returned 0x580000 [0226.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0226.163] GetProcessHeap () returned 0x580000 [0226.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0226.163] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.163] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x2c8ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.164] GetProcessHeap () returned 0x580000 [0226.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.164] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.164] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x2c8ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.164] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.164] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.164] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.165] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.165] CloseHandle (hObject=0x454) returned 1 [0226.165] GetProcessHeap () returned 0x580000 [0226.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0226.165] GetProcessHeap () returned 0x580000 [0226.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0226.165] GetProcessHeap () returned 0x580000 [0226.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe5299a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x2c8fd28, dwReserved1=0x61b540, cFileName="GROOVE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~3.YOU")) returned 0x5b9630 [0226.165] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.188] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", len=0x3e | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 1 [0226.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da0) returned 0x6dee6e0 [0226.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.188] CloseHandle (hObject=0x464) returned 1 [0226.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0226.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRA0F2~1.YOU")) returned 0x5b9730 [0226.190] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.190] GetProcessHeap () returned 0x580000 [0226.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0226.190] GetProcessHeap () returned 0x580000 [0226.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0226.190] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.190] ReadFile (in: hFile=0x464, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x2c8ff14*=0x260, lpOverlapped=0x0) returned 1 [0226.266] GetProcessHeap () returned 0x580000 [0226.266] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.266] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.266] WriteFile (in: hFile=0x464, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x2c8ff14*=0x260, lpOverlapped=0x0) returned 1 [0226.266] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.266] WriteFile (in: hFile=0x464, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.266] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.266] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.266] CloseHandle (hObject=0x464) returned 1 [0226.266] GetProcessHeap () returned 0x580000 [0226.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0226.266] GetProcessHeap () returned 0x580000 [0226.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0226.266] GetProcessHeap () returned 0x580000 [0226.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe634340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x2c8fd28, dwReserved1=0x6c61120, cFileName="GROOVE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRA0F2~1.YOU")) returned 0x5b9630 [0226.267] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.311] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", len=0x47 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned 1 [0226.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0226.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0226.312] CloseHandle (hObject=0x3b8) returned 1 [0226.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam.id_1622540890_.your_last_chance")) returned 1 [0226.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROCDB~1.YOU")) returned 0x5b9630 [0226.438] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0226.438] GetProcessHeap () returned 0x580000 [0226.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf41) returned 0x70b3528 [0226.439] GetProcessHeap () returned 0x580000 [0226.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf41) returned 0x7061928 [0226.439] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.439] ReadFile (in: hFile=0x3b8, lpBuffer=0x70b3528, nNumberOfBytesToRead=0xcf20, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesRead=0x2c8ff14*=0xcf20, lpOverlapped=0x0) returned 1 [0233.624] GetProcessHeap () returned 0x580000 [0233.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0233.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x7061928*, nNumberOfBytesToWrite=0xcf20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesWritten=0x2c8ff14*=0xcf20, lpOverlapped=0x0) returned 1 [0233.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x706e847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x706e847*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.626] CloseHandle (hObject=0x3b8) returned 1 [0233.626] GetProcessHeap () returned 0x580000 [0233.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0233.626] GetProcessHeap () returned 0x580000 [0233.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0233.626] GetProcessHeap () returned 0x580000 [0233.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0233.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc2c46ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcf4f, dwReserved0=0x2c8fd28, dwReserved1=0x70b3528, cFileName="PROCDB.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROCDB~1.YOU")) returned 0x5b9630 [0233.626] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0235.418] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", len=0x4c | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned 1 [0235.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0235.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0239.478] CloseHandle (hObject=0x4ac) returned 1 [0239.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.id_1622540890_.your_last_chance")) returned 1 [0239.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI3E2B~1.YOU")) returned 0x5b96f0 [0239.480] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0239.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0239.480] GetProcessHeap () returned 0x580000 [0239.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0239.480] GetProcessHeap () returned 0x580000 [0239.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0239.481] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.481] ReadFile (in: hFile=0x4ac, lpBuffer=0x7007128, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesRead=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.209] GetProcessHeap () returned 0x580000 [0242.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0242.209] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.209] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x2c8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.209] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.210] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0242.210] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.210] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0242.210] CloseHandle (hObject=0x4ac) returned 1 [0242.210] GetProcessHeap () returned 0x580000 [0242.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0242.210] GetProcessHeap () returned 0x580000 [0242.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0242.210] GetProcessHeap () returned 0x580000 [0242.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0242.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7e40080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3375b, dwReserved0=0x2c8fd28, dwReserved1=0x7007128, cFileName="Microsoft.Office.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI3E2B~1.YOU")) returned 0x5b9630 [0242.211] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.910] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML", len=0x40 | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned 1 [0242.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0242.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0245.392] CloseHandle (hObject=0x4a8) returned 1 [0245.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml.id_1622540890_.your_last_chance")) returned 1 [0248.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x206de900, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~4.YOU")) returned 0x5b96f0 [0248.790] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0248.790] GetProcessHeap () returned 0x580000 [0248.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb3e1) returned 0x6e21520 [0248.790] GetProcessHeap () returned 0x580000 [0248.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb3e1) returned 0x6e2c910 [0248.790] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.790] ReadFile (in: hFile=0x4a8, lpBuffer=0x6e21520, nNumberOfBytesToRead=0xb3c0, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x2c8ff14*=0xb3c0, lpOverlapped=0x0) returned 1 [0251.427] GetProcessHeap () returned 0x580000 [0251.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0251.427] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.427] WriteFile (in: hFile=0x4a8, lpBuffer=0x6e2c910*, nNumberOfBytesToWrite=0xb3c0, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2c910*, lpNumberOfBytesWritten=0x2c8ff14*=0xb3c0, lpOverlapped=0x0) returned 1 [0251.427] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.427] WriteFile (in: hFile=0x4a8, lpBuffer=0x6e37ccf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e37ccf*, lpNumberOfBytesWritten=0x2c8ff14*=0x20, lpOverlapped=0x0) returned 1 [0251.427] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.428] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2c8ff14*=0x4, lpOverlapped=0x0) returned 1 [0251.428] CloseHandle (hObject=0x4a8) returned 1 [0251.428] GetProcessHeap () returned 0x580000 [0251.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e2c910 | out: hHeap=0x580000) returned 1 [0251.428] GetProcessHeap () returned 0x580000 [0251.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0251.428] GetProcessHeap () returned 0x580000 [0251.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fccc | out: lpFindFileData=0x2c8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd62cd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb3fe, dwReserved0=0x2c8fd28, dwReserved1=0x6e21520, cFileName="PGLBL093.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~4.YOU")) returned 0x5b9730 [0254.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.357] SysReAllocStringLen (in: pbstr=0x2c8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV", len=0x3b | out: pbstr=0x2c8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 1 [0255.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f88) returned 0x72e5948 [0255.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0260.594] CloseHandle (hObject=0x4b0) returned 1 [0260.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.id_1622540890_.your_last_chance")) returned 1 [0260.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2c8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2c8fc74 | out: lpFindFileData=0x2c8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0dd700, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0dd700, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xe50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGTOCD~1.YOU")) returned 0x5b9630 [0260.595] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0260.595] GetProcessHeap () returned 0x580000 [0260.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe521) returned 0x74bfbe8 [0260.596] GetProcessHeap () returned 0x580000 [0260.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe521) returned 0x74ce118 [0260.596] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.596] ReadFile (in: hFile=0x4b0, lpBuffer=0x74bfbe8, nNumberOfBytesToRead=0xe500, lpNumberOfBytesRead=0x2c8ff14, lpOverlapped=0x0 | out: lpBuffer=0x74bfbe8*, lpNumberOfBytesRead=0x2c8ff14*=0xe500, lpOverlapped=0x0) returned 1 Thread: id = 12 os_tid = 0xa28 [0039.060] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.108] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.111] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.143] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.696] Sleep (dwMilliseconds=0x1) [0043.712] Sleep (dwMilliseconds=0x1) [0043.727] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.676] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", len=0x4a | out: pbstr=0x2d8ff84*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 1 [0059.676] GetProcessHeap () returned 0x580000 [0059.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x40) returned 0x61aa50 [0059.676] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0062.370] CloseHandle (hObject=0x41c) returned 1 [0062.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0062.370] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id_1622540890_.your_last_chance")) returned 1 [0068.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.360] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONOTEL~1.YOU")) returned 0x5b96b0 [0068.360] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0068.361] GetProcessHeap () returned 0x580000 [0068.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x624d18 [0068.361] GetProcessHeap () returned 0x580000 [0068.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ef2380 [0068.361] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.362] ReadFile (in: hFile=0x41c, lpBuffer=0x624d18, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x624d18*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.255] GetProcessHeap () returned 0x580000 [0073.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0073.256] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.256] WriteFile (in: hFile=0x41c, lpBuffer=0x6ef2380*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2380*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.919] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.919] WriteFile (in: hFile=0x41c, lpBuffer=0x6f03b7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03b7f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.361] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.361] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.361] CloseHandle (hObject=0x41c) returned 1 [0074.361] GetProcessHeap () returned 0x580000 [0074.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef2380 | out: hHeap=0x580000) returned 1 [0074.362] GetProcessHeap () returned 0x580000 [0074.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x624d18 | out: hHeap=0x580000) returned 1 [0074.365] GetProcessHeap () returned 0x580000 [0074.365] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0074.938] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63f3c600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10a5e1c, dwReserved0=0x2d8fd34, dwReserved1=0x7718ba87, cFileName="OnoteLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONOTEL~1.YOU")) returned 0x5b96b0 [0074.938] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.949] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", len=0x48 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 1 [0074.949] GetProcessHeap () returned 0x580000 [0074.949] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0074.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.949] Sleep (dwMilliseconds=0x1) [0074.966] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", len=0x3d | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 1 [0074.966] GetProcessHeap () returned 0x580000 [0074.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x9c) returned 0x5f76f0 [0074.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.967] Sleep (dwMilliseconds=0x1) [0079.338] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", len=0x3d | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 1 [0079.338] GetProcessHeap () returned 0x580000 [0079.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x6c) returned 0x5f76f0 [0079.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.338] Sleep (dwMilliseconds=0x1) [0079.356] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", len=0x4c | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 1 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x14) returned 0x5f76f0 [0079.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.362] Sleep (dwMilliseconds=0x1) [0084.368] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", len=0x4d | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 1 [0084.369] GetProcessHeap () returned 0x580000 [0084.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0084.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0084.838] CloseHandle (hObject=0x498) returned 1 [0084.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id_1622540890_.your_last_chance")) returned 1 [0084.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="DATES.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATESX~1.YOU")) returned 0x5b9630 [0084.838] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0084.839] GetProcessHeap () returned 0x580000 [0084.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e1) returned 0x67dc48 [0084.839] GetProcessHeap () returned 0x580000 [0084.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e1) returned 0x633b38 [0084.839] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.839] ReadFile (in: hFile=0x498, lpBuffer=0x67dc48, nNumberOfBytesToRead=0x22c0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67dc48*, lpNumberOfBytesRead=0x2d8ff14*=0x22c0, lpOverlapped=0x0) returned 1 [0084.871] GetProcessHeap () returned 0x580000 [0084.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.871] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.871] WriteFile (in: hFile=0x498, lpBuffer=0x633b38*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x633b38*, lpNumberOfBytesWritten=0x2d8ff14*=0x22c0, lpOverlapped=0x0) returned 1 [0084.871] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.871] WriteFile (in: hFile=0x498, lpBuffer=0x635df7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635df7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0084.871] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.872] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0084.872] CloseHandle (hObject=0x498) returned 1 [0084.872] GetProcessHeap () returned 0x580000 [0084.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x633b38 | out: hHeap=0x580000) returned 1 [0084.872] GetProcessHeap () returned 0x580000 [0084.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67dc48 | out: hHeap=0x580000) returned 1 [0084.872] GetProcessHeap () returned 0x580000 [0084.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a336200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22fa, dwReserved0=0x2d8fd28, dwReserved1=0x67dc48, cFileName="DATES.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATESX~1.YOU")) returned 0x5b9630 [0084.872] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.360] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", len=0x4d | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 1 [0088.360] GetProcessHeap () returned 0x580000 [0088.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0088.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0090.996] CloseHandle (hObject=0x4a0) returned 1 [0090.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0090.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id_1622540890_.your_last_chance")) returned 1 [0094.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEEPBL~1.YOU")) returned 0x5b96f0 [0094.117] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0094.117] GetProcessHeap () returned 0x580000 [0094.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x116e1) returned 0x6de0bc0 [0094.117] GetProcessHeap () returned 0x580000 [0094.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x116e1) returned 0x6c38cd8 [0094.117] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.117] ReadFile (in: hFile=0x498, lpBuffer=0x6de0bc0, nNumberOfBytesToRead=0x116c0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0bc0*, lpNumberOfBytesRead=0x2d8ff14*=0x116c0, lpOverlapped=0x0) returned 1 [0099.842] GetProcessHeap () returned 0x580000 [0099.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0099.843] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.843] WriteFile (in: hFile=0x498, lpBuffer=0x6c38cd8*, nNumberOfBytesToWrite=0x116c0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c38cd8*, lpNumberOfBytesWritten=0x2d8ff14*=0x116c0, lpOverlapped=0x0) returned 1 [0099.843] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.843] WriteFile (in: hFile=0x498, lpBuffer=0x6c4a397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a397*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.843] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.844] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.844] CloseHandle (hObject=0x498) returned 1 [0099.844] GetProcessHeap () returned 0x580000 [0099.844] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c38cd8 | out: hHeap=0x580000) returned 1 [0099.845] GetProcessHeap () returned 0x580000 [0099.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0bc0 | out: hHeap=0x580000) returned 1 [0099.846] GetProcessHeap () returned 0x580000 [0099.846] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73208a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11700, dwReserved0=0x2d8fd28, dwReserved1=0x6de0bc0, cFileName="DEEPBLUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEEPBL~1.YOU")) returned 0x5b96f0 [0101.349] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.405] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", len=0x49 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 1 [0101.405] GetProcessHeap () returned 0x580000 [0101.405] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0101.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0101.417] CloseHandle (hObject=0x484) returned 1 [0101.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id_1622540890_.your_last_chance")) returned 1 [0101.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~2.YOU")) returned 0x5b96b0 [0101.433] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0101.433] GetProcessHeap () returned 0x580000 [0101.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10b01) returned 0x6cf06d8 [0101.434] GetProcessHeap () returned 0x580000 [0101.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10b01) returned 0x6d21878 [0101.435] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.435] ReadFile (in: hFile=0x484, lpBuffer=0x6cf06d8, nNumberOfBytesToRead=0x10ae0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf06d8*, lpNumberOfBytesRead=0x2d8ff14*=0x10ae0, lpOverlapped=0x0) returned 1 [0104.745] GetProcessHeap () returned 0x580000 [0104.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0104.746] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.746] WriteFile (in: hFile=0x484, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x10ae0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x2d8ff14*=0x10ae0, lpOverlapped=0x0) returned 1 [0104.746] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.746] WriteFile (in: hFile=0x484, lpBuffer=0x6d32357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d32357*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0104.746] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.746] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0104.747] CloseHandle (hObject=0x484) returned 1 [0104.747] GetProcessHeap () returned 0x580000 [0104.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0104.747] GetProcessHeap () returned 0x580000 [0104.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf06d8 | out: hHeap=0x580000) returned 1 [0104.747] GetProcessHeap () returned 0x580000 [0104.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0104.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x760bf9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10b15, dwReserved0=0x2d8fd28, dwReserved1=0x6cf06d8, cFileName="SPRING.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~2.YOU")) returned 0x5b9630 [0104.747] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0106.154] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", len=0x46 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 1 [0106.154] GetProcessHeap () returned 0x580000 [0106.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x614d08 [0106.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0107.026] CloseHandle (hObject=0x4a0) returned 1 [0107.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id_1622540890_.your_last_chance")) returned 1 [0107.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBUI6C~1.YOU")) returned 0x5b9630 [0107.027] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0107.027] GetProcessHeap () returned 0x580000 [0107.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x656d50 [0107.028] GetProcessHeap () returned 0x580000 [0107.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0107.028] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.028] ReadFile (in: hFile=0x4a0, lpBuffer=0x656d50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x656d50*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.157] GetProcessHeap () returned 0x580000 [0111.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0111.157] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.158] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.158] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.158] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cf6ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ca7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.582] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.582] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.582] CloseHandle (hObject=0x4a0) returned 1 [0111.582] GetProcessHeap () returned 0x580000 [0111.582] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0111.586] GetProcessHeap () returned 0x580000 [0111.586] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656d50 | out: hHeap=0x580000) returned 1 [0111.586] GetProcessHeap () returned 0x580000 [0111.586] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0111.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a1e9400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65cba, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="VBUI6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBUI6C~1.YOU")) returned 0x5b96f0 [0111.586] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.124] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", len=0x4c | out: pbstr=0x2d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.124] GetProcessHeap () returned 0x580000 [0112.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x4c) returned 0x5e1778 [0112.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.124] Sleep (dwMilliseconds=0x1) [0112.264] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", len=0x5b | out: pbstr=0x2d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.265] GetProcessHeap () returned 0x580000 [0112.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.265] Sleep (dwMilliseconds=0x1) [0112.309] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", len=0x4b | out: pbstr=0x2d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 1 [0112.309] GetProcessHeap () returned 0x580000 [0112.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0112.309] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.310] Sleep (dwMilliseconds=0x1) [0113.334] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", len=0x3f | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 1 [0113.334] GetProcessHeap () returned 0x580000 [0113.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x8c) returned 0x6f0ceb8 [0113.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0113.478] CloseHandle (hObject=0x424) returned 1 [0113.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0264~1.YOU")) returned 0x5b9630 [0114.353] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0114.354] GetProcessHeap () returned 0x580000 [0114.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x677cd0 [0114.354] GetProcessHeap () returned 0x580000 [0114.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x635768 [0114.354] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.354] ReadFile (in: hFile=0x424, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x2d8ff14*=0xc20, lpOverlapped=0x0) returned 1 [0114.366] GetProcessHeap () returned 0x580000 [0114.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.366] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.366] WriteFile (in: hFile=0x424, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x2d8ff14*=0xc20, lpOverlapped=0x0) returned 1 [0114.366] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.366] WriteFile (in: hFile=0x424, lpBuffer=0x636387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636387*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.366] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.366] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.366] CloseHandle (hObject=0x424) returned 1 [0114.366] GetProcessHeap () returned 0x580000 [0114.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.366] GetProcessHeap () returned 0x580000 [0114.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0114.366] GetProcessHeap () returned 0x580000 [0114.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bc8aa20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc54, dwReserved0=0x2d8fd28, dwReserved1=0x677cd0, cFileName="AG00176_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0264~1.YOU")) returned 0x5b9630 [0114.366] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0114.398] CloseHandle (hObject=0x424) returned 1 [0114.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NA0245~1.YOU")) returned 0x5b9630 [0114.399] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0114.399] GetProcessHeap () returned 0x580000 [0114.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x635768 [0114.399] GetProcessHeap () returned 0x580000 [0114.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x6d10048 [0114.399] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.399] ReadFile (in: hFile=0x424, lpBuffer=0x635768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2d8ff14*=0xd20, lpOverlapped=0x0) returned 1 [0114.412] GetProcessHeap () returned 0x580000 [0114.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.412] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.412] WriteFile (in: hFile=0x424, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x2d8ff14*=0xd20, lpOverlapped=0x0) returned 1 [0114.413] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.413] WriteFile (in: hFile=0x424, lpBuffer=0x6d10d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10d67*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.413] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.413] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.413] CloseHandle (hObject=0x424) returned 1 [0114.413] GetProcessHeap () returned 0x580000 [0114.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0114.413] GetProcessHeap () returned 0x580000 [0114.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.413] GetProcessHeap () returned 0x580000 [0114.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0114.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bcfce40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd60, dwReserved0=0x2d8fd28, dwReserved1=0x635768, cFileName="NA02453_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NA0245~1.YOU")) returned 0x5b9630 [0115.605] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.997] CloseHandle (hObject=0x49c) returned 1 [0117.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0295~1.YOU")) returned 0x5b9630 [0117.998] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.998] GetProcessHeap () returned 0x580000 [0117.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2301) returned 0x6c75898 [0117.999] GetProcessHeap () returned 0x580000 [0118.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2301) returned 0x6c77ba8 [0118.052] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.052] ReadFile (in: hFile=0x49c, lpBuffer=0x6c75898, nNumberOfBytesToRead=0x22e0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75898*, lpNumberOfBytesRead=0x2d8ff14*=0x22e0, lpOverlapped=0x0) returned 1 [0118.086] GetProcessHeap () returned 0x580000 [0118.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0118.086] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.086] WriteFile (in: hFile=0x49c, lpBuffer=0x6c77ba8*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c77ba8*, lpNumberOfBytesWritten=0x2d8ff14*=0x22e0, lpOverlapped=0x0) returned 1 [0118.086] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.086] WriteFile (in: hFile=0x49c, lpBuffer=0x6c79e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79e87*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.086] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.086] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.086] CloseHandle (hObject=0x49c) returned 1 [0118.186] GetProcessHeap () returned 0x580000 [0118.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c77ba8 | out: hHeap=0x580000) returned 1 [0118.186] GetProcessHeap () returned 0x580000 [0118.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75898 | out: hHeap=0x580000) returned 1 [0118.186] GetProcessHeap () returned 0x580000 [0118.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0120.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dff3160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2318, dwReserved0=0x2d8fd28, dwReserved1=0x6c75898, cFileName="SO02958_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0295~1.YOU")) returned 0x5b96f0 [0120.088] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.101] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", len=0x3f | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF") returned 1 [0120.102] GetProcessHeap () returned 0x580000 [0120.102] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1770) returned 0x6d06ca8 [0120.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.114] CloseHandle (hObject=0x170) returned 1 [0120.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB087A~1.YOU")) returned 0x5b96f0 [0120.115] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.115] GetProcessHeap () returned 0x580000 [0120.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21890 [0120.115] GetProcessHeap () returned 0x580000 [0120.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21e98 [0120.115] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.115] ReadFile (in: hFile=0x170, lpBuffer=0x6c21890, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesRead=0x2d8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0120.122] GetProcessHeap () returned 0x580000 [0120.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.122] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x170, lpBuffer=0x6c21e98*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21e98*, lpNumberOfBytesWritten=0x2d8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0120.122] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x170, lpBuffer=0x6c22437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c22437*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.122] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.122] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.122] CloseHandle (hObject=0x170) returned 1 [0120.122] GetProcessHeap () returned 0x580000 [0120.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21e98 | out: hHeap=0x580000) returned 1 [0120.122] GetProcessHeap () returned 0x580000 [0120.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0120.122] GetProcessHeap () returned 0x580000 [0120.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f370580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x2d8fd28, dwReserved1=0x6c21890, cFileName="WB01745_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB087A~1.YOU")) returned 0x5b9630 [0120.175] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.183] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", len=0x3f | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF") returned 1 [0120.183] GetProcessHeap () returned 0x580000 [0120.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1764) returned 0x6d06ca8 [0120.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.183] CloseHandle (hObject=0x170) returned 1 [0120.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB4DED~1.YOU")) returned 0x5b9630 [0120.307] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.307] GetProcessHeap () returned 0x580000 [0120.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67c940 [0120.307] GetProcessHeap () returned 0x580000 [0120.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c4a820 [0120.308] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.308] ReadFile (in: hFile=0x170, lpBuffer=0x67c940, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x2d8ff14*=0x240, lpOverlapped=0x0) returned 1 [0120.343] GetProcessHeap () returned 0x580000 [0120.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.343] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.343] WriteFile (in: hFile=0x170, lpBuffer=0x6c4a820*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesWritten=0x2d8ff14*=0x240, lpOverlapped=0x0) returned 1 [0120.343] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.343] WriteFile (in: hFile=0x170, lpBuffer=0x6c4aa5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aa5f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.343] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.343] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.343] CloseHandle (hObject=0x170) returned 1 [0120.823] GetProcessHeap () returned 0x580000 [0120.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0120.823] GetProcessHeap () returned 0x580000 [0120.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0120.823] GetProcessHeap () returned 0x580000 [0120.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f5858c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x2d8fd28, dwReserved1=0x67c940, cFileName="WB01742_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB4DED~1.YOU")) returned 0x5b9730 [0121.700] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.302] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", len=0x4b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned 1 [0124.302] GetProcessHeap () returned 0x580000 [0124.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1934) returned 0x6f42f08 [0124.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.303] CloseHandle (hObject=0x484) returned 1 [0124.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.id_1622540890_.your_last_chance")) returned 1 [0124.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x45, dwReserved1=0x0, cFileName="Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0124.304] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.304] GetProcessHeap () returned 0x580000 [0124.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0124.304] GetProcessHeap () returned 0x580000 [0124.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0124.304] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.304] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x2d8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.318] GetProcessHeap () returned 0x580000 [0124.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.318] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.318] WriteFile (in: hFile=0x484, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x2d8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.318] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.318] WriteFile (in: hFile=0x484, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.319] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.319] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.319] CloseHandle (hObject=0x484) returned 1 [0124.319] GetProcessHeap () returned 0x580000 [0124.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.319] GetProcessHeap () returned 0x580000 [0124.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.319] GetProcessHeap () returned 0x580000 [0124.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81b75760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf11, dwReserved0=0x2d8fd28, dwReserved1=0x6c29878, cFileName="Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0124.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.352] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", len=0x53 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned 1 [0124.352] GetProcessHeap () returned 0x580000 [0124.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1928) returned 0x6f42f08 [0124.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0124.376] CloseHandle (hObject=0x4a8) returned 1 [0124.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.id_1622540890_.your_last_chance")) returned 1 [0124.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~3.YOU")) returned 0x5b9730 [0124.377] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0124.377] GetProcessHeap () returned 0x580000 [0124.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0124.377] GetProcessHeap () returned 0x580000 [0124.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6ce2378 [0124.377] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.377] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x2d8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.419] GetProcessHeap () returned 0x580000 [0124.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0124.419] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.419] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x2d8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.419] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.419] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce3197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3197*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.419] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.419] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.419] CloseHandle (hObject=0x4a8) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0125.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81c59fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x2d8fd28, dwReserved1=0x6c29878, cFileName="Office Classic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~3.YOU")) returned 0x5b9730 [0125.137] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.222] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", len=0x51 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 1 [0125.222] GetProcessHeap () returned 0x580000 [0125.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1878) returned 0x6f42f08 [0125.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0127.094] CloseHandle (hObject=0x488) returned 1 [0127.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0127.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id_1622540890_.your_last_chance")) returned 1 [0127.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDCO~1.YOU")) returned 0x5b9730 [0127.095] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0127.095] GetProcessHeap () returned 0x580000 [0127.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc0a00 [0127.095] GetProcessHeap () returned 0x580000 [0127.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0127.095] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.095] ReadFile (in: hFile=0x488, lpBuffer=0x6dc0a00, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.444] GetProcessHeap () returned 0x580000 [0128.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0128.444] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.445] WriteFile (in: hFile=0x488, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.445] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.445] WriteFile (in: hFile=0x488, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.557] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.557] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.557] CloseHandle (hObject=0x488) returned 1 [0128.557] GetProcessHeap () returned 0x580000 [0128.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0128.557] GetProcessHeap () returned 0x580000 [0128.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0128.558] GetProcessHeap () returned 0x580000 [0128.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0128.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x843c6c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x55a05, dwReserved0=0x2d8fd28, dwReserved1=0x6dc0a00, cFileName="Hardcover.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDCO~1.YOU")) returned 0x5b96f0 [0128.558] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.618] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", len=0x45 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned 1 [0128.619] GetProcessHeap () returned 0x580000 [0128.619] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bcc) returned 0x6e063d0 [0128.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.054] CloseHandle (hObject=0x41c) returned 1 [0129.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.id_1622540890_.your_last_chance")) returned 1 [0129.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1498~2.YOU")) returned 0x5b96f0 [0129.055] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.055] GetProcessHeap () returned 0x580000 [0129.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0129.055] GetProcessHeap () returned 0x580000 [0129.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0129.055] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.055] ReadFile (in: hFile=0x41c, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x2d8ff14*=0x160, lpOverlapped=0x0) returned 1 [0129.057] GetProcessHeap () returned 0x580000 [0129.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0129.057] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.057] WriteFile (in: hFile=0x41c, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x2d8ff14*=0x160, lpOverlapped=0x0) returned 1 [0129.057] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.057] WriteFile (in: hFile=0x41c, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.058] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.058] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.058] CloseHandle (hObject=0x41c) returned 1 [0129.058] GetProcessHeap () returned 0x580000 [0129.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0129.058] GetProcessHeap () returned 0x580000 [0129.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0129.058] GetProcessHeap () returned 0x580000 [0129.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0129.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84889800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x2d8fd28, dwReserved1=0x5aa990, cFileName="BD14981_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1498~2.YOU")) returned 0x5b9730 [0129.474] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.495] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", len=0x43 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned 1 [0129.496] GetProcessHeap () returned 0x580000 [0129.496] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0129.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.527] CloseHandle (hObject=0x458) returned 1 [0129.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.id_1622540890_.your_last_chance")) returned 1 [0129.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4a4400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4a4400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2152~1.YOU")) returned 0x5b9630 [0129.575] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.575] GetProcessHeap () returned 0x580000 [0129.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c4a820 [0129.575] GetProcessHeap () returned 0x580000 [0129.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c4aaa8 [0129.575] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.575] ReadFile (in: hFile=0x458, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x2d8ff14*=0x240, lpOverlapped=0x0) returned 1 [0129.579] GetProcessHeap () returned 0x580000 [0129.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.579] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.579] WriteFile (in: hFile=0x458, lpBuffer=0x6c4aaa8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aaa8*, lpNumberOfBytesWritten=0x2d8ff14*=0x240, lpOverlapped=0x0) returned 1 [0129.580] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.580] WriteFile (in: hFile=0x458, lpBuffer=0x6c4ace7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ace7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.580] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.580] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.580] CloseHandle (hObject=0x458) returned 1 [0129.580] GetProcessHeap () returned 0x580000 [0129.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aaa8 | out: hHeap=0x580000) returned 1 [0129.580] GetProcessHeap () returned 0x580000 [0129.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0129.580] GetProcessHeap () returned 0x580000 [0129.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4a4400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84d986c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x2d8fd28, dwReserved1=0x6c4a820, cFileName="BD21527_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2152~1.YOU")) returned 0x5b9630 [0129.580] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.638] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS", len=0x3a | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS") returned 1 [0129.638] GetProcessHeap () returned 0x580000 [0129.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0129.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.574] CloseHandle (hObject=0x470) returned 1 [0132.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.id_1622540890_.your_last_chance")) returned 1 [0132.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COFFEE~1.YOU")) returned 0x5b9730 [0132.577] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.577] GetProcessHeap () returned 0x580000 [0132.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0132.577] GetProcessHeap () returned 0x580000 [0132.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0132.577] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.577] ReadFile (in: hFile=0x470, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2d8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.590] GetProcessHeap () returned 0x580000 [0132.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.590] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.590] WriteFile (in: hFile=0x470, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2d8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.590] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.590] WriteFile (in: hFile=0x470, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.590] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.590] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.590] CloseHandle (hObject=0x470) returned 1 [0132.590] GetProcessHeap () returned 0x580000 [0132.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0132.590] GetProcessHeap () returned 0x580000 [0132.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0132.590] GetProcessHeap () returned 0x580000 [0132.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86a4f020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x2d8fd28, dwReserved1=0x635768, cFileName="COFFEE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COFFEE~1.YOU")) returned 0x5b96f0 [0135.016] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.016] Sleep (dwMilliseconds=0x1) [0135.050] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", len=0x4b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned 1 [0135.050] GetProcessHeap () returned 0x580000 [0135.050] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0135.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0135.050] CloseHandle (hObject=0x410) returned 1 [0135.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.id_1622540890_.your_last_chance")) returned 1 [0135.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x45, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EADOCU~2.YOU")) returned 0x5b96f0 [0135.052] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0135.052] GetProcessHeap () returned 0x580000 [0135.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x38a1) returned 0x6dd20d0 [0135.052] GetProcessHeap () returned 0x580000 [0135.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x38a1) returned 0x6ec4700 [0135.053] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.053] ReadFile (in: hFile=0x410, lpBuffer=0x6dd20d0, nNumberOfBytesToRead=0x3880, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesRead=0x2d8ff14*=0x3880, lpOverlapped=0x0) returned 1 [0136.572] GetProcessHeap () returned 0x580000 [0136.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.572] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.572] WriteFile (in: hFile=0x410, lpBuffer=0x6ec4700*, nNumberOfBytesToWrite=0x3880, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4700*, lpNumberOfBytesWritten=0x2d8ff14*=0x3880, lpOverlapped=0x0) returned 1 [0138.341] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.342] WriteFile (in: hFile=0x410, lpBuffer=0x6ec7f7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec7f7f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.525] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.525] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.525] CloseHandle (hObject=0x410) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4700 | out: hHeap=0x580000) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0140.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2d7aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38b2, dwReserved0=0x2d8fd28, dwReserved1=0x6dd20d0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EADOCU~2.YOU")) returned 0x5b9770 [0140.122] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.165] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", len=0x58 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css") returned 1 [0140.165] GetProcessHeap () returned 0x580000 [0140.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0140.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.598] CloseHandle (hObject=0x428) returned 1 [0140.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.598] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance")) returned 1 [0140.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b9770 [0140.599] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.599] GetProcessHeap () returned 0x580000 [0140.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0140.599] GetProcessHeap () returned 0x580000 [0140.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6c29878 [0140.599] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.599] ReadFile (in: hFile=0x428, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2d8ff14*=0xd00, lpOverlapped=0x0) returned 1 [0140.612] GetProcessHeap () returned 0x580000 [0140.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.612] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.612] WriteFile (in: hFile=0x428, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2d8ff14*=0xd00, lpOverlapped=0x0) returned 1 [0140.612] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.612] WriteFile (in: hFile=0x428, lpBuffer=0x6c2a577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a577*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.612] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.612] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.612] CloseHandle (hObject=0x428) returned 1 [0140.612] GetProcessHeap () returned 0x580000 [0140.613] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.613] GetProcessHeap () returned 0x580000 [0140.613] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0140.613] GetProcessHeap () returned 0x580000 [0140.613] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0141.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6c72e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd25, dwReserved0=0x2d8fd28, dwReserved1=0x635768, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b9730 [0141.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.265] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS", len=0x3b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 1 [0144.267] GetProcessHeap () returned 0x580000 [0144.267] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0144.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.268] CloseHandle (hObject=0x4a4) returned 1 [0144.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id_1622540890_.your_last_chance")) returned 1 [0144.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ede2d00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU5620~1.YOU")) returned 0x5b9730 [0144.269] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.269] GetProcessHeap () returned 0x580000 [0144.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ea1008 [0144.270] GetProcessHeap () returned 0x580000 [0144.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eb2838 [0144.270] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.270] ReadFile (in: hFile=0x4a4, lpBuffer=0x6ea1008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.103] GetProcessHeap () returned 0x580000 [0147.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0147.104] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.104] WriteFile (in: hFile=0x4a4, lpBuffer=0x6eb2838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2838*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.104] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.104] WriteFile (in: hFile=0x4a4, lpBuffer=0x6ec4037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4037*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0147.761] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.761] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0147.761] CloseHandle (hObject=0x4a4) returned 1 [0147.761] GetProcessHeap () returned 0x580000 [0147.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb2838 | out: hHeap=0x580000) returned 1 [0147.761] GetProcessHeap () returned 0x580000 [0147.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0148.622] GetProcessHeap () returned 0x580000 [0148.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0148.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8faea8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c8b, dwReserved0=0x580000, dwReserved1=0x70a1cf0, cFileName="OUTLOOK.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU5620~1.YOU")) returned 0x5b96f0 [0148.622] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0149.355] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", len=0x44 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned 1 [0149.355] GetProcessHeap () returned 0x580000 [0149.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0149.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0150.574] CloseHandle (hObject=0x4ac) returned 1 [0150.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.575] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR50~2.YOU")) returned 0x5b96f0 [0150.576] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0150.576] GetProcessHeap () returned 0x580000 [0150.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea1) returned 0x6c29878 [0150.576] GetProcessHeap () returned 0x580000 [0150.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea1) returned 0x6dd7c30 [0150.576] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.576] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x2d8ff14*=0xe80, lpOverlapped=0x0) returned 1 [0150.590] GetProcessHeap () returned 0x580000 [0150.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0150.590] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.590] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dd7c30*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesWritten=0x2d8ff14*=0xe80, lpOverlapped=0x0) returned 1 [0150.590] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.590] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dd8aaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8aaf*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.590] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.590] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.590] CloseHandle (hObject=0x4ac) returned 1 [0150.590] GetProcessHeap () returned 0x580000 [0150.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0150.591] GetProcessHeap () returned 0x580000 [0150.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0150.591] GetProcessHeap () returned 0x580000 [0150.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0150.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x915fe2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x2d8fd28, dwReserved1=0x6c29878, cFileName="PDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR50~2.YOU")) returned 0x5b96f0 [0150.904] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0151.773] CloseHandle (hObject=0x3a8) returned 1 [0151.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0151.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0151.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0151.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~1.YOU")) returned 0x5b9730 [0151.777] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0151.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0151.777] GetProcessHeap () returned 0x580000 [0151.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0151.777] GetProcessHeap () returned 0x580000 [0151.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0151.777] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.778] ReadFile (in: hFile=0x3a8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x2d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0151.780] GetProcessHeap () returned 0x580000 [0151.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.780] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.780] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x2d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0151.780] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.780] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.780] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.780] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.780] CloseHandle (hObject=0x3a8) returned 1 [0151.780] GetProcessHeap () returned 0x580000 [0151.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0151.780] GetProcessHeap () returned 0x580000 [0151.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0151.780] GetProcessHeap () returned 0x580000 [0151.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9214cb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x2d8fd28, dwReserved1=0x5ad8a0, cFileName="VISIO_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~1.YOU")) returned 0x5b9730 [0152.049] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.063] CloseHandle (hObject=0x478) returned 1 [0152.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0152.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x2a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~4.YOU")) returned 0x5b9730 [0152.064] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.065] GetProcessHeap () returned 0x580000 [0152.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673ce8 [0152.065] GetProcessHeap () returned 0x580000 [0152.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673fd0 [0152.065] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.065] ReadFile (in: hFile=0x478, lpBuffer=0x673ce8, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673ce8*, lpNumberOfBytesRead=0x2d8ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0152.095] GetProcessHeap () returned 0x580000 [0152.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.095] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.095] WriteFile (in: hFile=0x478, lpBuffer=0x673fd0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673fd0*, lpNumberOfBytesWritten=0x2d8ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0152.096] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.096] WriteFile (in: hFile=0x478, lpBuffer=0x67426f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67426f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.096] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.096] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.096] CloseHandle (hObject=0x478) returned 1 [0152.096] GetProcessHeap () returned 0x580000 [0152.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673fd0 | out: hHeap=0x580000) returned 1 [0152.096] GetProcessHeap () returned 0x580000 [0152.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673ce8 | out: hHeap=0x580000) returned 1 [0152.096] GetProcessHeap () returned 0x580000 [0152.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x924466e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x2d8fd28, dwReserved1=0x673ce8, cFileName="VISIO.SHAPESHEET_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~4.YOU")) returned 0x5b9730 [0152.096] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.240] CloseHandle (hObject=0x3e4) returned 1 [0155.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id_1622540890_.your_last_chance")) returned 1 [0155.241] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50e86000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x44b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIMESO~1.YOU")) returned 0x5b9730 [0155.242] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.242] GetProcessHeap () returned 0x580000 [0155.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0155.242] GetProcessHeap () returned 0x580000 [0155.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0155.243] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.243] ReadFile (in: hFile=0x3e4, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.709] GetProcessHeap () returned 0x580000 [0159.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.710] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.710] WriteFile (in: hFile=0x3e4, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.710] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.710] WriteFile (in: hFile=0x3e4, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0161.242] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.242] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0161.243] CloseHandle (hObject=0x3e4) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50e86000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x97b9ae00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x44b8c, dwReserved0=0x2d8fd28, dwReserved1=0x707ec98, cFileName="TIMESOLN.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIMESO~1.YOU")) returned 0x5b9730 [0164.569] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.548] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", len=0x3e | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 1 [0166.548] GetProcessHeap () returned 0x580000 [0166.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2240) returned 0x6f14048 [0166.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0166.617] CloseHandle (hObject=0x454) returned 1 [0166.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id_1622540890_.your_last_chance")) returned 1 [0169.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCLIC~1.YOU")) returned 0x5b96b0 [0169.233] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.234] GetProcessHeap () returned 0x580000 [0169.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0169.234] GetProcessHeap () returned 0x580000 [0169.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0169.234] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.234] ReadFile (in: hFile=0x454, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x2d8ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.239] GetProcessHeap () returned 0x580000 [0169.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.239] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.239] WriteFile (in: hFile=0x454, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x2d8ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.239] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.239] WriteFile (in: hFile=0x454, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.239] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.239] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.239] CloseHandle (hObject=0x454) returned 1 [0169.239] GetProcessHeap () returned 0x580000 [0169.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0169.239] GetProcessHeap () returned 0x580000 [0169.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0169.239] GetProcessHeap () returned 0x580000 [0169.239] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7c6e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2d8fd28, dwReserved1=0x5cf780, cFileName="DOCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCLIC~1.YOU")) returned 0x5b9770 [0172.814] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.861] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", len=0x41 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 1 [0172.861] GetProcessHeap () returned 0x580000 [0172.861] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2260) returned 0x6f14048 [0172.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.932] CloseHandle (hObject=0x48c) returned 1 [0172.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id_1622540890_.your_last_chance")) returned 1 [0172.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~1.YOU")) returned 0x5b9770 [0172.949] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.950] GetProcessHeap () returned 0x580000 [0172.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0172.950] GetProcessHeap () returned 0x580000 [0172.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0172.950] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.950] ReadFile (in: hFile=0x48c, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x2d8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0172.964] GetProcessHeap () returned 0x580000 [0172.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.964] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] WriteFile (in: hFile=0x48c, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x2d8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0172.964] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] WriteFile (in: hFile=0x48c, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.964] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.965] CloseHandle (hObject=0x48c) returned 1 [0172.971] GetProcessHeap () returned 0x580000 [0172.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0172.975] GetProcessHeap () returned 0x580000 [0172.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0172.975] GetProcessHeap () returned 0x580000 [0172.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb556a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x2d8fd28, dwReserved1=0x660a78, cFileName="SECRECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~1.YOU")) returned 0x5b9770 [0173.251] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.659] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", len=0x48 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned 1 [0174.659] GetProcessHeap () returned 0x580000 [0174.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0174.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.713] CloseHandle (hObject=0x4ac) returned 1 [0174.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.id_1622540890_.your_last_chance")) returned 1 [0174.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOTWA~1.YOU")) returned 0x5b96f0 [0174.714] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.714] GetProcessHeap () returned 0x580000 [0174.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb161) returned 0x6d248a8 [0174.714] GetProcessHeap () returned 0x580000 [0174.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb161) returned 0x6d61b88 [0174.714] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.714] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d248a8, nNumberOfBytesToRead=0xb140, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d248a8*, lpNumberOfBytesRead=0x2d8ff14*=0xb140, lpOverlapped=0x0) returned 1 [0177.385] GetProcessHeap () returned 0x580000 [0177.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0177.385] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.385] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d61b88*, nNumberOfBytesToWrite=0xb140, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d61b88*, lpNumberOfBytesWritten=0x2d8ff14*=0xb140, lpOverlapped=0x0) returned 1 [0177.385] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.385] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d6ccc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ccc7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.386] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.386] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.386] CloseHandle (hObject=0x4ac) returned 1 [0177.386] GetProcessHeap () returned 0x580000 [0177.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d61b88 | out: hHeap=0x580000) returned 1 [0177.386] GetProcessHeap () returned 0x580000 [0177.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d248a8 | out: hHeap=0x580000) returned 1 [0177.386] GetProcessHeap () returned 0x580000 [0177.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa156fbc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb172, dwReserved0=0x2d8fd28, dwReserved1=0x6d248a8, cFileName="SHOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOTWA~1.YOU")) returned 0x5b96f0 [0179.169] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.354] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", len=0x69 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned 1 [0180.354] GetProcessHeap () returned 0x580000 [0180.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0180.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.355] CloseHandle (hObject=0x3fc) returned 1 [0180.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b96b0 [0180.356] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.357] GetProcessHeap () returned 0x580000 [0180.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6fad568 [0180.357] GetProcessHeap () returned 0x580000 [0180.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6d28168 [0180.357] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.357] ReadFile (in: hFile=0x3fc, lpBuffer=0x6fad568, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad568*, lpNumberOfBytesRead=0x2d8ff14*=0x2780, lpOverlapped=0x0) returned 1 [0180.391] GetProcessHeap () returned 0x580000 [0180.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.391] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.391] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d28168*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d28168*, lpNumberOfBytesWritten=0x2d8ff14*=0x2780, lpOverlapped=0x0) returned 1 [0180.391] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.391] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d2a8e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2a8e7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.391] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.391] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.392] CloseHandle (hObject=0x3fc) returned 1 [0180.392] GetProcessHeap () returned 0x580000 [0180.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d28168 | out: hHeap=0x580000) returned 1 [0180.392] GetProcessHeap () returned 0x580000 [0180.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fad568 | out: hHeap=0x580000) returned 1 [0180.392] GetProcessHeap () returned 0x580000 [0180.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3226520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27bc, dwReserved0=0x2d8fd28, dwReserved1=0x6fad568, cFileName="MessageBoxIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b96b0 [0180.392] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.133] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", len=0x54 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned 1 [0183.133] GetProcessHeap () returned 0x580000 [0183.133] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0183.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.134] CloseHandle (hObject=0x46c) returned 1 [0183.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~3.YOU")) returned 0x5b9770 [0183.135] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.135] GetProcessHeap () returned 0x580000 [0183.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6c29878 [0183.135] GetProcessHeap () returned 0x580000 [0183.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6def670 [0183.135] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.135] ReadFile (in: hFile=0x46c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf20, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x2d8ff14*=0xf20, lpOverlapped=0x0) returned 1 [0183.189] GetProcessHeap () returned 0x580000 [0183.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.189] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0x46c, lpBuffer=0x6def670*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def670*, lpNumberOfBytesWritten=0x2d8ff14*=0xf20, lpOverlapped=0x0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0x46c, lpBuffer=0x6df058f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df058f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.189] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.189] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.189] CloseHandle (hObject=0x46c) returned 1 [0183.189] GetProcessHeap () returned 0x580000 [0183.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6def670 | out: hHeap=0x580000) returned 1 [0183.189] GetProcessHeap () returned 0x580000 [0183.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0183.189] GetProcessHeap () returned 0x580000 [0183.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4cc7b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x2d8fd28, dwReserved1=0x6c29878, cFileName="Shared16x16ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~3.YOU")) returned 0x5b9770 [0183.190] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.200] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned 1 [0183.200] GetProcessHeap () returned 0x580000 [0183.200] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0183.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.306] CloseHandle (hObject=0x3fc) returned 1 [0183.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe1a5d00, ftLastWriteTime.dwHighDateTime=0x1ca032e, nFileSizeHigh=0x0, nFileSizeLow=0x1238, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTUR~2.YOU")) returned 0x5b9770 [0183.307] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.308] GetProcessHeap () returned 0x580000 [0183.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1241) returned 0x6dd7c30 [0183.308] GetProcessHeap () returned 0x580000 [0183.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1241) returned 0x6d7d000 [0183.308] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.308] ReadFile (in: hFile=0x3fc, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x1220, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x2d8ff14*=0x1220, lpOverlapped=0x0) returned 1 [0183.325] GetProcessHeap () returned 0x580000 [0183.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.325] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.325] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d7d000*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7d000*, lpNumberOfBytesWritten=0x2d8ff14*=0x1220, lpOverlapped=0x0) returned 1 [0183.325] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.325] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d7e21f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7e21f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.325] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.326] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.326] CloseHandle (hObject=0x3fc) returned 1 [0183.326] GetProcessHeap () returned 0x580000 [0183.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7d000 | out: hHeap=0x580000) returned 1 [0183.326] GetProcessHeap () returned 0x580000 [0183.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0183.326] GetProcessHeap () returned 0x580000 [0183.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e1e7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x125c, dwReserved0=0x2d8fd28, dwReserved1=0x6dd7c30, cFileName="PicturesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTUR~2.YOU")) returned 0x5b9770 [0183.326] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.316] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", len=0x60 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned 1 [0184.316] GetProcessHeap () returned 0x580000 [0184.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0184.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0185.236] CloseHandle (hObject=0x46c) returned 1 [0185.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.id_1622540890_.your_last_chance")) returned 1 [0185.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b9770 [0185.238] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0185.238] GetProcessHeap () returned 0x580000 [0185.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x6e10170 [0185.238] GetProcessHeap () returned 0x580000 [0185.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x6fb2f38 [0185.238] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.238] ReadFile (in: hFile=0x46c, lpBuffer=0x6e10170, nNumberOfBytesToRead=0x7dc0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e10170*, lpNumberOfBytesRead=0x2d8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0187.419] GetProcessHeap () returned 0x580000 [0187.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.419] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.419] WriteFile (in: hFile=0x46c, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x2d8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0187.419] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.419] WriteFile (in: hFile=0x46c, lpBuffer=0x6fbacf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbacf7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.420] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.420] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.420] CloseHandle (hObject=0x46c) returned 1 [0187.874] GetProcessHeap () returned 0x580000 [0187.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0187.874] GetProcessHeap () returned 0x580000 [0187.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e10170 | out: hHeap=0x580000) returned 1 [0187.875] GetProcessHeap () returned 0x580000 [0187.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7df7, dwReserved0=0x2d8fd28, dwReserved1=0x6e10170, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b9770 [0191.030] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.038] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", len=0x45 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned 1 [0191.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0191.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0191.039] CloseHandle (hObject=0x3a8) returned 1 [0191.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe591, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~4.YOU")) returned 0x5b9770 [0191.040] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0191.040] GetProcessHeap () returned 0x580000 [0191.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6f976f8 [0191.040] GetProcessHeap () returned 0x580000 [0191.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6d630a8 [0191.041] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.041] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0xe580, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x2d8ff14*=0xe580, lpOverlapped=0x0) returned 1 [0195.992] GetProcessHeap () returned 0x580000 [0195.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.993] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0xe580, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x2d8ff14*=0xe580, lpOverlapped=0x0) returned 1 [0195.993] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.993] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d71627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71627*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.994] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.994] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.994] CloseHandle (hObject=0x3a8) returned 1 [0195.994] GetProcessHeap () returned 0x580000 [0195.994] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0195.994] GetProcessHeap () returned 0x580000 [0195.994] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0195.994] GetProcessHeap () returned 0x580000 [0195.994] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac6ec420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe5b5, dwReserved0=0x2d8fd28, dwReserved1=0x6f976f8, cFileName="ZPDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~4.YOU")) returned 0x5b97f0 [0198.067] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.652] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", len=0x62 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned 1 [0199.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0199.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.932] CloseHandle (hObject=0x43c) returned 1 [0200.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.id_1622540890_.your_last_chance")) returned 1 [0200.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b9770 [0200.933] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.933] GetProcessHeap () returned 0x580000 [0200.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x67fc68 [0200.933] GetProcessHeap () returned 0x580000 [0200.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x705f4e8 [0200.933] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.933] ReadFile (in: hFile=0x43c, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0200.937] GetProcessHeap () returned 0x580000 [0200.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0200.938] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.938] WriteFile (in: hFile=0x43c, lpBuffer=0x705f4e8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f4e8*, lpNumberOfBytesWritten=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0200.938] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.938] WriteFile (in: hFile=0x43c, lpBuffer=0x705f827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f827*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.938] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.938] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.938] CloseHandle (hObject=0x43c) returned 1 [0200.938] GetProcessHeap () returned 0x580000 [0200.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f4e8 | out: hHeap=0x580000) returned 1 [0200.938] GetProcessHeap () returned 0x580000 [0200.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0200.938] GetProcessHeap () returned 0x580000 [0200.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0201.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf615800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x2d8fd28, dwReserved1=0x67fc68, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b9770 [0201.404] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.429] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", len=0x6a | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned 1 [0201.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0201.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.488] CloseHandle (hObject=0x3e4) returned 1 [0201.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.id_1622540890_.your_last_chance")) returned 1 [0201.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b97b0 [0201.490] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.490] GetProcessHeap () returned 0x580000 [0201.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.490] GetProcessHeap () returned 0x580000 [0201.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0201.490] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.490] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.502] GetProcessHeap () returned 0x580000 [0201.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.502] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.502] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.502] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.502] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.502] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.503] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.503] CloseHandle (hObject=0x3e4) returned 1 [0201.503] GetProcessHeap () returned 0x580000 [0201.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0201.503] GetProcessHeap () returned 0x580000 [0201.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.503] GetProcessHeap () returned 0x580000 [0201.503] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafb70980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x2d8fd28, dwReserved1=0x6dcfb90, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b9770 [0202.258] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.348] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS", len=0x45 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS") returned 1 [0202.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0202.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0202.349] CloseHandle (hObject=0x480) returned 1 [0202.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.349] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css.id_1622540890_.your_last_chance")) returned 1 [0202.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532c200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7532c200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF175~1.YOU")) returned 0x5b9770 [0202.350] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0202.350] GetProcessHeap () returned 0x580000 [0202.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0202.350] GetProcessHeap () returned 0x580000 [0202.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0202.351] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.351] ReadFile (in: hFile=0x480, lpBuffer=0x702a188, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.501] GetProcessHeap () returned 0x580000 [0209.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0209.501] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.501] WriteFile (in: hFile=0x480, lpBuffer=0x703b9b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.502] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.502] WriteFile (in: hFile=0x480, lpBuffer=0x704d1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x704d1b7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.502] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.502] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.502] CloseHandle (hObject=0x480) returned 1 [0209.502] GetProcessHeap () returned 0x580000 [0209.502] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0209.930] GetProcessHeap () returned 0x580000 [0209.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0209.930] GetProcessHeap () returned 0x580000 [0209.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0209.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532c200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb47c2ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e470, dwReserved0=0x2d8fd28, dwReserved1=0x702a188, cFileName="SCHEME39.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF175~1.YOU")) returned 0x5b97b0 [0209.931] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.477] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS", len=0x45 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS") returned 1 [0210.477] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0210.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0210.572] CloseHandle (hObject=0x418) returned 1 [0210.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css.id_1622540890_.your_last_chance")) returned 1 [0210.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d3f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x220d3f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20030, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5EAB~1.YOU")) returned 0x5b9830 [0210.573] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0210.573] GetProcessHeap () returned 0x580000 [0210.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0210.573] GetProcessHeap () returned 0x580000 [0210.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0210.573] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.573] ReadFile (in: hFile=0x418, lpBuffer=0x6fc4768, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.109] GetProcessHeap () returned 0x580000 [0214.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0214.110] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.110] WriteFile (in: hFile=0x418, lpBuffer=0x6fd5f98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.110] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.110] WriteFile (in: hFile=0x418, lpBuffer=0x6fe7797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7797*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.110] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.110] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.115] CloseHandle (hObject=0x418) returned 1 [0214.115] GetProcessHeap () returned 0x580000 [0214.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0214.263] GetProcessHeap () returned 0x580000 [0214.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0214.263] GetProcessHeap () returned 0x580000 [0214.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0215.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d3f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb73cc1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20054, dwReserved0=0x2d8fd28, dwReserved1=0x6fc4768, cFileName="SCHEME11.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5EAB~1.YOU")) returned 0x5b97b0 [0215.041] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.049] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML", len=0x3c | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML") returned 1 [0215.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.052] CloseHandle (hObject=0x46c) returned 1 [0215.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.id_1622540890_.your_last_chance")) returned 1 [0215.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeaeefd00, ftLastWriteTime.dwHighDateTime=0x1c2c076, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCCMPV~1.YOU")) returned 0x5b97b0 [0215.054] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.054] GetProcessHeap () returned 0x580000 [0215.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x6dcfb90 [0215.054] GetProcessHeap () returned 0x580000 [0215.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x6c65108 [0215.054] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.054] ReadFile (in: hFile=0x46c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x2d8ff14*=0x460, lpOverlapped=0x0) returned 1 [0215.059] GetProcessHeap () returned 0x580000 [0215.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0215.059] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.059] WriteFile (in: hFile=0x46c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x2d8ff14*=0x460, lpOverlapped=0x0) returned 1 [0215.059] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.059] WriteFile (in: hFile=0x46c, lpBuffer=0x6c65567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65567*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.060] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.060] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.060] CloseHandle (hObject=0x46c) returned 1 [0215.060] GetProcessHeap () returned 0x580000 [0215.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0215.060] GetProcessHeap () returned 0x580000 [0215.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0215.060] GetProcessHeap () returned 0x580000 [0215.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0215.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb7cb9460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x2d8fd28, dwReserved1=0x6dcfb90, cFileName="OCCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCCMPV~1.YOU")) returned 0x5b97b0 [0215.060] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.062] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD", len=0x3c | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 1 [0215.062] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0215.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0215.064] CloseHandle (hObject=0x428) returned 1 [0215.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id_1622540890_.your_last_chance")) returned 1 [0215.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~1.YOU")) returned 0x5b97b0 [0215.065] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0215.065] GetProcessHeap () returned 0x580000 [0215.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0215.065] GetProcessHeap () returned 0x580000 [0215.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6f668d8 [0215.065] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.065] ReadFile (in: hFile=0x428, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2d8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0215.077] GetProcessHeap () returned 0x580000 [0215.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0215.077] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.077] WriteFile (in: hFile=0x428, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x2d8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0215.078] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.078] WriteFile (in: hFile=0x428, lpBuffer=0x6f67577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67577*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.078] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.078] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.078] CloseHandle (hObject=0x428) returned 1 [0215.078] GetProcessHeap () returned 0x580000 [0215.078] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0215.078] GetProcessHeap () returned 0x580000 [0215.078] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0215.078] GetProcessHeap () returned 0x580000 [0215.078] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0215.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb7d05720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x2d8fd28, dwReserved1=0x635768, cFileName="NETWORK3.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~1.YOU")) returned 0x5b97b0 [0215.078] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.093] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS", len=0x3b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS") returned 1 [0215.093] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0215.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0215.095] CloseHandle (hObject=0x450) returned 1 [0215.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.id_1622540890_.your_last_chance")) returned 1 [0215.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~4.YOU")) returned 0x5b97b0 [0215.097] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0215.097] GetProcessHeap () returned 0x580000 [0215.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0215.097] GetProcessHeap () returned 0x580000 [0215.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6f668d8 [0215.097] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.097] ReadFile (in: hFile=0x450, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x2d8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0216.217] GetProcessHeap () returned 0x580000 [0216.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0216.217] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.217] WriteFile (in: hFile=0x450, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x2d8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0216.218] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.218] WriteFile (in: hFile=0x450, lpBuffer=0x6f67637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67637*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0216.218] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.218] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0216.218] CloseHandle (hObject=0x450) returned 1 [0216.218] GetProcessHeap () returned 0x580000 [0216.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0216.218] GetProcessHeap () returned 0x580000 [0216.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0216.218] GetProcessHeap () returned 0x580000 [0216.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0217.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb87e1b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x2d8fd28, dwReserved1=0x635768, cFileName="NETWORK.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~4.YOU")) returned 0x5b9770 [0217.699] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.058] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned 1 [0221.058] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0221.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.059] CloseHandle (hObject=0x3e4) returned 1 [0221.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0221.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b9770 [0221.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.060] GetProcessHeap () returned 0x580000 [0221.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.060] GetProcessHeap () returned 0x580000 [0221.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.061] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.061] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.065] GetProcessHeap () returned 0x580000 [0221.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.065] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.065] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.065] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.065] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.065] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.065] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.065] CloseHandle (hObject=0x3e4) returned 1 [0221.066] GetProcessHeap () returned 0x580000 [0221.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.066] GetProcessHeap () returned 0x580000 [0221.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.066] GetProcessHeap () returned 0x580000 [0221.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb6005c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x2d8fd28, dwReserved1=0x6dcfb90, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b9770 [0221.066] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.136] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", len=0x5f | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned 1 [0221.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0221.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.288] CloseHandle (hObject=0x49c) returned 1 [0221.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.id_1622540890_.your_last_chance")) returned 1 [0221.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2577, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b9770 [0221.289] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.290] GetProcessHeap () returned 0x580000 [0221.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2581) returned 0x6e063d0 [0221.290] GetProcessHeap () returned 0x580000 [0221.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2581) returned 0x6e08960 [0221.290] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.290] ReadFile (in: hFile=0x49c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x2560, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x2d8ff14*=0x2560, lpOverlapped=0x0) returned 1 [0221.323] GetProcessHeap () returned 0x580000 [0221.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0221.323] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.323] WriteFile (in: hFile=0x49c, lpBuffer=0x6e08960*, nNumberOfBytesToWrite=0x2560, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e08960*, lpNumberOfBytesWritten=0x2d8ff14*=0x2560, lpOverlapped=0x0) returned 1 [0221.323] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.323] WriteFile (in: hFile=0x49c, lpBuffer=0x6e0aebf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0aebf*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.324] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.324] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.324] CloseHandle (hObject=0x49c) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e08960 | out: hHeap=0x580000) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0221.324] GetProcessHeap () returned 0x580000 [0221.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0223.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb887d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x259b, dwReserved0=0x2d8fd28, dwReserved1=0x6e063d0, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b96f0 [0223.310] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.399] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", len=0x62 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned 1 [0223.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0223.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.400] CloseHandle (hObject=0x49c) returned 1 [0223.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.id_1622540890_.your_last_chance")) returned 1 [0223.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b96f0 [0223.401] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.401] GetProcessHeap () returned 0x580000 [0223.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6599e8 [0223.401] GetProcessHeap () returned 0x580000 [0223.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x659d90 [0223.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.401] ReadFile (in: hFile=0x49c, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x2d8ff14*=0x360, lpOverlapped=0x0) returned 1 [0223.406] GetProcessHeap () returned 0x580000 [0223.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.406] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.406] WriteFile (in: hFile=0x49c, lpBuffer=0x659d90*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x659d90*, lpNumberOfBytesWritten=0x2d8ff14*=0x360, lpOverlapped=0x0) returned 1 [0223.406] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.406] WriteFile (in: hFile=0x49c, lpBuffer=0x65a0ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a0ef*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.406] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.406] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.406] CloseHandle (hObject=0x49c) returned 1 [0223.406] GetProcessHeap () returned 0x580000 [0223.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659d90 | out: hHeap=0x580000) returned 1 [0223.407] GetProcessHeap () returned 0x580000 [0223.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0223.407] GetProcessHeap () returned 0x580000 [0223.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc51400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x2d8fd28, dwReserved1=0x6599e8, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b96f0 [0223.407] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.434] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", len=0x65 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned 1 [0223.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0223.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0223.435] CloseHandle (hObject=0x494) returned 1 [0223.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.id_1622540890_.your_last_chance")) returned 1 [0223.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b96f0 [0223.436] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0223.436] GetProcessHeap () returned 0x580000 [0223.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcd1d0 [0223.436] GetProcessHeap () returned 0x580000 [0223.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcd540 [0223.436] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.436] ReadFile (in: hFile=0x494, lpBuffer=0x6dcd1d0, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesRead=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.459] GetProcessHeap () returned 0x580000 [0223.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0223.459] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.459] WriteFile (in: hFile=0x494, lpBuffer=0x6dcd540*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd540*, lpNumberOfBytesWritten=0x2d8ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.459] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.459] WriteFile (in: hFile=0x494, lpBuffer=0x6dcd87f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd87f*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.459] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.459] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.459] CloseHandle (hObject=0x494) returned 1 [0223.460] GetProcessHeap () returned 0x580000 [0223.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd540 | out: hHeap=0x580000) returned 1 [0223.460] GetProcessHeap () returned 0x580000 [0223.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0223.460] GetProcessHeap () returned 0x580000 [0223.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0223.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcce9980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x2d8fd28, dwReserved1=0x6dcd1d0, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b96f0 [0223.483] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.566] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", len=0x6b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned 1 [0223.566] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0223.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0224.971] CloseHandle (hObject=0x410) returned 1 [0224.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0224.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0224.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0224.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14316, dwReserved0=0x2e0067, dwReserved1=0x640069, cFileName="InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b9630 [0224.973] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0224.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0224.974] GetProcessHeap () returned 0x580000 [0224.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0224.974] GetProcessHeap () returned 0x580000 [0224.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0224.974] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.974] ReadFile (in: hFile=0x410, lpBuffer=0x702a188, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.723] GetProcessHeap () returned 0x580000 [0233.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0233.724] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.724] WriteFile (in: hFile=0x410, lpBuffer=0x703b9b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.724] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.724] WriteFile (in: hFile=0x410, lpBuffer=0x704d1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x704d1b7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.724] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.724] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.725] CloseHandle (hObject=0x410) returned 1 [0233.725] GetProcessHeap () returned 0x580000 [0233.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0233.725] GetProcessHeap () returned 0x580000 [0233.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0233.725] GetProcessHeap () returned 0x580000 [0233.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0233.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d51480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1433a, dwReserved0=0x2d8fd28, dwReserved1=0x702a188, cFileName="InfoPathWelcomeImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b9630 [0233.725] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0235.418] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", len=0x5e | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned 1 [0235.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd8) returned 0x6dee6e0 [0235.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0235.480] CloseHandle (hObject=0x484) returned 1 [0235.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0235.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.id_1622540890_.your_last_chance")) returned 1 [0235.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0235.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~3.YOU")) returned 0x5b9730 [0235.482] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0235.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0235.482] GetProcessHeap () returned 0x580000 [0235.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0235.482] GetProcessHeap () returned 0x580000 [0235.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0235.482] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.482] ReadFile (in: hFile=0x484, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x2d8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0235.484] GetProcessHeap () returned 0x580000 [0235.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0235.484] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.484] WriteFile (in: hFile=0x484, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x2d8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0235.484] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.484] WriteFile (in: hFile=0x484, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0235.484] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.484] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0235.484] CloseHandle (hObject=0x484) returned 1 [0235.484] GetProcessHeap () returned 0x580000 [0235.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0235.484] GetProcessHeap () returned 0x580000 [0235.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0235.484] GetProcessHeap () returned 0x580000 [0235.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0239.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3e20fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x2d8fd28, dwReserved1=0x60e978, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~3.YOU")) returned 0x5b9730 [0239.601] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.715] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", len=0x39 | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned 1 [0239.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0239.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0240.248] CloseHandle (hObject=0x390) returned 1 [0240.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.id_1622540890_.your_last_chance")) returned 1 [0240.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b9730 [0240.249] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenoteirm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0240.249] GetProcessHeap () returned 0x580000 [0240.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0240.249] GetProcessHeap () returned 0x580000 [0240.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0240.249] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.249] ReadFile (in: hFile=0x390, lpBuffer=0x7018958, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesRead=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0243.910] GetProcessHeap () returned 0x580000 [0243.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0243.910] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.911] WriteFile (in: hFile=0x390, lpBuffer=0x702a188*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesWritten=0x2d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0243.912] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.913] WriteFile (in: hFile=0x390, lpBuffer=0x703b987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b987*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0243.913] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.913] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0243.913] CloseHandle (hObject=0x390) returned 1 [0243.913] GetProcessHeap () returned 0x580000 [0243.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0243.913] GetProcessHeap () returned 0x580000 [0243.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0244.227] GetProcessHeap () returned 0x580000 [0244.227] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0248.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e77660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13918, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="ONENOTEIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b9630 [0248.283] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.321] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR", len=0x3b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 1 [0248.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0248.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0248.322] CloseHandle (hObject=0x488) returned 1 [0248.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.id_1622540890_.your_last_chance")) returned 1 [0248.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB7~1.YOU")) returned 0x5b9630 [0248.323] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0248.323] GetProcessHeap () returned 0x580000 [0248.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79a1) returned 0x7061928 [0248.324] GetProcessHeap () returned 0x580000 [0248.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79a1) returned 0x7100718 [0248.324] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.324] ReadFile (in: hFile=0x488, lpBuffer=0x7061928, nNumberOfBytesToRead=0x7980, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x2d8ff14*=0x7980, lpOverlapped=0x0) returned 1 [0250.190] GetProcessHeap () returned 0x580000 [0250.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0250.190] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.190] WriteFile (in: hFile=0x488, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x2d8ff14*=0x7980, lpOverlapped=0x0) returned 1 [0250.190] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.190] WriteFile (in: hFile=0x488, lpBuffer=0x7108097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7108097*, lpNumberOfBytesWritten=0x2d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0250.191] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.191] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0250.191] CloseHandle (hObject=0x488) returned 1 [0250.191] GetProcessHeap () returned 0x580000 [0250.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0250.191] GetProcessHeap () returned 0x580000 [0250.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0250.191] GetProcessHeap () returned 0x580000 [0250.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fccc | out: lpFindFileData=0x2d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca45f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79be, dwReserved0=0x2d8fd28, dwReserved1=0x7061928, cFileName="MSPUB7.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB7~1.YOU")) returned 0x5b9730 [0253.680] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.434] SysReAllocStringLen (in: pbstr=0x2d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC", len=0x3b | out: pbstr=0x2d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC") returned 1 [0254.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fdc) returned 0x72e5948 [0254.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.419] CloseHandle (hObject=0x410) returned 1 [0260.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc.id_1622540890_.your_last_chance")) returned 1 [0260.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2d8fc74 | out: lpFindFileData=0x2d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENV11P~1.YOU")) returned 0x5b9630 [0260.425] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.426] GetProcessHeap () returned 0x580000 [0260.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc601) returned 0x747e158 [0260.426] GetProcessHeap () returned 0x580000 [0260.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc601) returned 0x748a768 [0260.427] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.427] ReadFile (in: hFile=0x3b8, lpBuffer=0x747e158, nNumberOfBytesToRead=0xc5e0, lpNumberOfBytesRead=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x747e158*, lpNumberOfBytesRead=0x2d8ff14*=0xc5e0, lpOverlapped=0x0) returned 1 [0265.230] GetProcessHeap () returned 0x580000 [0265.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0265.230] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.230] WriteFile (in: hFile=0x3b8, lpBuffer=0x748a768*, nNumberOfBytesToWrite=0xc5e0, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x748a768*, lpNumberOfBytesWritten=0x2d8ff14*=0xc5e0, lpOverlapped=0x0) returned 1 [0265.231] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.232] WriteFile (hFile=0x3b8, lpBuffer=0x7496d47, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d8ff14, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xa2c [0039.060] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.108] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.557] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.143] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.696] Sleep (dwMilliseconds=0x1) [0043.712] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.685] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", len=0x4d | out: pbstr=0x2e8ff84*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 1 [0059.686] GetProcessHeap () returned 0x580000 [0059.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa50, Size=0x3c) returned 0x61a8a0 [0059.686] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0064.585] CloseHandle (hObject=0x46c) returned 1 [0064.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0064.585] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id_1622540890_.your_last_chance")) returned 1 [0066.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.561] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b9630 [0067.131] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.131] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0067.131] GetProcessHeap () returned 0x580000 [0067.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f69938 [0067.131] GetProcessHeap () returned 0x580000 [0067.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f69fa8 [0067.131] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.131] ReadFile (in: hFile=0x478, lpBuffer=0x6f69938, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69938*, lpNumberOfBytesRead=0x2e8ff14*=0x640, lpOverlapped=0x0) returned 1 [0067.975] GetProcessHeap () returned 0x580000 [0067.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0067.975] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.975] WriteFile (in: hFile=0x478, lpBuffer=0x6f69fa8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69fa8*, lpNumberOfBytesWritten=0x2e8ff14*=0x640, lpOverlapped=0x0) returned 1 [0067.976] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.976] WriteFile (in: hFile=0x478, lpBuffer=0x6f6a5e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a5e7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.976] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.976] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.976] CloseHandle (hObject=0x478) returned 1 [0067.977] GetProcessHeap () returned 0x580000 [0067.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69fa8 | out: hHeap=0x580000) returned 1 [0067.977] GetProcessHeap () returned 0x580000 [0067.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69938 | out: hHeap=0x580000) returned 1 [0067.977] GetProcessHeap () returned 0x580000 [0067.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0068.744] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x6042c420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x2e8fd28, dwReserved1=0x6f69938, cFileName="OneNoteMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b96b0 [0068.744] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.831] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", len=0x4b | out: pbstr=0x2e8ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 1 [0068.831] GetProcessHeap () returned 0x580000 [0068.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9710 | out: hHeap=0x580000) returned 1 [0068.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0068.831] CloseHandle (hObject=0x484) returned 1 [0068.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.831] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id_1622540890_.your_last_chance")) returned 1 [0071.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0071.886] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x45, dwReserved1=0x0, cFileName="branding.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b9770 [0071.886] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0071.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0071.886] GetProcessHeap () returned 0x580000 [0071.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0071.886] GetProcessHeap () returned 0x580000 [0071.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0071.887] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.887] ReadFile (in: hFile=0x484, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0075.112] GetProcessHeap () returned 0x580000 [0075.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0075.113] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.113] WriteFile (in: hFile=0x484, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0075.113] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.113] WriteFile (in: hFile=0x484, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.740] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.740] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.740] CloseHandle (hObject=0x484) returned 1 [0075.740] GetProcessHeap () returned 0x580000 [0075.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0075.740] GetProcessHeap () returned 0x580000 [0075.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0075.741] GetProcessHeap () returned 0x580000 [0075.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0079.341] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0x64c2dda0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91999, dwReserved0=0x2e8fd28, dwReserved1=0x6d10048, cFileName="branding.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b96f0 [0079.341] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.489] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", len=0x6a | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 1 [0079.489] GetProcessHeap () returned 0x580000 [0079.489] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0079.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0079.535] CloseHandle (hObject=0x458) returned 1 [0079.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id_1622540890_.your_last_chance")) returned 1 [0079.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b96f0 [0079.536] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0079.536] GetProcessHeap () returned 0x580000 [0079.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f06f08 [0079.536] GetProcessHeap () returned 0x580000 [0079.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f09b20 [0079.536] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.536] ReadFile (in: hFile=0x458, lpBuffer=0x6f06f08, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06f08*, lpNumberOfBytesRead=0x2e8ff14*=0x540, lpOverlapped=0x0) returned 1 [0079.565] GetProcessHeap () returned 0x580000 [0079.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.565] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.565] WriteFile (in: hFile=0x458, lpBuffer=0x6f09b20*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b20*, lpNumberOfBytesWritten=0x2e8ff14*=0x540, lpOverlapped=0x0) returned 1 [0079.566] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.566] WriteFile (in: hFile=0x458, lpBuffer=0x6f0a05f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a05f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.566] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.566] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.566] CloseHandle (hObject=0x458) returned 1 [0079.566] GetProcessHeap () returned 0x580000 [0079.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b20 | out: hHeap=0x580000) returned 1 [0079.566] GetProcessHeap () returned 0x580000 [0079.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06f08 | out: hHeap=0x580000) returned 1 [0079.566] GetProcessHeap () returned 0x580000 [0079.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x670a0e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x569, dwReserved0=0x2e8fd28, dwReserved1=0x6f06f08, cFileName="AccessMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b96f0 [0079.566] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.773] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", len=0x64 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 1 [0083.773] GetProcessHeap () returned 0x580000 [0083.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0083.787] CloseHandle (hObject=0x480) returned 1 [0083.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0083.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0083.788] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0083.788] GetProcessHeap () returned 0x580000 [0083.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6f0efe0 [0083.788] GetProcessHeap () returned 0x580000 [0083.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6f094f0 [0083.789] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.789] ReadFile (in: hFile=0x480, lpBuffer=0x6f0efe0, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0efe0*, lpNumberOfBytesRead=0x2e8ff14*=0x960, lpOverlapped=0x0) returned 1 [0083.799] GetProcessHeap () returned 0x580000 [0083.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.799] WriteFile (in: hFile=0x480, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x2e8ff14*=0x960, lpOverlapped=0x0) returned 1 [0083.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.799] WriteFile (in: hFile=0x480, lpBuffer=0x6f09e4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09e4f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.799] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.799] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.799] CloseHandle (hObject=0x480) returned 1 [0083.800] GetProcessHeap () returned 0x580000 [0083.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0083.800] GetProcessHeap () returned 0x580000 [0083.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0efe0 | out: hHeap=0x580000) returned 1 [0083.800] GetProcessHeap () returned 0x580000 [0083.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x698f2320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x2e8fd28, dwReserved1=0x6f0efe0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0083.800] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.972] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", len=0x43 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 1 [0085.972] GetProcessHeap () returned 0x580000 [0085.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x5c) returned 0x614a48 [0085.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.988] Sleep (dwMilliseconds=0x1) [0086.209] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", len=0x43 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 1 [0086.209] GetProcessHeap () returned 0x580000 [0086.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0086.209] CloseHandle (hObject=0x490) returned 1 [0086.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id_1622540890_.your_last_chance")) returned 1 [0086.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPFT63~1.YOU")) returned 0x5b9630 [0086.210] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0086.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0086.210] GetProcessHeap () returned 0x580000 [0086.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0086.211] GetProcessHeap () returned 0x580000 [0086.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0086.211] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.211] ReadFile (in: hFile=0x490, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0090.377] GetProcessHeap () returned 0x580000 [0090.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0090.377] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.377] WriteFile (in: hFile=0x490, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0090.760] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.760] WriteFile (in: hFile=0x490, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.440] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.440] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.440] CloseHandle (hObject=0x490) returned 1 [0091.622] GetProcessHeap () returned 0x580000 [0091.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0091.622] GetProcessHeap () returned 0x580000 [0091.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0091.625] GetProcessHeap () returned 0x580000 [0091.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46b94, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="WPFT632.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPFT63~1.YOU")) returned 0x5b96f0 [0091.669] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.827] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", len=0x4d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 1 [0091.827] GetProcessHeap () returned 0x580000 [0091.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0091.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0091.840] CloseHandle (hObject=0x48c) returned 1 [0091.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.841] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id_1622540890_.your_last_chance")) returned 1 [0091.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EVRGRE~1.YOU")) returned 0x5b9730 [0091.849] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0091.849] GetProcessHeap () returned 0x580000 [0091.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f0c4f8 [0091.849] GetProcessHeap () returned 0x580000 [0091.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f0c748 [0091.849] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.849] ReadFile (in: hFile=0x48c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x2e8ff14*=0x220, lpOverlapped=0x0) returned 1 [0091.876] GetProcessHeap () returned 0x580000 [0091.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.876] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.877] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c748*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c748*, lpNumberOfBytesWritten=0x2e8ff14*=0x220, lpOverlapped=0x0) returned 1 [0091.877] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.877] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c967*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c967*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.877] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.877] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.877] CloseHandle (hObject=0x48c) returned 1 [0091.877] GetProcessHeap () returned 0x580000 [0091.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c748 | out: hHeap=0x580000) returned 1 [0091.877] GetProcessHeap () returned 0x580000 [0091.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0091.877] GetProcessHeap () returned 0x580000 [0091.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e602b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x247, dwReserved0=0x2e8fd28, dwReserved1=0x6f0c4f8, cFileName="EVRGREEN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EVRGRE~1.YOU")) returned 0x5b96f0 [0091.877] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.965] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", len=0x45 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 1 [0091.965] GetProcessHeap () returned 0x580000 [0091.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a468 [0091.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.977] CloseHandle (hObject=0x4a0) returned 1 [0091.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id_1622540890_.your_last_chance")) returned 1 [0091.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IRISEL~1.YOU")) returned 0x5b9730 [0091.981] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.981] GetProcessHeap () returned 0x580000 [0091.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10161) returned 0x652ad0 [0091.982] GetProcessHeap () returned 0x580000 [0091.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10161) returned 0x6f2a8c8 [0091.982] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.982] ReadFile (in: hFile=0x4a0, lpBuffer=0x652ad0, nNumberOfBytesToRead=0x10140, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x652ad0*, lpNumberOfBytesRead=0x2e8ff14*=0x10140, lpOverlapped=0x0) returned 1 [0099.035] GetProcessHeap () returned 0x580000 [0099.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.036] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f2a8c8*, nNumberOfBytesToWrite=0x10140, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2a8c8*, lpNumberOfBytesWritten=0x2e8ff14*=0x10140, lpOverlapped=0x0) returned 1 [0099.036] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3aa07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3aa07*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.036] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.036] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.036] CloseHandle (hObject=0x4a0) returned 1 [0099.037] GetProcessHeap () returned 0x580000 [0099.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2a8c8 | out: hHeap=0x580000) returned 1 [0099.037] GetProcessHeap () returned 0x580000 [0099.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x652ad0 | out: hHeap=0x580000) returned 1 [0099.042] GetProcessHeap () returned 0x580000 [0099.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72a4c280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10181, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="IRIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IRISEL~1.YOU")) returned 0x5b96b0 [0099.043] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.404] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", len=0x4d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 1 [0101.404] GetProcessHeap () returned 0x580000 [0101.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0101.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0103.880] CloseHandle (hObject=0x4b0) returned 1 [0103.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0103.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id_1622540890_.your_last_chance")) returned 1 [0103.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0103.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRTED~2.YOU")) returned 0x5b9730 [0103.891] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0103.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0103.891] GetProcessHeap () returned 0x580000 [0103.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe241) returned 0x6c57108 [0103.892] GetProcessHeap () returned 0x580000 [0103.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe241) returned 0x6599d0 [0103.892] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.893] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c57108, nNumberOfBytesToRead=0xe220, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x2e8ff14*=0xe220, lpOverlapped=0x0) returned 1 [0106.143] GetProcessHeap () returned 0x580000 [0106.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0106.144] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.144] WriteFile (in: hFile=0x4a4, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0xe220, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x2e8ff14*=0xe220, lpOverlapped=0x0) returned 1 [0106.144] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.144] WriteFile (in: hFile=0x4a4, lpBuffer=0x667bef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x667bef*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.144] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.144] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.144] CloseHandle (hObject=0x4a4) returned 1 [0106.145] GetProcessHeap () returned 0x580000 [0106.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0106.145] GetProcessHeap () returned 0x580000 [0106.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0106.148] GetProcessHeap () returned 0x580000 [0106.148] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0106.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76e23580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe256, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="STRTEDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRTED~2.YOU")) returned 0x5b96b0 [0106.148] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0111.844] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\fieldswitch.ax", len=0x29 | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 1 [0111.844] GetProcessHeap () returned 0x580000 [0111.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.868] Sleep (dwMilliseconds=0x1) [0111.892] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", len=0x2c | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 1 [0111.892] GetProcessHeap () returned 0x580000 [0111.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.892] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.910] Sleep (dwMilliseconds=0x1) [0111.946] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", len=0x3b | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 1 [0111.947] GetProcessHeap () returned 0x580000 [0111.947] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61db40, Size=0x8c) returned 0x61daa8 [0111.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.958] Sleep (dwMilliseconds=0x1) [0112.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.064] Sleep (dwMilliseconds=0x1) [0112.128] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", len=0x4d | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned 1 [0112.129] GetProcessHeap () returned 0x580000 [0112.129] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x2c) returned 0x61f848 [0112.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.138] Sleep (dwMilliseconds=0x1) [0112.219] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", len=0x55 | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.219] GetProcessHeap () returned 0x580000 [0112.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.219] Sleep (dwMilliseconds=0x1) [0112.236] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", len=0x4b | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 1 [0112.236] GetProcessHeap () returned 0x580000 [0112.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.236] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.250] Sleep (dwMilliseconds=0x1) [0112.367] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", len=0x4a | out: pbstr=0x2e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 1 [0112.367] GetProcessHeap () returned 0x580000 [0112.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.389] Sleep (dwMilliseconds=0x1) [0113.316] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", len=0x3f | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 1 [0113.316] GetProcessHeap () returned 0x580000 [0113.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xe4) returned 0x6f0ceb8 [0113.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0113.491] CloseHandle (hObject=0x414) returned 1 [0113.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0350~1.YOU")) returned 0x5b9630 [0114.931] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0114.931] GetProcessHeap () returned 0x580000 [0114.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2421) returned 0x6c2a808 [0114.931] GetProcessHeap () returned 0x580000 [0114.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2421) returned 0x6c2cc38 [0114.931] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.931] ReadFile (in: hFile=0x414, lpBuffer=0x6c2a808, nNumberOfBytesToRead=0x2400, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a808*, lpNumberOfBytesRead=0x2e8ff14*=0x2400, lpOverlapped=0x0) returned 1 [0114.964] GetProcessHeap () returned 0x580000 [0114.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.964] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.964] WriteFile (in: hFile=0x414, lpBuffer=0x6c2cc38*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2cc38*, lpNumberOfBytesWritten=0x2e8ff14*=0x2400, lpOverlapped=0x0) returned 1 [0114.964] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.964] WriteFile (in: hFile=0x414, lpBuffer=0x6c2f037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2f037*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.964] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.964] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.964] CloseHandle (hObject=0x414) returned 1 [0114.965] GetProcessHeap () returned 0x580000 [0114.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2cc38 | out: hHeap=0x580000) returned 1 [0114.965] GetProcessHeap () returned 0x580000 [0114.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a808 | out: hHeap=0x580000) returned 1 [0114.965] GetProcessHeap () returned 0x580000 [0114.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c231e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x2e8fd28, dwReserved1=0x6c2a808, cFileName="AN03500_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0350~1.YOU")) returned 0x5b9630 [0116.033] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.795] CloseHandle (hObject=0x49c) returned 1 [0118.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUBBY~2.YOU")) returned 0x5b9730 [0118.796] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.797] GetProcessHeap () returned 0x580000 [0118.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0118.797] GetProcessHeap () returned 0x580000 [0118.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0118.797] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.797] ReadFile (in: hFile=0x49c, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x2e8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0118.806] GetProcessHeap () returned 0x580000 [0118.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.807] WriteFile (in: hFile=0x49c, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x2e8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0118.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.807] WriteFile (in: hFile=0x49c, lpBuffer=0x62f717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f717*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.807] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.807] CloseHandle (hObject=0x49c) returned 1 [0118.807] GetProcessHeap () returned 0x580000 [0118.807] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0118.807] GetProcessHeap () returned 0x580000 [0118.807] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.807] GetProcessHeap () returned 0x580000 [0118.807] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e6cb0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x2e8fd28, dwReserved1=0x6c676b8, cFileName="STUBBY2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUBBY~2.YOU")) returned 0x5b96f0 [0120.125] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.152] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", len=0x4c | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 1 [0120.152] GetProcessHeap () returned 0x580000 [0120.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c0) returned 0x6d06ca8 [0120.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.109] CloseHandle (hObject=0x440) returned 1 [0122.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~2.YOU")) returned 0x5b9730 [0122.110] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.111] GetProcessHeap () returned 0x580000 [0122.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6037d8 [0122.111] GetProcessHeap () returned 0x580000 [0122.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x603d20 [0122.111] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.111] ReadFile (in: hFile=0x440, lpBuffer=0x6037d8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6037d8*, lpNumberOfBytesRead=0x2e8ff14*=0x500, lpOverlapped=0x0) returned 1 [0122.116] GetProcessHeap () returned 0x580000 [0122.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.117] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.117] WriteFile (in: hFile=0x440, lpBuffer=0x603d20*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x603d20*, lpNumberOfBytesWritten=0x2e8ff14*=0x500, lpOverlapped=0x0) returned 1 [0122.117] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.117] WriteFile (in: hFile=0x440, lpBuffer=0x60421f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60421f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.117] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.117] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.117] CloseHandle (hObject=0x440) returned 1 [0122.117] GetProcessHeap () returned 0x580000 [0122.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x603d20 | out: hHeap=0x580000) returned 1 [0122.117] GetProcessHeap () returned 0x580000 [0122.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6037d8 | out: hHeap=0x580000) returned 1 [0122.117] GetProcessHeap () returned 0x580000 [0122.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80655420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x2e8fd28, dwReserved1=0x6037d8, cFileName="WB02074_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~2.YOU")) returned 0x5b9730 [0124.406] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.420] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", len=0x4c | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned 1 [0124.420] GetProcessHeap () returned 0x580000 [0124.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1900) returned 0x6f42f08 [0124.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0125.570] CloseHandle (hObject=0x470) returned 1 [0125.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.id_1622540890_.your_last_chance")) returned 1 [0125.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOUNDR~1.YOU")) returned 0x5b9730 [0125.572] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0125.572] GetProcessHeap () returned 0x580000 [0125.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xee1) returned 0x6c29878 [0125.572] GetProcessHeap () returned 0x580000 [0125.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xee1) returned 0x6ce2378 [0125.572] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.572] ReadFile (in: hFile=0x470, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xec0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x2e8ff14*=0xec0, lpOverlapped=0x0) returned 1 [0125.589] GetProcessHeap () returned 0x580000 [0125.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.589] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.589] WriteFile (in: hFile=0x470, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x2e8ff14*=0xec0, lpOverlapped=0x0) returned 1 [0125.589] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.589] WriteFile (in: hFile=0x470, lpBuffer=0x6ce3237*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3237*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.589] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.590] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.590] CloseHandle (hObject=0x470) returned 1 [0125.590] GetProcessHeap () returned 0x580000 [0125.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0125.590] GetProcessHeap () returned 0x580000 [0125.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.590] GetProcessHeap () returned 0x580000 [0125.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x827826c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x2e8fd28, dwReserved1=0x6c29878, cFileName="Foundry.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOUNDR~1.YOU")) returned 0x5b9730 [0125.590] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.596] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", len=0x3d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned 1 [0125.596] GetProcessHeap () returned 0x580000 [0125.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e4) returned 0x667250 [0125.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0128.869] CloseHandle (hObject=0x4a8) returned 1 [0128.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03014~1.YOU")) returned 0x5b96f0 [0129.076] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0129.077] GetProcessHeap () returned 0x580000 [0129.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f61) returned 0x6f14048 [0129.077] GetProcessHeap () returned 0x580000 [0129.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f61) returned 0x6dd20d0 [0129.077] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.077] ReadFile (in: hFile=0x4a8, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x1f40, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x2e8ff14*=0x1f40, lpOverlapped=0x0) returned 1 [0129.105] GetProcessHeap () returned 0x580000 [0129.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.105] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.105] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dd20d0*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesWritten=0x2e8ff14*=0x1f40, lpOverlapped=0x0) returned 1 [0129.106] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.106] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dd400f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd400f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.106] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.106] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.106] CloseHandle (hObject=0x4a8) returned 1 [0129.106] GetProcessHeap () returned 0x580000 [0129.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0129.106] GetProcessHeap () returned 0x580000 [0129.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0129.106] GetProcessHeap () returned 0x580000 [0129.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848fbc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x2e8fd28, dwReserved1=0x6f14048, cFileName="J0301480.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03014~1.YOU")) returned 0x5b9730 [0129.600] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.668] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta", len=0x40 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 1 [0129.668] GetProcessHeap () returned 0x580000 [0129.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0129.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.439] CloseHandle (hObject=0x3e4) returned 1 [0132.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id_1622540890_.your_last_chance")) returned 1 [0132.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b9730 [0132.440] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.440] GetProcessHeap () returned 0x580000 [0132.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ea16a0 [0132.441] GetProcessHeap () returned 0x580000 [0132.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eb2ed0 [0132.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.442] ReadFile (in: hFile=0x3e4, lpBuffer=0x6ea16a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea16a0*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.029] GetProcessHeap () returned 0x580000 [0137.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0137.030] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.030] WriteFile (in: hFile=0x3e4, lpBuffer=0x6eb2ed0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2ed0*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.471] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.471] WriteFile (in: hFile=0x3e4, lpBuffer=0x6ec46cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec46cf*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.538] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.538] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.539] CloseHandle (hObject=0x3e4) returned 1 [0138.608] GetProcessHeap () returned 0x580000 [0138.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb2ed0 | out: hHeap=0x580000) returned 1 [0138.608] GetProcessHeap () returned 0x580000 [0138.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea16a0 | out: hHeap=0x580000) returned 1 [0138.608] GetProcessHeap () returned 0x580000 [0138.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x587ed, dwReserved0=0x2e8fd28, dwReserved1=0x6ea16a0, cFileName="Discussion14.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b9770 [0139.880] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.908] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", len=0x57 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css") returned 1 [0139.908] GetProcessHeap () returned 0x580000 [0139.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0139.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.049] CloseHandle (hObject=0x3b4) returned 1 [0140.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.id_1622540890_.your_last_chance")) returned 1 [0140.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="Discussion.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b9770 [0140.050] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.050] GetProcessHeap () returned 0x580000 [0140.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0140.051] GetProcessHeap () returned 0x580000 [0140.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0140.051] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.051] ReadFile (in: hFile=0x3b4, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x2e8ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.053] GetProcessHeap () returned 0x580000 [0140.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.053] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.053] WriteFile (in: hFile=0x3b4, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x2e8ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.053] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.053] WriteFile (in: hFile=0x3b4, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.053] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.053] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.053] CloseHandle (hObject=0x3b4) returned 1 [0140.053] GetProcessHeap () returned 0x580000 [0140.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.053] GetProcessHeap () returned 0x580000 [0140.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.053] GetProcessHeap () returned 0x580000 [0140.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b16c160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x197, dwReserved0=0x2e8fd28, dwReserved1=0x5aa990, cFileName="Discussion.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b9770 [0140.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.448] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", len=0x43 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned 1 [0140.448] GetProcessHeap () returned 0x580000 [0140.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd0) returned 0x6f14048 [0140.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.469] CloseHandle (hObject=0x3a8) returned 1 [0140.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1515~1.YOU")) returned 0x5b9770 [0140.470] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.470] GetProcessHeap () returned 0x580000 [0140.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0140.470] GetProcessHeap () returned 0x580000 [0140.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0140.470] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.470] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x2e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.472] GetProcessHeap () returned 0x580000 [0140.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.472] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x2e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.473] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.473] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.473] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.473] CloseHandle (hObject=0x3a8) returned 1 [0140.473] GetProcessHeap () returned 0x580000 [0140.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0140.473] GetProcessHeap () returned 0x580000 [0140.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0140.473] GetProcessHeap () returned 0x580000 [0140.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b570680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x2e8fd28, dwReserved1=0x6f3bec0, cFileName="BD15156_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1515~1.YOU")) returned 0x5b9730 [0140.786] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.813] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC", len=0x3d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 1 [0140.813] GetProcessHeap () returned 0x580000 [0140.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0140.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.814] CloseHandle (hObject=0x448) returned 1 [0140.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0140.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~4.YOU")) returned 0x5b9730 [0140.815] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.815] GetProcessHeap () returned 0x580000 [0140.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0140.815] GetProcessHeap () returned 0x580000 [0140.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0140.815] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.815] ReadFile (in: hFile=0x448, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x2e8ff14*=0x260, lpOverlapped=0x0) returned 1 [0140.858] GetProcessHeap () returned 0x580000 [0140.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.858] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.858] WriteFile (in: hFile=0x448, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x2e8ff14*=0x260, lpOverlapped=0x0) returned 1 [0140.859] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.859] WriteFile (in: hFile=0x448, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.859] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.859] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.859] CloseHandle (hObject=0x448) returned 1 [0140.859] GetProcessHeap () returned 0x580000 [0140.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0140.859] GetProcessHeap () returned 0x580000 [0140.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0140.859] GetProcessHeap () returned 0x580000 [0140.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b9288e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x2e8fd28, dwReserved1=0x6d08520, cFileName="MSOUC_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~4.YOU")) returned 0x5b9730 [0140.859] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.916] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS", len=0x3c | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 1 [0140.916] GetProcessHeap () returned 0x580000 [0140.916] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.916] CloseHandle (hObject=0x170) returned 1 [0140.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id_1622540890_.your_last_chance")) returned 1 [0140.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSF685~1.YOU")) returned 0x5b9730 [0140.917] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.918] GetProcessHeap () returned 0x580000 [0140.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0140.918] GetProcessHeap () returned 0x580000 [0140.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ea1008 [0140.918] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.918] ReadFile (in: hFile=0x170, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.292] GetProcessHeap () returned 0x580000 [0143.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0143.292] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.292] WriteFile (in: hFile=0x170, lpBuffer=0x6ea1008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.293] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.293] WriteFile (in: hFile=0x170, lpBuffer=0x6eb2807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2807*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0143.602] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.602] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0143.602] CloseHandle (hObject=0x170) returned 1 [0143.971] GetProcessHeap () returned 0x580000 [0143.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0143.972] GetProcessHeap () returned 0x580000 [0143.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0143.972] GetProcessHeap () returned 0x580000 [0143.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d357ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c36, dwReserved0=0x2e8fd28, dwReserved1=0x6f468d8, cFileName="MSACCESS.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSF685~1.YOU")) returned 0x5b96f0 [0146.862] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.876] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", len=0x44 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned 1 [0146.876] GetProcessHeap () returned 0x580000 [0146.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.038] CloseHandle (hObject=0x4a0) returned 1 [0153.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.id_1622540890_.your_last_chance")) returned 1 [0153.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR29~2.YOU")) returned 0x5b9730 [0153.039] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.040] GetProcessHeap () returned 0x580000 [0153.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x6dd7c30 [0153.040] GetProcessHeap () returned 0x580000 [0153.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x67ec60 [0153.040] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.040] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x11a0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x2e8ff14*=0x11a0, lpOverlapped=0x0) returned 1 [0153.056] GetProcessHeap () returned 0x580000 [0153.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.056] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.056] WriteFile (in: hFile=0x4a0, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x2e8ff14*=0x11a0, lpOverlapped=0x0) returned 1 [0153.057] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.057] WriteFile (in: hFile=0x4a0, lpBuffer=0x67fdff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fdff*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.057] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.057] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.057] CloseHandle (hObject=0x4a0) returned 1 [0153.057] GetProcessHeap () returned 0x580000 [0153.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0153.057] GetProcessHeap () returned 0x580000 [0153.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0153.057] GetProcessHeap () returned 0x580000 [0153.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92d7fc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11d7, dwReserved0=0x2e8fd28, dwReserved1=0x6dd7c30, cFileName="PDIR29B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR29~2.YOU")) returned 0x5b9630 [0153.753] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.456] CloseHandle (hObject=0x4a0) returned 1 [0155.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WID6D6~1.YOU")) returned 0x5b9730 [0155.458] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.458] GetProcessHeap () returned 0x580000 [0155.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.458] GetProcessHeap () returned 0x580000 [0155.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.458] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.458] ReadFile (in: hFile=0x4a0, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x2e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.459] GetProcessHeap () returned 0x580000 [0155.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.459] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.459] WriteFile (in: hFile=0x4a0, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x2e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.459] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.460] WriteFile (in: hFile=0x4a0, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.460] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.460] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.460] CloseHandle (hObject=0x4a0) returned 1 [0155.460] GetProcessHeap () returned 0x580000 [0155.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.460] GetProcessHeap () returned 0x580000 [0155.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.460] GetProcessHeap () returned 0x580000 [0155.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94468fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2e8fd28, dwReserved1=0x61b540, cFileName="WINWORD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WID6D6~1.YOU")) returned 0x5b9630 [0155.972] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.986] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", len=0x3d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 1 [0155.986] GetProcessHeap () returned 0x580000 [0155.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0155.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0165.923] CloseHandle (hObject=0x48c) returned 1 [0165.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id_1622540890_.your_last_chance")) returned 1 [0165.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART2~1.YOU")) returned 0x5b9730 [0165.924] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0165.924] GetProcessHeap () returned 0x580000 [0165.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb861) returned 0x6f58108 [0165.924] GetProcessHeap () returned 0x580000 [0165.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb861) returned 0x6481a0 [0165.924] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.924] ReadFile (in: hFile=0x48c, lpBuffer=0x6f58108, nNumberOfBytesToRead=0xb840, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x2e8ff14*=0xb840, lpOverlapped=0x0) returned 1 [0168.156] GetProcessHeap () returned 0x580000 [0168.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0168.156] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.156] WriteFile (in: hFile=0x48c, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0xb840, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x2e8ff14*=0xb840, lpOverlapped=0x0) returned 1 [0168.156] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.156] WriteFile (in: hFile=0x48c, lpBuffer=0x6539df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6539df*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0168.156] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.156] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0168.157] CloseHandle (hObject=0x48c) returned 1 [0168.157] GetProcessHeap () returned 0x580000 [0168.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0168.157] GetProcessHeap () returned 0x580000 [0168.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0168.157] GetProcessHeap () returned 0x580000 [0168.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bd82f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb878, dwReserved0=0x2e8fd28, dwReserved1=0x6f58108, cFileName="MSART2.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART2~1.YOU")) returned 0x5b9730 [0170.192] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.234] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", len=0x69 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 1 [0170.234] GetProcessHeap () returned 0x580000 [0170.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b0) returned 0x6f14048 [0170.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0170.234] CloseHandle (hObject=0x46c) returned 1 [0170.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.id_1622540890_.your_last_chance")) returned 1 [0171.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0171.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNED~1.YOU")) returned 0x5b9770 [0171.523] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0171.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0171.524] GetProcessHeap () returned 0x580000 [0171.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e023e8 [0171.524] GetProcessHeap () returned 0x580000 [0171.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e026f0 [0171.524] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.524] ReadFile (in: hFile=0x46c, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x2e8ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0171.527] GetProcessHeap () returned 0x580000 [0171.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0171.527] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.527] WriteFile (in: hFile=0x46c, lpBuffer=0x6e026f0*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e026f0*, lpNumberOfBytesWritten=0x2e8ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0171.528] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.528] WriteFile (in: hFile=0x46c, lpBuffer=0x6e029af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e029af*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.528] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.528] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.528] CloseHandle (hObject=0x46c) returned 1 [0171.528] GetProcessHeap () returned 0x580000 [0171.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e026f0 | out: hHeap=0x580000) returned 1 [0171.528] GetProcessHeap () returned 0x580000 [0171.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0171.528] GetProcessHeap () returned 0x580000 [0171.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0173.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dda5820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x302, dwReserved0=0x2e8fd28, dwReserved1=0x6e023e8, cFileName="SignedComponents.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNED~1.YOU")) returned 0x5b9770 [0173.048] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.086] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", len=0x42 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 1 [0173.086] GetProcessHeap () returned 0x580000 [0173.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0173.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.096] CloseHandle (hObject=0x46c) returned 1 [0173.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id_1622540890_.your_last_chance")) returned 1 [0173.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ecff500, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~1.YOU")) returned 0x5b9770 [0173.097] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.098] GetProcessHeap () returned 0x580000 [0173.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0173.098] GetProcessHeap () returned 0x580000 [0173.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0173.098] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.098] ReadFile (in: hFile=0x46c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x2e8ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.103] GetProcessHeap () returned 0x580000 [0173.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.103] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.103] WriteFile (in: hFile=0x46c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x2e8ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.103] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.103] WriteFile (in: hFile=0x46c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.103] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.103] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.103] CloseHandle (hObject=0x46c) returned 1 [0173.103] GetProcessHeap () returned 0x580000 [0173.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0173.103] GetProcessHeap () returned 0x580000 [0173.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0173.103] GetProcessHeap () returned 0x580000 [0173.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ecac300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x2e8fd28, dwReserved1=0x5cf780, cFileName="RSSITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~1.YOU")) returned 0x5b9770 [0173.388] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.394] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", len=0x43 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 1 [0173.395] GetProcessHeap () returned 0x580000 [0173.395] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0173.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.455] CloseHandle (hObject=0x3fc) returned 1 [0173.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id_1622540890_.your_last_chance")) returned 1 [0173.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLJRNL~1.YOU")) returned 0x5b9770 [0173.456] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.456] GetProcessHeap () returned 0x580000 [0173.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6def4b0 [0173.457] GetProcessHeap () returned 0x580000 [0173.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6fd5f98 [0173.457] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.457] ReadFile (in: hFile=0x3fc, lpBuffer=0x6def4b0, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def4b0*, lpNumberOfBytesRead=0x2e8ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0174.034] GetProcessHeap () returned 0x580000 [0174.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0174.034] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.034] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fd5f98*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesWritten=0x2e8ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0174.034] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.034] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fd8737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd8737*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.034] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.034] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.035] CloseHandle (hObject=0x3fc) returned 1 [0174.035] GetProcessHeap () returned 0x580000 [0174.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0174.041] GetProcessHeap () returned 0x580000 [0174.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6def4b0 | out: hHeap=0x580000) returned 1 [0174.041] GetProcessHeap () returned 0x580000 [0174.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0176.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f599580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="OLJRNLR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLJRNL~1.YOU")) returned 0x5b96f0 [0176.749] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.796] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", len=0x48 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned 1 [0176.796] GetProcessHeap () returned 0x580000 [0176.796] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0176.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0177.856] CloseHandle (hObject=0x488) returned 1 [0177.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.id_1622540890_.your_last_chance")) returned 1 [0177.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUZZWA~1.YOU")) returned 0x5b96f0 [0177.857] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0177.857] GetProcessHeap () returned 0x580000 [0177.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb81) returned 0x6d430a8 [0177.857] GetProcessHeap () returned 0x580000 [0177.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb81) returned 0x6d51c38 [0177.857] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.857] ReadFile (in: hFile=0x488, lpBuffer=0x6d430a8, nNumberOfBytesToRead=0xeb60, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430a8*, lpNumberOfBytesRead=0x2e8ff14*=0xeb60, lpOverlapped=0x0) returned 1 [0179.835] GetProcessHeap () returned 0x580000 [0179.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.836] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.836] WriteFile (in: hFile=0x488, lpBuffer=0x6d51c38*, nNumberOfBytesToWrite=0xeb60, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d51c38*, lpNumberOfBytesWritten=0x2e8ff14*=0xeb60, lpOverlapped=0x0) returned 1 [0179.836] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.836] WriteFile (in: hFile=0x488, lpBuffer=0x6d60797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d60797*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.836] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.836] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.836] CloseHandle (hObject=0x488) returned 1 [0179.836] GetProcessHeap () returned 0x580000 [0179.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d51c38 | out: hHeap=0x580000) returned 1 [0179.836] GetProcessHeap () returned 0x580000 [0179.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430a8 | out: hHeap=0x580000) returned 1 [0179.836] GetProcessHeap () returned 0x580000 [0179.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0181.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2ccb3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeb9c, dwReserved0=0x2e8fd28, dwReserved1=0x6d430a8, cFileName="BUZZ.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUZZWA~1.YOU")) returned 0x5b9770 [0181.350] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.359] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", len=0x6a | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned 1 [0181.360] GetProcessHeap () returned 0x580000 [0181.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0181.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0182.653] CloseHandle (hObject=0x48c) returned 1 [0182.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALF638~1.YOU")) returned 0x5b9770 [0183.029] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0183.032] GetProcessHeap () returned 0x580000 [0183.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f81) returned 0x6fad418 [0183.032] GetProcessHeap () returned 0x580000 [0183.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f81) returned 0x6dec6e0 [0183.032] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.032] ReadFile (in: hFile=0x48c, lpBuffer=0x6fad418, nNumberOfBytesToRead=0x2f60, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad418*, lpNumberOfBytesRead=0x2e8ff14*=0x2f60, lpOverlapped=0x0) returned 1 [0183.815] GetProcessHeap () returned 0x580000 [0183.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.815] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.815] WriteFile (in: hFile=0x48c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2f60, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x2e8ff14*=0x2f60, lpOverlapped=0x0) returned 1 [0183.815] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.815] WriteFile (in: hFile=0x48c, lpBuffer=0x6def63f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def63f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.171] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.171] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.201] CloseHandle (hObject=0x48c) returned 1 [0184.220] GetProcessHeap () returned 0x580000 [0184.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0184.220] GetProcessHeap () returned 0x580000 [0184.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fad418 | out: hHeap=0x580000) returned 1 [0184.220] GetProcessHeap () returned 0x580000 [0184.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5699600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f9d, dwReserved0=0x2e8fd28, dwReserved1=0x6fad418, cFileName="AlertImage_ContactLow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALF638~1.YOU")) returned 0x5b9770 [0184.221] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.221] Sleep (dwMilliseconds=0x1) [0184.706] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", len=0x55 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned 1 [0184.706] GetProcessHeap () returned 0x580000 [0184.706] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x212c) returned 0x6f14048 [0184.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.096] CloseHandle (hObject=0x43c) returned 1 [0185.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82b9af00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOFE71~1.YOU")) returned 0x5b9770 [0185.097] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.098] GetProcessHeap () returned 0x580000 [0185.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0185.098] GetProcessHeap () returned 0x580000 [0185.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0185.098] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.098] ReadFile (in: hFile=0x43c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x2e8ff14*=0x300, lpOverlapped=0x0) returned 1 [0185.102] GetProcessHeap () returned 0x580000 [0185.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0185.102] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.102] WriteFile (in: hFile=0x43c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x2e8ff14*=0x300, lpOverlapped=0x0) returned 1 [0185.102] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.102] WriteFile (in: hFile=0x43c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.102] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.102] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.102] CloseHandle (hObject=0x43c) returned 1 [0185.102] GetProcessHeap () returned 0x580000 [0185.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0185.102] GetProcessHeap () returned 0x580000 [0185.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0185.102] GetProcessHeap () returned 0x580000 [0185.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0185.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f14460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2e8fd28, dwReserved1=0x6df6780, cFileName="NotifierDisableUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOFE71~1.YOU")) returned 0x5b9770 [0185.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.582] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", len=0x5b | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned 1 [0185.582] GetProcessHeap () returned 0x580000 [0185.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.060] CloseHandle (hObject=0x3b4) returned 1 [0187.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0187.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b96b0 [0187.061] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.061] GetProcessHeap () returned 0x580000 [0187.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0187.061] GetProcessHeap () returned 0x580000 [0187.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0187.061] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.062] ReadFile (in: hFile=0x3b4, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x2e8ff14*=0x620, lpOverlapped=0x0) returned 1 [0187.068] GetProcessHeap () returned 0x580000 [0187.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.068] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.068] WriteFile (in: hFile=0x3b4, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x2e8ff14*=0x620, lpOverlapped=0x0) returned 1 [0187.068] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.068] WriteFile (in: hFile=0x3b4, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.068] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.068] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.068] CloseHandle (hObject=0x3b4) returned 1 [0187.068] GetProcessHeap () returned 0x580000 [0187.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0187.068] GetProcessHeap () returned 0x580000 [0187.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0187.068] GetProcessHeap () returned 0x580000 [0187.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0187.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa71d31a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x2e8fd28, dwReserved1=0x626d30, cFileName="DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b96b0 [0187.069] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.107] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", len=0x6a | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned 1 [0187.107] GetProcessHeap () returned 0x580000 [0187.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0187.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.371] CloseHandle (hObject=0x4a0) returned 1 [0188.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.id_1622540890_.your_last_chance")) returned 1 [0188.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9770 [0188.372] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.372] GetProcessHeap () returned 0x580000 [0188.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x701) returned 0x6c79898 [0188.372] GetProcessHeap () returned 0x580000 [0188.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x701) returned 0x6d00cd8 [0188.372] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.372] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x2e8ff14*=0x6e0, lpOverlapped=0x0) returned 1 [0188.379] GetProcessHeap () returned 0x580000 [0188.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.379] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.379] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x2e8ff14*=0x6e0, lpOverlapped=0x0) returned 1 [0188.380] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.380] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d013b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d013b7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.380] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.380] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.380] CloseHandle (hObject=0x4a0) returned 1 [0188.380] GetProcessHeap () returned 0x580000 [0188.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0188.380] GetProcessHeap () returned 0x580000 [0188.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0188.380] GetProcessHeap () returned 0x580000 [0188.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7e52520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x2e8fd28, dwReserved1=0x6c79898, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9770 [0191.280] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.355] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", len=0x45 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned 1 [0191.355] GetProcessHeap () returned 0x580000 [0191.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0191.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0191.397] CloseHandle (hObject=0x264) returned 1 [0191.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa9f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD4A7~1.YOU")) returned 0x5b9770 [0191.398] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0191.399] GetProcessHeap () returned 0x580000 [0191.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa01) returned 0x704c968 [0191.399] GetProcessHeap () returned 0x580000 [0191.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa01) returned 0x6fb2f38 [0191.399] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.399] ReadFile (in: hFile=0x264, lpBuffer=0x704c968, nNumberOfBytesToRead=0xa9e0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x704c968*, lpNumberOfBytesRead=0x2e8ff14*=0xa9e0, lpOverlapped=0x0) returned 1 [0194.368] GetProcessHeap () returned 0x580000 [0194.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0194.368] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.368] WriteFile (in: hFile=0x264, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0xa9e0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x2e8ff14*=0xa9e0, lpOverlapped=0x0) returned 1 [0194.369] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.369] WriteFile (in: hFile=0x264, lpBuffer=0x6fbd917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbd917*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.369] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.369] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.369] CloseHandle (hObject=0x264) returned 1 [0194.369] GetProcessHeap () returned 0x580000 [0194.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0194.369] GetProcessHeap () returned 0x580000 [0194.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704c968 | out: hHeap=0x580000) returned 1 [0194.369] GetProcessHeap () returned 0x580000 [0194.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0194.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab773520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaa14, dwReserved0=0x2e8fd28, dwReserved1=0x704c968, cFileName="ZPDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD4A7~1.YOU")) returned 0x5b97b0 [0194.369] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.625] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", len=0x76 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned 1 [0196.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0196.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.626] CloseHandle (hObject=0x4ac) returned 1 [0196.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0196.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x5c0065, dwReserved1=0x750062, cFileName="button.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0196.627] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.627] GetProcessHeap () returned 0x580000 [0196.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0196.627] GetProcessHeap () returned 0x580000 [0196.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0196.627] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.627] ReadFile (in: hFile=0x4ac, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x2e8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0196.628] GetProcessHeap () returned 0x580000 [0196.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.628] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.628] WriteFile (in: hFile=0x4ac, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x2e8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0196.629] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.629] WriteFile (in: hFile=0x4ac, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.629] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.629] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.629] CloseHandle (hObject=0x4ac) returned 1 [0196.629] GetProcessHeap () returned 0x580000 [0196.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0196.629] GetProcessHeap () returned 0x580000 [0196.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0196.629] GetProcessHeap () returned 0x580000 [0196.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd05c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2e8fd28, dwReserved1=0x60e8a8, cFileName="button.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0196.629] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.663] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0196.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0196.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.789] CloseHandle (hObject=0x4ac) returned 1 [0196.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.791] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.791] GetProcessHeap () returned 0x580000 [0196.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.791] GetProcessHeap () returned 0x580000 [0196.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.791] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.791] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x2e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.793] GetProcessHeap () returned 0x580000 [0196.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0196.793] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x2e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.793] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.793] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.793] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.793] CloseHandle (hObject=0x4ac) returned 1 [0196.793] GetProcessHeap () returned 0x580000 [0196.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.793] GetProcessHeap () returned 0x580000 [0196.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.793] GetProcessHeap () returned 0x580000 [0196.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0196.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xace82a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x2e8fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.794] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.798] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", len=0x45 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned 1 [0196.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fcc) returned 0x6f14048 [0196.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.800] CloseHandle (hObject=0x480) returned 1 [0196.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x34cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~1.YOU")) returned 0x5b97b0 [0196.803] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.803] GetProcessHeap () returned 0x580000 [0196.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x6e08e60 [0196.803] GetProcessHeap () returned 0x580000 [0196.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x715c008 [0196.803] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.803] ReadFile (in: hFile=0x480, lpBuffer=0x6e08e60, nNumberOfBytesToRead=0x34c0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e08e60*, lpNumberOfBytesRead=0x2e8ff14*=0x34c0, lpOverlapped=0x0) returned 1 [0197.316] GetProcessHeap () returned 0x580000 [0197.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0197.316] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.316] WriteFile (in: hFile=0x480, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x34c0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x2e8ff14*=0x34c0, lpOverlapped=0x0) returned 1 [0197.317] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.317] WriteFile (in: hFile=0x480, lpBuffer=0x715f4c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715f4c7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.317] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.317] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.317] CloseHandle (hObject=0x480) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e08e60 | out: hHeap=0x580000) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0199.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad391900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34f3, dwReserved0=0x2e8fd28, dwReserved1=0x6e08e60, cFileName="ZPDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~1.YOU")) returned 0x5b96b0 [0199.650] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.954] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", len=0x62 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned 1 [0200.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fec) returned 0x6f14048 [0200.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0200.993] CloseHandle (hObject=0x4a0) returned 1 [0200.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.id_1622540890_.your_last_chance")) returned 1 [0201.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b97b0 [0201.741] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0201.741] GetProcessHeap () returned 0x580000 [0201.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.741] GetProcessHeap () returned 0x580000 [0201.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.741] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.741] ReadFile (in: hFile=0x4a0, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x2e8ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.746] GetProcessHeap () returned 0x580000 [0201.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.746] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.746] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x2e8ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.746] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.746] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.746] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.746] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.746] CloseHandle (hObject=0x4a0) returned 1 [0201.746] GetProcessHeap () returned 0x580000 [0201.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.746] GetProcessHeap () returned 0x580000 [0201.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.746] GetProcessHeap () returned 0x580000 [0201.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdd1f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x2e8fd28, dwReserved1=0x6eef020, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b9770 [0202.582] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.645] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS", len=0x45 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS") returned 1 [0202.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed4) returned 0x6f14048 [0202.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0202.691] CloseHandle (hObject=0x41c) returned 1 [0202.691] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css.id_1622540890_.your_last_chance")) returned 1 [0202.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fda00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43fda00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDA8F~1.YOU")) returned 0x5b9770 [0202.746] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0202.746] GetProcessHeap () returned 0x580000 [0202.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71cff08 [0202.746] GetProcessHeap () returned 0x580000 [0202.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71e1738 [0202.747] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.747] ReadFile (in: hFile=0x41c, lpBuffer=0x71cff08, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71cff08*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.074] GetProcessHeap () returned 0x580000 [0209.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0209.075] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.075] WriteFile (in: hFile=0x41c, lpBuffer=0x71e1738*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71e1738*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.075] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.075] WriteFile (in: hFile=0x41c, lpBuffer=0x71f2f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71f2f37*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.075] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.075] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.076] CloseHandle (hObject=0x41c) returned 1 [0209.076] GetProcessHeap () returned 0x580000 [0209.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71e1738 | out: hHeap=0x580000) returned 1 [0209.527] GetProcessHeap () returned 0x580000 [0209.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71cff08 | out: hHeap=0x580000) returned 1 [0209.530] GetProcessHeap () returned 0x580000 [0209.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0210.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fda00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb43be5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eb44, dwReserved0=0x2e8fd28, dwReserved1=0x580000, cFileName="SCHEME32.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDA8F~1.YOU")) returned 0x5b97b0 [0210.090] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.125] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", len=0x65 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned 1 [0210.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0210.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.283] CloseHandle (hObject=0x3b8) returned 1 [0215.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0215.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b97b0 [0215.284] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.284] GetProcessHeap () returned 0x580000 [0215.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0215.285] GetProcessHeap () returned 0x580000 [0215.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x6c29878 [0215.285] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.285] ReadFile (in: hFile=0x3b8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x2e8ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0215.296] GetProcessHeap () returned 0x580000 [0215.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.296] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.296] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2e8ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0215.296] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.296] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c2a457*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a457*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.296] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.297] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.297] CloseHandle (hObject=0x3b8) returned 1 [0215.297] GetProcessHeap () returned 0x580000 [0215.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0215.297] GetProcessHeap () returned 0x580000 [0215.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0215.297] GetProcessHeap () returned 0x580000 [0215.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0221.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f1aa60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x2e8fd28, dwReserved1=0x677cd0, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b9770 [0221.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.131] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", len=0x64 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned 1 [0221.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0221.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0221.132] CloseHandle (hObject=0x440) returned 1 [0221.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.id_1622540890_.your_last_chance")) returned 1 [0221.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa52f, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b9770 [0221.133] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0221.133] GetProcessHeap () returned 0x580000 [0221.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa541) returned 0x7062940 [0221.134] GetProcessHeap () returned 0x580000 [0221.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa541) returned 0x7450048 [0221.134] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.134] ReadFile (in: hFile=0x440, lpBuffer=0x7062940, nNumberOfBytesToRead=0xa520, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesRead=0x2e8ff14*=0xa520, lpOverlapped=0x0) returned 1 [0222.102] GetProcessHeap () returned 0x580000 [0222.102] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.103] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.103] WriteFile (in: hFile=0x440, lpBuffer=0x7450048*, nNumberOfBytesToWrite=0xa520, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesWritten=0x2e8ff14*=0xa520, lpOverlapped=0x0) returned 1 [0222.103] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.103] WriteFile (in: hFile=0x440, lpBuffer=0x745a567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x745a567*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.103] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.103] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.103] CloseHandle (hObject=0x440) returned 1 [0222.103] GetProcessHeap () returned 0x580000 [0222.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0222.103] GetProcessHeap () returned 0x580000 [0222.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0222.103] GetProcessHeap () returned 0x580000 [0222.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0223.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbff81e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa553, dwReserved0=0x2e8fd28, dwReserved1=0x7062940, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b96f0 [0223.595] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.643] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", len=0x54 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned 1 [0223.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0223.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0223.644] CloseHandle (hObject=0x414) returned 1 [0223.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.id_1622540890_.your_last_chance")) returned 1 [0223.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~1.YOU")) returned 0x5b9630 [0223.645] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0223.645] GetProcessHeap () returned 0x580000 [0223.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0223.645] GetProcessHeap () returned 0x580000 [0223.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0223.646] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.646] ReadFile (in: hFile=0x414, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.242] GetProcessHeap () returned 0x580000 [0228.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0228.243] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.243] WriteFile (in: hFile=0x414, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.243] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.243] WriteFile (in: hFile=0x414, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0228.244] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.244] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0228.244] CloseHandle (hObject=0x414) returned 1 [0228.244] GetProcessHeap () returned 0x580000 [0228.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0228.244] GetProcessHeap () returned 0x580000 [0228.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0228.244] GetProcessHeap () returned 0x580000 [0228.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf8f3080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a577, dwReserved0=0x2e8fd28, dwReserved1=0x6d21878, cFileName="StarterToolTemplates.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~1.YOU")) returned 0x5b9630 [0230.813] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.858] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", len=0x36 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 1 [0230.858] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0230.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0230.943] CloseHandle (hObject=0x264) returned 1 [0230.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id_1622540890_.your_last_chance")) returned 1 [0230.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7D~1.YOU")) returned 0x5b9630 [0230.944] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0230.945] GetProcessHeap () returned 0x580000 [0230.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75d1f98 [0230.945] GetProcessHeap () returned 0x580000 [0230.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75e37c8 [0230.946] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.946] ReadFile (in: hFile=0x264, lpBuffer=0x75d1f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x75d1f98*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.051] GetProcessHeap () returned 0x580000 [0238.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0238.051] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.052] WriteFile (in: hFile=0x264, lpBuffer=0x75e37c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x75e37c8*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.278] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.278] WriteFile (in: hFile=0x264, lpBuffer=0x75f4fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x75f4fc7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.278] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.279] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.279] CloseHandle (hObject=0x264) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75e37c8 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75d1f98 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0240.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6247e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c5024, dwReserved0=0x2e8fd28, dwReserved1=0x75d1f98, cFileName="mset7db.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7D~1.YOU")) returned 0x5b9730 [0240.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.656] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML", len=0x4e | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned 1 [0240.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0240.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.702] CloseHandle (hObject=0x488) returned 1 [0240.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml.id_1622540890_.your_last_chance")) returned 1 [0240.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5952~1.YOU")) returned 0x5b9730 [0240.703] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.703] GetProcessHeap () returned 0x580000 [0240.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d095a0 [0240.703] GetProcessHeap () returned 0x580000 [0240.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09908 [0240.703] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.703] ReadFile (in: hFile=0x488, lpBuffer=0x6d095a0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d095a0*, lpNumberOfBytesRead=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.757] GetProcessHeap () returned 0x580000 [0240.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.757] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.757] WriteFile (in: hFile=0x488, lpBuffer=0x6d09908*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09908*, lpNumberOfBytesWritten=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.758] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.758] WriteFile (in: hFile=0x488, lpBuffer=0x6d09c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09c27*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.758] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.758] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.758] CloseHandle (hObject=0x488) returned 1 [0240.758] GetProcessHeap () returned 0x580000 [0240.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09908 | out: hHeap=0x580000) returned 1 [0240.758] GetProcessHeap () returned 0x580000 [0240.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d095a0 | out: hHeap=0x580000) returned 1 [0240.758] GetProcessHeap () returned 0x580000 [0240.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc706a0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x2e8fd28, dwReserved1=0x6d095a0, cFileName="YAHOO.CO.TH.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5952~1.YOU")) returned 0x5b9730 [0240.758] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.807] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML", len=0x50 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned 1 [0240.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0240.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0241.877] CloseHandle (hObject=0x170) returned 1 [0241.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.id_1622540890_.your_last_chance")) returned 1 [0241.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NLROGE~1.YOU")) returned 0x5b9630 [0241.879] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0241.880] GetProcessHeap () returned 0x580000 [0241.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.880] GetProcessHeap () returned 0x580000 [0241.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.880] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.880] ReadFile (in: hFile=0x170, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.891] GetProcessHeap () returned 0x580000 [0241.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.891] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.891] WriteFile (in: hFile=0x170, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.891] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.891] WriteFile (in: hFile=0x170, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.891] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.891] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.891] CloseHandle (hObject=0x170) returned 1 [0241.891] GetProcessHeap () returned 0x580000 [0241.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.892] GetProcessHeap () returned 0x580000 [0241.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.892] GetProcessHeap () returned 0x580000 [0241.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7b203a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x2e8fd28, dwReserved1=0x6d0a340, cFileName="NL.ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NLROGE~1.YOU")) returned 0x5b9630 [0241.892] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.894] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML", len=0x40 | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned 1 [0241.894] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0241.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0244.733] CloseHandle (hObject=0x264) returned 1 [0244.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml.id_1622540890_.your_last_chance")) returned 1 [0244.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45218b00, ftCreationTime.dwHighDateTime=0x1ca1b45, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45218b00, ftLastWriteTime.dwHighDateTime=0x1ca1b45, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~2.YOU")) returned 0x5b96f0 [0244.735] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0244.735] GetProcessHeap () returned 0x580000 [0244.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0244.736] GetProcessHeap () returned 0x580000 [0244.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0244.736] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.736] ReadFile (in: hFile=0x264, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.013] GetProcessHeap () returned 0x580000 [0248.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0248.014] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.014] WriteFile (in: hFile=0x264, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x2e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.014] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.014] WriteFile (in: hFile=0x264, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.015] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.015] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.015] CloseHandle (hObject=0x264) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0248.223] GetProcessHeap () returned 0x580000 [0248.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0253.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45218b00, ftCreationTime.dwHighDateTime=0x1ca1b45, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb598000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d5ea, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PGLBL107.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~2.YOU")) returned 0x5b9730 [0253.022] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.077] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC", len=0x3e | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 1 [0253.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0253.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0253.078] CloseHandle (hObject=0x428) returned 1 [0253.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.id_1622540890_.your_last_chance")) returned 1 [0253.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ef0c00, ftCreationTime.dwHighDateTime=0x1c97a03, ftLastAccessTime.dwLowDateTime=0x5fff0470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ef0c00, ftLastWriteTime.dwHighDateTime=0x1c97a03, nFileSizeHigh=0x0, nFileSizeLow=0x4e42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BORDER~1.YOU")) returned 0x5b9730 [0253.080] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0253.080] GetProcessHeap () returned 0x580000 [0253.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e61) returned 0x7111f48 [0253.080] GetProcessHeap () returned 0x580000 [0253.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e61) returned 0x6ebe838 [0253.080] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.080] ReadFile (in: hFile=0x428, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x4e40, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x2e8ff14*=0x4e40, lpOverlapped=0x0) returned 1 [0254.008] GetProcessHeap () returned 0x580000 [0254.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0254.008] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.008] WriteFile (in: hFile=0x428, lpBuffer=0x6ebe838*, nNumberOfBytesToWrite=0x4e40, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebe838*, lpNumberOfBytesWritten=0x2e8ff14*=0x4e40, lpOverlapped=0x0) returned 1 [0254.008] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.009] WriteFile (in: hFile=0x428, lpBuffer=0x6ec3677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec3677*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0254.009] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.009] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0254.009] CloseHandle (hObject=0x428) returned 1 [0254.009] GetProcessHeap () returned 0x580000 [0254.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebe838 | out: hHeap=0x580000) returned 1 [0254.009] GetProcessHeap () returned 0x580000 [0254.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0254.009] GetProcessHeap () returned 0x580000 [0254.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ef0c00, ftCreationTime.dwHighDateTime=0x1c97a03, ftLastAccessTime.dwLowDateTime=0x5fff0470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceeb9000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4e66, dwReserved0=0x2e8fd28, dwReserved1=0x7111f48, cFileName="BORDERBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BORDER~1.YOU")) returned 0x5b9730 [0255.019] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.062] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC", len=0x3a | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC") returned 1 [0255.062] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc4) returned 0x72e5948 [0255.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0255.146] CloseHandle (hObject=0x488) returned 1 [0255.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc.id_1622540890_.your_last_chance")) returned 1 [0255.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOTSPO~1.YOU")) returned 0x5b9730 [0255.148] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0255.149] GetProcessHeap () returned 0x580000 [0255.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c61) returned 0x6dee6e0 [0255.149] GetProcessHeap () returned 0x580000 [0255.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c61) returned 0x70bc718 [0255.149] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.149] ReadFile (in: hFile=0x488, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1c40, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x2e8ff14*=0x1c40, lpOverlapped=0x0) returned 1 [0255.225] GetProcessHeap () returned 0x580000 [0255.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.225] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.225] WriteFile (in: hFile=0x488, lpBuffer=0x70bc718*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bc718*, lpNumberOfBytesWritten=0x2e8ff14*=0x1c40, lpOverlapped=0x0) returned 1 [0255.225] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.225] WriteFile (in: hFile=0x488, lpBuffer=0x70be357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70be357*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.225] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.225] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.225] CloseHandle (hObject=0x488) returned 1 [0255.225] GetProcessHeap () returned 0x580000 [0255.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70bc718 | out: hHeap=0x580000) returned 1 [0255.225] GetProcessHeap () returned 0x580000 [0255.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0255.225] GetProcessHeap () returned 0x580000 [0255.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa53b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c7a, dwReserved0=0x2e8fd28, dwReserved1=0x6dee6e0, cFileName="DOTS.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOTSPO~1.YOU")) returned 0x5b9730 [0255.226] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.296] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML", len=0x3d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML") returned 1 [0255.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f90) returned 0x72e5948 [0255.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.396] CloseHandle (hObject=0x410) returned 1 [0260.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml.id_1622540890_.your_last_chance")) returned 1 [0260.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149d5b00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x149d5b00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBA~1.YOU")) returned 0x5b9630 [0260.397] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.397] GetProcessHeap () returned 0x580000 [0260.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0260.397] GetProcessHeap () returned 0x580000 [0260.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0260.397] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.398] ReadFile (in: hFile=0x410, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0260.401] GetProcessHeap () returned 0x580000 [0260.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.401] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.401] WriteFile (in: hFile=0x410, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x2e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0260.402] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.402] WriteFile (in: hFile=0x410, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0260.402] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.402] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0260.402] CloseHandle (hObject=0x410) returned 1 [0260.402] GetProcessHeap () returned 0x580000 [0260.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0260.402] GetProcessHeap () returned 0x580000 [0260.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0260.402] GetProcessHeap () returned 0x580000 [0260.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149d5b00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2bb83c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x2e8fd28, dwReserved1=0x6d0a340, cFileName="DGWEBAD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBA~1.YOU")) returned 0x5b9630 [0260.402] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.417] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC", len=0x3d | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC") returned 1 [0260.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0260.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.418] CloseHandle (hObject=0x3b8) returned 1 [0260.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc.id_1622540890_.your_last_chance")) returned 1 [0260.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa6c00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16aa6c00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSPMEC~1.YOU")) returned 0x5b9630 [0260.420] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.420] GetProcessHeap () returned 0x580000 [0260.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673ce8 [0260.420] GetProcessHeap () returned 0x580000 [0260.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673fd0 [0260.420] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.420] ReadFile (in: hFile=0x3b8, lpBuffer=0x673ce8, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673ce8*, lpNumberOfBytesRead=0x2e8ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0260.423] GetProcessHeap () returned 0x580000 [0260.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.424] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.424] WriteFile (in: hFile=0x3b8, lpBuffer=0x673fd0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673fd0*, lpNumberOfBytesWritten=0x2e8ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0260.424] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.424] WriteFile (in: hFile=0x3b8, lpBuffer=0x67426f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67426f*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0260.424] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.424] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0260.424] CloseHandle (hObject=0x3b8) returned 1 [0260.424] GetProcessHeap () returned 0x580000 [0260.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673fd0 | out: hHeap=0x580000) returned 1 [0260.424] GetProcessHeap () returned 0x580000 [0260.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673ce8 | out: hHeap=0x580000) returned 1 [0260.424] GetProcessHeap () returned 0x580000 [0260.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fccc | out: lpFindFileData=0x2e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa6c00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2bde520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x580000, cFileName="RSPMECH.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSPMEC~1.YOU")) returned 0x5b9630 [0260.424] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.430] SysReAllocStringLen (in: pbstr=0x2e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV", len=0x3c | out: pbstr=0x2e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV") returned 1 [0260.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2060) returned 0x72e5948 [0260.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0260.431] CloseHandle (hObject=0x490) returned 1 [0260.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv.id_1622540890_.your_last_chance")) returned 1 [0260.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2e8fc74 | out: lpFindFileData=0x2e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2274ed00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2274ed00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESUME.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESUME~2.YOU")) returned 0x5b9630 [0260.433] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0260.433] GetProcessHeap () returned 0x580000 [0260.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c21) returned 0x70bdab8 [0260.433] GetProcessHeap () returned 0x580000 [0260.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c21) returned 0x72c20f8 [0260.441] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.441] ReadFile (in: hFile=0x490, lpBuffer=0x70bdab8, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bdab8*, lpNumberOfBytesRead=0x2e8ff14*=0x2c00, lpOverlapped=0x0) returned 1 [0262.290] GetProcessHeap () returned 0x580000 [0262.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0262.290] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.290] WriteFile (in: hFile=0x490, lpBuffer=0x72c20f8*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c20f8*, lpNumberOfBytesWritten=0x2e8ff14*=0x2c00, lpOverlapped=0x0) returned 1 [0262.903] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.904] WriteFile (in: hFile=0x490, lpBuffer=0x72c4cf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c4cf7*, lpNumberOfBytesWritten=0x2e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.613] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.613] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.661] CloseHandle (hObject=0x490) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c20f8 | out: hHeap=0x580000) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70bdab8 | out: hHeap=0x580000) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 Thread: id = 14 os_tid = 0xa30 [0039.060] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.108] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.557] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.144] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.712] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.686] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", len=0x4d | out: pbstr=0x2f8ff84*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 1 [0059.686] GetProcessHeap () returned 0x580000 [0059.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a8a0, Size=0x38) returned 0x5b9630 [0059.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0066.956] CloseHandle (hObject=0x470) returned 1 [0066.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.956] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id_1622540890_.your_last_chance")) returned 1 [0067.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0067.130] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~2.YOU")) returned 0x5b9630 [0067.130] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0067.131] GetProcessHeap () returned 0x580000 [0067.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c9d3e8 [0067.131] GetProcessHeap () returned 0x580000 [0067.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6caec18 [0067.131] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.131] ReadFile (in: hFile=0x470, lpBuffer=0x6c9d3e8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3e8*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.865] GetProcessHeap () returned 0x580000 [0073.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0073.865] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.865] WriteFile (in: hFile=0x470, lpBuffer=0x6caec18*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6caec18*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.865] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.866] WriteFile (in: hFile=0x470, lpBuffer=0x6cc0417*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0417*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.317] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.317] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.317] CloseHandle (hObject=0x470) returned 1 [0074.318] GetProcessHeap () returned 0x580000 [0074.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6caec18 | out: hHeap=0x580000) returned 1 [0074.323] GetProcessHeap () returned 0x580000 [0074.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9d3e8 | out: hHeap=0x580000) returned 1 [0074.323] GetProcessHeap () returned 0x580000 [0074.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0074.648] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63eca1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x263424, dwReserved0=0x2f8fd34, dwReserved1=0x7718ba87, cFileName="OneNoteMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~2.YOU")) returned 0x5b9730 [0074.648] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.331] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", len=0x3d | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 1 [0079.331] GetProcessHeap () returned 0x580000 [0079.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x88) returned 0x5f76f0 [0079.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.331] Sleep (dwMilliseconds=0x1) [0079.346] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", len=0x3d | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 1 [0079.346] GetProcessHeap () returned 0x580000 [0079.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x54) returned 0x5f76f0 [0079.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.359] Sleep (dwMilliseconds=0x1) [0081.683] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", len=0x68 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 1 [0081.683] GetProcessHeap () returned 0x580000 [0081.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0081.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.699] CloseHandle (hObject=0x444) returned 1 [0081.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance")) returned 1 [0081.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0081.700] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.701] GetProcessHeap () returned 0x580000 [0081.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x624d18 [0081.701] GetProcessHeap () returned 0x580000 [0081.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0081.702] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.702] ReadFile (in: hFile=0x444, lpBuffer=0x624d18, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x624d18*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0083.302] GetProcessHeap () returned 0x580000 [0083.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0083.302] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.303] WriteFile (in: hFile=0x444, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0083.303] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.303] WriteFile (in: hFile=0x444, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.494] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.494] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.494] CloseHandle (hObject=0x444) returned 1 [0083.495] GetProcessHeap () returned 0x580000 [0083.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0083.495] GetProcessHeap () returned 0x580000 [0083.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x624d18 | out: hHeap=0x580000) returned 1 [0083.495] GetProcessHeap () returned 0x580000 [0083.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0083.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6961e900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaec5e, dwReserved0=0x2f8fd28, dwReserved1=0x624d18, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0083.495] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.972] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", len=0x46 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 1 [0085.972] GetProcessHeap () returned 0x580000 [0085.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x60) returned 0x614a48 [0085.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.972] Sleep (dwMilliseconds=0x1) [0086.224] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", len=0x44 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 1 [0086.224] GetProcessHeap () returned 0x580000 [0086.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0086.284] CloseHandle (hObject=0x48c) returned 1 [0086.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id_1622540890_.your_last_chance")) returned 1 [0086.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECOVR~1.YOU")) returned 0x5b96f0 [0086.285] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0086.286] GetProcessHeap () returned 0x580000 [0086.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8f81) returned 0x673cd0 [0086.286] GetProcessHeap () returned 0x580000 [0086.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8f81) returned 0x626d18 [0086.287] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.287] ReadFile (in: hFile=0x48c, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x8f60, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x2f8ff14*=0x8f60, lpOverlapped=0x0) returned 1 [0087.825] GetProcessHeap () returned 0x580000 [0087.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0087.825] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.825] WriteFile (in: hFile=0x48c, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0x8f60, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x2f8ff14*=0x8f60, lpOverlapped=0x0) returned 1 [0087.825] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.825] WriteFile (in: hFile=0x48c, lpBuffer=0x62fc77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62fc77*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0087.825] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.825] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0087.825] CloseHandle (hObject=0x48c) returned 1 [0087.826] GetProcessHeap () returned 0x580000 [0087.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0087.826] GetProcessHeap () returned 0x580000 [0087.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0087.826] GetProcessHeap () returned 0x580000 [0087.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6bf545e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8c, dwReserved0=0x2f8fd28, dwReserved1=0x673cd0, cFileName="RECOVR32.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECOVR~1.YOU")) returned 0x5b96f0 [0088.156] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.970] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 1 [0091.970] GetProcessHeap () returned 0x580000 [0091.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x4c) returned 0x669420 [0091.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0091.971] CloseHandle (hObject=0x44c) returned 1 [0091.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0092.006] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0092.006] GetProcessHeap () returned 0x580000 [0092.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4801) returned 0x662c40 [0092.006] GetProcessHeap () returned 0x580000 [0092.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4801) returned 0x6f3aa38 [0092.006] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.007] ReadFile (in: hFile=0x44c, lpBuffer=0x662c40, nNumberOfBytesToRead=0x47e0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesRead=0x2f8ff14*=0x47e0, lpOverlapped=0x0) returned 1 [0093.180] GetProcessHeap () returned 0x580000 [0093.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.180] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.180] WriteFile (in: hFile=0x44c, lpBuffer=0x6f3aa38*, nNumberOfBytesToWrite=0x47e0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3aa38*, lpNumberOfBytesWritten=0x2f8ff14*=0x47e0, lpOverlapped=0x0) returned 1 [0093.180] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.180] WriteFile (in: hFile=0x44c, lpBuffer=0x6f3f217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f217*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0093.180] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.181] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0093.181] CloseHandle (hObject=0x44c) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3aa38 | out: hHeap=0x580000) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662c40 | out: hHeap=0x580000) returned 1 [0093.181] GetProcessHeap () returned 0x580000 [0093.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f281ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4811, dwReserved0=0x2f8fd28, dwReserved1=0x662c40, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0094.165] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.165] Sleep (dwMilliseconds=0x1) [0094.184] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", len=0x4b | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 1 [0094.184] GetProcessHeap () returned 0x580000 [0094.184] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x38) returned 0x5b9730 [0094.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.344] CloseHandle (hObject=0x43c) returned 1 [0094.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0094.345] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.346] GetProcessHeap () returned 0x580000 [0094.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6f0c4f8 [0094.346] GetProcessHeap () returned 0x580000 [0094.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6c556f8 [0094.346] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.346] ReadFile (in: hFile=0x43c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x2f8ff14*=0x580, lpOverlapped=0x0) returned 1 [0094.385] GetProcessHeap () returned 0x580000 [0094.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.385] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.385] WriteFile (in: hFile=0x43c, lpBuffer=0x6c556f8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c556f8*, lpNumberOfBytesWritten=0x2f8ff14*=0x580, lpOverlapped=0x0) returned 1 [0094.386] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.386] WriteFile (in: hFile=0x43c, lpBuffer=0x6c55c77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55c77*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0094.386] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.386] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0094.386] CloseHandle (hObject=0x43c) returned 1 [0094.386] GetProcessHeap () returned 0x580000 [0094.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c556f8 | out: hHeap=0x580000) returned 1 [0094.386] GetProcessHeap () returned 0x580000 [0094.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0094.386] GetProcessHeap () returned 0x580000 [0094.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fdf68c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b3, dwReserved0=0x2f8fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0094.386] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.438] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 1 [0094.438] GetProcessHeap () returned 0x580000 [0094.438] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x669420 [0094.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.438] CloseHandle (hObject=0x43c) returned 1 [0094.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0094.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0094.446] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.446] GetProcessHeap () returned 0x580000 [0094.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbb61) returned 0x6f69938 [0094.446] GetProcessHeap () returned 0x580000 [0094.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbb61) returned 0x6f754a8 [0094.446] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.447] ReadFile (in: hFile=0x43c, lpBuffer=0x6f69938, nNumberOfBytesToRead=0xbb40, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69938*, lpNumberOfBytesRead=0x2f8ff14*=0xbb40, lpOverlapped=0x0) returned 1 [0099.329] GetProcessHeap () returned 0x580000 [0099.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.329] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.329] WriteFile (in: hFile=0x43c, lpBuffer=0x6f754a8*, nNumberOfBytesToWrite=0xbb40, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f754a8*, lpNumberOfBytesWritten=0x2f8ff14*=0xbb40, lpOverlapped=0x0) returned 1 [0099.329] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.329] WriteFile (in: hFile=0x43c, lpBuffer=0x6f80fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f80fe7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.329] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.329] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.329] CloseHandle (hObject=0x43c) returned 1 [0099.330] GetProcessHeap () returned 0x580000 [0099.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f754a8 | out: hHeap=0x580000) returned 1 [0099.330] GetProcessHeap () returned 0x580000 [0099.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69938 | out: hHeap=0x580000) returned 1 [0099.330] GetProcessHeap () returned 0x580000 [0099.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72d1fca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbb7e, dwReserved0=0x2f8fd28, dwReserved1=0x6f69938, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0099.330] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.420] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x2f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 1 [0101.420] GetProcessHeap () returned 0x580000 [0101.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0101.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0101.428] CloseHandle (hObject=0x3f8) returned 1 [0101.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0101.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.439] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0101.439] GetProcessHeap () returned 0x580000 [0101.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xad21) returned 0x6f10048 [0101.440] GetProcessHeap () returned 0x580000 [0101.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xad21) returned 0x6dfaac0 [0101.440] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.440] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f10048, nNumberOfBytesToRead=0xad00, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x2f8ff14*=0xad00, lpOverlapped=0x0) returned 1 [0103.457] GetProcessHeap () returned 0x580000 [0103.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.457] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.457] WriteFile (in: hFile=0x3f8, lpBuffer=0x6dfaac0*, nNumberOfBytesToWrite=0xad00, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesWritten=0x2f8ff14*=0xad00, lpOverlapped=0x0) returned 1 [0103.458] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x3f8, lpBuffer=0x6e057bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e057bf*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.458] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.458] CloseHandle (hObject=0x3f8) returned 1 [0103.458] GetProcessHeap () returned 0x580000 [0103.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0103.459] GetProcessHeap () returned 0x580000 [0103.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0103.459] GetProcessHeap () returned 0x580000 [0103.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x754667a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xad32, dwReserved0=0x2f8fd28, dwReserved1=0x6f10048, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0103.459] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.078] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x2f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned 1 [0112.078] GetProcessHeap () returned 0x580000 [0112.078] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.078] Sleep (dwMilliseconds=0x1) [0112.094] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", len=0x5b | out: pbstr=0x2f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.095] GetProcessHeap () returned 0x580000 [0112.095] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.099] Sleep (dwMilliseconds=0x1) [0112.193] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.208] Sleep (dwMilliseconds=0x1) [0112.318] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", len=0x63 | out: pbstr=0x2f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned 1 [0112.318] GetProcessHeap () returned 0x580000 [0112.318] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x30) returned 0x61f8b8 [0112.318] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.328] Sleep (dwMilliseconds=0x1) [0113.332] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", len=0x3f | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 1 [0113.332] GetProcessHeap () returned 0x580000 [0113.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x98) returned 0x6f0ceb8 [0113.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0113.480] CloseHandle (hObject=0x47c) returned 1 [0113.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0079~1.YOU")) returned 0x5b9630 [0114.447] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0114.447] GetProcessHeap () returned 0x580000 [0114.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x6d035f8 [0114.447] GetProcessHeap () returned 0x580000 [0114.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x6d06ca8 [0114.447] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.447] ReadFile (in: hFile=0x47c, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1620, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x2f8ff14*=0x1620, lpOverlapped=0x0) returned 1 [0114.468] GetProcessHeap () returned 0x580000 [0114.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.468] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.468] WriteFile (in: hFile=0x47c, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x2f8ff14*=0x1620, lpOverlapped=0x0) returned 1 [0114.468] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.468] WriteFile (in: hFile=0x47c, lpBuffer=0x6d082c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d082c7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.468] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.468] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.468] CloseHandle (hObject=0x47c) returned 1 [0114.469] GetProcessHeap () returned 0x580000 [0114.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0114.469] GetProcessHeap () returned 0x580000 [0114.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0114.469] GetProcessHeap () returned 0x580000 [0114.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bd6f260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1658, dwReserved0=0x2f8fd28, dwReserved1=0x6d035f8, cFileName="AN00790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0079~1.YOU")) returned 0x5b9630 [0115.608] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0115.655] CloseHandle (hObject=0x440) returned 1 [0115.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~3.YOU")) returned 0x5b9630 [0115.656] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0115.656] GetProcessHeap () returned 0x580000 [0115.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x6d06ca8 [0115.656] GetProcessHeap () returned 0x580000 [0115.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x6e00ac0 [0115.656] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.656] ReadFile (in: hFile=0x440, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x15e0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x2f8ff14*=0x15e0, lpOverlapped=0x0) returned 1 [0115.741] GetProcessHeap () returned 0x580000 [0115.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.741] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.741] WriteFile (in: hFile=0x440, lpBuffer=0x6e00ac0*, nNumberOfBytesToWrite=0x15e0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesWritten=0x2f8ff14*=0x15e0, lpOverlapped=0x0) returned 1 [0115.741] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.741] WriteFile (in: hFile=0x440, lpBuffer=0x6e0209f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0209f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.741] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.741] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.741] CloseHandle (hObject=0x440) returned 1 [0115.741] GetProcessHeap () returned 0x580000 [0115.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0115.741] GetProcessHeap () returned 0x580000 [0115.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0115.741] GetProcessHeap () returned 0x580000 [0115.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0115.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9a2320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1622, dwReserved0=0x2f8fd28, dwReserved1=0x6d06ca8, cFileName="SO00199_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~3.YOU")) returned 0x5b9630 [0115.742] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0115.811] CloseHandle (hObject=0x440) returned 1 [0115.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.812] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO219B~1.YOU")) returned 0x5b9630 [0115.812] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0115.812] GetProcessHeap () returned 0x580000 [0115.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6c6a0f8 [0115.812] GetProcessHeap () returned 0x580000 [0115.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6f10048 [0115.813] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.813] ReadFile (in: hFile=0x440, lpBuffer=0x6c6a0f8, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesRead=0x2f8ff14*=0x5140, lpOverlapped=0x0) returned 1 [0117.659] GetProcessHeap () returned 0x580000 [0117.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0117.659] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.659] WriteFile (in: hFile=0x440, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x2f8ff14*=0x5140, lpOverlapped=0x0) returned 1 [0117.660] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.660] WriteFile (in: hFile=0x440, lpBuffer=0x6f15187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15187*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.660] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.660] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.660] CloseHandle (hObject=0x440) returned 1 [0117.927] GetProcessHeap () returned 0x580000 [0117.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0117.928] GetProcessHeap () returned 0x580000 [0117.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0117.928] GetProcessHeap () returned 0x580000 [0117.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dbeec40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5170, dwReserved0=0x2f8fd28, dwReserved1=0x6c6a0f8, cFileName="SO00190_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO219B~1.YOU")) returned 0x5b96f0 [0120.014] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.030] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", len=0x3f | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF") returned 1 [0120.031] GetProcessHeap () returned 0x580000 [0120.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1798) returned 0x6d06ca8 [0120.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.928] CloseHandle (hObject=0x488) returned 1 [0121.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.928] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~1.YOU")) returned 0x5b9730 [0121.929] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.929] GetProcessHeap () returned 0x580000 [0121.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6c79898 [0121.929] GetProcessHeap () returned 0x580000 [0121.929] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6c676b8 [0121.929] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.929] ReadFile (in: hFile=0x488, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x2f8ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0121.936] GetProcessHeap () returned 0x580000 [0121.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.936] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.936] WriteFile (in: hFile=0x488, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x2f8ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0121.936] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.936] WriteFile (in: hFile=0x488, lpBuffer=0x6c67c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67c97*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.936] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.937] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.937] CloseHandle (hObject=0x488) returned 1 [0121.937] GetProcessHeap () returned 0x580000 [0121.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0121.937] GetProcessHeap () returned 0x580000 [0121.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0121.937] GetProcessHeap () returned 0x580000 [0121.937] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x804b2500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x622, dwReserved0=0x2f8fd28, dwReserved1=0x6c79898, cFileName="WB01840_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~1.YOU")) returned 0x5b9730 [0122.565] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.565] Sleep (dwMilliseconds=0x1) [0122.607] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", len=0x4c | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned 1 [0122.607] GetProcessHeap () returned 0x580000 [0122.607] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1940) returned 0x6f42f08 [0122.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0124.695] CloseHandle (hObject=0x48c) returned 1 [0124.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.id_1622540890_.your_last_chance")) returned 1 [0125.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0125.475] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0125.475] GetProcessHeap () returned 0x580000 [0125.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe81) returned 0x6f66848 [0125.475] GetProcessHeap () returned 0x580000 [0125.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe81) returned 0x6c29878 [0125.475] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.475] ReadFile (in: hFile=0x48c, lpBuffer=0x6f66848, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66848*, lpNumberOfBytesRead=0x2f8ff14*=0xe60, lpOverlapped=0x0) returned 1 [0125.489] GetProcessHeap () returned 0x580000 [0125.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.489] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.489] WriteFile (in: hFile=0x48c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x2f8ff14*=0xe60, lpOverlapped=0x0) returned 1 [0125.489] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.489] WriteFile (in: hFile=0x48c, lpBuffer=0x6c2a6d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a6d7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.489] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.489] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.489] CloseHandle (hObject=0x48c) returned 1 [0125.489] GetProcessHeap () returned 0x580000 [0125.489] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.489] GetProcessHeap () returned 0x580000 [0125.489] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f66848 | out: hHeap=0x580000) returned 1 [0125.489] GetProcessHeap () returned 0x580000 [0125.489] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8269de80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xea3, dwReserved0=0x2f8fd28, dwReserved1=0x6f66848, cFileName="Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0125.490] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.553] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", len=0x3d | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned 1 [0125.554] GetProcessHeap () returned 0x580000 [0125.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f0) returned 0x667250 [0125.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0128.614] CloseHandle (hObject=0x460) returned 1 [0128.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03049~1.YOU")) returned 0x5b9730 [0130.625] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0130.625] GetProcessHeap () returned 0x580000 [0130.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4da1) returned 0x6e1f410 [0130.626] GetProcessHeap () returned 0x580000 [0130.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4da1) returned 0x6e241c0 [0130.626] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.626] ReadFile (in: hFile=0x460, lpBuffer=0x6e1f410, nNumberOfBytesToRead=0x4d80, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1f410*, lpNumberOfBytesRead=0x2f8ff14*=0x4d80, lpOverlapped=0x0) returned 1 [0131.708] GetProcessHeap () returned 0x580000 [0131.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0131.709] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.709] WriteFile (in: hFile=0x460, lpBuffer=0x6e241c0*, nNumberOfBytesToWrite=0x4d80, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e241c0*, lpNumberOfBytesWritten=0x2f8ff14*=0x4d80, lpOverlapped=0x0) returned 1 [0131.709] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.709] WriteFile (in: hFile=0x460, lpBuffer=0x6e28f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e28f3f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.709] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.709] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.709] CloseHandle (hObject=0x460) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e241c0 | out: hHeap=0x580000) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1f410 | out: hHeap=0x580000) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x861d41c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x2f8fd28, dwReserved1=0x6e1f410, cFileName="J0304933.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03049~1.YOU")) returned 0x5b96f0 [0135.292] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.292] Sleep (dwMilliseconds=0x1) [0135.302] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", len=0x3c | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 1 [0135.302] GetProcessHeap () returned 0x580000 [0135.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.796] CloseHandle (hObject=0x3a8) returned 1 [0138.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id_1622540890_.your_last_chance")) returned 1 [0138.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b9770 [0138.843] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.843] GetProcessHeap () returned 0x580000 [0138.843] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0138.844] GetProcessHeap () returned 0x580000 [0138.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0138.844] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.844] ReadFile (in: hFile=0x3a8, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0139.774] GetProcessHeap () returned 0x580000 [0139.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.775] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.775] WriteFile (in: hFile=0x3a8, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0139.775] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.775] WriteFile (in: hFile=0x3a8, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.776] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.776] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.776] CloseHandle (hObject=0x3a8) returned 1 [0139.776] GetProcessHeap () returned 0x580000 [0139.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0139.776] GetProcessHeap () returned 0x580000 [0139.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0139.782] GetProcessHeap () returned 0x580000 [0139.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8aebe8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79024, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="ACCESS12.ACC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b9770 [0140.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.172] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", len=0x5b | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned 1 [0140.172] GetProcessHeap () returned 0x580000 [0140.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.746] CloseHandle (hObject=0x448) returned 1 [0140.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.id_1622540890_.your_last_chance")) returned 1 [0140.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="Main.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAINGI~1.YOU")) returned 0x5b9730 [0140.747] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.747] GetProcessHeap () returned 0x580000 [0140.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6c59120 [0140.747] GetProcessHeap () returned 0x580000 [0140.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6c597a8 [0140.747] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.747] ReadFile (in: hFile=0x448, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x2f8ff14*=0x620, lpOverlapped=0x0) returned 1 [0140.754] GetProcessHeap () returned 0x580000 [0140.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0140.754] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.754] WriteFile (in: hFile=0x448, lpBuffer=0x6c597a8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a8*, lpNumberOfBytesWritten=0x2f8ff14*=0x620, lpOverlapped=0x0) returned 1 [0140.754] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.754] WriteFile (in: hFile=0x448, lpBuffer=0x6c59dc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59dc7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.754] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.754] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.754] CloseHandle (hObject=0x448) returned 1 [0140.754] GetProcessHeap () returned 0x580000 [0140.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c597a8 | out: hHeap=0x580000) returned 1 [0140.754] GetProcessHeap () returned 0x580000 [0140.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0140.755] GetProcessHeap () returned 0x580000 [0140.755] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0141.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b81df40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x658, dwReserved0=0x2f8fd28, dwReserved1=0x6c59120, cFileName="Main.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAINGI~1.YOU")) returned 0x5b9730 [0141.666] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.715] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC", len=0x3c | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned 1 [0141.715] GetProcessHeap () returned 0x580000 [0141.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0141.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.716] CloseHandle (hObject=0x3b4) returned 1 [0141.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.id_1622540890_.your_last_chance")) returned 1 [0141.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4722d700, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR76C5~1.YOU")) returned 0x5b9730 [0141.717] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0141.717] GetProcessHeap () returned 0x580000 [0141.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e21) returned 0x6fa8f28 [0141.717] GetProcessHeap () returned 0x580000 [0141.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e21) returned 0x6d8e818 [0141.717] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.718] ReadFile (in: hFile=0x3b4, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x2f8ff14*=0x4e00, lpOverlapped=0x0) returned 1 [0142.731] GetProcessHeap () returned 0x580000 [0142.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0142.731] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.731] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x2f8ff14*=0x4e00, lpOverlapped=0x0) returned 1 [0142.731] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.732] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d93617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d93617*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.732] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.732] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.732] CloseHandle (hObject=0x3b4) returned 1 [0143.287] GetProcessHeap () returned 0x580000 [0143.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0143.287] GetProcessHeap () returned 0x580000 [0143.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0143.287] GetProcessHeap () returned 0x580000 [0143.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8cb02de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4e24, dwReserved0=0x2f8fd28, dwReserved1=0x6fa8f28, cFileName="PROTTPLN.DOC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR76C5~1.YOU")) returned 0x5b96f0 [0146.861] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.875] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", len=0x44 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned 1 [0146.875] GetProcessHeap () returned 0x580000 [0146.875] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0146.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0152.959] CloseHandle (hObject=0x430) returned 1 [0152.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.id_1622540890_.your_last_chance")) returned 1 [0152.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR30~2.YOU")) returned 0x5b9730 [0152.960] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0152.960] GetProcessHeap () returned 0x580000 [0152.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3341) returned 0x7092a58 [0152.960] GetProcessHeap () returned 0x580000 [0152.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3341) returned 0x7095da8 [0152.960] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.960] ReadFile (in: hFile=0x430, lpBuffer=0x7092a58, nNumberOfBytesToRead=0x3320, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7092a58*, lpNumberOfBytesRead=0x2f8ff14*=0x3320, lpOverlapped=0x0) returned 1 [0154.140] GetProcessHeap () returned 0x580000 [0154.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.140] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.140] WriteFile (in: hFile=0x430, lpBuffer=0x7095da8*, nNumberOfBytesToWrite=0x3320, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7095da8*, lpNumberOfBytesWritten=0x2f8ff14*=0x3320, lpOverlapped=0x0) returned 1 [0154.140] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.140] WriteFile (in: hFile=0x430, lpBuffer=0x70990c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70990c7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.140] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.140] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.140] CloseHandle (hObject=0x430) returned 1 [0154.140] GetProcessHeap () returned 0x580000 [0154.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7095da8 | out: hHeap=0x580000) returned 1 [0154.140] GetProcessHeap () returned 0x580000 [0154.141] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7092a58 | out: hHeap=0x580000) returned 1 [0154.141] GetProcessHeap () returned 0x580000 [0154.141] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937c3b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3352, dwReserved0=0x2f8fd28, dwReserved1=0x7092a58, cFileName="PDIR30B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR30~2.YOU")) returned 0x5b9630 [0154.141] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.684] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT", len=0x43 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 1 [0154.684] GetProcessHeap () returned 0x580000 [0154.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0154.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0158.310] CloseHandle (hObject=0x478) returned 1 [0158.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0158.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI40EA~1.YOU")) returned 0x5b9630 [0158.311] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0158.311] GetProcessHeap () returned 0x580000 [0158.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0158.311] GetProcessHeap () returned 0x580000 [0158.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0158.311] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.311] ReadFile (in: hFile=0x478, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x2f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0158.313] GetProcessHeap () returned 0x580000 [0158.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0158.313] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.313] WriteFile (in: hFile=0x478, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x2f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0158.313] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.313] WriteFile (in: hFile=0x478, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.313] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.313] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.313] CloseHandle (hObject=0x478) returned 1 [0158.313] GetProcessHeap () returned 0x580000 [0158.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0158.313] GetProcessHeap () returned 0x580000 [0158.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0158.314] GetProcessHeap () returned 0x580000 [0158.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0159.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95fa2b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x2f8fd28, dwReserved1=0x5ad8a0, cFileName="WINPROJ.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI40EA~1.YOU")) returned 0x5b9630 [0159.265] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0164.488] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", len=0x35 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned 1 [0164.488] GetProcessHeap () returned 0x580000 [0164.488] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0164.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0166.036] CloseHandle (hObject=0x450) returned 1 [0166.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.036] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id_1622540890_.your_last_chance")) returned 1 [0166.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVTEL~1.YOU")) returned 0x5b9730 [0166.037] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0166.038] GetProcessHeap () returned 0x580000 [0166.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0166.038] GetProcessHeap () returned 0x580000 [0166.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0166.038] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.038] ReadFile (in: hFile=0x450, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.123] GetProcessHeap () returned 0x580000 [0169.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.124] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.124] WriteFile (in: hFile=0x450, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.124] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.124] WriteFile (in: hFile=0x450, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.199] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.199] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.199] CloseHandle (hObject=0x450) returned 1 [0169.199] GetProcessHeap () returned 0x580000 [0169.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0169.203] GetProcessHeap () returned 0x580000 [0169.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0169.203] GetProcessHeap () returned 0x580000 [0169.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c77ab40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a1ffa, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="ADVTEL.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVTEL~1.YOU")) returned 0x5b9770 [0172.813] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.860] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", len=0x40 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 1 [0172.860] GetProcessHeap () returned 0x580000 [0172.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x226c) returned 0x6f14048 [0172.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0172.936] CloseHandle (hObject=0x43c) returned 1 [0172.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id_1622540890_.your_last_chance")) returned 1 [0172.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURS~1.YOU")) returned 0x5b9770 [0172.982] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0172.982] GetProcessHeap () returned 0x580000 [0172.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0172.982] GetProcessHeap () returned 0x580000 [0172.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0172.982] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.982] ReadFile (in: hFile=0x43c, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x2f8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.005] GetProcessHeap () returned 0x580000 [0173.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.005] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.005] WriteFile (in: hFile=0x43c, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x2f8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.005] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.005] WriteFile (in: hFile=0x43c, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.005] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.005] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.005] CloseHandle (hObject=0x43c) returned 1 [0173.005] GetProcessHeap () returned 0x580000 [0173.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0173.006] GetProcessHeap () returned 0x580000 [0173.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0173.006] GetProcessHeap () returned 0x580000 [0173.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ebc7ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x2f8fd28, dwReserved1=0x660a78, cFileName="SECURS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURS~1.YOU")) returned 0x5b9770 [0173.006] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.252] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", len=0x41 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 1 [0173.252] GetProcessHeap () returned 0x580000 [0173.252] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0173.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.252] CloseHandle (hObject=0x46c) returned 1 [0173.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id_1622540890_.your_last_chance")) returned 1 [0173.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~1.YOU")) returned 0x5b9770 [0173.273] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.273] GetProcessHeap () returned 0x580000 [0173.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.273] GetProcessHeap () returned 0x580000 [0173.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.273] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.274] ReadFile (in: hFile=0x46c, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x2f8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.321] GetProcessHeap () returned 0x580000 [0173.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.321] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.321] WriteFile (in: hFile=0x46c, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x2f8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x46c, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.322] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.322] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.322] CloseHandle (hObject=0x46c) returned 1 [0173.322] GetProcessHeap () returned 0x580000 [0173.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0173.322] GetProcessHeap () returned 0x580000 [0173.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0173.322] GetProcessHeap () returned 0x580000 [0173.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eec1640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x2f8fd28, dwReserved1=0x662288, cFileName="REMOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~1.YOU")) returned 0x5b9770 [0173.322] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.361] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", len=0x3e | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 1 [0173.361] GetProcessHeap () returned 0x580000 [0173.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0173.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.362] CloseHandle (hObject=0x454) returned 1 [0173.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTCF~1.YOU")) returned 0x5b9770 [0173.363] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.364] GetProcessHeap () returned 0x580000 [0173.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x67fc68 [0173.364] GetProcessHeap () returned 0x580000 [0173.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6e17c00 [0173.364] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.364] ReadFile (in: hFile=0x454, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x2f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.394] GetProcessHeap () returned 0x580000 [0173.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.394] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.394] WriteFile (in: hFile=0x454, lpBuffer=0x6e17c00*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesWritten=0x2f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.394] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.394] WriteFile (in: hFile=0x454, lpBuffer=0x6e17eff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17eff*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.394] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.395] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.395] CloseHandle (hObject=0x454) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef7fd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x2f8fd28, dwReserved1=0x67fc68, cFileName="POST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTCF~1.YOU")) returned 0x5b96f0 [0174.662] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.803] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK", len=0x43 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 1 [0176.803] GetProcessHeap () returned 0x580000 [0176.803] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0176.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.804] CloseHandle (hObject=0x49c) returned 1 [0176.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0176.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEC67~1.YOU")) returned 0x5b96f0 [0176.805] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.805] GetProcessHeap () returned 0x580000 [0176.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0176.806] GetProcessHeap () returned 0x580000 [0176.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0176.806] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.806] ReadFile (in: hFile=0x49c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x2f8ff14*=0x60, lpOverlapped=0x0) returned 1 [0176.807] GetProcessHeap () returned 0x580000 [0176.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.807] WriteFile (in: hFile=0x49c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x2f8ff14*=0x60, lpOverlapped=0x0) returned 1 [0176.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.807] WriteFile (in: hFile=0x49c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.807] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.807] CloseHandle (hObject=0x49c) returned 1 [0176.807] GetProcessHeap () returned 0x580000 [0176.807] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0176.808] GetProcessHeap () returned 0x580000 [0176.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0176.808] GetProcessHeap () returned 0x580000 [0176.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0fee8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2f8fd28, dwReserved1=0x61b540, cFileName="VISIO_PRM_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEC67~1.YOU")) returned 0x5b96f0 [0176.808] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.844] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", len=0x41 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 1 [0176.844] GetProcessHeap () returned 0x580000 [0176.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2110) returned 0x6f14048 [0176.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.435] CloseHandle (hObject=0x470) returned 1 [0179.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.436] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0179.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~2.YOU")) returned 0x5b96f0 [0179.437] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.437] GetProcessHeap () returned 0x580000 [0179.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0179.437] GetProcessHeap () returned 0x580000 [0179.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0179.437] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.437] ReadFile (in: hFile=0x470, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x2f8ff14*=0x60, lpOverlapped=0x0) returned 1 [0179.439] GetProcessHeap () returned 0x580000 [0179.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.439] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.439] WriteFile (in: hFile=0x470, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x2f8ff14*=0x60, lpOverlapped=0x0) returned 1 [0179.439] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x470, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.440] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.440] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.440] CloseHandle (hObject=0x470) returned 1 [0179.440] GetProcessHeap () returned 0x580000 [0179.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0179.440] GetProcessHeap () returned 0x580000 [0179.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0179.440] GetProcessHeap () returned 0x580000 [0179.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2913140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x2f8fd28, dwReserved1=0x61b540, cFileName="SETLANG_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~2.YOU")) returned 0x5b96b0 [0180.461] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.474] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", len=0x6b | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned 1 [0180.474] GetProcessHeap () returned 0x580000 [0180.474] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0180.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0180.474] CloseHandle (hObject=0x490) returned 1 [0180.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d183d00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x2e0070, dwReserved1=0x640069, cFileName="CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~3.YOU")) returned 0x5b96b0 [0180.476] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0180.476] GetProcessHeap () returned 0x580000 [0180.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6ce68d0 [0180.476] GetProcessHeap () returned 0x580000 [0180.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6ce72d8 [0180.476] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.476] ReadFile (in: hFile=0x490, lpBuffer=0x6ce68d0, nNumberOfBytesToRead=0x9c0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce68d0*, lpNumberOfBytesRead=0x2f8ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0180.571] GetProcessHeap () returned 0x580000 [0180.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.571] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.571] WriteFile (in: hFile=0x490, lpBuffer=0x6ce72d8*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce72d8*, lpNumberOfBytesWritten=0x2f8ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0180.571] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.571] WriteFile (in: hFile=0x490, lpBuffer=0x6ce7c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce7c97*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.571] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.571] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.571] CloseHandle (hObject=0x490) returned 1 [0180.571] GetProcessHeap () returned 0x580000 [0180.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce72d8 | out: hHeap=0x580000) returned 1 [0180.572] GetProcessHeap () returned 0x580000 [0180.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce68d0 | out: hHeap=0x580000) returned 1 [0180.572] GetProcessHeap () returned 0x580000 [0180.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa33ef5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x2f8fd28, dwReserved1=0x6ce68d0, cFileName="CommsIncomingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~3.YOU")) returned 0x5b96b0 [0180.572] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.238] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", len=0x55 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned 1 [0183.238] GetProcessHeap () returned 0x580000 [0183.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0183.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0183.258] CloseHandle (hObject=0x430) returned 1 [0183.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a3c500, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5203, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTUR~1.YOU")) returned 0x5b9770 [0183.259] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0183.260] GetProcessHeap () returned 0x580000 [0183.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5221) returned 0x6e063d0 [0183.260] GetProcessHeap () returned 0x580000 [0183.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5221) returned 0x6e0b600 [0183.260] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.260] ReadFile (in: hFile=0x430, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x5200, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x2f8ff14*=0x5200, lpOverlapped=0x0) returned 1 [0184.314] GetProcessHeap () returned 0x580000 [0184.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.314] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.314] WriteFile (in: hFile=0x430, lpBuffer=0x6e0b600*, nNumberOfBytesToWrite=0x5200, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0b600*, lpNumberOfBytesWritten=0x2f8ff14*=0x5200, lpOverlapped=0x0) returned 1 [0184.314] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.314] WriteFile (in: hFile=0x430, lpBuffer=0x6e107ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e107ff*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.314] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.315] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.315] CloseHandle (hObject=0x430) returned 1 [0184.315] GetProcessHeap () returned 0x580000 [0184.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0b600 | out: hHeap=0x580000) returned 1 [0184.315] GetProcessHeap () returned 0x580000 [0184.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0184.315] GetProcessHeap () returned 0x580000 [0184.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa57a3fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5227, dwReserved0=0x2f8fd28, dwReserved1=0x6e063d0, cFileName="PicturesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTUR~1.YOU")) returned 0x5b9770 [0184.315] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.315] Sleep (dwMilliseconds=0x1) [0184.735] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", len=0x52 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned 1 [0184.735] GetProcessHeap () returned 0x580000 [0184.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2124) returned 0x6f14048 [0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.188] CloseHandle (hObject=0x484) returned 1 [0185.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79304700, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NO85C5~1.YOU")) returned 0x5b9770 [0185.190] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.190] GetProcessHeap () returned 0x580000 [0185.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0185.190] GetProcessHeap () returned 0x580000 [0185.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6df6780 [0185.190] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.190] ReadFile (in: hFile=0x484, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x2f8ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0185.194] GetProcessHeap () returned 0x580000 [0185.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0185.194] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.194] WriteFile (in: hFile=0x484, lpBuffer=0x6df6780*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesWritten=0x2f8ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0185.194] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.194] WriteFile (in: hFile=0x484, lpBuffer=0x6df6a5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a5f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.195] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.195] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.195] CloseHandle (hObject=0x484) returned 1 [0185.195] GetProcessHeap () returned 0x580000 [0185.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0185.195] GetProcessHeap () returned 0x580000 [0185.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0185.195] GetProcessHeap () returned 0x580000 [0185.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0185.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5ff8ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x316, dwReserved0=0x2f8fd28, dwReserved1=0x67c940, cFileName="NotifierCloseButton.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NO85C5~1.YOU")) returned 0x5b9770 [0185.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.582] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", len=0x57 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned 1 [0185.582] GetProcessHeap () returned 0x580000 [0185.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0187.027] CloseHandle (hObject=0x4a8) returned 1 [0187.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2eaf, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b96b0 [0187.028] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0187.028] GetProcessHeap () returned 0x580000 [0187.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ec1) returned 0x700c8d8 [0187.028] GetProcessHeap () returned 0x580000 [0187.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ec1) returned 0x700f7a8 [0187.030] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.030] ReadFile (in: hFile=0x4a8, lpBuffer=0x700c8d8, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x700c8d8*, lpNumberOfBytesRead=0x2f8ff14*=0x2ea0, lpOverlapped=0x0) returned 1 [0187.732] GetProcessHeap () returned 0x580000 [0187.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf930 [0187.732] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.732] WriteFile (in: hFile=0x4a8, lpBuffer=0x700f7a8*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x700f7a8*, lpNumberOfBytesWritten=0x2f8ff14*=0x2ea0, lpOverlapped=0x0) returned 1 [0187.733] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.733] WriteFile (in: hFile=0x4a8, lpBuffer=0x7012647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7012647*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.733] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.733] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.733] CloseHandle (hObject=0x4a8) returned 1 [0187.733] GetProcessHeap () returned 0x580000 [0187.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x700f7a8 | out: hHeap=0x580000) returned 1 [0187.733] GetProcessHeap () returned 0x580000 [0187.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x700c8d8 | out: hHeap=0x580000) returned 1 [0187.733] GetProcessHeap () returned 0x580000 [0187.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf930 | out: hHeap=0x580000) returned 1 [0188.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7838cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ed3, dwReserved0=0x2f8fd28, dwReserved1=0x700c8d8, cFileName="DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b9770 [0188.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.067] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", len=0x45 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned 1 [0188.067] GetProcessHeap () returned 0x580000 [0188.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2098) returned 0x6f14048 [0188.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.067] CloseHandle (hObject=0x464) returned 1 [0188.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.id_1622540890_.your_last_chance")) returned 1 [0188.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~3.YOU")) returned 0x5b9770 [0188.068] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.069] GetProcessHeap () returned 0x580000 [0188.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6efb008 [0188.069] GetProcessHeap () returned 0x580000 [0188.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6f19958 [0188.069] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.069] ReadFile (in: hFile=0x464, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x2f8ff14*=0x1160, lpOverlapped=0x0) returned 1 [0188.185] GetProcessHeap () returned 0x580000 [0188.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.185] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.185] WriteFile (in: hFile=0x464, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x2f8ff14*=0x1160, lpOverlapped=0x0) returned 1 [0188.185] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.185] WriteFile (in: hFile=0x464, lpBuffer=0x6f1aab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aab7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.185] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.185] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.185] CloseHandle (hObject=0x464) returned 1 [0188.231] GetProcessHeap () returned 0x580000 [0188.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0188.231] GetProcessHeap () returned 0x580000 [0188.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0188.231] GetProcessHeap () returned 0x580000 [0188.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c894a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x119d, dwReserved0=0x2f8fd28, dwReserved1=0x6efb008, cFileName="ZPDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~3.YOU")) returned 0x5b9770 [0191.179] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.272] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", len=0x45 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned 1 [0191.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0191.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0191.273] CloseHandle (hObject=0x490) returned 1 [0191.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP15B6~1.YOU")) returned 0x5b9770 [0191.274] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0191.274] GetProcessHeap () returned 0x580000 [0191.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd1c1) returned 0x70325c8 [0191.274] GetProcessHeap () returned 0x580000 [0191.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd1c1) returned 0x703f798 [0191.274] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.274] ReadFile (in: hFile=0x490, lpBuffer=0x70325c8, nNumberOfBytesToRead=0xd1a0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70325c8*, lpNumberOfBytesRead=0x2f8ff14*=0xd1a0, lpOverlapped=0x0) returned 1 [0195.483] GetProcessHeap () returned 0x580000 [0195.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.484] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.484] WriteFile (in: hFile=0x490, lpBuffer=0x703f798*, nNumberOfBytesToWrite=0xd1a0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x703f798*, lpNumberOfBytesWritten=0x2f8ff14*=0xd1a0, lpOverlapped=0x0) returned 1 [0195.484] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.484] WriteFile (in: hFile=0x490, lpBuffer=0x704c937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x704c937*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.485] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.485] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.485] CloseHandle (hObject=0x490) returned 1 [0195.485] GetProcessHeap () returned 0x580000 [0195.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703f798 | out: hHeap=0x580000) returned 1 [0195.485] GetProcessHeap () returned 0x580000 [0195.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70325c8 | out: hHeap=0x580000) returned 1 [0195.485] GetProcessHeap () returned 0x580000 [0195.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac229820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd1d0, dwReserved0=0x2f8fd28, dwReserved1=0x70325c8, cFileName="ZPDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP15B6~1.YOU")) returned 0x5b97b0 [0196.620] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.643] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x72 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0196.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0196.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.644] CloseHandle (hObject=0x4a0) returned 1 [0196.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0196.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x540054, dwReserved1=0x4e004f, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0196.645] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.645] GetProcessHeap () returned 0x580000 [0196.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0196.645] GetProcessHeap () returned 0x580000 [0196.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0196.645] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.645] ReadFile (in: hFile=0x4a0, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x2f8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0196.647] GetProcessHeap () returned 0x580000 [0196.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.647] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.647] WriteFile (in: hFile=0x4a0, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x2f8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0196.647] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.647] WriteFile (in: hFile=0x4a0, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.647] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.647] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.647] CloseHandle (hObject=0x4a0) returned 1 [0196.647] GetProcessHeap () returned 0x580000 [0196.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0196.647] GetProcessHeap () returned 0x580000 [0196.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0196.647] GetProcessHeap () returned 0x580000 [0196.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd2bde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x2f8fd28, dwReserved1=0x60e8a8, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0196.648] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.673] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", len=0x45 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned 1 [0196.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe8) returned 0x6f14048 [0196.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0196.674] CloseHandle (hObject=0x438) returned 1 [0196.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1983, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPEA56~1.YOU")) returned 0x5b97b0 [0196.675] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0196.675] GetProcessHeap () returned 0x580000 [0196.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x6f42f08 [0196.676] GetProcessHeap () returned 0x580000 [0196.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x667250 [0196.676] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.676] ReadFile (in: hFile=0x438, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1980, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x2f8ff14*=0x1980, lpOverlapped=0x0) returned 1 [0196.785] GetProcessHeap () returned 0x580000 [0196.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.785] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.785] WriteFile (in: hFile=0x438, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x2f8ff14*=0x1980, lpOverlapped=0x0) returned 1 [0196.785] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.785] WriteFile (in: hFile=0x438, lpBuffer=0x668bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x668bcf*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.785] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.785] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.786] CloseHandle (hObject=0x438) returned 1 [0196.798] GetProcessHeap () returned 0x580000 [0196.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0196.799] GetProcessHeap () returned 0x580000 [0196.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0196.799] GetProcessHeap () returned 0x580000 [0196.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xace82a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a7, dwReserved0=0x2f8fd28, dwReserved1=0x6f42f08, cFileName="ZPDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPEA56~1.YOU")) returned 0x5b97f0 [0199.133] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.141] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", len=0x44 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned 1 [0199.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0199.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0199.244] CloseHandle (hObject=0x43c) returned 1 [0199.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.244] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd4a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR37~1.YOU")) returned 0x5b97b0 [0199.245] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0199.245] GetProcessHeap () returned 0x580000 [0199.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd4c1) returned 0x6d10048 [0199.245] GetProcessHeap () returned 0x580000 [0199.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd4c1) returned 0x6d1d518 [0199.245] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.245] ReadFile (in: hFile=0x43c, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xd4a0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x2f8ff14*=0xd4a0, lpOverlapped=0x0) returned 1 [0200.917] GetProcessHeap () returned 0x580000 [0200.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.917] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.917] WriteFile (in: hFile=0x43c, lpBuffer=0x6d1d518*, nNumberOfBytesToWrite=0xd4a0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1d518*, lpNumberOfBytesWritten=0x2f8ff14*=0xd4a0, lpOverlapped=0x0) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2a9b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2a9b7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.918] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.918] CloseHandle (hObject=0x43c) returned 1 [0200.918] GetProcessHeap () returned 0x580000 [0200.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1d518 | out: hHeap=0x580000) returned 1 [0200.918] GetProcessHeap () returned 0x580000 [0200.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0200.918] GetProcessHeap () returned 0x580000 [0200.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf5ef6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd4c7, dwReserved0=0x2f8fd28, dwReserved1=0x6d10048, cFileName="PDIR37F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR37~1.YOU")) returned 0x5b9770 [0201.396] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.403] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", len=0x76 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0201.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0201.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.447] CloseHandle (hObject=0x480) returned 1 [0201.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0201.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x6b0063, dwReserved1=0x720067, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0201.449] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.449] GetProcessHeap () returned 0x580000 [0201.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6dd40d0 [0201.449] GetProcessHeap () returned 0x580000 [0201.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6dee6e0 [0201.449] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.450] ReadFile (in: hFile=0x480, lpBuffer=0x6dd40d0, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesRead=0x2f8ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0201.480] GetProcessHeap () returned 0x580000 [0201.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.480] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x480, lpBuffer=0x6dee6e0*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesWritten=0x2f8ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0201.480] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x480, lpBuffer=0x6df01bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df01bf*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.480] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.480] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.480] CloseHandle (hObject=0x480) returned 1 [0201.480] GetProcessHeap () returned 0x580000 [0201.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0201.480] GetProcessHeap () returned 0x580000 [0201.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0201.480] GetProcessHeap () returned 0x580000 [0201.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafb4a820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b1e, dwReserved0=0x2f8fd28, dwReserved1=0x6dd40d0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0202.087] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.190] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS", len=0x45 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS") returned 1 [0202.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0202.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0202.302] CloseHandle (hObject=0x414) returned 1 [0202.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css.id_1622540890_.your_last_chance")) returned 1 [0202.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621ff200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x621ff200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC9BA2~1.YOU")) returned 0x5b9770 [0202.303] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0202.303] GetProcessHeap () returned 0x580000 [0202.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0202.303] GetProcessHeap () returned 0x580000 [0202.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0202.303] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.303] ReadFile (in: hFile=0x414, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.752] GetProcessHeap () returned 0x580000 [0208.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.752] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.752] WriteFile (in: hFile=0x414, lpBuffer=0x6fe77c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.753] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.753] WriteFile (in: hFile=0x414, lpBuffer=0x6ff8fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8fc7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.753] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.753] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.753] CloseHandle (hObject=0x414) returned 1 [0208.753] GetProcessHeap () returned 0x580000 [0208.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0208.753] GetProcessHeap () returned 0x580000 [0208.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0208.753] GetProcessHeap () returned 0x580000 [0208.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621ff200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb409e8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e97c, dwReserved0=0x2f8fd28, dwReserved1=0x6fd5f98, cFileName="SCHEME41.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC9BA2~1.YOU")) returned 0x5b97b0 [0210.087] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.120] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", len=0x64 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned 1 [0210.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0210.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0210.121] CloseHandle (hObject=0x3a8) returned 1 [0210.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.id_1622540890_.your_last_chance")) returned 1 [0214.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b9830 [0214.323] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0214.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0214.323] GetProcessHeap () returned 0x580000 [0214.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x6e063d0 [0214.323] GetProcessHeap () returned 0x580000 [0214.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x715c008 [0214.324] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.324] ReadFile (in: hFile=0x3a8, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x2f8ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0215.628] GetProcessHeap () returned 0x580000 [0215.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0215.628] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.628] WriteFile (in: hFile=0x3a8, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x2f8ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0215.629] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.629] WriteFile (in: hFile=0x3a8, lpBuffer=0x715fd47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715fd47*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.629] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.629] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.629] CloseHandle (hObject=0x3a8) returned 1 [0216.872] GetProcessHeap () returned 0x580000 [0216.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0216.872] GetProcessHeap () returned 0x580000 [0216.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0216.873] GetProcessHeap () returned 0x580000 [0216.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb823a740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d7b, dwReserved0=0x2f8fd28, dwReserved1=0x6e063d0, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b9770 [0221.057] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.068] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned 1 [0221.068] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0221.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.069] CloseHandle (hObject=0x3e4) returned 1 [0221.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0221.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b9770 [0221.070] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.070] GetProcessHeap () returned 0x580000 [0221.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.070] GetProcessHeap () returned 0x580000 [0221.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.070] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.070] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x2f8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.074] GetProcessHeap () returned 0x580000 [0221.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.074] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.074] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x2f8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.074] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.074] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.075] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.075] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.075] CloseHandle (hObject=0x3e4) returned 1 [0221.075] GetProcessHeap () returned 0x580000 [0221.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.075] GetProcessHeap () returned 0x580000 [0221.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.075] GetProcessHeap () returned 0x580000 [0221.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb626720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x2f8fd28, dwReserved1=0x6dcfb90, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b9770 [0221.075] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.084] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", len=0x61 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned 1 [0221.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0221.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.084] CloseHandle (hObject=0x414) returned 1 [0221.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.id_1622540890_.your_last_chance")) returned 1 [0221.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b9770 [0221.085] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.086] GetProcessHeap () returned 0x580000 [0221.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.086] GetProcessHeap () returned 0x580000 [0221.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.086] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.086] ReadFile (in: hFile=0x414, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x2f8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.090] GetProcessHeap () returned 0x580000 [0221.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.090] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.090] WriteFile (in: hFile=0x414, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x2f8ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.090] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.090] WriteFile (in: hFile=0x414, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.090] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.090] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.090] CloseHandle (hObject=0x414) returned 1 [0221.090] GetProcessHeap () returned 0x580000 [0221.090] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.090] GetProcessHeap () returned 0x580000 [0221.090] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.090] GetProcessHeap () returned 0x580000 [0221.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb64c880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x2f8fd28, dwReserved1=0x6dcfb90, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b9770 [0221.091] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.099] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", len=0x5f | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned 1 [0221.099] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0221.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.102] CloseHandle (hObject=0x414) returned 1 [0221.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.id_1622540890_.your_last_chance")) returned 1 [0221.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b9770 [0221.103] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.103] GetProcessHeap () returned 0x580000 [0221.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x65a138 [0221.103] GetProcessHeap () returned 0x580000 [0221.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x65a4e0 [0221.103] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.103] ReadFile (in: hFile=0x414, lpBuffer=0x65a138, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a138*, lpNumberOfBytesRead=0x2f8ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.108] GetProcessHeap () returned 0x580000 [0221.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0221.109] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.109] WriteFile (in: hFile=0x414, lpBuffer=0x65a4e0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a4e0*, lpNumberOfBytesWritten=0x2f8ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.109] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.109] WriteFile (in: hFile=0x414, lpBuffer=0x65a83f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a83f*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.109] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.109] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.109] CloseHandle (hObject=0x414) returned 1 [0221.109] GetProcessHeap () returned 0x580000 [0221.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65a4e0 | out: hHeap=0x580000) returned 1 [0221.109] GetProcessHeap () returned 0x580000 [0221.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x580000) returned 1 [0221.109] GetProcessHeap () returned 0x580000 [0221.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb6729e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x2f8fd28, dwReserved1=0x65a138, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b9770 [0221.109] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.115] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", len=0x65 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned 1 [0221.115] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0221.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.116] CloseHandle (hObject=0x49c) returned 1 [0221.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0221.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21e5, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b9770 [0221.117] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.118] GetProcessHeap () returned 0x580000 [0221.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2201) returned 0x6e063d0 [0221.118] GetProcessHeap () returned 0x580000 [0221.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2201) returned 0x711c020 [0221.118] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.118] ReadFile (in: hFile=0x49c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x21e0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x2f8ff14*=0x21e0, lpOverlapped=0x0) returned 1 [0221.201] GetProcessHeap () returned 0x580000 [0221.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0221.201] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.202] WriteFile (in: hFile=0x49c, lpBuffer=0x711c020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c020*, lpNumberOfBytesWritten=0x2f8ff14*=0x21e0, lpOverlapped=0x0) returned 1 [0221.202] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.202] WriteFile (in: hFile=0x49c, lpBuffer=0x711e1ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x711e1ff*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.202] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.202] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.202] CloseHandle (hObject=0x49c) returned 1 [0221.286] GetProcessHeap () returned 0x580000 [0221.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c020 | out: hHeap=0x580000) returned 1 [0221.286] GetProcessHeap () returned 0x580000 [0221.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0221.287] GetProcessHeap () returned 0x580000 [0221.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0225.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb757220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2209, dwReserved0=0x2f8fd28, dwReserved1=0x6e063d0, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b9630 [0225.414] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.452] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", len=0x53 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned 1 [0225.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0225.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0225.453] CloseHandle (hObject=0x49c) returned 1 [0225.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance")) returned 1 [0227.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0227.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0227.669] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0227.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0227.669] GetProcessHeap () returned 0x580000 [0227.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7287b88 [0227.669] GetProcessHeap () returned 0x580000 [0227.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72993b8 [0227.670] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.670] ReadFile (in: hFile=0x49c, lpBuffer=0x7287b88, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7287b88*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.581] GetProcessHeap () returned 0x580000 [0237.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0237.581] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.581] WriteFile (in: hFile=0x49c, lpBuffer=0x72993b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72993b8*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.107] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.107] WriteFile (in: hFile=0x49c, lpBuffer=0x72aabb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72aabb7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.156] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.156] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.156] CloseHandle (hObject=0x49c) returned 1 [0239.157] GetProcessHeap () returned 0x580000 [0239.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72993b8 | out: hHeap=0x580000) returned 1 [0239.157] GetProcessHeap () returned 0x580000 [0239.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7287b88 | out: hHeap=0x580000) returned 1 [0239.157] GetProcessHeap () returned 0x580000 [0239.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0240.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6117300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3de03, dwReserved0=0x2f8fd28, dwReserved1=0x7287b88, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0240.571] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.568] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML", len=0x3f | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned 1 [0241.568] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0241.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0241.667] CloseHandle (hObject=0x428) returned 1 [0241.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml.id_1622540890_.your_last_chance")) returned 1 [0241.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGF526~1.YOU")) returned 0x5b9630 [0241.668] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0241.668] GetProcessHeap () returned 0x580000 [0241.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x658970 [0241.668] GetProcessHeap () returned 0x580000 [0241.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x6ce2378 [0241.668] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.668] ReadFile (in: hFile=0x428, lpBuffer=0x658970, nNumberOfBytesToRead=0xfe0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesRead=0x2f8ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0241.685] GetProcessHeap () returned 0x580000 [0241.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.685] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.685] WriteFile (in: hFile=0x428, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x2f8ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0241.685] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.686] WriteFile (in: hFile=0x428, lpBuffer=0x6ce3357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3357*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.686] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.686] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.686] CloseHandle (hObject=0x428) returned 1 [0241.687] GetProcessHeap () returned 0x580000 [0241.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0241.687] GetProcessHeap () returned 0x580000 [0241.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0241.687] GetProcessHeap () returned 0x580000 [0241.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc79311c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x2f8fd28, dwReserved1=0x658970, cFileName="PGMN105.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGF526~1.YOU")) returned 0x5b9630 [0241.727] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.778] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML", len=0x3f | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned 1 [0241.778] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0241.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.778] CloseHandle (hObject=0x45c) returned 1 [0241.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml.id_1622540890_.your_last_chance")) returned 1 [0241.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7f300, ftCreationTime.dwHighDateTime=0x1c67971, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63d7f300, ftLastWriteTime.dwHighDateTime=0x1c67971, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~4.YOU")) returned 0x5b9630 [0241.781] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.782] GetProcessHeap () returned 0x580000 [0241.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x658970 [0241.782] GetProcessHeap () returned 0x580000 [0241.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x6ce2378 [0241.782] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.782] ReadFile (in: hFile=0x45c, lpBuffer=0x658970, nNumberOfBytesToRead=0xfe0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesRead=0x2f8ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0241.797] GetProcessHeap () returned 0x580000 [0241.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.797] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.797] WriteFile (in: hFile=0x45c, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x2f8ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0241.797] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.797] WriteFile (in: hFile=0x45c, lpBuffer=0x6ce3357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3357*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.797] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.797] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.797] CloseHandle (hObject=0x45c) returned 1 [0241.797] GetProcessHeap () returned 0x580000 [0241.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0241.797] GetProcessHeap () returned 0x580000 [0241.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0241.798] GetProcessHeap () returned 0x580000 [0241.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7f300, ftCreationTime.dwHighDateTime=0x1c67971, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a3bb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x100c, dwReserved0=0x2f8fd28, dwReserved1=0x658970, cFileName="PGMN092.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~4.YOU")) returned 0x5b9630 [0241.798] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.666] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML", len=0x40 | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned 1 [0242.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0242.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0245.394] CloseHandle (hObject=0x44c) returned 1 [0245.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml.id_1622540890_.your_last_chance")) returned 1 [0248.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f636100, ftLastWriteTime.dwHighDateTime=0x1c9ef1a, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG0126~1.YOU")) returned 0x5b96f0 [0248.868] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0248.868] GetProcessHeap () returned 0x580000 [0248.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80c1) returned 0x72aa068 [0248.869] GetProcessHeap () returned 0x580000 [0248.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80c1) returned 0x72b2138 [0248.869] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.869] ReadFile (in: hFile=0x44c, lpBuffer=0x72aa068, nNumberOfBytesToRead=0x80a0, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72aa068*, lpNumberOfBytesRead=0x2f8ff14*=0x80a0, lpOverlapped=0x0) returned 1 [0250.807] GetProcessHeap () returned 0x580000 [0250.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0250.807] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.807] WriteFile (in: hFile=0x44c, lpBuffer=0x72b2138*, nNumberOfBytesToWrite=0x80a0, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72b2138*, lpNumberOfBytesWritten=0x2f8ff14*=0x80a0, lpOverlapped=0x0) returned 1 [0250.808] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.808] WriteFile (in: hFile=0x44c, lpBuffer=0x72ba1d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72ba1d7*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0250.808] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.808] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0250.808] CloseHandle (hObject=0x44c) returned 1 [0250.808] GetProcessHeap () returned 0x580000 [0250.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72b2138 | out: hHeap=0x580000) returned 1 [0250.808] GetProcessHeap () returned 0x580000 [0250.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72aa068 | out: hHeap=0x580000) returned 1 [0250.808] GetProcessHeap () returned 0x580000 [0250.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0254.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd039620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x80de, dwReserved0=0x2f8fd28, dwReserved1=0x72aa068, cFileName="PGLBL097.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG0126~1.YOU")) returned 0x5b9730 [0254.421] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.226] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV", len=0x3d | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 1 [0255.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa0) returned 0x72e5948 [0255.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0255.227] CloseHandle (hObject=0x488) returned 1 [0255.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.id_1622540890_.your_last_chance")) returned 1 [0255.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4317bc00, ftCreationTime.dwHighDateTime=0x1c68573, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4317bc00, ftLastWriteTime.dwHighDateTime=0x1c68573, nFileSizeHigh=0x0, nFileSizeLow=0x2f814, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBH~2.YOU")) returned 0x5b9730 [0255.228] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0255.228] GetProcessHeap () returned 0x580000 [0255.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7177a38 [0255.229] GetProcessHeap () returned 0x580000 [0255.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7189268 [0255.229] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.229] ReadFile (in: hFile=0x488, lpBuffer=0x7177a38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7177a38*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.437] GetProcessHeap () returned 0x580000 [0258.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0258.437] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.437] WriteFile (in: hFile=0x488, lpBuffer=0x7189268*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7189268*, lpNumberOfBytesWritten=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.438] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.438] WriteFile (in: hFile=0x488, lpBuffer=0x719aa67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x719aa67*, lpNumberOfBytesWritten=0x2f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.438] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.438] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x2f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.438] CloseHandle (hObject=0x488) returned 1 [0258.440] GetProcessHeap () returned 0x580000 [0258.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7189268 | out: hHeap=0x580000) returned 1 [0258.440] GetProcessHeap () returned 0x580000 [0258.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7177a38 | out: hHeap=0x580000) returned 1 [0258.445] GetProcessHeap () returned 0x580000 [0258.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0259.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fccc | out: lpFindFileData=0x2f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4317bc00, ftCreationTime.dwHighDateTime=0x1c68573, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd18f9680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f838, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="DGWEBHD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBH~2.YOU")) returned 0x5b9630 [0259.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.234] SysReAllocStringLen (in: pbstr=0x2f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC", len=0x3b | out: pbstr=0x2f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC") returned 1 [0259.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20ac) returned 0x72e5948 [0259.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0259.361] CloseHandle (hObject=0x45c) returned 1 [0259.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x2f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x2f8fc74 | out: lpFindFileData=0x2f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd17a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1dd17a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x40a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOC98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TOC98P~1.YOU")) returned 0x5b9630 [0259.363] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0259.363] GetProcessHeap () returned 0x580000 [0259.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0259.363] GetProcessHeap () returned 0x580000 [0259.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0259.364] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.364] ReadFile (in: hFile=0x45c, lpBuffer=0x6e21520, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x2f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x2f8ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 15 os_tid = 0xa34 [0039.060] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.557] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.144] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.340] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.717] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", len=0x4b | out: pbstr=0x308ff84*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 1 [0059.717] GetProcessHeap () returned 0x580000 [0059.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f768 [0059.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0059.718] CloseHandle (hObject=0x438) returned 1 [0059.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.718] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id_1622540890_.your_last_chance")) returned 1 [0059.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.718] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x45, dwReserved1=0x0, cFileName="VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~2.YOU")) returned 0x5b96b0 [0059.719] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0059.719] GetProcessHeap () returned 0x580000 [0059.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x625140 [0059.719] GetProcessHeap () returned 0x580000 [0059.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0059.720] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.720] ReadFile (in: hFile=0x438, lpBuffer=0x625140, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x625140*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0065.619] GetProcessHeap () returned 0x580000 [0065.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0065.619] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.620] WriteFile (in: hFile=0x438, lpBuffer=0x6d9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.313] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.313] WriteFile (in: hFile=0x438, lpBuffer=0x6db09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db09cf*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.314] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.314] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.314] CloseHandle (hObject=0x438) returned 1 [0067.578] GetProcessHeap () returned 0x580000 [0067.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0067.578] GetProcessHeap () returned 0x580000 [0067.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x625140 | out: hHeap=0x580000) returned 1 [0067.578] GetProcessHeap () returned 0x580000 [0067.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0067.578] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x6004e060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ab024, dwReserved0=0x308fd28, dwReserved1=0x625140, cFileName="VisioMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~2.YOU")) returned 0x5b9630 [0067.578] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.672] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", len=0x4c | out: pbstr=0x308ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 1 [0068.672] GetProcessHeap () returned 0x580000 [0068.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x14) returned 0x5e9710 [0068.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0068.672] CloseHandle (hObject=0x434) returned 1 [0068.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.672] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id_1622540890_.your_last_chance")) returned 1 [0068.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.673] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x450043, dwReserved1=0x0, cFileName="OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~4.YOU")) returned 0x5b96b0 [0068.673] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.673] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0068.673] GetProcessHeap () returned 0x580000 [0068.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f21878 [0068.673] GetProcessHeap () returned 0x580000 [0068.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f330a8 [0068.673] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.673] ReadFile (in: hFile=0x434, lpBuffer=0x6f21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21878*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.360] GetProcessHeap () returned 0x580000 [0073.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0073.360] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.361] WriteFile (in: hFile=0x434, lpBuffer=0x6f330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f330a8*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.361] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.361] WriteFile (in: hFile=0x434, lpBuffer=0x6f448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f448a7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.922] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.922] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.922] CloseHandle (hObject=0x434) returned 1 [0073.923] GetProcessHeap () returned 0x580000 [0073.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f330a8 | out: hHeap=0x580000) returned 1 [0073.923] GetProcessHeap () returned 0x580000 [0073.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f21878 | out: hHeap=0x580000) returned 1 [0073.923] GetProcessHeap () returned 0x580000 [0073.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0073.923] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x387e24, dwReserved0=0x308fd28, dwReserved1=0x6f21878, cFileName="OfficeMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~4.YOU")) returned 0x5b96b0 [0073.923] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.964] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", len=0x3d | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 1 [0074.964] GetProcessHeap () returned 0x580000 [0074.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xa4) returned 0x5f76f0 [0074.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.967] Sleep (dwMilliseconds=0x1) [0079.336] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", len=0x3d | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 1 [0079.337] GetProcessHeap () returned 0x580000 [0079.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x74) returned 0x5f76f0 [0079.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.338] Sleep (dwMilliseconds=0x1) [0079.355] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", len=0x58 | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 1 [0079.355] GetProcessHeap () returned 0x580000 [0079.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x18) returned 0x5f76f0 [0079.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.362] Sleep (dwMilliseconds=0x1) [0084.368] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", len=0x4d | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 1 [0084.368] GetProcessHeap () returned 0x580000 [0084.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0084.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0084.469] CloseHandle (hObject=0x478) returned 1 [0084.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id_1622540890_.your_last_chance")) returned 1 [0084.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PHONEX~1.YOU")) returned 0x5b96b0 [0084.471] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0084.471] GetProcessHeap () returned 0x580000 [0084.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6f0c4f8 [0084.472] GetProcessHeap () returned 0x580000 [0084.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6d0ef98 [0084.472] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.472] ReadFile (in: hFile=0x478, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x308ff14*=0x720, lpOverlapped=0x0) returned 1 [0084.493] GetProcessHeap () returned 0x580000 [0084.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.493] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.493] WriteFile (in: hFile=0x478, lpBuffer=0x6d0ef98*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ef98*, lpNumberOfBytesWritten=0x308ff14*=0x720, lpOverlapped=0x0) returned 1 [0084.493] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.493] WriteFile (in: hFile=0x478, lpBuffer=0x6d0f6b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f6b7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0084.493] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.493] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0084.493] CloseHandle (hObject=0x478) returned 1 [0084.494] GetProcessHeap () returned 0x580000 [0084.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0ef98 | out: hHeap=0x580000) returned 1 [0084.494] GetProcessHeap () returned 0x580000 [0084.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0084.494] GetProcessHeap () returned 0x580000 [0084.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x69fa4100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x308fd28, dwReserved1=0x6f0c4f8, cFileName="PHONE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PHONEX~1.YOU")) returned 0x5b96b0 [0084.494] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.494] Sleep (dwMilliseconds=0x1) [0084.517] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", len=0x42 | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 1 [0084.517] GetProcessHeap () returned 0x580000 [0084.517] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0084.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0084.521] CloseHandle (hObject=0x458) returned 1 [0084.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id_1622540890_.your_last_chance")) returned 1 [0084.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTAGT~1.YOU")) returned 0x5b9630 [0084.522] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0084.523] GetProcessHeap () returned 0x580000 [0084.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3581) returned 0x67a6b8 [0084.523] GetProcessHeap () returned 0x580000 [0084.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3581) returned 0x6305a8 [0084.523] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.523] ReadFile (in: hFile=0x458, lpBuffer=0x67a6b8, nNumberOfBytesToRead=0x3560, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67a6b8*, lpNumberOfBytesRead=0x308ff14*=0x3560, lpOverlapped=0x0) returned 1 [0084.940] GetProcessHeap () returned 0x580000 [0084.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.940] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.941] WriteFile (in: hFile=0x458, lpBuffer=0x6305a8*, nNumberOfBytesToWrite=0x3560, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6305a8*, lpNumberOfBytesWritten=0x308ff14*=0x3560, lpOverlapped=0x0) returned 1 [0084.941] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.941] WriteFile (in: hFile=0x458, lpBuffer=0x633b07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x633b07*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0084.941] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.941] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0084.941] CloseHandle (hObject=0x458) returned 1 [0084.941] GetProcessHeap () returned 0x580000 [0084.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6305a8 | out: hHeap=0x580000) returned 1 [0084.941] GetProcessHeap () returned 0x580000 [0084.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67a6b8 | out: hHeap=0x580000) returned 1 [0084.941] GetProcessHeap () returned 0x580000 [0084.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3ce780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3598, dwReserved0=0x308fd28, dwReserved1=0x67a6b8, cFileName="MSTAG.TLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTAGT~1.YOU")) returned 0x5b9630 [0084.942] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.226] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", len=0x4a | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 1 [0088.226] GetProcessHeap () returned 0x580000 [0088.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0088.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.330] CloseHandle (hObject=0x450) returned 1 [0088.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.331] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.331] GetProcessHeap () returned 0x580000 [0088.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xac1) returned 0x6c79138 [0088.331] GetProcessHeap () returned 0x580000 [0088.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xac1) returned 0x67ec60 [0088.331] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.331] ReadFile (in: hFile=0x450, lpBuffer=0x6c79138, nNumberOfBytesToRead=0xaa0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79138*, lpNumberOfBytesRead=0x308ff14*=0xaa0, lpOverlapped=0x0) returned 1 [0088.342] GetProcessHeap () returned 0x580000 [0088.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.342] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.342] WriteFile (in: hFile=0x450, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x308ff14*=0xaa0, lpOverlapped=0x0) returned 1 [0088.342] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.342] WriteFile (in: hFile=0x450, lpBuffer=0x67f6ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f6ff*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.342] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.342] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.342] CloseHandle (hObject=0x450) returned 1 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79138 | out: hHeap=0x580000) returned 1 [0088.343] GetProcessHeap () returned 0x580000 [0088.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c43d340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xac6, dwReserved0=0x308fd28, dwReserved1=0x6c79138, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.343] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.359] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", len=0x4d | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 1 [0088.359] GetProcessHeap () returned 0x580000 [0088.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x28) returned 0x5dc550 [0088.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0092.716] CloseHandle (hObject=0x428) returned 1 [0092.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id_1622540890_.your_last_chance")) returned 1 [0097.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEEPBL~2.YOU")) returned 0x5b96f0 [0097.300] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0097.300] GetProcessHeap () returned 0x580000 [0097.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6c65268 [0097.300] GetProcessHeap () returned 0x580000 [0097.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f2a368 [0097.300] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.300] ReadFile (in: hFile=0x474, lpBuffer=0x6c65268, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65268*, lpNumberOfBytesRead=0x308ff14*=0x220, lpOverlapped=0x0) returned 1 [0097.304] GetProcessHeap () returned 0x580000 [0097.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0097.304] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.304] WriteFile (in: hFile=0x474, lpBuffer=0x6f2a368*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2a368*, lpNumberOfBytesWritten=0x308ff14*=0x220, lpOverlapped=0x0) returned 1 [0097.304] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.304] WriteFile (in: hFile=0x474, lpBuffer=0x6f2a587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2a587*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.305] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.305] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.305] CloseHandle (hObject=0x474) returned 1 [0097.305] GetProcessHeap () returned 0x580000 [0097.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2a368 | out: hHeap=0x580000) returned 1 [0097.305] GetProcessHeap () returned 0x580000 [0097.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65268 | out: hHeap=0x580000) returned 1 [0097.305] GetProcessHeap () returned 0x580000 [0097.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0097.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x719c89e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x308fd28, dwReserved1=0x6c65268, cFileName="DEEPBLUE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEEPBL~2.YOU")) returned 0x5b96f0 [0097.305] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.314] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", len=0x48 | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 1 [0097.314] GetProcessHeap () returned 0x580000 [0097.314] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0097.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0097.315] CloseHandle (hObject=0x474) returned 1 [0097.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0097.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0097.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.317] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0097.317] GetProcessHeap () returned 0x580000 [0097.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7281) returned 0x6efd498 [0097.317] GetProcessHeap () returned 0x580000 [0097.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7281) returned 0x6c57108 [0097.317] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.317] ReadFile (in: hFile=0x474, lpBuffer=0x6efd498, nNumberOfBytesToRead=0x7260, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efd498*, lpNumberOfBytesRead=0x308ff14*=0x7260, lpOverlapped=0x0) returned 1 [0099.606] GetProcessHeap () returned 0x580000 [0099.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.606] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.606] WriteFile (in: hFile=0x474, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0x7260, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x308ff14*=0x7260, lpOverlapped=0x0) returned 1 [0100.168] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.169] WriteFile (in: hFile=0x474, lpBuffer=0x6c5e367*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5e367*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.169] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.169] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.169] CloseHandle (hObject=0x474) returned 1 [0100.169] GetProcessHeap () returned 0x580000 [0100.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0100.524] GetProcessHeap () returned 0x580000 [0100.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efd498 | out: hHeap=0x580000) returned 1 [0100.525] GetProcessHeap () returned 0x580000 [0100.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0101.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735286e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x729d, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.840] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.160] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", len=0x46 | out: pbstr=0x308ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 1 [0106.163] GetProcessHeap () returned 0x580000 [0106.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614d08, Size=0x1c) returned 0x615078 [0106.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.030] CloseHandle (hObject=0x39c) returned 1 [0107.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id_1622540890_.your_last_chance")) returned 1 [0107.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBOB6C~1.YOU")) returned 0x5b9630 [0107.031] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.031] GetProcessHeap () returned 0x580000 [0107.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0107.064] GetProcessHeap () returned 0x580000 [0107.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0107.064] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.064] ReadFile (in: hFile=0x39c, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.438] GetProcessHeap () returned 0x580000 [0110.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0110.439] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.439] WriteFile (in: hFile=0x39c, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.439] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.439] WriteFile (in: hFile=0x39c, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0110.440] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.440] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0110.440] CloseHandle (hObject=0x39c) returned 1 [0110.440] GetProcessHeap () returned 0x580000 [0110.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0110.440] GetProcessHeap () returned 0x580000 [0110.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0110.440] GetProcessHeap () returned 0x580000 [0110.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0110.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7970cfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e458, dwReserved0=0x308fd28, dwReserved1=0x6d10048, cFileName="VBOB6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBOB6C~1.YOU")) returned 0x5b9630 [0110.440] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.160] Sleep (dwMilliseconds=0x1) [0111.788] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\bod_r.TTF", len=0x24 | out: pbstr=0x308ff84*="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 1 [0111.788] GetProcessHeap () returned 0x580000 [0111.791] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.845] Sleep (dwMilliseconds=0x1) [0112.124] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", len=0x4c | out: pbstr=0x308ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned 1 [0112.124] GetProcessHeap () returned 0x580000 [0112.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x48) returned 0x596cd8 [0112.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.136] Sleep (dwMilliseconds=0x1) [0112.194] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.208] Sleep (dwMilliseconds=0x1) [0112.319] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", len=0x4c | out: pbstr=0x308ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 1 [0112.319] GetProcessHeap () returned 0x580000 [0112.319] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x28) returned 0x5dc550 [0112.319] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.329] Sleep (dwMilliseconds=0x1) [0113.333] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", len=0x3f | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 1 [0113.334] GetProcessHeap () returned 0x580000 [0113.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x90) returned 0x6f0ceb8 [0113.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0113.479] CloseHandle (hObject=0x498) returned 1 [0113.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0001~1.YOU")) returned 0x5b9630 [0114.414] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0114.415] GetProcessHeap () returned 0x580000 [0114.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x677cd0 [0114.415] GetProcessHeap () returned 0x580000 [0114.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x635768 [0114.415] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.415] ReadFile (in: hFile=0x498, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x308ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0114.426] GetProcessHeap () returned 0x580000 [0114.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.426] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.426] WriteFile (in: hFile=0x498, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x308ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0114.427] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.427] WriteFile (in: hFile=0x498, lpBuffer=0x636327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x636327*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.427] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.427] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.427] CloseHandle (hObject=0x498) returned 1 [0114.427] GetProcessHeap () returned 0x580000 [0114.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.427] GetProcessHeap () returned 0x580000 [0114.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0114.427] GetProcessHeap () returned 0x580000 [0114.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bd22fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf6, dwReserved0=0x308fd28, dwReserved1=0x677cd0, cFileName="AN00010_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0001~1.YOU")) returned 0x5b9630 [0115.606] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0116.938] CloseHandle (hObject=0x454) returned 1 [0116.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0020~2.YOU")) returned 0x5b9630 [0116.940] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0116.940] GetProcessHeap () returned 0x580000 [0116.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ec1) returned 0x6c4a808 [0116.940] GetProcessHeap () returned 0x580000 [0116.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ec1) returned 0x6c4d6d8 [0116.940] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.940] ReadFile (in: hFile=0x454, lpBuffer=0x6c4a808, nNumberOfBytesToRead=0x2ea0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesRead=0x308ff14*=0x2ea0, lpOverlapped=0x0) returned 1 [0117.639] GetProcessHeap () returned 0x580000 [0117.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0117.639] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.639] WriteFile (in: hFile=0x454, lpBuffer=0x6c4d6d8*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4d6d8*, lpNumberOfBytesWritten=0x308ff14*=0x2ea0, lpOverlapped=0x0) returned 1 [0117.639] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.639] WriteFile (in: hFile=0x454, lpBuffer=0x6c50577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c50577*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.639] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.639] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.639] CloseHandle (hObject=0x454) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4d6d8 | out: hHeap=0x580000) returned 1 [0117.927] GetProcessHeap () returned 0x580000 [0117.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0117.927] GetProcessHeap () returned 0x580000 [0117.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dba2980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ec4, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SO00208_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0020~2.YOU")) returned 0x5b96f0 [0120.013] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.030] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", len=0x3f | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF") returned 1 [0120.030] GetProcessHeap () returned 0x580000 [0120.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x179c) returned 0x6d06ca8 [0120.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.937] CloseHandle (hObject=0x488) returned 1 [0121.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~2.YOU")) returned 0x5b9730 [0121.938] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.938] GetProcessHeap () returned 0x580000 [0121.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6cda390 [0121.938] GetProcessHeap () returned 0x580000 [0121.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6cdab58 [0121.938] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.938] ReadFile (in: hFile=0x488, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x308ff14*=0x760, lpOverlapped=0x0) returned 1 [0121.946] GetProcessHeap () returned 0x580000 [0121.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.947] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.947] WriteFile (in: hFile=0x488, lpBuffer=0x6cdab58*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab58*, lpNumberOfBytesWritten=0x308ff14*=0x760, lpOverlapped=0x0) returned 1 [0121.947] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.947] WriteFile (in: hFile=0x488, lpBuffer=0x6cdb2b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb2b7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.947] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.947] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.947] CloseHandle (hObject=0x488) returned 1 [0121.947] GetProcessHeap () returned 0x580000 [0121.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab58 | out: hHeap=0x580000) returned 1 [0121.947] GetProcessHeap () returned 0x580000 [0121.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0121.947] GetProcessHeap () returned 0x580000 [0121.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x804d8660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x308fd28, dwReserved1=0x6cda390, cFileName="WB01842_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~2.YOU")) returned 0x5b9730 [0122.565] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.566] Sleep (dwMilliseconds=0x1) [0122.607] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", len=0x50 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned 1 [0122.608] GetProcessHeap () returned 0x580000 [0122.608] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x193c) returned 0x6f42f08 [0122.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0124.694] CloseHandle (hObject=0x4a8) returned 1 [0124.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.id_1622540890_.your_last_chance")) returned 1 [0125.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0125.427] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0125.428] GetProcessHeap () returned 0x580000 [0125.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0125.428] GetProcessHeap () returned 0x580000 [0125.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0125.428] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.428] ReadFile (in: hFile=0x4a8, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x308ff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.441] GetProcessHeap () returned 0x580000 [0125.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.441] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.442] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x308ff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.442] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.442] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.442] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.442] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.442] CloseHandle (hObject=0x4a8) returned 1 [0125.442] GetProcessHeap () returned 0x580000 [0125.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0125.442] GetProcessHeap () returned 0x580000 [0125.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0125.442] GetProcessHeap () returned 0x580000 [0125.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8262ba60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe33, dwReserved0=0x308fd28, dwReserved1=0x6f69420, cFileName="Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0125.442] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.458] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", len=0x3d | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned 1 [0125.458] GetProcessHeap () returned 0x580000 [0125.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19fc) returned 0x667250 [0125.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0128.615] CloseHandle (hObject=0x170) returned 1 [0128.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.id_1622540890_.your_last_chance")) returned 1 [0130.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03154~1.YOU")) returned 0x5b9730 [0130.713] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0130.714] GetProcessHeap () returned 0x580000 [0130.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6101) returned 0x6e2c300 [0130.714] GetProcessHeap () returned 0x580000 [0130.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6101) returned 0x6e32410 [0130.714] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.714] ReadFile (in: hFile=0x170, lpBuffer=0x6e2c300, nNumberOfBytesToRead=0x60e0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2c300*, lpNumberOfBytesRead=0x308ff14*=0x60e0, lpOverlapped=0x0) returned 1 [0131.751] GetProcessHeap () returned 0x580000 [0131.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0131.751] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.751] WriteFile (in: hFile=0x170, lpBuffer=0x6e32410*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32410*, lpNumberOfBytesWritten=0x308ff14*=0x60e0, lpOverlapped=0x0) returned 1 [0131.751] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.751] WriteFile (in: hFile=0x170, lpBuffer=0x6e384ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e384ef*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.751] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.751] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.752] CloseHandle (hObject=0x170) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32410 | out: hHeap=0x580000) returned 1 [0132.909] GetProcessHeap () returned 0x580000 [0132.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e2c300 | out: hHeap=0x580000) returned 1 [0132.909] GetProcessHeap () returned 0x580000 [0132.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0135.294] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x862465e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6108, dwReserved0=0x308fd28, dwReserved1=0x6e2c300, cFileName="J0315447.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03154~1.YOU")) returned 0x5b96f0 [0135.294] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.294] Sleep (dwMilliseconds=0x1) [0135.304] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", len=0x43 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned 1 [0135.304] GetProcessHeap () returned 0x580000 [0135.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.740] CloseHandle (hObject=0x4a0) returned 1 [0139.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7546300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7546300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2141~1.YOU")) returned 0x5b97b0 [0139.802] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.802] GetProcessHeap () returned 0x580000 [0139.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0139.802] GetProcessHeap () returned 0x580000 [0139.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0139.802] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.802] ReadFile (in: hFile=0x4a0, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x308ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0139.807] GetProcessHeap () returned 0x580000 [0139.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.807] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.807] WriteFile (in: hFile=0x4a0, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x308ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0139.807] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.807] WriteFile (in: hFile=0x4a0, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.808] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.808] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.808] CloseHandle (hObject=0x4a0) returned 1 [0139.808] GetProcessHeap () returned 0x580000 [0139.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0139.808] GetProcessHeap () returned 0x580000 [0139.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0139.809] GetProcessHeap () returned 0x580000 [0139.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7546300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8af30cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x308fd28, dwReserved1=0x678958, cFileName="BD21413_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2141~1.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.173] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", len=0x5e | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned 1 [0140.173] GetProcessHeap () returned 0x580000 [0140.173] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.183] CloseHandle (hObject=0x448) returned 1 [0140.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.id_1622540890_.your_last_chance")) returned 1 [0140.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x832, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="Generic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GENERI~1.YOU")) returned 0x5b9730 [0140.732] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.732] GetProcessHeap () returned 0x580000 [0140.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0140.732] GetProcessHeap () returned 0x580000 [0140.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0140.732] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.732] ReadFile (in: hFile=0x448, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x308ff14*=0x820, lpOverlapped=0x0) returned 1 [0140.741] GetProcessHeap () returned 0x580000 [0140.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0140.741] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.741] WriteFile (in: hFile=0x448, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x308ff14*=0x820, lpOverlapped=0x0) returned 1 [0140.741] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.741] WriteFile (in: hFile=0x448, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.741] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.741] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.741] CloseHandle (hObject=0x448) returned 1 [0140.741] GetProcessHeap () returned 0x580000 [0140.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0140.741] GetProcessHeap () returned 0x580000 [0140.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0140.741] GetProcessHeap () returned 0x580000 [0140.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0141.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b7f7de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x856, dwReserved0=0x308fd28, dwReserved1=0x6c79898, cFileName="Generic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GENERI~1.YOU")) returned 0x5b9730 [0141.621] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.665] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", len=0x3c | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned 1 [0141.665] GetProcessHeap () returned 0x580000 [0141.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0141.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.666] CloseHandle (hObject=0x4a0) returned 1 [0141.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.id_1622540890_.your_last_chance")) returned 1 [0141.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x51dd6c00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~2.YOU")) returned 0x5b9730 [0141.668] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.668] GetProcessHeap () returned 0x580000 [0141.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x6ec4068 [0141.668] GetProcessHeap () returned 0x580000 [0141.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x6ec6298 [0141.668] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.668] ReadFile (in: hFile=0x4a0, lpBuffer=0x6ec4068, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesRead=0x308ff14*=0x2200, lpOverlapped=0x0) returned 1 [0141.700] GetProcessHeap () returned 0x580000 [0141.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.700] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.700] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ec6298*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec6298*, lpNumberOfBytesWritten=0x308ff14*=0x2200, lpOverlapped=0x0) returned 1 [0141.701] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.701] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ec8497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec8497*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.701] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.701] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.701] CloseHandle (hObject=0x4a0) returned 1 [0141.701] GetProcessHeap () returned 0x580000 [0141.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec6298 | out: hHeap=0x580000) returned 1 [0141.701] GetProcessHeap () returned 0x580000 [0141.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0141.701] GetProcessHeap () returned 0x580000 [0141.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c131320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2224, dwReserved0=0x308fd28, dwReserved1=0x6ec4068, cFileName="PROTTPLN.XLS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~2.YOU")) returned 0x5b9730 [0141.701] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.690] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS", len=0x45 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS") returned 1 [0146.690] GetProcessHeap () returned 0x580000 [0146.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0146.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0146.765] CloseHandle (hObject=0x470) returned 1 [0146.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css.id_1622540890_.your_last_chance")) returned 1 [0146.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d95100, ftCreationTime.dwHighDateTime=0x1c69a53, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74d95100, ftLastWriteTime.dwHighDateTime=0x1c69a53, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~3.YOU")) returned 0x5b96f0 [0146.766] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0146.767] GetProcessHeap () returned 0x580000 [0146.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e6f4f0 [0146.767] GetProcessHeap () returned 0x580000 [0146.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e80d20 [0146.768] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.768] ReadFile (in: hFile=0x470, lpBuffer=0x6e6f4f0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6f4f0*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.267] GetProcessHeap () returned 0x580000 [0150.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0150.268] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.268] WriteFile (in: hFile=0x470, lpBuffer=0x6e80d20*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e80d20*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.268] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.268] WriteFile (in: hFile=0x470, lpBuffer=0x6e9251f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9251f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.268] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.268] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.268] CloseHandle (hObject=0x470) returned 1 [0150.269] GetProcessHeap () returned 0x580000 [0150.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e80d20 | out: hHeap=0x580000) returned 1 [0150.269] GetProcessHeap () returned 0x580000 [0150.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e6f4f0 | out: hHeap=0x580000) returned 1 [0150.269] GetProcessHeap () returned 0x580000 [0150.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0150.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d95100, ftCreationTime.dwHighDateTime=0x1c69a53, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x912de600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6c8, dwReserved0=0x308fd28, dwReserved1=0x6e6f4f0, cFileName="SCHEME53.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~3.YOU")) returned 0x5b96f0 [0150.638] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.684] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", len=0x44 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned 1 [0150.684] GetProcessHeap () returned 0x580000 [0150.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0150.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.707] CloseHandle (hObject=0x3b8) returned 1 [0150.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.id_1622540890_.your_last_chance")) returned 1 [0150.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2b53, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR48~2.YOU")) returned 0x5b96f0 [0150.708] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.709] GetProcessHeap () returned 0x580000 [0150.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b61) returned 0x6f58108 [0150.709] GetProcessHeap () returned 0x580000 [0150.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b61) returned 0x6f5ac78 [0150.709] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.709] ReadFile (in: hFile=0x3b8, lpBuffer=0x6f58108, nNumberOfBytesToRead=0x2b40, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x308ff14*=0x2b40, lpOverlapped=0x0) returned 1 [0151.309] GetProcessHeap () returned 0x580000 [0151.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0151.309] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.310] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f5ac78*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5ac78*, lpNumberOfBytesWritten=0x308ff14*=0x2b40, lpOverlapped=0x0) returned 1 [0151.312] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f5d7b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5d7b7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.312] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.312] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.312] CloseHandle (hObject=0x3b8) returned 1 [0151.927] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f5ac78 | out: hHeap=0x580000) returned 1 [0151.928] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0151.928] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0152.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91cd6220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b77, dwReserved0=0x308fd28, dwReserved1=0x6f58108, cFileName="PDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR48~2.YOU")) returned 0x5b9730 [0152.050] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.075] CloseHandle (hObject=0x3a8) returned 1 [0152.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0152.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~1.YOU")) returned 0x5b9730 [0152.077] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.077] GetProcessHeap () returned 0x580000 [0152.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b5d0 [0152.077] GetProcessHeap () returned 0x580000 [0152.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b660 [0152.077] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.078] ReadFile (in: hFile=0x3a8, lpBuffer=0x61b5d0, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b5d0*, lpNumberOfBytesRead=0x308ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.079] GetProcessHeap () returned 0x580000 [0152.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b660*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b660*, lpNumberOfBytesWritten=0x308ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b6bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b6bf*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.079] CloseHandle (hObject=0x3a8) returned 1 [0152.079] GetProcessHeap () returned 0x580000 [0152.079] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b660 | out: hHeap=0x580000) returned 1 [0152.079] GetProcessHeap () returned 0x580000 [0152.079] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b5d0 | out: hHeap=0x580000) returned 1 [0152.079] GetProcessHeap () returned 0x580000 [0152.079] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x92420580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x308fd28, dwReserved1=0x61b5d0, cFileName="VISIO.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~1.YOU")) returned 0x5b9730 [0152.080] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.195] CloseHandle (hObject=0x3a8) returned 1 [0152.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id_1622540890_.your_last_chance")) returned 1 [0152.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISCOL~1.YOU")) returned 0x5b9730 [0152.196] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.197] GetProcessHeap () returned 0x580000 [0152.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa9a1) returned 0x6d8e818 [0152.197] GetProcessHeap () returned 0x580000 [0152.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa9a1) returned 0x6f58108 [0152.197] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.197] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xa980, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x308ff14*=0xa980, lpOverlapped=0x0) returned 1 [0155.113] GetProcessHeap () returned 0x580000 [0155.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.114] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0xa980, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x308ff14*=0xa980, lpOverlapped=0x0) returned 1 [0155.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.114] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f62a87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62a87*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.114] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.114] CloseHandle (hObject=0x3a8) returned 1 [0155.115] GetProcessHeap () returned 0x580000 [0155.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0155.115] GetProcessHeap () returned 0x580000 [0155.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0155.115] GetProcessHeap () returned 0x580000 [0155.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x941231a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa9a4, dwReserved0=0x308fd28, dwReserved1=0x6d8e818, cFileName="VISCOLOR.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISCOL~1.YOU")) returned 0x5b9630 [0155.748] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.808] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", len=0x45 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL") returned 1 [0155.808] GetProcessHeap () returned 0x580000 [0155.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0155.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0155.853] CloseHandle (hObject=0x170) returned 1 [0155.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl.id_1622540890_.your_last_chance")) returned 1 [0155.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YEARXS~1.YOU")) returned 0x5b9630 [0155.904] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0155.904] GetProcessHeap () returned 0x580000 [0155.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c01) returned 0x702e9c8 [0155.904] GetProcessHeap () returned 0x580000 [0155.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c01) returned 0x6e3ac60 [0155.905] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.905] ReadFile (in: hFile=0x170, lpBuffer=0x702e9c8, nNumberOfBytesToRead=0x8be0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x702e9c8*, lpNumberOfBytesRead=0x308ff14*=0x8be0, lpOverlapped=0x0) returned 1 [0158.087] GetProcessHeap () returned 0x580000 [0158.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0158.087] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.087] WriteFile (in: hFile=0x170, lpBuffer=0x6e3ac60*, nNumberOfBytesToWrite=0x8be0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3ac60*, lpNumberOfBytesWritten=0x308ff14*=0x8be0, lpOverlapped=0x0) returned 1 [0158.087] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.088] WriteFile (in: hFile=0x170, lpBuffer=0x6e4383f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4383f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.088] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.088] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.088] CloseHandle (hObject=0x170) returned 1 [0158.088] GetProcessHeap () returned 0x580000 [0158.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3ac60 | out: hHeap=0x580000) returned 1 [0158.088] GetProcessHeap () returned 0x580000 [0158.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702e9c8 | out: hHeap=0x580000) returned 1 [0158.089] GetProcessHeap () returned 0x580000 [0158.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0159.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d676e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x308fd28, dwReserved1=0x702e9c8, cFileName="YEAR.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YEARXS~1.YOU")) returned 0x5b9630 [0159.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.262] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", len=0x48 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL") returned 1 [0159.262] GetProcessHeap () returned 0x580000 [0159.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0159.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0159.331] CloseHandle (hObject=0x458) returned 1 [0159.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISO690~2.YOU")) returned 0x5b9630 [0159.332] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0159.332] GetProcessHeap () returned 0x580000 [0159.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7162708 [0159.333] GetProcessHeap () returned 0x580000 [0159.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7173f38 [0159.333] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.333] ReadFile (in: hFile=0x458, lpBuffer=0x7162708, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162708*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.039] GetProcessHeap () returned 0x580000 [0165.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0165.040] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.040] WriteFile (in: hFile=0x458, lpBuffer=0x7173f38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7173f38*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.040] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.041] WriteFile (in: hFile=0x458, lpBuffer=0x7185737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7185737*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.415] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.415] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.415] CloseHandle (hObject=0x458) returned 1 [0165.415] GetProcessHeap () returned 0x580000 [0165.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7173f38 | out: hHeap=0x580000) returned 1 [0165.416] GetProcessHeap () returned 0x580000 [0165.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162708 | out: hHeap=0x580000) returned 1 [0165.416] GetProcessHeap () returned 0x580000 [0165.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a353d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x40361, dwReserved0=0x308fd28, dwReserved1=0x7162708, cFileName="ISO690.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISO690~2.YOU")) returned 0x5b9730 [0169.279] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.377] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", len=0x36 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 1 [0169.377] GetProcessHeap () returned 0x580000 [0169.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0169.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.378] CloseHandle (hObject=0x448) returned 1 [0169.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id_1622540890_.your_last_chance")) returned 1 [0169.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGLIS~1.YOU")) returned 0x5b9730 [0169.379] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.379] GetProcessHeap () returned 0x580000 [0169.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0169.380] GetProcessHeap () returned 0x580000 [0169.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0169.380] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.380] ReadFile (in: hFile=0x448, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.761] GetProcessHeap () returned 0x580000 [0173.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.761] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.761] WriteFile (in: hFile=0x448, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.761] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.762] WriteFile (in: hFile=0x448, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.130] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.130] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.130] CloseHandle (hObject=0x448) returned 1 [0174.130] GetProcessHeap () returned 0x580000 [0174.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0174.134] GetProcessHeap () returned 0x580000 [0174.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0174.134] GetProcessHeap () returned 0x580000 [0174.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0176.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f67ddc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c250, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="ENGLISH.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGLIS~1.YOU")) returned 0x5b96f0 [0176.797] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.830] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS", len=0x3a | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS") returned 1 [0176.830] GetProcessHeap () returned 0x580000 [0176.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2138) returned 0x6f14048 [0176.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.501] CloseHandle (hObject=0x41c) returned 1 [0179.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.501] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.id_1622540890_.your_last_chance")) returned 1 [0179.502] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.502] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUNSET~1.YOU")) returned 0x5b96f0 [0179.502] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunset.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.502] GetProcessHeap () returned 0x580000 [0179.502] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.503] GetProcessHeap () returned 0x580000 [0179.503] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.503] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.503] ReadFile (in: hFile=0x41c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x308ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.517] GetProcessHeap () returned 0x580000 [0179.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.517] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.517] WriteFile (in: hFile=0x41c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x308ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.517] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.517] WriteFile (in: hFile=0x41c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.517] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.517] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.517] CloseHandle (hObject=0x41c) returned 1 [0179.517] GetProcessHeap () returned 0x580000 [0179.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.517] GetProcessHeap () returned 0x580000 [0179.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.518] GetProcessHeap () returned 0x580000 [0179.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa29d1820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x308fd28, dwReserved1=0x635768, cFileName="SUNSET.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUNSET~1.YOU")) returned 0x5b96b0 [0180.573] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0182.194] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", len=0x59 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned 1 [0182.194] GetProcessHeap () returned 0x580000 [0182.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0182.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.194] CloseHandle (hObject=0x46c) returned 1 [0182.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d554a00, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKBA~2.YOU")) returned 0x5b9770 [0182.195] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.196] GetProcessHeap () returned 0x580000 [0182.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6c29878 [0182.196] GetProcessHeap () returned 0x580000 [0182.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6dd7c30 [0182.196] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.196] ReadFile (in: hFile=0x46c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf20, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x308ff14*=0xf20, lpOverlapped=0x0) returned 1 [0182.210] GetProcessHeap () returned 0x580000 [0182.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0182.210] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.210] WriteFile (in: hFile=0x46c, lpBuffer=0x6dd7c30*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesWritten=0x308ff14*=0xf20, lpOverlapped=0x0) returned 1 [0182.210] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.211] WriteFile (in: hFile=0x46c, lpBuffer=0x6dd8b4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8b4f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.211] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.211] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.211] CloseHandle (hObject=0x46c) returned 1 [0182.211] GetProcessHeap () returned 0x580000 [0182.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0182.211] GetProcessHeap () returned 0x580000 [0182.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0182.211] GetProcessHeap () returned 0x580000 [0182.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0182.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa438e600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x308fd28, dwReserved1=0x6c29878, cFileName="TaskbarIconImages256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKBA~2.YOU")) returned 0x5b9770 [0182.211] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.494] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", len=0x6f | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned 1 [0183.494] GetProcessHeap () returned 0x580000 [0183.494] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0184.093] CloseHandle (hObject=0x43c) returned 1 [0184.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0184.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24ed, dwReserved0=0x2e0065, dwReserved1=0x70006a, cFileName="InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INACTI~1.YOU")) returned 0x5b9770 [0184.095] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0184.095] GetProcessHeap () returned 0x580000 [0184.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2501) returned 0x6faa688 [0184.095] GetProcessHeap () returned 0x580000 [0184.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2501) returned 0x656970 [0184.095] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.095] ReadFile (in: hFile=0x43c, lpBuffer=0x6faa688, nNumberOfBytesToRead=0x24e0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6faa688*, lpNumberOfBytesRead=0x308ff14*=0x24e0, lpOverlapped=0x0) returned 1 [0184.133] GetProcessHeap () returned 0x580000 [0184.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.134] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.134] WriteFile (in: hFile=0x43c, lpBuffer=0x656970*, nNumberOfBytesToWrite=0x24e0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesWritten=0x308ff14*=0x24e0, lpOverlapped=0x0) returned 1 [0184.134] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.134] WriteFile (in: hFile=0x43c, lpBuffer=0x658e4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x658e4f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.134] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.134] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.134] CloseHandle (hObject=0x43c) returned 1 [0184.136] GetProcessHeap () returned 0x580000 [0184.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0184.136] GetProcessHeap () returned 0x580000 [0184.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6faa688 | out: hHeap=0x580000) returned 1 [0184.136] GetProcessHeap () returned 0x580000 [0184.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55daf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2511, dwReserved0=0x308fd28, dwReserved1=0x6faa688, cFileName="InactiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INACTI~1.YOU")) returned 0x5b9770 [0184.136] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.658] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", len=0x64 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned 1 [0184.658] GetProcessHeap () returned 0x580000 [0184.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2134) returned 0x6f14048 [0184.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.388] CloseHandle (hObject=0x484) returned 1 [0185.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b9770 [0185.389] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.389] GetProcessHeap () returned 0x580000 [0185.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0185.389] GetProcessHeap () returned 0x580000 [0185.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x706e008 [0185.389] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.389] ReadFile (in: hFile=0x484, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x308ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0185.401] GetProcessHeap () returned 0x580000 [0185.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.401] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.401] WriteFile (in: hFile=0x484, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x308ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.401] WriteFile (in: hFile=0x484, lpBuffer=0x706ebe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ebe7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.401] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.401] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.401] CloseHandle (hObject=0x484) returned 1 [0185.402] GetProcessHeap () returned 0x580000 [0185.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0185.402] GetProcessHeap () returned 0x580000 [0185.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0185.402] GetProcessHeap () returned 0x580000 [0185.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa61e7e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x308fd28, dwReserved1=0x677cd0, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b9770 [0185.536] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.584] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", len=0x4e | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned 1 [0185.584] GetProcessHeap () returned 0x580000 [0185.584] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0185.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.869] CloseHandle (hObject=0x478) returned 1 [0186.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHESSI~1.YOU")) returned 0x5b96b0 [0186.870] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.871] GetProcessHeap () returned 0x580000 [0186.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6c29878 [0186.871] GetProcessHeap () returned 0x580000 [0186.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x67ec60 [0186.871] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.871] ReadFile (in: hFile=0x478, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf20, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x308ff14*=0xf20, lpOverlapped=0x0) returned 1 [0186.885] GetProcessHeap () returned 0x580000 [0186.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0186.885] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.885] WriteFile (in: hFile=0x478, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x308ff14*=0xf20, lpOverlapped=0x0) returned 1 [0186.885] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.885] WriteFile (in: hFile=0x478, lpBuffer=0x67fb7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fb7f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.885] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.885] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.885] CloseHandle (hObject=0x478) returned 1 [0186.885] GetProcessHeap () returned 0x580000 [0186.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0186.885] GetProcessHeap () returned 0x580000 [0186.886] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0186.886] GetProcessHeap () returned 0x580000 [0186.886] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0186.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa700a120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x308fd28, dwReserved1=0x6c29878, cFileName="ChessIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHESSI~1.YOU")) returned 0x5b96b0 [0186.886] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.888] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", len=0x60 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned 1 [0186.889] GetProcessHeap () returned 0x580000 [0186.889] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0186.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.448] CloseHandle (hObject=0x4a0) returned 1 [0188.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.id_1622540890_.your_last_chance")) returned 1 [0188.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5836a590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MENU_A~1.YOU")) returned 0x5b9770 [0188.450] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.450] GetProcessHeap () returned 0x580000 [0188.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0188.450] GetProcessHeap () returned 0x580000 [0188.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0188.450] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.450] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x308ff14*=0x320, lpOverlapped=0x0) returned 1 [0188.454] GetProcessHeap () returned 0x580000 [0188.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.454] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.454] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x308ff14*=0x320, lpOverlapped=0x0) returned 1 [0188.454] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.454] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.454] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.454] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.455] CloseHandle (hObject=0x4a0) returned 1 [0188.455] GetProcessHeap () returned 0x580000 [0188.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0188.455] GetProcessHeap () returned 0x580000 [0188.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0188.455] GetProcessHeap () returned 0x580000 [0188.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5836a590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7f10c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35e, dwReserved0=0x308fd28, dwReserved1=0x6c59120, cFileName="menu_arrow.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MENU_A~1.YOU")) returned 0x5b9770 [0191.356] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.407] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", len=0x45 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned 1 [0191.407] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0191.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0191.519] CloseHandle (hObject=0x454) returned 1 [0191.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP70C0~1.YOU")) returned 0x5b9770 [0191.601] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0191.601] GetProcessHeap () returned 0x580000 [0191.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b81) returned 0x6d770a8 [0191.601] GetProcessHeap () returned 0x580000 [0191.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b81) returned 0x70c0718 [0191.601] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.601] ReadFile (in: hFile=0x48c, lpBuffer=0x6d770a8, nNumberOfBytesToRead=0x3b60, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d770a8*, lpNumberOfBytesRead=0x308ff14*=0x3b60, lpOverlapped=0x0) returned 1 [0192.551] GetProcessHeap () returned 0x580000 [0192.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0192.551] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.551] WriteFile (in: hFile=0x48c, lpBuffer=0x70c0718*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0718*, lpNumberOfBytesWritten=0x308ff14*=0x3b60, lpOverlapped=0x0) returned 1 [0192.551] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.551] WriteFile (in: hFile=0x48c, lpBuffer=0x70c4277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4277*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0192.551] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.551] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0192.551] CloseHandle (hObject=0x48c) returned 1 [0193.112] GetProcessHeap () returned 0x580000 [0193.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0718 | out: hHeap=0x580000) returned 1 [0193.112] GetProcessHeap () returned 0x580000 [0193.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d770a8 | out: hHeap=0x580000) returned 1 [0193.112] GetProcessHeap () returned 0x580000 [0193.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0193.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa6315a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b92, dwReserved0=0x308fd28, dwReserved1=0x6d770a8, cFileName="ZPDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP70C0~1.YOU")) returned 0x5b97b0 [0193.419] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.470] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", len=0x68 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned 1 [0193.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0193.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0193.470] CloseHandle (hObject=0x170) returned 1 [0193.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.id_1622540890_.your_last_chance")) returned 1 [0196.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b97f0 [0196.410] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0196.411] GetProcessHeap () returned 0x580000 [0196.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6df2798 [0196.411] GetProcessHeap () returned 0x580000 [0196.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6df2b80 [0196.411] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.411] ReadFile (in: hFile=0x170, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x308ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0196.420] GetProcessHeap () returned 0x580000 [0196.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.420] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.420] WriteFile (in: hFile=0x170, lpBuffer=0x6df2b80*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2b80*, lpNumberOfBytesWritten=0x308ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0196.420] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.420] WriteFile (in: hFile=0x170, lpBuffer=0x6df2f1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2f1f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.421] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.421] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.421] CloseHandle (hObject=0x170) returned 1 [0196.421] GetProcessHeap () returned 0x580000 [0196.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2b80 | out: hHeap=0x580000) returned 1 [0196.421] GetProcessHeap () returned 0x580000 [0196.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0196.421] GetProcessHeap () returned 0x580000 [0196.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacb16aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x308fd28, dwReserved1=0x6df2798, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b97f0 [0199.024] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.655] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned 1 [0199.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0199.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.768] CloseHandle (hObject=0x488) returned 1 [0201.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0201.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b97b0 [0201.769] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.769] GetProcessHeap () returned 0x580000 [0201.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.769] GetProcessHeap () returned 0x580000 [0201.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0201.769] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.769] ReadFile (in: hFile=0x488, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x308ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.773] GetProcessHeap () returned 0x580000 [0201.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.773] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.774] WriteFile (in: hFile=0x488, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x308ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.774] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.774] WriteFile (in: hFile=0x488, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.774] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.774] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.774] CloseHandle (hObject=0x488) returned 1 [0201.774] GetProcessHeap () returned 0x580000 [0201.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0201.774] GetProcessHeap () returned 0x580000 [0201.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.774] GetProcessHeap () returned 0x580000 [0201.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafe1e240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x308fd28, dwReserved1=0x6dcfb90, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b9770 [0202.700] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.759] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS", len=0x45 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS") returned 1 [0202.759] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec4) returned 0x6f14048 [0202.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0202.760] CloseHandle (hObject=0x42c) returned 1 [0202.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css.id_1622540890_.your_last_chance")) returned 1 [0202.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC8764~1.YOU")) returned 0x5b9770 [0202.761] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0202.761] GetProcessHeap () returned 0x580000 [0202.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7239028 [0202.762] GetProcessHeap () returned 0x580000 [0202.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x724a858 [0202.762] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.762] ReadFile (in: hFile=0x42c, lpBuffer=0x7239028, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7239028*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.938] GetProcessHeap () returned 0x580000 [0209.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0209.938] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.938] WriteFile (in: hFile=0x42c, lpBuffer=0x724a858*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x724a858*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.939] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.939] WriteFile (in: hFile=0x42c, lpBuffer=0x725c057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x725c057*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.939] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.939] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.939] CloseHandle (hObject=0x42c) returned 1 [0209.939] GetProcessHeap () returned 0x580000 [0209.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x724a858 | out: hHeap=0x580000) returned 1 [0209.946] GetProcessHeap () returned 0x580000 [0209.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7239028 | out: hHeap=0x580000) returned 1 [0209.950] GetProcessHeap () returned 0x580000 [0209.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4bed160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d778, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="SCHEME28.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC8764~1.YOU")) returned 0x5b97b0 [0210.571] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.710] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS", len=0x45 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS") returned 1 [0210.710] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0210.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0210.711] CloseHandle (hObject=0x464) returned 1 [0210.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css.id_1622540890_.your_last_chance")) returned 1 [0210.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20444, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC53F2~1.YOU")) returned 0x5b97b0 [0210.712] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0210.712] GetProcessHeap () returned 0x580000 [0210.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e9be70 [0210.713] GetProcessHeap () returned 0x580000 [0210.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead6a0 [0210.713] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.713] ReadFile (in: hFile=0x464, lpBuffer=0x6e9be70, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be70*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.246] GetProcessHeap () returned 0x580000 [0214.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0214.246] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.246] WriteFile (in: hFile=0x464, lpBuffer=0x6ead6a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead6a0*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.247] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.247] WriteFile (in: hFile=0x464, lpBuffer=0x6ebee9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebee9f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.247] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.247] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.247] CloseHandle (hObject=0x464) returned 1 [0214.247] GetProcessHeap () returned 0x580000 [0214.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead6a0 | out: hHeap=0x580000) returned 1 [0214.264] GetProcessHeap () returned 0x580000 [0214.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9be70 | out: hHeap=0x580000) returned 1 [0214.269] GetProcessHeap () returned 0x580000 [0214.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0215.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb74fcce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20468, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="SCHEME09.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC53F2~1.YOU")) returned 0x5b97b0 [0215.050] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.115] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK", len=0x40 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 1 [0215.115] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0215.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.116] CloseHandle (hObject=0x43c) returned 1 [0215.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.117] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~2.YOU")) returned 0x5b97b0 [0215.117] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.117] GetProcessHeap () returned 0x580000 [0215.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.117] GetProcessHeap () returned 0x580000 [0215.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.117] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.117] ReadFile (in: hFile=0x43c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x308ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.119] GetProcessHeap () returned 0x580000 [0215.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.119] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] WriteFile (in: hFile=0x43c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x308ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.119] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] WriteFile (in: hFile=0x43c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.119] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.119] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.119] CloseHandle (hObject=0x43c) returned 1 [0215.119] GetProcessHeap () returned 0x580000 [0215.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.119] GetProcessHeap () returned 0x580000 [0215.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.119] GetProcessHeap () returned 0x580000 [0215.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7d519e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x308fd28, dwReserved1=0x61b540, cFileName="MSTORE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~2.YOU")) returned 0x5b97b0 [0215.120] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.181] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM", len=0x3b | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM") returned 1 [0215.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0215.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.182] CloseHandle (hObject=0x458) returned 1 [0215.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.id_1622540890_.your_last_chance")) returned 1 [0215.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd8527700, ftLastWriteTime.dwHighDateTime=0x1c33a9f, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSQRY3~1.YOU")) returned 0x5b97b0 [0215.183] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.183] GetProcessHeap () returned 0x580000 [0215.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e55db0 [0215.184] GetProcessHeap () returned 0x580000 [0215.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e675e0 [0215.184] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.184] ReadFile (in: hFile=0x458, lpBuffer=0x6e55db0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55db0*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.558] GetProcessHeap () returned 0x580000 [0220.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0220.558] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.558] WriteFile (in: hFile=0x458, lpBuffer=0x6e675e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.559] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.559] WriteFile (in: hFile=0x458, lpBuffer=0x6e78ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78ddf*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.796] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.796] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.796] CloseHandle (hObject=0x458) returned 1 [0220.796] GetProcessHeap () returned 0x580000 [0220.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e675e0 | out: hHeap=0x580000) returned 1 [0220.796] GetProcessHeap () returned 0x580000 [0220.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e55db0 | out: hHeap=0x580000) returned 1 [0220.796] GetProcessHeap () returned 0x580000 [0220.796] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0221.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbb378e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7d6a6, dwReserved0=0x308fd28, dwReserved1=0x6e55db0, cFileName="MSQRY32.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSQRY3~1.YOU")) returned 0x5b9730 [0221.878] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.884] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", len=0x6b | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned 1 [0221.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0221.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.923] CloseHandle (hObject=0x460) returned 1 [0221.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d72, dwReserved0=0x2e0070, dwReserved1=0x640069, cFileName="WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHITEB~2.YOU")) returned 0x5b9730 [0221.924] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.924] GetProcessHeap () returned 0x580000 [0221.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d81) returned 0x7111f48 [0221.924] GetProcessHeap () returned 0x580000 [0221.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d81) returned 0x6f976f8 [0221.925] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.925] ReadFile (in: hFile=0x460, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x4d60, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x308ff14*=0x4d60, lpOverlapped=0x0) returned 1 [0222.310] GetProcessHeap () returned 0x580000 [0222.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0222.310] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.310] WriteFile (in: hFile=0x460, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x4d60, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x308ff14*=0x4d60, lpOverlapped=0x0) returned 1 [0222.311] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.311] WriteFile (in: hFile=0x460, lpBuffer=0x6f9c457*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9c457*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.311] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.311] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.311] CloseHandle (hObject=0x460) returned 1 [0222.530] GetProcessHeap () returned 0x580000 [0222.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0222.530] GetProcessHeap () returned 0x580000 [0222.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0222.530] GetProcessHeap () returned 0x580000 [0222.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0225.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc1e73c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d96, dwReserved0=0x308fd28, dwReserved1=0x7111f48, cFileName="WhiteboxMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHITEB~2.YOU")) returned 0x5b9630 [0225.413] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.445] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", len=0x34 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned 1 [0225.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0225.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0225.446] CloseHandle (hObject=0x428) returned 1 [0225.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.446] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.id_1622540890_.your_last_chance")) returned 1 [0225.447] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPIRMX~1.YOU")) returned 0x5b9630 [0225.447] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0225.448] GetProcessHeap () returned 0x580000 [0225.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e44580 [0225.448] GetProcessHeap () returned 0x580000 [0225.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e55db0 [0225.449] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.449] ReadFile (in: hFile=0x428, lpBuffer=0x6e44580, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.996] GetProcessHeap () returned 0x580000 [0233.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0233.997] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.997] WriteFile (in: hFile=0x428, lpBuffer=0x6e55db0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55db0*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.997] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.997] WriteFile (in: hFile=0x428, lpBuffer=0x6e675af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675af*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.997] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.997] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.998] CloseHandle (hObject=0x428) returned 1 [0235.467] GetProcessHeap () returned 0x580000 [0235.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e55db0 | out: hHeap=0x580000) returned 1 [0235.467] GetProcessHeap () returned 0x580000 [0235.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e44580 | out: hHeap=0x580000) returned 1 [0235.479] GetProcessHeap () returned 0x580000 [0235.479] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0239.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2fd8be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13780, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="IPIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPIRMX~1.YOU")) returned 0x5b9630 [0239.586] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.710] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", len=0x37 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 1 [0239.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0239.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.712] CloseHandle (hObject=0x4a0) returned 1 [0239.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.id_1622540890_.your_last_chance")) returned 1 [0239.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORMMOD~1.YOU")) returned 0x5b9730 [0239.713] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ormmodel.mdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0239.713] GetProcessHeap () returned 0x580000 [0239.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0239.714] GetProcessHeap () returned 0x580000 [0239.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0239.714] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.714] ReadFile (in: hFile=0x4a0, lpBuffer=0x72c5008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0243.477] GetProcessHeap () returned 0x580000 [0243.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0243.477] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.477] WriteFile (in: hFile=0x4a0, lpBuffer=0x72d6838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0243.478] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.478] WriteFile (in: hFile=0x4a0, lpBuffer=0x72e8037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e8037*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0243.478] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.478] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0243.478] CloseHandle (hObject=0x4a0) returned 1 [0243.478] GetProcessHeap () returned 0x580000 [0243.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0243.478] GetProcessHeap () returned 0x580000 [0243.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0243.478] GetProcessHeap () returned 0x580000 [0243.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0245.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8a4cfe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x119b4, dwReserved0=0x308fd28, dwReserved1=0x72c5008, cFileName="ORMMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORMMOD~1.YOU")) returned 0x5b9730 [0245.397] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.276] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC", len=0x3b | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 1 [0249.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0249.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0249.277] CloseHandle (hObject=0x47c) returned 1 [0249.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.id_1622540890_.your_last_chance")) returned 1 [0249.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9e500, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9e500, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x329e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALHMP~1.YOU")) returned 0x5b9730 [0249.279] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0249.279] GetProcessHeap () returned 0x580000 [0249.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe4530 [0249.279] GetProcessHeap () returned 0x580000 [0249.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0249.280] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.281] ReadFile (in: hFile=0x47c, lpBuffer=0x6fe4530, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe4530*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.907] GetProcessHeap () returned 0x580000 [0252.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0252.908] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.908] WriteFile (in: hFile=0x47c, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.908] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.908] WriteFile (in: hFile=0x47c, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.908] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.908] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.908] CloseHandle (hObject=0x47c) returned 1 [0252.917] GetProcessHeap () returned 0x580000 [0252.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0252.917] GetProcessHeap () returned 0x580000 [0252.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe4530 | out: hHeap=0x580000) returned 1 [0252.918] GetProcessHeap () returned 0x580000 [0252.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9e500, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce44efc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32a04, dwReserved0=0x308fd28, dwReserved1=0x6fe4530, cFileName="CALHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALHMP~1.YOU")) returned 0x5b9730 [0254.425] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.364] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML", len=0x3e | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML") returned 1 [0255.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f54) returned 0x72e5948 [0255.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.570] CloseHandle (hObject=0x488) returned 1 [0258.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml.id_1622540890_.your_last_chance")) returned 1 [0258.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb78a5e00, ftCreationTime.dwHighDateTime=0x1c9a6c0, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78a5e00, ftLastWriteTime.dwHighDateTime=0x1c9a6c0, nFileSizeHigh=0x0, nFileSizeLow=0x1aca, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPICC~2.YOU")) returned 0x5b96f0 [0258.575] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.575] GetProcessHeap () returned 0x580000 [0258.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ae1) returned 0x6dd40d0 [0258.575] GetProcessHeap () returned 0x580000 [0258.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ae1) returned 0x71631d8 [0258.575] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.575] ReadFile (in: hFile=0x488, lpBuffer=0x6dd40d0, nNumberOfBytesToRead=0x1ac0, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesRead=0x308ff14*=0x1ac0, lpOverlapped=0x0) returned 1 [0258.599] GetProcessHeap () returned 0x580000 [0258.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.600] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.600] WriteFile (in: hFile=0x488, lpBuffer=0x71631d8*, nNumberOfBytesToWrite=0x1ac0, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x71631d8*, lpNumberOfBytesWritten=0x308ff14*=0x1ac0, lpOverlapped=0x0) returned 1 [0258.600] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.600] WriteFile (in: hFile=0x488, lpBuffer=0x7164c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7164c97*, lpNumberOfBytesWritten=0x308ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.600] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.600] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x308ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.600] CloseHandle (hObject=0x488) returned 1 [0258.600] GetProcessHeap () returned 0x580000 [0258.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71631d8 | out: hHeap=0x580000) returned 1 [0258.600] GetProcessHeap () returned 0x580000 [0258.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0258.600] GetProcessHeap () returned 0x580000 [0258.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fccc | out: lpFindFileData=0x308fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb78a5e00, ftCreationTime.dwHighDateTime=0x1c9a6c0, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1a76440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1aee, dwReserved0=0x308fd28, dwReserved1=0x6dd40d0, cFileName="DGPICCAP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPICC~2.YOU")) returned 0x5b9630 [0259.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.235] SysReAllocStringLen (in: pbstr=0x308ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV", len=0x41 | out: pbstr=0x308ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV") returned 1 [0259.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x209c) returned 0x72e5948 [0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0259.350] CloseHandle (hObject=0x470) returned 1 [0259.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x308ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x308fc74 | out: lpFindFileData=0x308fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211e800, ftCreationTime.dwHighDateTime=0x1c9c70d, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211e800, ftLastWriteTime.dwHighDateTime=0x1c9c70d, nFileSizeHigh=0x0, nFileSizeLow=0x4c9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STORYV~1.YOU")) returned 0x5b9630 [0259.351] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0259.351] GetProcessHeap () returned 0x580000 [0259.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7031ed8 [0259.351] GetProcessHeap () returned 0x580000 [0259.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0259.352] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.352] ReadFile (in: hFile=0x470, lpBuffer=0x7031ed8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x308ff14, lpOverlapped=0x0 | out: lpBuffer=0x7031ed8*, lpNumberOfBytesRead=0x308ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 16 os_tid = 0xa38 [0039.060] Sleep (dwMilliseconds=0x1) [0039.086] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.287] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.557] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.144] Sleep (dwMilliseconds=0x1) [0043.200] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.340] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.720] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", len=0x4a | out: pbstr=0x31cff84*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 1 [0059.721] GetProcessHeap () returned 0x580000 [0059.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f768, Size=0x2c) returned 0x61f730 [0059.721] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0059.749] CloseHandle (hObject=0x440) returned 1 [0059.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.749] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id_1622540890_.your_last_chance")) returned 1 [0059.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.749] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOL~1.YOU")) returned 0x5b96b0 [0059.749] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0059.750] GetProcessHeap () returned 0x580000 [0059.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6db0a00 [0059.750] GetProcessHeap () returned 0x580000 [0059.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc2230 [0059.751] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.751] ReadFile (in: hFile=0x440, lpBuffer=0x6db0a00, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db0a00*, lpNumberOfBytesRead=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0065.631] GetProcessHeap () returned 0x580000 [0065.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0065.631] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.631] WriteFile (in: hFile=0x440, lpBuffer=0x6dc2230*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc2230*, lpNumberOfBytesWritten=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.348] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.348] WriteFile (in: hFile=0x440, lpBuffer=0x6dd3a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a2f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0066.829] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.829] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0066.829] CloseHandle (hObject=0x440) returned 1 [0074.324] GetProcessHeap () returned 0x580000 [0074.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc2230 | out: hHeap=0x580000) returned 1 [0074.324] GetProcessHeap () returned 0x580000 [0074.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db0a00 | out: hHeap=0x580000) returned 1 [0074.336] GetProcessHeap () returned 0x580000 [0074.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0074.648] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x63b5e240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3078101, dwReserved0=0x31cfd34, dwReserved1=0x7718ba87, cFileName="VisioLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOL~1.YOU")) returned 0x5b9730 [0074.648] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.331] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", len=0x3d | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 1 [0079.331] GetProcessHeap () returned 0x580000 [0079.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x84) returned 0x5f76f0 [0079.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.332] Sleep (dwMilliseconds=0x1) [0079.347] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", len=0x3d | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 1 [0079.347] GetProcessHeap () returned 0x580000 [0079.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x4c) returned 0x5f76f0 [0079.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.348] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.494] Sleep (dwMilliseconds=0x1) [0085.956] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", len=0x4d | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 1 [0085.956] GetProcessHeap () returned 0x580000 [0085.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc0) returned 0x614a48 [0085.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.958] Sleep (dwMilliseconds=0x1) [0085.973] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", len=0x43 | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned 1 [0085.973] GetProcessHeap () returned 0x580000 [0085.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x54) returned 0x614a48 [0085.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.987] Sleep (dwMilliseconds=0x1) [0088.362] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", len=0x4b | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 1 [0088.362] GetProcessHeap () returned 0x580000 [0088.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0088.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0088.363] CloseHandle (hObject=0x470) returned 1 [0088.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.364] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0088.364] GetProcessHeap () returned 0x580000 [0088.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6f043d8 [0088.364] GetProcessHeap () returned 0x580000 [0088.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x67c450 [0088.364] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.364] ReadFile (in: hFile=0x470, lpBuffer=0x6f043d8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f043d8*, lpNumberOfBytesRead=0x31cff14*=0x500, lpOverlapped=0x0) returned 1 [0088.462] GetProcessHeap () returned 0x580000 [0088.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.462] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.462] WriteFile (in: hFile=0x470, lpBuffer=0x67c450*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x67c450*, lpNumberOfBytesWritten=0x31cff14*=0x500, lpOverlapped=0x0) returned 1 [0088.462] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.462] WriteFile (in: hFile=0x470, lpBuffer=0x67c94f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x67c94f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0088.462] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.462] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0088.462] CloseHandle (hObject=0x470) returned 1 [0088.472] GetProcessHeap () returned 0x580000 [0088.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c450 | out: hHeap=0x580000) returned 1 [0088.472] GetProcessHeap () returned 0x580000 [0088.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f043d8 | out: hHeap=0x580000) returned 1 [0088.472] GetProcessHeap () returned 0x580000 [0088.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c56de40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x531, dwReserved0=0x31cfd28, dwReserved1=0x6f043d8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.473] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.044] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 1 [0092.044] GetProcessHeap () returned 0x580000 [0092.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1af38, Size=0x6c) returned 0x6f1aec0 [0092.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0092.138] CloseHandle (hObject=0x490) returned 1 [0092.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0092.144] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0092.144] GetProcessHeap () returned 0x580000 [0092.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x679f00 [0092.144] GetProcessHeap () returned 0x580000 [0092.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x6d01608 [0092.145] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.145] ReadFile (in: hFile=0x490, lpBuffer=0x679f00, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x679f00*, lpNumberOfBytesRead=0x31cff14*=0x2d20, lpOverlapped=0x0) returned 1 [0093.197] GetProcessHeap () returned 0x580000 [0093.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.197] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.197] WriteFile (in: hFile=0x490, lpBuffer=0x6d01608*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01608*, lpNumberOfBytesWritten=0x31cff14*=0x2d20, lpOverlapped=0x0) returned 1 [0093.197] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.197] WriteFile (in: hFile=0x490, lpBuffer=0x6d04327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04327*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0093.197] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.197] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0093.197] CloseHandle (hObject=0x490) returned 1 [0093.198] GetProcessHeap () returned 0x580000 [0093.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d01608 | out: hHeap=0x580000) returned 1 [0093.198] GetProcessHeap () returned 0x580000 [0093.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x679f00 | out: hHeap=0x580000) returned 1 [0093.198] GetProcessHeap () returned 0x580000 [0093.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f2a8040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d59, dwReserved0=0x31cfd28, dwReserved1=0x679f00, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0094.167] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.185] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 1 [0094.185] GetProcessHeap () returned 0x580000 [0094.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b96b0 [0094.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0094.185] CloseHandle (hObject=0x460) returned 1 [0094.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0095.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0095.676] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0095.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0095.676] GetProcessHeap () returned 0x580000 [0095.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c81) returned 0x6d2dee8 [0095.676] GetProcessHeap () returned 0x580000 [0095.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c81) returned 0x662c40 [0095.676] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.676] ReadFile (in: hFile=0x460, lpBuffer=0x6d2dee8, nNumberOfBytesToRead=0x4c60, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2dee8*, lpNumberOfBytesRead=0x31cff14*=0x4c60, lpOverlapped=0x0) returned 1 [0097.133] GetProcessHeap () returned 0x580000 [0097.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0097.133] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x460, lpBuffer=0x662c40*, nNumberOfBytesToWrite=0x4c60, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x662c40*, lpNumberOfBytesWritten=0x31cff14*=0x4c60, lpOverlapped=0x0) returned 1 [0097.133] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x460, lpBuffer=0x66789f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x66789f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0097.133] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.133] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0097.133] CloseHandle (hObject=0x460) returned 1 [0097.134] GetProcessHeap () returned 0x580000 [0097.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662c40 | out: hHeap=0x580000) returned 1 [0097.134] GetProcessHeap () returned 0x580000 [0097.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2dee8 | out: hHeap=0x580000) returned 1 [0097.134] GetProcessHeap () returned 0x580000 [0097.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0097.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71825ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c8f, dwReserved0=0x31cfd28, dwReserved1=0x6d2dee8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0098.249] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 1 [0098.250] GetProcessHeap () returned 0x580000 [0098.250] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0098.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0098.250] CloseHandle (hObject=0x484) returned 1 [0098.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0098.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0099.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0099.698] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0099.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0099.698] GetProcessHeap () returned 0x580000 [0099.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x6e7ea40 [0099.698] GetProcessHeap () returned 0x580000 [0099.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x673cd0 [0099.699] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.699] ReadFile (in: hFile=0x484, lpBuffer=0x6e7ea40, nNumberOfBytesToRead=0x6a20, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7ea40*, lpNumberOfBytesRead=0x31cff14*=0x6a20, lpOverlapped=0x0) returned 1 [0101.193] GetProcessHeap () returned 0x580000 [0101.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0101.194] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.194] WriteFile (in: hFile=0x484, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x6a20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x31cff14*=0x6a20, lpOverlapped=0x0) returned 1 [0101.194] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.194] WriteFile (in: hFile=0x484, lpBuffer=0x67a6ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x67a6ef*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0101.194] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.194] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0101.194] CloseHandle (hObject=0x484) returned 1 [0101.194] GetProcessHeap () returned 0x580000 [0101.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0101.195] GetProcessHeap () returned 0x580000 [0101.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e7ea40 | out: hHeap=0x580000) returned 1 [0101.197] GetProcessHeap () returned 0x580000 [0101.197] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73ed4040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a4d, dwReserved0=0x31cfd28, dwReserved1=0x580000, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.842] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.638] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", len=0x33 | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 1 [0109.645] GetProcessHeap () returned 0x580000 [0109.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0109.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.673] Sleep (dwMilliseconds=0x1) [0109.709] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", len=0x34 | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 1 [0109.709] GetProcessHeap () returned 0x580000 [0109.709] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x6150c8 [0109.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.709] Sleep (dwMilliseconds=0x1) [0111.108] Sleep (dwMilliseconds=0x1) [0111.119] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.713] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", len=0x38 | out: pbstr=0x31cff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 1 [0111.713] GetProcessHeap () returned 0x580000 [0111.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.717] Sleep (dwMilliseconds=0x1) [0111.886] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", len=0x54 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 1 [0111.886] GetProcessHeap () returned 0x580000 [0111.886] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0111.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.890] Sleep (dwMilliseconds=0x1) [0111.903] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", len=0x52 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 1 [0111.903] GetProcessHeap () returned 0x580000 [0111.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0111.903] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.907] Sleep (dwMilliseconds=0x1) [0111.932] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", len=0x4e | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 1 [0111.932] GetProcessHeap () returned 0x580000 [0111.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.932] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.934] Sleep (dwMilliseconds=0x1) [0111.958] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", len=0x44 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 1 [0111.958] GetProcessHeap () returned 0x580000 [0111.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x70) returned 0x6f1b028 [0111.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.958] Sleep (dwMilliseconds=0x1) [0111.967] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", len=0x42 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 1 [0111.967] GetProcessHeap () returned 0x580000 [0111.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1930 [0111.968] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.969] Sleep (dwMilliseconds=0x1) [0112.004] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", len=0x48 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 1 [0112.005] GetProcessHeap () returned 0x580000 [0112.005] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.007] Sleep (dwMilliseconds=0x1) [0112.057] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", len=0x45 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 1 [0112.058] GetProcessHeap () returned 0x580000 [0112.058] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.061] Sleep (dwMilliseconds=0x1) [0112.088] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", len=0x4d | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 1 [0112.088] GetProcessHeap () returned 0x580000 [0112.088] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.088] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.089] Sleep (dwMilliseconds=0x1) [0112.119] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", len=0x54 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 1 [0112.119] GetProcessHeap () returned 0x580000 [0112.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa1f0, Size=0x78) returned 0x5d6258 [0112.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.119] Sleep (dwMilliseconds=0x1) [0112.151] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", len=0x4b | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned 1 [0112.151] GetProcessHeap () returned 0x580000 [0112.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.151] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.154] Sleep (dwMilliseconds=0x1) [0112.167] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", len=0x46 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 1 [0112.167] GetProcessHeap () returned 0x580000 [0112.167] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.167] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.170] Sleep (dwMilliseconds=0x1) [0112.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.184] Sleep (dwMilliseconds=0x1) [0112.196] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.201] Sleep (dwMilliseconds=0x1) [0112.227] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", len=0x4d | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 1 [0112.227] GetProcessHeap () returned 0x580000 [0112.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.227] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.227] Sleep (dwMilliseconds=0x1) [0112.243] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", len=0x5b | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.243] GetProcessHeap () returned 0x580000 [0112.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.243] Sleep (dwMilliseconds=0x1) [0112.258] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", len=0x53 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned 1 [0112.258] GetProcessHeap () returned 0x580000 [0112.258] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.258] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.258] Sleep (dwMilliseconds=0x1) [0112.274] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", len=0x3f | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned 1 [0112.274] GetProcessHeap () returned 0x580000 [0112.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.274] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.274] Sleep (dwMilliseconds=0x1) [0112.289] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", len=0x51 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned 1 [0112.289] GetProcessHeap () returned 0x580000 [0112.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1ae8 [0112.289] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.293] Sleep (dwMilliseconds=0x1) [0112.305] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", len=0x57 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 1 [0112.305] GetProcessHeap () returned 0x580000 [0112.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f99f8, Size=0x78) returned 0x5d6258 [0112.305] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.309] Sleep (dwMilliseconds=0x1) [0112.320] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", len=0x63 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.320] GetProcessHeap () returned 0x580000 [0112.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.321] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.321] Sleep (dwMilliseconds=0x1) [0112.336] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", len=0x43 | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 1 [0112.336] GetProcessHeap () returned 0x580000 [0112.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b9630 [0112.336] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.338] Sleep (dwMilliseconds=0x1) [0112.353] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv", len=0x4c | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv") returned 1 [0112.353] GetProcessHeap () returned 0x580000 [0112.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c562c0 [0112.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.354] Sleep (dwMilliseconds=0x1) [0112.368] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", len=0x4b | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 1 [0112.369] GetProcessHeap () returned 0x580000 [0112.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.369] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.370] Sleep (dwMilliseconds=0x1) [0112.384] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", len=0x2b | out: pbstr=0x31cff84*="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 1 [0112.384] GetProcessHeap () returned 0x580000 [0112.384] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.384] Sleep (dwMilliseconds=0x1) [0112.400] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", len=0x4f | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 1 [0112.400] GetProcessHeap () returned 0x580000 [0112.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0112.402] CloseHandle (hObject=0x454) returned 1 [0112.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id_1622540890_.your_last_chance")) returned 1 [0112.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL200~1.YOU")) returned 0x5b9630 [0112.403] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0112.403] GetProcessHeap () returned 0x580000 [0112.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8521) returned 0x6f10048 [0112.403] GetProcessHeap () returned 0x580000 [0112.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8521) returned 0x6dfaac0 [0112.404] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.404] ReadFile (in: hFile=0x454, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x8500, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x31cff14*=0x8500, lpOverlapped=0x0) returned 1 [0112.916] GetProcessHeap () returned 0x580000 [0112.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0112.916] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x454, lpBuffer=0x6dfaac0*, nNumberOfBytesToWrite=0x8500, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesWritten=0x31cff14*=0x8500, lpOverlapped=0x0) returned 1 [0112.916] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x454, lpBuffer=0x6e02fbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02fbf*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0112.916] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0112.916] CloseHandle (hObject=0x454) returned 1 [0113.036] GetProcessHeap () returned 0x580000 [0113.036] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0113.037] GetProcessHeap () returned 0x580000 [0113.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0113.038] GetProcessHeap () returned 0x580000 [0113.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0113.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7aeb4a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8540, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="sql2000.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL200~1.YOU")) returned 0x5b9730 [0113.289] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.309] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", len=0x3f | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 1 [0113.309] GetProcessHeap () returned 0x580000 [0113.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x10c) returned 0x6f0ceb8 [0113.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.442] CloseHandle (hObject=0x430) returned 1 [0113.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0423~1.YOU")) returned 0x5b9630 [0113.443] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.443] GetProcessHeap () returned 0x580000 [0113.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6e023d0 [0113.443] GetProcessHeap () returned 0x580000 [0113.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6e04260 [0113.444] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.444] ReadFile (in: hFile=0x430, lpBuffer=0x6e023d0, nNumberOfBytesToRead=0x1e60, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023d0*, lpNumberOfBytesRead=0x31cff14*=0x1e60, lpOverlapped=0x0) returned 1 [0113.472] GetProcessHeap () returned 0x580000 [0113.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0113.472] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.472] WriteFile (in: hFile=0x430, lpBuffer=0x6e04260*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e04260*, lpNumberOfBytesWritten=0x31cff14*=0x1e60, lpOverlapped=0x0) returned 1 [0113.472] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.472] WriteFile (in: hFile=0x430, lpBuffer=0x6e060bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e060bf*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0113.472] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.472] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0113.472] CloseHandle (hObject=0x430) returned 1 [0113.472] GetProcessHeap () returned 0x580000 [0113.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e04260 | out: hHeap=0x580000) returned 1 [0113.472] GetProcessHeap () returned 0x580000 [0113.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023d0 | out: hHeap=0x580000) returned 1 [0113.472] GetProcessHeap () returned 0x580000 [0113.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0113.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b3e9a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0, dwReserved0=0x31cfd28, dwReserved1=0x6e023d0, cFileName="AN04235_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0423~1.YOU")) returned 0x5b9630 [0113.832] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0116.367] CloseHandle (hObject=0x49c) returned 1 [0116.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0029~1.YOU")) returned 0x5b9630 [0116.368] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0116.368] GetProcessHeap () returned 0x580000 [0116.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x62e3b8 [0116.368] GetProcessHeap () returned 0x580000 [0116.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x6c9a390 [0116.369] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.369] ReadFile (in: hFile=0x49c, lpBuffer=0x62e3b8, nNumberOfBytesToRead=0x1260, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x62e3b8*, lpNumberOfBytesRead=0x31cff14*=0x1260, lpOverlapped=0x0) returned 1 [0116.448] GetProcessHeap () returned 0x580000 [0116.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.448] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.449] WriteFile (in: hFile=0x49c, lpBuffer=0x6c9a390*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesWritten=0x31cff14*=0x1260, lpOverlapped=0x0) returned 1 [0116.449] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.449] WriteFile (in: hFile=0x49c, lpBuffer=0x6c9b5ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b5ef*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0116.449] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.449] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0116.449] CloseHandle (hObject=0x49c) returned 1 [0116.449] GetProcessHeap () returned 0x580000 [0116.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0116.449] GetProcessHeap () returned 0x580000 [0116.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62e3b8 | out: hHeap=0x580000) returned 1 [0116.449] GetProcessHeap () returned 0x580000 [0116.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d054100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x128c, dwReserved0=0x31cfd28, dwReserved1=0x62e3b8, cFileName="SL00298_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0029~1.YOU")) returned 0x5b9630 [0116.449] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.556] CloseHandle (hObject=0x438) returned 1 [0116.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id_1622540890_.your_last_chance")) returned 1 [0116.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAFRI_~1.YOU")) returned 0x5b9630 [0116.557] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.558] GetProcessHeap () returned 0x580000 [0116.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6cbcda8 [0116.558] GetProcessHeap () returned 0x580000 [0116.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6cbf558 [0116.558] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.558] ReadFile (in: hFile=0x438, lpBuffer=0x6cbcda8, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbcda8*, lpNumberOfBytesRead=0x31cff14*=0x2780, lpOverlapped=0x0) returned 1 [0117.460] GetProcessHeap () returned 0x580000 [0117.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0117.460] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.460] WriteFile (in: hFile=0x438, lpBuffer=0x6cbf558*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf558*, lpNumberOfBytesWritten=0x31cff14*=0x2780, lpOverlapped=0x0) returned 1 [0117.460] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.460] WriteFile (in: hFile=0x438, lpBuffer=0x6cc1cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc1cd7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0117.460] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.460] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0117.460] CloseHandle (hObject=0x438) returned 1 [0117.921] GetProcessHeap () returned 0x580000 [0117.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbf558 | out: hHeap=0x580000) returned 1 [0117.922] GetProcessHeap () returned 0x580000 [0117.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbcda8 | out: hHeap=0x580000) returned 1 [0117.922] GetProcessHeap () returned 0x580000 [0117.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0120.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d9ffa60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27ae, dwReserved0=0x31cfd28, dwReserved1=0x6cbcda8, cFileName="SAFRI_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAFRI_~1.YOU")) returned 0x5b96f0 [0120.012] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.027] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", len=0x3d | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF") returned 1 [0120.027] GetProcessHeap () returned 0x580000 [0120.027] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ac) returned 0x6d06ca8 [0120.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.998] CloseHandle (hObject=0x488) returned 1 [0121.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.id_1622540890_.your_last_chance")) returned 1 [0121.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHIRL2~1.YOU")) returned 0x5b9730 [0121.999] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.999] GetProcessHeap () returned 0x580000 [0122.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x677cd0 [0122.000] GetProcessHeap () returned 0x580000 [0122.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x635768 [0122.000] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.000] ReadFile (in: hFile=0x488, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x31cff14*=0xb80, lpOverlapped=0x0) returned 1 [0122.011] GetProcessHeap () returned 0x580000 [0122.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0122.011] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.011] WriteFile (in: hFile=0x488, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x31cff14*=0xb80, lpOverlapped=0x0) returned 1 [0122.011] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.012] WriteFile (in: hFile=0x488, lpBuffer=0x6362e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6362e7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.012] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.012] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.012] CloseHandle (hObject=0x488) returned 1 [0122.012] GetProcessHeap () returned 0x580000 [0122.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0122.012] GetProcessHeap () returned 0x580000 [0122.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0122.012] GetProcessHeap () returned 0x580000 [0122.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80570be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbba, dwReserved0=0x31cfd28, dwReserved1=0x677cd0, cFileName="WHIRL2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHIRL2~1.YOU")) returned 0x5b9730 [0124.519] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.540] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", len=0x4e | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned 1 [0124.540] GetProcessHeap () returned 0x580000 [0124.540] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f4) returned 0x6f42f08 [0124.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.578] CloseHandle (hObject=0x4a0) returned 1 [0124.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.id_1622540890_.your_last_chance")) returned 1 [0124.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Essential.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ESSENT~1.YOU")) returned 0x5b9730 [0124.579] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.579] GetProcessHeap () returned 0x580000 [0124.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.579] GetProcessHeap () returned 0x580000 [0124.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.579] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.579] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x31cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.615] GetProcessHeap () returned 0x580000 [0124.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.615] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.615] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x31cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.615] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.615] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.615] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.615] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.615] CloseHandle (hObject=0x4a0) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81e49180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x31cfd28, dwReserved1=0x6f69420, cFileName="Essential.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ESSENT~1.YOU")) returned 0x5b9730 [0125.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.344] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", len=0x3d | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned 1 [0125.344] GetProcessHeap () returned 0x580000 [0125.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1944) returned 0x6f42f08 [0125.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0128.882] CloseHandle (hObject=0x3b4) returned 1 [0128.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02330~1.YOU")) returned 0x5b9730 [0130.245] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0130.246] GetProcessHeap () returned 0x580000 [0130.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6f19958 [0130.246] GetProcessHeap () returned 0x580000 [0130.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6d035f8 [0130.246] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.246] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1520, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x31cff14*=0x1520, lpOverlapped=0x0) returned 1 [0130.267] GetProcessHeap () returned 0x580000 [0130.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.267] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.267] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x31cff14*=0x1520, lpOverlapped=0x0) returned 1 [0130.267] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.267] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d04b17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04b17*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0130.268] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.268] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0130.268] CloseHandle (hObject=0x3b4) returned 1 [0130.268] GetProcessHeap () returned 0x580000 [0130.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0130.268] GetProcessHeap () returned 0x580000 [0130.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0130.268] GetProcessHeap () returned 0x580000 [0130.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0130.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85424340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1546, dwReserved0=0x31cfd28, dwReserved1=0x6f19958, cFileName="J0233070.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02330~1.YOU")) returned 0x5b9730 [0130.268] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0130.308] CloseHandle (hObject=0x490) returned 1 [0130.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0130.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id_1622540890_.your_last_chance")) returned 1 [0132.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTV~2.YOU")) returned 0x5b9730 [0132.632] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0132.632] GetProcessHeap () returned 0x580000 [0132.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c79898 [0132.632] GetProcessHeap () returned 0x580000 [0132.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c3a820 [0132.633] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.633] ReadFile (in: hFile=0x490, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x31cff14*=0x7e0, lpOverlapped=0x0) returned 1 [0132.641] GetProcessHeap () returned 0x580000 [0132.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.641] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.641] WriteFile (in: hFile=0x490, lpBuffer=0x6c3a820*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesWritten=0x31cff14*=0x7e0, lpOverlapped=0x0) returned 1 [0132.641] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.641] WriteFile (in: hFile=0x490, lpBuffer=0x6c3afff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3afff*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0132.641] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.641] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0132.641] CloseHandle (hObject=0x490) returned 1 [0132.641] GetProcessHeap () returned 0x580000 [0132.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0132.641] GetProcessHeap () returned 0x580000 [0132.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0132.641] GetProcessHeap () returned 0x580000 [0132.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86ac1440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x81f, dwReserved0=0x31cfd28, dwReserved1=0x6c79898, cFileName="GANTT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTV~2.YOU")) returned 0x5b96f0 [0135.021] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.021] Sleep (dwMilliseconds=0x1) [0135.086] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", len=0x39 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 1 [0135.086] GetProcessHeap () returned 0x580000 [0135.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0135.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.129] CloseHandle (hObject=0x39c) returned 1 [0135.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id_1622540890_.your_last_chance")) returned 1 [0135.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBWIZV~1.YOU")) returned 0x5b96f0 [0135.130] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0135.130] GetProcessHeap () returned 0x580000 [0135.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0135.130] GetProcessHeap () returned 0x580000 [0135.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d330a8 [0135.130] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.130] ReadFile (in: hFile=0x39c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.228] GetProcessHeap () returned 0x580000 [0138.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0138.228] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.228] WriteFile (in: hFile=0x39c, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.493] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] WriteFile (in: hFile=0x39c, lpBuffer=0x6d448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d448a7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.493] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.493] CloseHandle (hObject=0x39c) returned 1 [0138.575] GetProcessHeap () returned 0x580000 [0138.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0138.577] GetProcessHeap () returned 0x580000 [0138.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0138.578] GetProcessHeap () returned 0x580000 [0138.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0139.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2819c, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="DBWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBWIZV~1.YOU")) returned 0x5b9770 [0139.878] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.903] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", len=0x52 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css") returned 1 [0139.903] GetProcessHeap () returned 0x580000 [0139.904] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0139.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.077] CloseHandle (hObject=0x3b4) returned 1 [0140.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.id_1622540890_.your_last_chance")) returned 1 [0140.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.078] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b9770 [0140.078] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.079] GetProcessHeap () returned 0x580000 [0140.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706ecb0 [0140.079] GetProcessHeap () returned 0x580000 [0140.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706fab8 [0140.079] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.079] ReadFile (in: hFile=0x3b4, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x31cff14*=0xd80, lpOverlapped=0x0) returned 1 [0140.094] GetProcessHeap () returned 0x580000 [0140.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.094] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.094] WriteFile (in: hFile=0x3b4, lpBuffer=0x706fab8*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x706fab8*, lpNumberOfBytesWritten=0x31cff14*=0xd80, lpOverlapped=0x0) returned 1 [0140.094] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.095] WriteFile (in: hFile=0x3b4, lpBuffer=0x7070837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7070837*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.095] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.095] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.095] CloseHandle (hObject=0x3b4) returned 1 [0140.095] GetProcessHeap () returned 0x580000 [0140.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706fab8 | out: hHeap=0x580000) returned 1 [0140.095] GetProcessHeap () returned 0x580000 [0140.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0140.095] GetProcessHeap () returned 0x580000 [0140.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b1de580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xda4, dwReserved0=0x31cfd28, dwReserved1=0x706ecb0, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b9770 [0140.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.449] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", len=0x43 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned 1 [0140.449] GetProcessHeap () returned 0x580000 [0140.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc4) returned 0x6f14048 [0140.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.565] CloseHandle (hObject=0x428) returned 1 [0140.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1507~2.YOU")) returned 0x5b9770 [0140.566] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.566] GetProcessHeap () returned 0x580000 [0140.566] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5f77d8 [0140.566] GetProcessHeap () returned 0x580000 [0140.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5f79b0 [0140.567] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.567] ReadFile (in: hFile=0x428, lpBuffer=0x5f77d8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5f77d8*, lpNumberOfBytesRead=0x31cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.569] GetProcessHeap () returned 0x580000 [0140.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.569] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.569] WriteFile (in: hFile=0x428, lpBuffer=0x5f79b0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5f79b0*, lpNumberOfBytesWritten=0x31cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.569] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.569] WriteFile (in: hFile=0x428, lpBuffer=0x5f7b4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5f7b4f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.569] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.569] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.569] CloseHandle (hObject=0x428) returned 1 [0140.569] GetProcessHeap () returned 0x580000 [0140.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f79b0 | out: hHeap=0x580000) returned 1 [0140.569] GetProcessHeap () returned 0x580000 [0140.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f77d8 | out: hHeap=0x580000) returned 1 [0140.569] GetProcessHeap () returned 0x580000 [0140.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0141.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b654ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x31cfd28, dwReserved1=0x5f77d8, cFileName="BD15072_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1507~2.YOU")) returned 0x5b9730 [0141.009] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.001] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC", len=0x44 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 1 [0142.001] GetProcessHeap () returned 0x580000 [0142.001] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0142.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0142.002] CloseHandle (hObject=0x470) returned 1 [0142.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0142.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0142.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0142.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POA4D4~1.YOU")) returned 0x5b9730 [0142.003] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0142.003] GetProcessHeap () returned 0x580000 [0142.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2798 [0142.003] GetProcessHeap () returned 0x580000 [0142.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2a60 [0142.003] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.004] ReadFile (in: hFile=0x470, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x31cff14*=0x280, lpOverlapped=0x0) returned 1 [0142.034] GetProcessHeap () returned 0x580000 [0142.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0142.034] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.034] WriteFile (in: hFile=0x470, lpBuffer=0x6df2a60*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a60*, lpNumberOfBytesWritten=0x31cff14*=0x280, lpOverlapped=0x0) returned 1 [0142.034] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x470, lpBuffer=0x6df2cdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2cdf*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0142.035] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.035] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0142.035] CloseHandle (hObject=0x470) returned 1 [0142.569] GetProcessHeap () returned 0x580000 [0142.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a60 | out: hHeap=0x580000) returned 1 [0142.569] GetProcessHeap () returned 0x580000 [0142.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0142.569] GetProcessHeap () returned 0x580000 [0142.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c451000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x31cfd28, dwReserved1=0x6df2798, cFileName="POWERPNT.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POA4D4~1.YOU")) returned 0x5b96f0 [0146.719] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.771] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS", len=0x45 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS") returned 1 [0146.771] GetProcessHeap () returned 0x580000 [0146.771] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0146.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0146.772] CloseHandle (hObject=0x430) returned 1 [0146.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css.id_1622540890_.your_last_chance")) returned 1 [0146.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ce8a00, ftCreationTime.dwHighDateTime=0x1c69651, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1ce8a00, ftLastWriteTime.dwHighDateTime=0x1c69651, nFileSizeHigh=0x0, nFileSizeLow=0x1e254, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~4.YOU")) returned 0x5b96f0 [0146.773] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0146.773] GetProcessHeap () returned 0x580000 [0146.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0146.773] GetProcessHeap () returned 0x580000 [0146.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0146.774] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.774] ReadFile (in: hFile=0x430, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.291] GetProcessHeap () returned 0x580000 [0150.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0150.291] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.291] WriteFile (in: hFile=0x430, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.291] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.292] WriteFile (in: hFile=0x430, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0150.292] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.292] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0150.292] CloseHandle (hObject=0x430) returned 1 [0150.292] GetProcessHeap () returned 0x580000 [0150.292] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0150.292] GetProcessHeap () returned 0x580000 [0150.292] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0150.292] GetProcessHeap () returned 0x580000 [0150.292] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0150.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ce8a00, ftCreationTime.dwHighDateTime=0x1c69651, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9132a8c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e278, dwReserved0=0x31cfd28, dwReserved1=0x707ec98, cFileName="SCHEME52.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~4.YOU")) returned 0x5b96f0 [0150.681] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.740] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", len=0x45 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 1 [0150.740] GetProcessHeap () returned 0x580000 [0150.740] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0150.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0150.780] CloseHandle (hObject=0x490) returned 1 [0150.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0150.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9324cb00, ftCreationTime.dwHighDateTime=0x1ca9b88, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9324cb00, ftLastWriteTime.dwHighDateTime=0x1ca9b88, nFileSizeHigh=0x0, nFileSizeLow=0x2a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBWZI~1.YOU")) returned 0x5b96f0 [0150.781] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0150.781] GetProcessHeap () returned 0x580000 [0150.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0150.782] GetProcessHeap () returned 0x580000 [0150.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d67938 [0150.782] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.782] ReadFile (in: hFile=0x490, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0154.701] GetProcessHeap () returned 0x580000 [0154.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.702] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.702] WriteFile (in: hFile=0x490, lpBuffer=0x6d67938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d67938*, lpNumberOfBytesWritten=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0154.702] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.702] WriteFile (in: hFile=0x490, lpBuffer=0x6d79137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d79137*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0154.702] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.703] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0154.703] CloseHandle (hObject=0x490) returned 1 [0154.740] GetProcessHeap () returned 0x580000 [0154.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d67938 | out: hHeap=0x580000) returned 1 [0154.747] GetProcessHeap () returned 0x580000 [0154.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0154.748] GetProcessHeap () returned 0x580000 [0154.748] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9324cb00, ftCreationTime.dwHighDateTime=0x1ca9b88, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93d1ec80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a7a4, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PUBWZINT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBWZI~1.YOU")) returned 0x5b9730 [0155.735] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0156.843] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", len=0x3e | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 1 [0156.843] GetProcessHeap () returned 0x580000 [0156.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0156.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0158.365] CloseHandle (hObject=0x170) returned 1 [0158.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~3.YOU")) returned 0x5b9630 [0158.366] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0158.366] GetProcessHeap () returned 0x580000 [0158.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ee1) returned 0x6e3ac60 [0158.367] GetProcessHeap () returned 0x580000 [0158.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ee1) returned 0x6de0f50 [0158.367] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.367] ReadFile (in: hFile=0x170, lpBuffer=0x6e3ac60, nNumberOfBytesToRead=0x6ec0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3ac60*, lpNumberOfBytesRead=0x31cff14*=0x6ec0, lpOverlapped=0x0) returned 1 [0161.337] GetProcessHeap () returned 0x580000 [0161.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0161.338] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.338] WriteFile (in: hFile=0x170, lpBuffer=0x6de0f50*, nNumberOfBytesToWrite=0x6ec0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesWritten=0x31cff14*=0x6ec0, lpOverlapped=0x0) returned 1 [0161.339] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.340] WriteFile (in: hFile=0x170, lpBuffer=0x6de7e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de7e0f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0161.340] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.340] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0161.340] CloseHandle (hObject=0x170) returned 1 [0162.836] GetProcessHeap () returned 0x580000 [0162.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0162.836] GetProcessHeap () returned 0x580000 [0162.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3ac60 | out: hHeap=0x580000) returned 1 [0162.837] GetProcessHeap () returned 0x580000 [0162.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0166.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97c7f640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6ef4, dwReserved0=0x31cfd28, dwReserved1=0x6e3ac60, cFileName="MSART13.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~3.YOU")) returned 0x5b9730 [0166.185] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.207] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", len=0x3d | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 1 [0166.207] GetProcessHeap () returned 0x580000 [0166.207] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0166.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0166.243] CloseHandle (hObject=0x440) returned 1 [0166.243] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.243] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id_1622540890_.your_last_chance")) returned 1 [0166.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLMAIL~1.YOU")) returned 0x5b9730 [0166.282] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0166.282] GetProcessHeap () returned 0x580000 [0166.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf7a1) returned 0x7128bb8 [0166.282] GetProcessHeap () returned 0x580000 [0166.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf7a1) returned 0x7138368 [0166.282] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.282] ReadFile (in: hFile=0x440, lpBuffer=0x7128bb8, nNumberOfBytesToRead=0xf780, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7128bb8*, lpNumberOfBytesRead=0x31cff14*=0xf780, lpOverlapped=0x0) returned 1 [0169.012] GetProcessHeap () returned 0x580000 [0169.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0169.012] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.012] WriteFile (in: hFile=0x440, lpBuffer=0x7138368*, nNumberOfBytesToWrite=0xf780, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7138368*, lpNumberOfBytesWritten=0x31cff14*=0xf780, lpOverlapped=0x0) returned 1 [0169.012] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.012] WriteFile (in: hFile=0x440, lpBuffer=0x7147ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7147ae7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0169.013] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.013] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0169.013] CloseHandle (hObject=0x440) returned 1 [0169.013] GetProcessHeap () returned 0x580000 [0169.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7138368 | out: hHeap=0x580000) returned 1 [0169.013] GetProcessHeap () returned 0x580000 [0169.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7128bb8 | out: hHeap=0x580000) returned 1 [0169.013] GetProcessHeap () returned 0x580000 [0169.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c5b1ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf7bc, dwReserved0=0x31cfd28, dwReserved1=0x7128bb8, cFileName="OLMAIL.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLMAIL~1.YOU")) returned 0x5b96b0 [0170.243] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.246] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", len=0x42 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 1 [0170.246] GetProcessHeap () returned 0x580000 [0170.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2294) returned 0x6f14048 [0170.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.249] CloseHandle (hObject=0x458) returned 1 [0170.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id_1622540890_.your_last_chance")) returned 1 [0170.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~2.YOU")) returned 0x5b96b0 [0170.250] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.251] GetProcessHeap () returned 0x580000 [0170.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0170.251] GetProcessHeap () returned 0x580000 [0170.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0170.251] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.251] ReadFile (in: hFile=0x458, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x31cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.258] GetProcessHeap () returned 0x580000 [0170.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.258] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.258] WriteFile (in: hFile=0x458, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x31cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.259] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.259] WriteFile (in: hFile=0x458, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.259] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.259] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.259] CloseHandle (hObject=0x458) returned 1 [0170.259] GetProcessHeap () returned 0x580000 [0170.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0170.259] GetProcessHeap () returned 0x580000 [0170.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0170.259] GetProcessHeap () returned 0x580000 [0170.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d1988c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x31cfd28, dwReserved1=0x5d0090, cFileName="TASKACCL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~2.YOU")) returned 0x5b9770 [0172.816] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.817] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", len=0x3e | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 1 [0172.818] GetProcessHeap () returned 0x580000 [0172.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2288) returned 0x6f14048 [0172.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0172.818] CloseHandle (hObject=0x464) returned 1 [0172.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id_1622540890_.your_last_chance")) returned 1 [0172.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff90d00, ftCreationTime.dwHighDateTime=0x1c666e6, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ff90d00, ftLastWriteTime.dwHighDateTime=0x1c666e6, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMSLIC~1.YOU")) returned 0x5b9770 [0172.820] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0172.820] GetProcessHeap () returned 0x580000 [0172.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6d77938 [0172.820] GetProcessHeap () returned 0x580000 [0172.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x70479c8 [0172.820] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.820] ReadFile (in: hFile=0x464, lpBuffer=0x6d77938, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77938*, lpNumberOfBytesRead=0x31cff14*=0x2780, lpOverlapped=0x0) returned 1 [0173.978] GetProcessHeap () returned 0x580000 [0173.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0173.978] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.978] WriteFile (in: hFile=0x464, lpBuffer=0x70479c8*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70479c8*, lpNumberOfBytesWritten=0x31cff14*=0x2780, lpOverlapped=0x0) returned 1 [0173.979] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.979] WriteFile (in: hFile=0x464, lpBuffer=0x704a147*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x704a147*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.979] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.979] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.979] CloseHandle (hObject=0x464) returned 1 [0174.231] GetProcessHeap () returned 0x580000 [0174.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70479c8 | out: hHeap=0x580000) returned 1 [0174.235] GetProcessHeap () returned 0x580000 [0174.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d77938 | out: hHeap=0x580000) returned 1 [0174.236] GetProcessHeap () returned 0x580000 [0174.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0176.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff90d00, ftCreationTime.dwHighDateTime=0x1c666e6, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f501000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x31cfd28, dwReserved1=0x6d77938, cFileName="SMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMSLIC~1.YOU")) returned 0x5b96f0 [0176.798] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.843] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", len=0x3b | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 1 [0176.843] GetProcessHeap () returned 0x580000 [0176.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2118) returned 0x6f14048 [0176.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0179.537] CloseHandle (hObject=0x484) returned 1 [0179.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.572] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id_1622540890_.your_last_chance")) returned 1 [0179.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHAPNU~1.YOU")) returned 0x5b96f0 [0179.573] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0179.573] GetProcessHeap () returned 0x580000 [0179.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa581) returned 0x6d8e818 [0179.573] GetProcessHeap () returned 0x580000 [0179.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa581) returned 0x6f58108 [0179.574] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.574] ReadFile (in: hFile=0x484, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xa560, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x31cff14*=0xa560, lpOverlapped=0x0) returned 1 [0181.773] GetProcessHeap () returned 0x580000 [0181.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0181.773] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x484, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0xa560, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x31cff14*=0xa560, lpOverlapped=0x0) returned 1 [0181.773] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x484, lpBuffer=0x6f62667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62667*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0181.773] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.773] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0181.773] CloseHandle (hObject=0x484) returned 1 [0181.774] GetProcessHeap () returned 0x580000 [0181.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0181.774] GetProcessHeap () returned 0x580000 [0181.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0181.774] GetProcessHeap () returned 0x580000 [0181.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3f63f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa594, dwReserved0=0x31cfd28, dwReserved1=0x6d8e818, cFileName="SHAPNUM.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHAPNU~1.YOU")) returned 0x5b9770 [0183.326] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.347] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", len=0x64 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned 1 [0183.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.348] CloseHandle (hObject=0x448) returned 1 [0183.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~1.YOU")) returned 0x5b96b0 [0183.349] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.349] GetProcessHeap () returned 0x580000 [0183.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0183.349] GetProcessHeap () returned 0x580000 [0183.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0183.349] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.349] ReadFile (in: hFile=0x448, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x31cff14*=0x820, lpOverlapped=0x0) returned 1 [0183.361] GetProcessHeap () returned 0x580000 [0183.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.361] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.361] WriteFile (in: hFile=0x448, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x31cff14*=0x820, lpOverlapped=0x0) returned 1 [0183.362] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.362] WriteFile (in: hFile=0x448, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0183.362] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.362] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0183.362] CloseHandle (hObject=0x448) returned 1 [0183.362] GetProcessHeap () returned 0x580000 [0183.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0183.362] GetProcessHeap () returned 0x580000 [0183.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0183.362] GetProcessHeap () returned 0x580000 [0183.362] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e6aa60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x31cfd28, dwReserved1=0x6c79898, cFileName="computericonMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~1.YOU")) returned 0x5b9770 [0183.363] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.363] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", len=0x58 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned 1 [0183.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0183.379] CloseHandle (hObject=0x4ac) returned 1 [0183.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1938, dwReserved0=0x1, dwReserved1=0x4c005f, cFileName="OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLIN~1.YOU")) returned 0x5b9770 [0183.381] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0183.381] GetProcessHeap () returned 0x580000 [0183.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6f42f08 [0183.381] GetProcessHeap () returned 0x580000 [0183.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x667250 [0183.381] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.381] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1920, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x31cff14*=0x1920, lpOverlapped=0x0) returned 1 [0184.327] GetProcessHeap () returned 0x580000 [0184.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.327] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.327] WriteFile (in: hFile=0x4ac, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x31cff14*=0x1920, lpOverlapped=0x0) returned 1 [0184.328] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.328] WriteFile (in: hFile=0x4ac, lpBuffer=0x668b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x668b6f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.328] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.328] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.328] CloseHandle (hObject=0x4ac) returned 1 [0184.328] GetProcessHeap () returned 0x580000 [0184.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0184.328] GetProcessHeap () returned 0x580000 [0184.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0184.328] GetProcessHeap () returned 0x580000 [0184.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa57a3fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x195c, dwReserved0=0x31cfd28, dwReserved1=0x6f42f08, cFileName="OutlineToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLIN~1.YOU")) returned 0x5b9770 [0184.329] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.735] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", len=0x54 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned 1 [0184.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2120) returned 0x6f14048 [0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.141] CloseHandle (hObject=0x450) returned 1 [0185.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50410c00, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOC429~1.YOU")) returned 0x5b9770 [0185.142] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.143] GetProcessHeap () returned 0x580000 [0185.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40c1) returned 0x6d273e8 [0185.143] GetProcessHeap () returned 0x580000 [0185.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x40c1) returned 0x6d2b4b8 [0185.143] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.143] ReadFile (in: hFile=0x450, lpBuffer=0x6d273e8, nNumberOfBytesToRead=0x40a0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d273e8*, lpNumberOfBytesRead=0x31cff14*=0x40a0, lpOverlapped=0x0) returned 1 [0185.311] GetProcessHeap () returned 0x580000 [0185.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.311] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.311] WriteFile (in: hFile=0x450, lpBuffer=0x6d2b4b8*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2b4b8*, lpNumberOfBytesWritten=0x31cff14*=0x40a0, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.311] WriteFile (in: hFile=0x450, lpBuffer=0x6d2f557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f557*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0185.311] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.311] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0185.311] CloseHandle (hObject=0x450) returned 1 [0185.311] GetProcessHeap () returned 0x580000 [0185.311] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2b4b8 | out: hHeap=0x580000) returned 1 [0185.311] GetProcessHeap () returned 0x580000 [0185.311] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d273e8 | out: hHeap=0x580000) returned 1 [0185.311] GetProcessHeap () returned 0x580000 [0185.311] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6103640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x40ce, dwReserved0=0x31cfd28, dwReserved1=0x6d273e8, cFileName="NotifierBackgroundRTL.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOC429~1.YOU")) returned 0x5b9770 [0185.535] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.583] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", len=0x51 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned 1 [0185.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0185.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0186.954] CloseHandle (hObject=0x3b4) returned 1 [0186.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.954] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.955] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATALI~1.YOU")) returned 0x5b96b0 [0186.955] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0186.955] GetProcessHeap () returned 0x580000 [0186.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x6de8f50 [0186.955] GetProcessHeap () returned 0x580000 [0186.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x706ecb0 [0186.955] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.955] ReadFile (in: hFile=0x3b4, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x31cff14*=0x16c0, lpOverlapped=0x0) returned 1 [0186.976] GetProcessHeap () returned 0x580000 [0186.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0186.976] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x706ecb0*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesWritten=0x31cff14*=0x16c0, lpOverlapped=0x0) returned 1 [0186.976] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x707036f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x707036f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0186.976] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0186.976] CloseHandle (hObject=0x3b4) returned 1 [0186.976] GetProcessHeap () returned 0x580000 [0186.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0186.976] GetProcessHeap () returned 0x580000 [0186.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0186.976] GetProcessHeap () returned 0x580000 [0186.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0186.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa70ee960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16eb, dwReserved0=0x31cfd28, dwReserved1=0x6de8f50, cFileName="DataListIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATALI~1.YOU")) returned 0x5b96b0 [0186.976] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.987] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", len=0x64 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned 1 [0186.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0186.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.571] CloseHandle (hObject=0x4a8) returned 1 [0188.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0188.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9770 [0188.572] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.572] GetProcessHeap () returned 0x580000 [0188.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x70c4d58 [0188.572] GetProcessHeap () returned 0x580000 [0188.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x7005128 [0188.572] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.572] ReadFile (in: hFile=0x4a8, lpBuffer=0x70c4d58, nNumberOfBytesToRead=0x1be0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4d58*, lpNumberOfBytesRead=0x31cff14*=0x1be0, lpOverlapped=0x0) returned 1 [0188.624] GetProcessHeap () returned 0x580000 [0188.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.624] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.624] WriteFile (in: hFile=0x4a8, lpBuffer=0x7005128*, nNumberOfBytesToWrite=0x1be0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7005128*, lpNumberOfBytesWritten=0x31cff14*=0x1be0, lpOverlapped=0x0) returned 1 [0188.624] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.624] WriteFile (in: hFile=0x4a8, lpBuffer=0x7006d07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7006d07*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.625] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.625] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0188.625] CloseHandle (hObject=0x4a8) returned 1 [0188.625] GetProcessHeap () returned 0x580000 [0188.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7005128 | out: hHeap=0x580000) returned 1 [0188.625] GetProcessHeap () returned 0x580000 [0188.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c4d58 | out: hHeap=0x580000) returned 1 [0188.625] GetProcessHeap () returned 0x580000 [0188.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80b3b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c1f, dwReserved0=0x31cfd28, dwReserved1=0x70c4d58, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9770 [0191.609] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.678] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", len=0x45 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned 1 [0191.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0191.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0191.712] CloseHandle (hObject=0x4ac) returned 1 [0191.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD212~1.YOU")) returned 0x5b9770 [0191.713] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0191.714] GetProcessHeap () returned 0x580000 [0191.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1461) returned 0x6efb008 [0191.714] GetProcessHeap () returned 0x580000 [0191.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1461) returned 0x6f19958 [0191.714] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.714] ReadFile (in: hFile=0x4ac, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1440, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x31cff14*=0x1440, lpOverlapped=0x0) returned 1 [0191.767] GetProcessHeap () returned 0x580000 [0191.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0191.767] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.767] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x31cff14*=0x1440, lpOverlapped=0x0) returned 1 [0191.768] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.768] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f1ad97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ad97*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0191.768] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.768] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0191.768] CloseHandle (hObject=0x4ac) returned 1 [0192.559] GetProcessHeap () returned 0x580000 [0192.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0192.559] GetProcessHeap () returned 0x580000 [0192.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0192.559] GetProcessHeap () returned 0x580000 [0192.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0193.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e9af80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1468, dwReserved0=0x31cfd28, dwReserved1=0x6efb008, cFileName="ZPDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD212~1.YOU")) returned 0x5b97b0 [0193.418] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.459] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", len=0x63 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned 1 [0193.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0193.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.500] CloseHandle (hObject=0x438) returned 1 [0193.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.500] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.id_1622540890_.your_last_chance")) returned 1 [0193.501] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b97b0 [0193.501] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.501] GetProcessHeap () returned 0x580000 [0193.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6fe7ed8 [0193.501] GetProcessHeap () returned 0x580000 [0193.501] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6fed048 [0193.501] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.501] ReadFile (in: hFile=0x438, lpBuffer=0x6fe7ed8, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7ed8*, lpNumberOfBytesRead=0x31cff14*=0x5140, lpOverlapped=0x0) returned 1 [0195.178] GetProcessHeap () returned 0x580000 [0195.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.178] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.178] WriteFile (in: hFile=0x438, lpBuffer=0x6fed048*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fed048*, lpNumberOfBytesWritten=0x31cff14*=0x5140, lpOverlapped=0x0) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] WriteFile (in: hFile=0x438, lpBuffer=0x6ff2187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff2187*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.179] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0195.179] CloseHandle (hObject=0x438) returned 1 [0195.179] GetProcessHeap () returned 0x580000 [0195.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fed048 | out: hHeap=0x580000) returned 1 [0195.179] GetProcessHeap () returned 0x580000 [0195.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe7ed8 | out: hHeap=0x580000) returned 1 [0195.179] GetProcessHeap () returned 0x580000 [0195.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabf2fca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x31cfd28, dwReserved1=0x6fe7ed8, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b97b0 [0195.179] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.941] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", len=0x43 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned 1 [0197.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0197.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0197.942] CloseHandle (hObject=0x4a0) returned 1 [0197.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.id_1622540890_.your_last_chance")) returned 1 [0197.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x24dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR6B~1.YOU")) returned 0x5b97f0 [0197.943] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0197.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0197.943] GetProcessHeap () returned 0x580000 [0197.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24e1) returned 0x6dc71d0 [0197.944] GetProcessHeap () returned 0x580000 [0197.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24e1) returned 0x6c59108 [0197.944] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.944] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x24c0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x31cff14*=0x24c0, lpOverlapped=0x0) returned 1 [0198.433] GetProcessHeap () returned 0x580000 [0198.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0198.433] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.433] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c59108*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesWritten=0x31cff14*=0x24c0, lpOverlapped=0x0) returned 1 [0198.433] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.434] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c5b5c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b5c7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0198.434] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.434] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0198.434] CloseHandle (hObject=0x4a0) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0199.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xade47c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2501, dwReserved0=0x31cfd28, dwReserved1=0x6dc71d0, cFileName="PDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR6B~1.YOU")) returned 0x5b96b0 [0199.654] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.963] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", len=0x6d | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css") returned 1 [0200.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb4) returned 0x6f14048 [0200.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.963] CloseHandle (hObject=0x43c) returned 1 [0200.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance")) returned 1 [0201.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x730063, dwReserved1=0x2e0073, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b97b0 [0201.840] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0201.840] GetProcessHeap () returned 0x580000 [0201.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.840] GetProcessHeap () returned 0x580000 [0201.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.840] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.840] ReadFile (in: hFile=0x43c, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x31cff14*=0x360, lpOverlapped=0x0) returned 1 [0201.845] GetProcessHeap () returned 0x580000 [0201.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.845] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.845] WriteFile (in: hFile=0x43c, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x31cff14*=0x360, lpOverlapped=0x0) returned 1 [0201.845] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.845] WriteFile (in: hFile=0x43c, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.845] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.845] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.845] CloseHandle (hObject=0x43c) returned 1 [0201.845] GetProcessHeap () returned 0x580000 [0201.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.845] GetProcessHeap () returned 0x580000 [0201.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.845] GetProcessHeap () returned 0x580000 [0201.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafeb67c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x31cfd28, dwReserved1=0x6eef020, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b9770 [0202.961] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.023] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", len=0x66 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned 1 [0203.023] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0203.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0205.032] CloseHandle (hObject=0x428) returned 1 [0205.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0205.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.id_1622540890_.your_last_chance")) returned 1 [0206.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0206.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b97b0 [0206.311] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0206.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0206.311] GetProcessHeap () returned 0x580000 [0206.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6dcfb90 [0206.311] GetProcessHeap () returned 0x580000 [0206.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6c65108 [0206.311] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.311] ReadFile (in: hFile=0x428, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x31cff14*=0x440, lpOverlapped=0x0) returned 1 [0206.316] GetProcessHeap () returned 0x580000 [0206.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0206.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x428, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x31cff14*=0x440, lpOverlapped=0x0) returned 1 [0206.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x428, lpBuffer=0x6c65547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65547*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0206.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.316] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0206.317] CloseHandle (hObject=0x428) returned 1 [0206.317] GetProcessHeap () returned 0x580000 [0206.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0206.317] GetProcessHeap () returned 0x580000 [0206.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0206.317] GetProcessHeap () returned 0x580000 [0206.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0209.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2969260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x483, dwReserved0=0x31cfd28, dwReserved1=0x6dcfb90, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b97f0 [0209.679] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.707] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0209.708] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0209.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0210.026] CloseHandle (hObject=0x484) returned 1 [0210.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.026] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0210.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.035] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0210.035] GetProcessHeap () returned 0x580000 [0210.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0210.035] GetProcessHeap () returned 0x580000 [0210.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0210.035] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.035] ReadFile (in: hFile=0x484, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x31cff14*=0x140, lpOverlapped=0x0) returned 1 [0210.037] GetProcessHeap () returned 0x580000 [0210.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.037] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.037] WriteFile (in: hFile=0x484, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x31cff14*=0x140, lpOverlapped=0x0) returned 1 [0210.037] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.037] WriteFile (in: hFile=0x484, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0210.037] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.037] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0210.037] CloseHandle (hObject=0x484) returned 1 [0210.037] GetProcessHeap () returned 0x580000 [0210.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0210.037] GetProcessHeap () returned 0x580000 [0210.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0210.038] GetProcessHeap () returned 0x580000 [0210.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cd19a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x31cfd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.537] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.556] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", len=0x68 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned 1 [0214.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0214.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0218.440] CloseHandle (hObject=0x39c) returned 1 [0218.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0218.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.id_1622540890_.your_last_chance")) returned 1 [0219.230] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0219.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b9770 [0219.230] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0219.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0219.230] GetProcessHeap () returned 0x580000 [0219.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10e1) returned 0x67ec60 [0219.230] GetProcessHeap () returned 0x580000 [0219.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10e1) returned 0x6f19958 [0219.230] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.230] ReadFile (in: hFile=0x39c, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x10c0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x31cff14*=0x10c0, lpOverlapped=0x0) returned 1 [0219.246] GetProcessHeap () returned 0x580000 [0219.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0219.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.246] WriteFile (in: hFile=0x39c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x31cff14*=0x10c0, lpOverlapped=0x0) returned 1 [0219.246] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.246] WriteFile (in: hFile=0x39c, lpBuffer=0x6f1aa17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aa17*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0219.247] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.247] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0219.247] CloseHandle (hObject=0x39c) returned 1 [0219.247] GetProcessHeap () returned 0x580000 [0219.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0219.247] GetProcessHeap () returned 0x580000 [0219.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0219.247] GetProcessHeap () returned 0x580000 [0219.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0221.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4be640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10fb, dwReserved0=0x31cfd28, dwReserved1=0x67ec60, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b97b0 [0221.391] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0223.333] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", len=0x66 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned 1 [0223.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0223.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.334] CloseHandle (hObject=0x458) returned 1 [0223.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0223.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xefe7, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b96f0 [0223.335] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.336] GetProcessHeap () returned 0x580000 [0223.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf001) returned 0x7450048 [0223.336] GetProcessHeap () returned 0x580000 [0223.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf001) returned 0x6f9a9e8 [0223.336] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.336] ReadFile (in: hFile=0x458, lpBuffer=0x7450048, nNumberOfBytesToRead=0xefe0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesRead=0x31cff14*=0xefe0, lpOverlapped=0x0) returned 1 [0226.874] GetProcessHeap () returned 0x580000 [0226.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0226.874] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.874] WriteFile (in: hFile=0x458, lpBuffer=0x6f9a9e8*, nNumberOfBytesToWrite=0xefe0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9a9e8*, lpNumberOfBytesWritten=0x31cff14*=0xefe0, lpOverlapped=0x0) returned 1 [0226.875] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.875] WriteFile (in: hFile=0x458, lpBuffer=0x6fa99c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa99c7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0226.875] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.875] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0226.875] CloseHandle (hObject=0x458) returned 1 [0226.875] GetProcessHeap () returned 0x580000 [0226.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9a9e8 | out: hHeap=0x580000) returned 1 [0226.875] GetProcessHeap () returned 0x580000 [0226.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0226.875] GetProcessHeap () returned 0x580000 [0226.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0230.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbec018e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf00b, dwReserved0=0x31cfd28, dwReserved1=0x7450048, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9630 [0230.309] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.456] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", len=0x33 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 1 [0230.456] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0230.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.457] CloseHandle (hObject=0x47c) returned 1 [0230.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.457] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.id_1622540890_.your_last_chance")) returned 1 [0230.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MYSLIC~1.YOU")) returned 0x5b9630 [0230.458] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mysl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.458] GetProcessHeap () returned 0x580000 [0230.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6f19958 [0230.458] GetProcessHeap () returned 0x580000 [0230.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6efb008 [0230.458] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.458] ReadFile (in: hFile=0x47c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1520, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x31cff14*=0x1520, lpOverlapped=0x0) returned 1 [0230.485] GetProcessHeap () returned 0x580000 [0230.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0230.485] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.485] WriteFile (in: hFile=0x47c, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x31cff14*=0x1520, lpOverlapped=0x0) returned 1 [0230.485] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.485] WriteFile (in: hFile=0x47c, lpBuffer=0x6efc527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc527*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0230.485] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.485] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0230.485] CloseHandle (hObject=0x47c) returned 1 [0230.485] GetProcessHeap () returned 0x580000 [0230.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0230.485] GetProcessHeap () returned 0x580000 [0230.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0230.485] GetProcessHeap () returned 0x580000 [0230.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0230.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e5f680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x155a, dwReserved0=0x31cfd28, dwReserved1=0x6f19958, cFileName="MYSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MYSLIC~1.YOU")) returned 0x5b9630 [0230.522] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.537] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", len=0x35 | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 1 [0230.537] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0230.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0230.538] CloseHandle (hObject=0x414) returned 1 [0230.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.id_1622540890_.your_last_chance")) returned 1 [0230.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUTL~1.YOU")) returned 0x5b9630 [0230.539] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msoutl.olb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0230.540] GetProcessHeap () returned 0x580000 [0230.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74ffd58 [0230.540] GetProcessHeap () returned 0x580000 [0230.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7511588 [0230.541] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.541] ReadFile (in: hFile=0x414, lpBuffer=0x74ffd58, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x74ffd58*, lpNumberOfBytesRead=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.864] GetProcessHeap () returned 0x580000 [0237.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0237.865] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.865] WriteFile (in: hFile=0x414, lpBuffer=0x7511588*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7511588*, lpNumberOfBytesWritten=0x31cff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.268] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.268] WriteFile (in: hFile=0x414, lpBuffer=0x7522d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7522d87*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0239.342] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.342] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0239.342] CloseHandle (hObject=0x414) returned 1 [0239.474] GetProcessHeap () returned 0x580000 [0239.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7511588 | out: hHeap=0x580000) returned 1 [0239.474] GetProcessHeap () returned 0x580000 [0239.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74ffd58 | out: hHeap=0x580000) returned 1 [0239.476] GetProcessHeap () returned 0x580000 [0239.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0241.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65d9c, dwReserved0=0x31cfd28, dwReserved1=0x74ffd58, cFileName="MSOUTL.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUTL~1.YOU")) returned 0x5b9730 [0241.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.430] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML", len=0x3f | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned 1 [0241.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0241.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0241.431] CloseHandle (hObject=0x48c) returned 1 [0241.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml.id_1622540890_.your_last_chance")) returned 1 [0241.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908ec600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x908ec600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~1.YOU")) returned 0x5b9630 [0241.432] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0241.432] GetProcessHeap () returned 0x580000 [0241.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ac1) returned 0x6d0e508 [0241.432] GetProcessHeap () returned 0x580000 [0241.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ac1) returned 0x6dd40d0 [0241.432] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.432] ReadFile (in: hFile=0x48c, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1aa0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x31cff14*=0x1aa0, lpOverlapped=0x0) returned 1 [0241.527] GetProcessHeap () returned 0x580000 [0241.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.527] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.527] WriteFile (in: hFile=0x48c, lpBuffer=0x6dd40d0*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesWritten=0x31cff14*=0x1aa0, lpOverlapped=0x0) returned 1 [0241.528] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.528] WriteFile (in: hFile=0x48c, lpBuffer=0x6dd5b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd5b6f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0241.528] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.528] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0241.528] CloseHandle (hObject=0x48c) returned 1 [0241.528] GetProcessHeap () returned 0x580000 [0241.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0241.528] GetProcessHeap () returned 0x580000 [0241.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0241.528] GetProcessHeap () returned 0x580000 [0241.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908ec600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc77b4400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ac6, dwReserved0=0x31cfd28, dwReserved1=0x6d0e508, cFileName="PGMN109.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~1.YOU")) returned 0x5b9630 [0241.567] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.613] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML", len=0x3f | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned 1 [0241.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0241.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0241.614] CloseHandle (hObject=0x3b4) returned 1 [0241.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml.id_1622540890_.your_last_chance")) returned 1 [0241.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55662300, ftCreationTime.dwHighDateTime=0x1ca0f14, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55662300, ftLastWriteTime.dwHighDateTime=0x1ca0f14, nFileSizeHigh=0x0, nFileSizeLow=0xde0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~4.YOU")) returned 0x5b9630 [0241.616] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0241.616] GetProcessHeap () returned 0x580000 [0241.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xde21) returned 0x6fb2e00 [0241.617] GetProcessHeap () returned 0x580000 [0241.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xde21) returned 0x6fc0c30 [0241.617] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.617] ReadFile (in: hFile=0x3b4, lpBuffer=0x6fb2e00, nNumberOfBytesToRead=0xde00, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2e00*, lpNumberOfBytesRead=0x31cff14*=0xde00, lpOverlapped=0x0) returned 1 [0244.139] GetProcessHeap () returned 0x580000 [0244.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0244.139] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.140] WriteFile (in: hFile=0x3b4, lpBuffer=0x6fc0c30*, nNumberOfBytesToWrite=0xde00, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc0c30*, lpNumberOfBytesWritten=0x31cff14*=0xde00, lpOverlapped=0x0) returned 1 [0244.140] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.140] WriteFile (in: hFile=0x3b4, lpBuffer=0x6fcea2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fcea2f*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0244.141] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.141] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0244.141] CloseHandle (hObject=0x3b4) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc0c30 | out: hHeap=0x580000) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2e00 | out: hHeap=0x580000) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0248.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55662300, ftCreationTime.dwHighDateTime=0x1ca0f14, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc90b2b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xde30, dwReserved0=0x31cfd28, dwReserved1=0x6fb2e00, cFileName="PGMN103.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~4.YOU")) returned 0x5b9730 [0248.407] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.469] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC", len=0x3b | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 1 [0253.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0253.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0253.470] CloseHandle (hObject=0x420) returned 1 [0253.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.id_1622540890_.your_last_chance")) returned 1 [0253.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x91cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BAN98P~1.YOU")) returned 0x5b9730 [0253.472] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0253.472] GetProcessHeap () returned 0x580000 [0253.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x91e1) returned 0x7301a38 [0253.472] GetProcessHeap () returned 0x580000 [0253.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x91e1) returned 0x70b3528 [0253.472] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.472] ReadFile (in: hFile=0x420, lpBuffer=0x7301a38, nNumberOfBytesToRead=0x91c0, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesRead=0x31cff14*=0x91c0, lpOverlapped=0x0) returned 1 [0255.459] GetProcessHeap () returned 0x580000 [0255.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0255.459] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.459] WriteFile (in: hFile=0x420, lpBuffer=0x70b3528*, nNumberOfBytesToWrite=0x91c0, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesWritten=0x31cff14*=0x91c0, lpOverlapped=0x0) returned 1 [0255.460] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.460] WriteFile (in: hFile=0x420, lpBuffer=0x70bc6e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x70bc6e7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0255.460] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.460] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0255.460] CloseHandle (hObject=0x420) returned 1 [0256.743] GetProcessHeap () returned 0x580000 [0256.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0256.743] GetProcessHeap () returned 0x580000 [0256.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0256.743] GetProcessHeap () returned 0x580000 [0256.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0258.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc8efe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91f0, dwReserved0=0x31cfd28, dwReserved1=0x7301a38, cFileName="BAN98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BAN98P~1.YOU")) returned 0x5b9730 [0258.985] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0258.992] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML", len=0x3e | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML") returned 1 [0258.992] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb8) returned 0x72e5948 [0258.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0258.992] CloseHandle (hObject=0x428) returned 1 [0258.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml.id_1622540890_.your_last_chance")) returned 1 [0258.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x31cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfc74 | out: lpFindFileData=0x31cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c11df00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5680a890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c11df00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x309e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LETTHE~1.YOU")) returned 0x5b9730 [0258.994] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0258.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0258.994] GetProcessHeap () returned 0x580000 [0258.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30a1) returned 0x7111f48 [0258.994] GetProcessHeap () returned 0x580000 [0258.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30a1) returned 0x6fa8f28 [0258.994] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.994] ReadFile (in: hFile=0x428, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x3080, lpNumberOfBytesRead=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x31cff14*=0x3080, lpOverlapped=0x0) returned 1 [0261.016] GetProcessHeap () returned 0x580000 [0261.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0261.016] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.016] WriteFile (in: hFile=0x428, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x31cff14*=0x3080, lpOverlapped=0x0) returned 1 [0261.016] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.016] WriteFile (in: hFile=0x428, lpBuffer=0x6fabfa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fabfa7*, lpNumberOfBytesWritten=0x31cff14*=0x20, lpOverlapped=0x0) returned 1 [0261.016] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.016] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x31cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x31cff14*=0x4, lpOverlapped=0x0) returned 1 [0261.016] CloseHandle (hObject=0x428) returned 1 [0261.016] GetProcessHeap () returned 0x580000 [0261.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0261.017] GetProcessHeap () returned 0x580000 [0261.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0261.017] GetProcessHeap () returned 0x580000 [0261.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0261.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x31cfccc | out: lpFindFileData=0x31cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c11df00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5680a890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3185960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x31cfd28, dwReserved1=0x7111f48, cFileName="LETTHEAD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LETTHE~1.YOU")) returned 0x5b9630 [0261.017] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.783] SysReAllocStringLen (in: pbstr=0x31cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy", len=0x5d | out: pbstr=0x31cff84*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy") returned 1 [0262.783] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2060) returned 0x72e5948 [0262.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 17 os_tid = 0xa3c [0039.061] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.126] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.294] Sleep (dwMilliseconds=0x1) [0040.352] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.353] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.557] Sleep (dwMilliseconds=0x1) [0042.649] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.134] Sleep (dwMilliseconds=0x1) [0043.144] Sleep (dwMilliseconds=0x1) [0043.200] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.340] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.869] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.753] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x330ff84*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.753] GetProcessHeap () returned 0x580000 [0059.753] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f730, Size=0x28) returned 0x5dc340 [0059.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.780] CloseHandle (hObject=0x444) returned 1 [0059.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.780] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0059.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.781] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.781] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.781] GetProcessHeap () returned 0x580000 [0059.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1881) returned 0x6dd3a60 [0059.781] GetProcessHeap () returned 0x580000 [0059.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1881) returned 0x6dd52f0 [0059.781] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.781] ReadFile (in: hFile=0x444, lpBuffer=0x6dd3a60, nNumberOfBytesToRead=0x1860, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a60*, lpNumberOfBytesRead=0x330ff14*=0x1860, lpOverlapped=0x0) returned 1 [0059.805] GetProcessHeap () returned 0x580000 [0059.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.805] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.805] WriteFile (in: hFile=0x444, lpBuffer=0x6dd52f0*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd52f0*, lpNumberOfBytesWritten=0x330ff14*=0x1860, lpOverlapped=0x0) returned 1 [0059.805] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.805] WriteFile (in: hFile=0x444, lpBuffer=0x6dd6b4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd6b4f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.805] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.805] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.805] CloseHandle (hObject=0x444) returned 1 [0059.806] GetProcessHeap () returned 0x580000 [0059.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd52f0 | out: hHeap=0x580000) returned 1 [0059.806] GetProcessHeap () returned 0x580000 [0059.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd3a60 | out: hHeap=0x580000) returned 1 [0059.806] GetProcessHeap () returned 0x580000 [0059.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.807] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x5b71bbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1885, dwReserved0=0x330fd28, dwReserved1=0x6dd3a60, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.807] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.818] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", len=0x4e | out: pbstr=0x330ff84*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 1 [0059.818] GetProcessHeap () returned 0x580000 [0059.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615348, Size=0x1c) returned 0x615320 [0059.818] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.819] CloseHandle (hObject=0x444) returned 1 [0059.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.819] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id_1622540890_.your_last_chance")) returned 1 [0059.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.820] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b96b0 [0059.820] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.820] GetProcessHeap () returned 0x580000 [0059.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dd3a60 [0059.821] GetProcessHeap () returned 0x580000 [0059.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de5290 [0059.821] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.821] ReadFile (in: hFile=0x444, lpBuffer=0x6dd3a60, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a60*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0065.800] GetProcessHeap () returned 0x580000 [0065.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0065.801] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.801] WriteFile (in: hFile=0x444, lpBuffer=0x6de5290*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5290*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.452] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.452] WriteFile (in: hFile=0x444, lpBuffer=0x6df6a8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a8f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.412] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.412] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.412] CloseHandle (hObject=0x444) returned 1 [0068.553] GetProcessHeap () returned 0x580000 [0068.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5290 | out: hHeap=0x580000) returned 1 [0068.553] GetProcessHeap () returned 0x580000 [0068.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd3a60 | out: hHeap=0x580000) returned 1 [0068.553] GetProcessHeap () returned 0x580000 [0068.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0068.854] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x609ad700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fac24, dwReserved0=0x330fd28, dwReserved1=0x6dd3a60, cFileName="InfoPathMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b96f0 [0068.854] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.899] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", len=0x3f | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 1 [0068.899] GetProcessHeap () returned 0x580000 [0068.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a8a0, Size=0x3c) returned 0x61aa50 [0068.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.937] Sleep (dwMilliseconds=0x1) [0068.955] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", len=0x45 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 1 [0068.955] GetProcessHeap () returned 0x580000 [0068.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56188, Size=0x5c) returned 0x6c56120 [0068.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.955] Sleep (dwMilliseconds=0x1) [0068.969] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", len=0x4b | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 1 [0068.969] GetProcessHeap () returned 0x580000 [0068.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x6c) returned 0x5f7468 [0068.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.970] Sleep (dwMilliseconds=0x1) [0068.984] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", len=0x56 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 1 [0068.984] GetProcessHeap () returned 0x580000 [0068.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x64) returned 0x5f7468 [0068.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.984] Sleep (dwMilliseconds=0x1) [0068.999] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", len=0x4b | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 1 [0068.999] GetProcessHeap () returned 0x580000 [0068.999] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x5c) returned 0x5f7468 [0068.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.001] Sleep (dwMilliseconds=0x1) [0069.015] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", len=0x43 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 1 [0069.015] GetProcessHeap () returned 0x580000 [0069.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x50) returned 0x5f7468 [0069.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.016] Sleep (dwMilliseconds=0x1) [0069.031] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", len=0x48 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 1 [0069.031] GetProcessHeap () returned 0x580000 [0069.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x48) returned 0x5f7468 [0069.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.986] Sleep (dwMilliseconds=0x1) [0072.141] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", len=0x49 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 1 [0072.141] GetProcessHeap () returned 0x580000 [0072.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x78) returned 0x5b5d08 [0072.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.141] Sleep (dwMilliseconds=0x1) [0072.151] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", len=0x4f | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 1 [0072.151] GetProcessHeap () returned 0x580000 [0072.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x64) returned 0x5b5d08 [0072.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.001] Sleep (dwMilliseconds=0x1) [0073.074] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", len=0x43 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 1 [0073.074] GetProcessHeap () returned 0x580000 [0073.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0073.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0073.074] CloseHandle (hObject=0x3f4) returned 1 [0073.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id_1622540890_.your_last_chance")) returned 1 [0074.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTIM~1.YOU")) returned 0x5b9730 [0074.553] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0074.553] GetProcessHeap () returned 0x580000 [0074.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dfaac0 [0074.553] GetProcessHeap () returned 0x580000 [0074.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0c2f0 [0074.553] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.554] ReadFile (in: hFile=0x3f4, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.834] GetProcessHeap () returned 0x580000 [0077.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0077.834] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.834] WriteFile (in: hFile=0x3f4, lpBuffer=0x6e0c2f0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c2f0*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.835] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.835] WriteFile (in: hFile=0x3f4, lpBuffer=0x6e1daef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1daef*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0077.835] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.835] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0077.835] CloseHandle (hObject=0x3f4) returned 1 [0078.687] GetProcessHeap () returned 0x580000 [0078.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c2f0 | out: hHeap=0x580000) returned 1 [0078.687] GetProcessHeap () returned 0x580000 [0078.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0078.687] GetProcessHeap () returned 0x580000 [0078.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0079.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6601d5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11d9c, dwReserved0=0x330fd28, dwReserved1=0x6dfaac0, cFileName="PICTIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PICTIM~1.YOU")) returned 0x5b96f0 [0079.397] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.960] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", len=0x43 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 1 [0085.961] GetProcessHeap () returned 0x580000 [0085.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xa8) returned 0x614a48 [0085.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.962] Sleep (dwMilliseconds=0x1) [0085.977] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", len=0x4a | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 1 [0085.977] GetProcessHeap () returned 0x580000 [0085.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x3c) returned 0x614a48 [0085.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.485] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", len=0x4d | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 1 [0086.485] GetProcessHeap () returned 0x580000 [0086.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0086.494] CloseHandle (hObject=0x440) returned 1 [0086.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id_1622540890_.your_last_chance")) returned 1 [0086.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUECA~1.YOU")) returned 0x5b96f0 [0086.495] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0086.495] GetProcessHeap () returned 0x580000 [0086.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc2c1) returned 0x6c6ce68 [0086.495] GetProcessHeap () returned 0x580000 [0086.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc2c1) returned 0x6f10048 [0086.496] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.496] ReadFile (in: hFile=0x440, lpBuffer=0x6c6ce68, nNumberOfBytesToRead=0xc2a0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6ce68*, lpNumberOfBytesRead=0x330ff14*=0xc2a0, lpOverlapped=0x0) returned 1 [0088.931] GetProcessHeap () returned 0x580000 [0088.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0088.931] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.931] WriteFile (in: hFile=0x440, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0xc2a0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x330ff14*=0xc2a0, lpOverlapped=0x0) returned 1 [0088.932] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.932] WriteFile (in: hFile=0x440, lpBuffer=0x6f1c2e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c2e7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.932] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.932] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.932] CloseHandle (hObject=0x440) returned 1 [0090.808] GetProcessHeap () returned 0x580000 [0090.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0090.808] GetProcessHeap () returned 0x580000 [0090.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6ce68 | out: hHeap=0x580000) returned 1 [0090.809] GetProcessHeap () returned 0x580000 [0090.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0090.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c9e4780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc2de, dwReserved0=0x330fd28, dwReserved1=0x6c6ce68, cFileName="BLUECALM.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUECA~1.YOU")) returned 0x5b96b0 [0090.810] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.184] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", len=0x4b | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 1 [0092.184] GetProcessHeap () returned 0x580000 [0092.184] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1af38, Size=0x6c) returned 0x6f1aec0 [0092.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.200] CloseHandle (hObject=0x448) returned 1 [0092.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id_1622540890_.your_last_chance")) returned 1 [0092.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x45, dwReserved1=0x0, cFileName="PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPYRU~2.YOU")) returned 0x5b96b0 [0092.201] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.201] GetProcessHeap () returned 0x580000 [0092.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dfaac0 [0092.202] GetProcessHeap () returned 0x580000 [0092.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0092.203] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.203] ReadFile (in: hFile=0x448, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.471] GetProcessHeap () returned 0x580000 [0099.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.472] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.472] WriteFile (in: hFile=0x448, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.472] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.472] WriteFile (in: hFile=0x448, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.472] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.472] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.473] CloseHandle (hObject=0x448) returned 1 [0099.473] GetProcessHeap () returned 0x580000 [0099.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0099.473] GetProcessHeap () returned 0x580000 [0099.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0099.473] GetProcessHeap () returned 0x580000 [0099.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72e76900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x166f9, dwReserved0=0x330fd28, dwReserved1=0x6dfaac0, cFileName="PAPYRUS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPYRU~2.YOU")) returned 0x5b9730 [0099.473] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.673] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", len=0x49 | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 1 [0101.673] GetProcessHeap () returned 0x580000 [0101.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0101.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0101.674] CloseHandle (hObject=0x40c) returned 1 [0101.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id_1622540890_.your_last_chance")) returned 1 [0101.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1EN~1.YOU")) returned 0x5b96b0 [0101.675] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0101.675] GetProcessHeap () returned 0x580000 [0101.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ecf008 [0101.676] GetProcessHeap () returned 0x580000 [0101.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ee0838 [0101.676] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.676] ReadFile (in: hFile=0x40c, lpBuffer=0x6ecf008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf008*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.139] GetProcessHeap () returned 0x580000 [0105.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0105.139] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.139] WriteFile (in: hFile=0x40c, lpBuffer=0x6ee0838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ee0838*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.140] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.140] WriteFile (in: hFile=0x40c, lpBuffer=0x6ef2037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2037*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0105.720] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.720] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0105.720] CloseHandle (hObject=0x40c) returned 1 [0105.721] GetProcessHeap () returned 0x580000 [0105.721] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ee0838 | out: hHeap=0x580000) returned 1 [0105.726] GetProcessHeap () returned 0x580000 [0105.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf008 | out: hHeap=0x580000) returned 1 [0105.726] GetProcessHeap () returned 0x580000 [0105.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0105.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x769f8f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeed42, dwReserved0=0x580000, dwReserved1=0x6f03890, cFileName="MSB1ENES.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1EN~1.YOU")) returned 0x5b9730 [0105.726] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0106.875] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", len=0x4d | out: pbstr=0x330ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 1 [0106.875] GetProcessHeap () returned 0x580000 [0106.875] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x614d08 [0106.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0107.846] CloseHandle (hObject=0x4a4) returned 1 [0107.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id_1622540890_.your_last_chance")) returned 1 [0107.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHGDTX~1.YOU")) returned 0x5b9730 [0107.847] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0107.847] GetProcessHeap () returned 0x580000 [0107.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c7a378 [0107.848] GetProcessHeap () returned 0x580000 [0107.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c8bba8 [0107.848] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.848] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c7a378, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a378*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.540] GetProcessHeap () returned 0x580000 [0111.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0111.693] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.694] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c8bba8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c8bba8*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.694] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.694] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c9d3a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3a7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.694] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.694] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.694] CloseHandle (hObject=0x4a4) returned 1 [0111.694] GetProcessHeap () returned 0x580000 [0111.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c8bba8 | out: hHeap=0x580000) returned 1 [0111.697] GetProcessHeap () returned 0x580000 [0111.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a378 | out: hHeap=0x580000) returned 1 [0111.698] GetProcessHeap () returned 0x580000 [0111.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0111.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a2f3da0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x369f7, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="WHGDTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHGDTX~1.YOU")) returned 0x5b9730 [0111.698] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.842] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\SecretST.TTF", len=0x27 | out: pbstr=0x330ff84*="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 1 [0111.842] GetProcessHeap () returned 0x580000 [0111.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0111.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.866] Sleep (dwMilliseconds=0x1) [0111.913] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", len=0x58 | out: pbstr=0x330ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 1 [0111.913] GetProcessHeap () returned 0x580000 [0111.913] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0111.913] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.945] Sleep (dwMilliseconds=0x1) [0112.023] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.047] Sleep (dwMilliseconds=0x1) [0112.162] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", len=0x4d | out: pbstr=0x330ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 1 [0112.163] GetProcessHeap () returned 0x580000 [0112.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x28) returned 0x5dc550 [0112.163] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.187] Sleep (dwMilliseconds=0x1) [0112.340] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", len=0x41 | out: pbstr=0x330ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 1 [0112.340] GetProcessHeap () returned 0x580000 [0112.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.341] Sleep (dwMilliseconds=0x1) [0112.359] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv", len=0x43 | out: pbstr=0x330ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv") returned 1 [0112.359] GetProcessHeap () returned 0x580000 [0112.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1828, Size=0x4c) returned 0x5e1ae8 [0112.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.382] Sleep (dwMilliseconds=0x1) [0113.341] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", len=0x3f | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 1 [0113.341] GetProcessHeap () returned 0x580000 [0113.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x68) returned 0x6f0ceb8 [0113.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.473] CloseHandle (hObject=0x430) returned 1 [0113.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id_1622540890_.your_last_chance")) returned 1 [0113.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~2.YOU")) returned 0x5b9630 [0113.986] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.987] GetProcessHeap () returned 0x580000 [0113.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33e1) returned 0x6c61108 [0113.987] GetProcessHeap () returned 0x580000 [0113.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33e1) returned 0x626d18 [0113.987] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.987] ReadFile (in: hFile=0x430, lpBuffer=0x6c61108, nNumberOfBytesToRead=0x33c0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesRead=0x330ff14*=0x33c0, lpOverlapped=0x0) returned 1 [0115.235] GetProcessHeap () returned 0x580000 [0115.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.235] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.235] WriteFile (in: hFile=0x430, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x330ff14*=0x33c0, lpOverlapped=0x0) returned 1 [0115.235] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.235] WriteFile (in: hFile=0x430, lpBuffer=0x62a0d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x62a0d7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.235] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.235] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.235] CloseHandle (hObject=0x430) returned 1 [0115.236] GetProcessHeap () returned 0x580000 [0115.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0115.236] GetProcessHeap () returned 0x580000 [0115.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0115.236] GetProcessHeap () returned 0x580000 [0115.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c4b95c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x33ea, dwReserved0=0x330fd28, dwReserved1=0x6c61108, cFileName="AG00164_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~2.YOU")) returned 0x5b9630 [0116.347] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0116.464] CloseHandle (hObject=0x470) returned 1 [0116.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0026~2.YOU")) returned 0x5b9630 [0116.465] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0116.465] GetProcessHeap () returned 0x580000 [0116.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7cc1) returned 0x6de2d20 [0116.465] GetProcessHeap () returned 0x580000 [0116.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7cc1) returned 0x6dea9f0 [0116.465] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.466] ReadFile (in: hFile=0x470, lpBuffer=0x6de2d20, nNumberOfBytesToRead=0x7ca0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de2d20*, lpNumberOfBytesRead=0x330ff14*=0x7ca0, lpOverlapped=0x0) returned 1 [0117.807] GetProcessHeap () returned 0x580000 [0117.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0117.807] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.807] WriteFile (in: hFile=0x470, lpBuffer=0x6dea9f0*, nNumberOfBytesToWrite=0x7ca0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea9f0*, lpNumberOfBytesWritten=0x330ff14*=0x7ca0, lpOverlapped=0x0) returned 1 [0117.808] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.808] WriteFile (in: hFile=0x470, lpBuffer=0x6df268f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df268f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.808] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.808] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.808] CloseHandle (hObject=0x470) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dea9f0 | out: hHeap=0x580000) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de2d20 | out: hHeap=0x580000) returned 1 [0117.932] GetProcessHeap () returned 0x580000 [0117.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0120.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dd458a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7cc8, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SL00260_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0026~2.YOU")) returned 0x5b96f0 [0120.014] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.033] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", len=0x3f | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF") returned 1 [0120.033] GetProcessHeap () returned 0x580000 [0120.033] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x178c) returned 0x6d06ca8 [0120.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.914] CloseHandle (hObject=0x488) returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0177~1.YOU")) returned 0x5b9730 [0121.915] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.915] GetProcessHeap () returned 0x580000 [0121.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0121.915] GetProcessHeap () returned 0x580000 [0121.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6c65108 [0121.915] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.915] ReadFile (in: hFile=0x488, lpBuffer=0x6f0c8f8, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesRead=0x330ff14*=0x300, lpOverlapped=0x0) returned 1 [0121.920] GetProcessHeap () returned 0x580000 [0121.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.920] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.920] WriteFile (in: hFile=0x488, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x330ff14*=0x300, lpOverlapped=0x0) returned 1 [0121.920] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.920] WriteFile (in: hFile=0x488, lpBuffer=0x6c65407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65407*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.920] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.920] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.920] CloseHandle (hObject=0x488) returned 1 [0121.920] GetProcessHeap () returned 0x580000 [0121.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0121.920] GetProcessHeap () returned 0x580000 [0121.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0121.920] GetProcessHeap () returned 0x580000 [0121.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8048c3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x330fd28, dwReserved1=0x6f0c8f8, cFileName="WB01770_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0177~1.YOU")) returned 0x5b9730 [0122.563] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.563] Sleep (dwMilliseconds=0x1) [0122.606] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", len=0x4d | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned 1 [0122.606] GetProcessHeap () returned 0x580000 [0122.606] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1948) returned 0x6f42f08 [0122.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.763] CloseHandle (hObject=0x470) returned 1 [0124.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.id_1622540890_.your_last_chance")) returned 1 [0125.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0125.490] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0125.491] GetProcessHeap () returned 0x580000 [0125.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0125.491] GetProcessHeap () returned 0x580000 [0125.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0125.491] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.491] ReadFile (in: hFile=0x470, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x330ff14*=0xee0, lpOverlapped=0x0) returned 1 [0125.552] GetProcessHeap () returned 0x580000 [0125.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.552] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.553] WriteFile (in: hFile=0x470, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x330ff14*=0xee0, lpOverlapped=0x0) returned 1 [0125.553] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.553] WriteFile (in: hFile=0x470, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.553] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.553] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.553] CloseHandle (hObject=0x470) returned 1 [0125.553] GetProcessHeap () returned 0x580000 [0125.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0125.553] GetProcessHeap () returned 0x580000 [0125.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.553] GetProcessHeap () returned 0x580000 [0125.553] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82736400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf0d, dwReserved0=0x330fd28, dwReserved1=0x6c29878, cFileName="Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0125.553] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.570] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", len=0x3d | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned 1 [0125.570] GetProcessHeap () returned 0x580000 [0125.570] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19ec) returned 0x667250 [0125.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0128.614] CloseHandle (hObject=0x484) returned 1 [0128.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.614] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.id_1622540890_.your_last_chance")) returned 1 [0130.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03029~1.YOU")) returned 0x5b9730 [0130.589] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0130.589] GetProcessHeap () returned 0x580000 [0130.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25e1) returned 0x6e1f410 [0130.589] GetProcessHeap () returned 0x580000 [0130.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25e1) returned 0x6d98c08 [0130.589] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.589] ReadFile (in: hFile=0x484, lpBuffer=0x6e1f410, nNumberOfBytesToRead=0x25c0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1f410*, lpNumberOfBytesRead=0x330ff14*=0x25c0, lpOverlapped=0x0) returned 1 [0130.623] GetProcessHeap () returned 0x580000 [0130.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.623] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.623] WriteFile (in: hFile=0x484, lpBuffer=0x6d98c08*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98c08*, lpNumberOfBytesWritten=0x330ff14*=0x25c0, lpOverlapped=0x0) returned 1 [0130.624] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.624] WriteFile (in: hFile=0x484, lpBuffer=0x6d9b1c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9b1c7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.624] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.624] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.624] CloseHandle (hObject=0x484) returned 1 [0130.624] GetProcessHeap () returned 0x580000 [0130.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98c08 | out: hHeap=0x580000) returned 1 [0130.624] GetProcessHeap () returned 0x580000 [0130.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1f410 | out: hHeap=0x580000) returned 1 [0130.624] GetProcessHeap () returned 0x580000 [0130.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x857902e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x330fd28, dwReserved1=0x6e1f410, cFileName="J0302953.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03029~1.YOU")) returned 0x5b9730 [0130.624] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0132.711] CloseHandle (hObject=0x170) returned 1 [0132.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id_1622540890_.your_last_chance")) returned 1 [0132.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x22c410, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b9730 [0132.712] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0132.712] GetProcessHeap () returned 0x580000 [0132.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ff8ff8 [0132.713] GetProcessHeap () returned 0x580000 [0132.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x700a828 [0132.713] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.713] ReadFile (in: hFile=0x170, lpBuffer=0x6ff8ff8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.109] GetProcessHeap () returned 0x580000 [0137.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0137.109] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.109] WriteFile (in: hFile=0x170, lpBuffer=0x700a828*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x700a828*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.475] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.475] WriteFile (in: hFile=0x170, lpBuffer=0x701c027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x701c027*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.541] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.541] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.541] CloseHandle (hObject=0x170) returned 1 [0138.603] GetProcessHeap () returned 0x580000 [0138.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x700a828 | out: hHeap=0x580000) returned 1 [0138.604] GetProcessHeap () returned 0x580000 [0138.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0138.604] GetProcessHeap () returned 0x580000 [0138.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22c434, dwReserved0=0x330fd28, dwReserved1=0x6ff8ff8, cFileName="GROOVE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b9770 [0139.879] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.907] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x5e | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0139.907] GetProcessHeap () returned 0x580000 [0139.907] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0139.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.907] CloseHandle (hObject=0x470) returned 1 [0139.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0139.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0139.915] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.915] GetProcessHeap () returned 0x580000 [0139.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0139.915] GetProcessHeap () returned 0x580000 [0139.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0139.915] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.915] ReadFile (in: hFile=0x470, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x330ff14*=0x140, lpOverlapped=0x0) returned 1 [0139.917] GetProcessHeap () returned 0x580000 [0139.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0139.917] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.917] WriteFile (in: hFile=0x470, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x330ff14*=0x140, lpOverlapped=0x0) returned 1 [0139.917] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.917] WriteFile (in: hFile=0x470, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.917] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.917] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.918] CloseHandle (hObject=0x470) returned 1 [0139.918] GetProcessHeap () returned 0x580000 [0139.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0139.918] GetProcessHeap () returned 0x580000 [0139.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0139.918] GetProcessHeap () returned 0x580000 [0139.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0140.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b03b660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x330fd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.131] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.139] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", len=0x5c | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned 1 [0140.139] GetProcessHeap () returned 0x580000 [0140.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.254] CloseHandle (hObject=0x454) returned 1 [0140.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0140.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.255] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.255] GetProcessHeap () returned 0x580000 [0140.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0140.255] GetProcessHeap () returned 0x580000 [0140.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0140.256] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.256] ReadFile (in: hFile=0x454, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x330ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.257] GetProcessHeap () returned 0x580000 [0140.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0140.257] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.257] WriteFile (in: hFile=0x454, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x330ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.257] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.257] WriteFile (in: hFile=0x454, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.257] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.257] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.257] CloseHandle (hObject=0x454) returned 1 [0140.258] GetProcessHeap () returned 0x580000 [0140.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0140.258] GetProcessHeap () returned 0x580000 [0140.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0140.258] GetProcessHeap () returned 0x580000 [0140.258] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0140.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b35b340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.662] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.672] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", len=0x43 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned 1 [0140.672] GetProcessHeap () returned 0x580000 [0140.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da0) returned 0x6f14048 [0140.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.031] CloseHandle (hObject=0x4a0) returned 1 [0141.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1480~2.YOU")) returned 0x5b9730 [0141.032] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.032] GetProcessHeap () returned 0x580000 [0141.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c61120 [0141.033] GetProcessHeap () returned 0x580000 [0141.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c614e8 [0141.033] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.033] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x330ff14*=0x380, lpOverlapped=0x0) returned 1 [0141.037] GetProcessHeap () returned 0x580000 [0141.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.037] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.037] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c614e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c614e8*, lpNumberOfBytesWritten=0x330ff14*=0x380, lpOverlapped=0x0) returned 1 [0141.037] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.037] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c61867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61867*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.037] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.037] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.037] CloseHandle (hObject=0x4a0) returned 1 [0141.037] GetProcessHeap () returned 0x580000 [0141.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c614e8 | out: hHeap=0x580000) returned 1 [0141.038] GetProcessHeap () returned 0x580000 [0141.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0141.038] GetProcessHeap () returned 0x580000 [0141.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0144.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8bacb800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a8, dwReserved0=0x330fd28, dwReserved1=0x6c61120, cFileName="BD14801_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1480~2.YOU")) returned 0x5b9730 [0144.584] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.865] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", len=0x44 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned 1 [0146.865] GetProcessHeap () returned 0x580000 [0146.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0146.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0152.865] CloseHandle (hObject=0x470) returned 1 [0152.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x52da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR31~1.YOU")) returned 0x5b9730 [0152.866] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0152.866] GetProcessHeap () returned 0x580000 [0152.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x52e1) returned 0x707ec98 [0152.866] GetProcessHeap () returned 0x580000 [0152.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x52e1) returned 0x7083f88 [0152.867] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.867] ReadFile (in: hFile=0x470, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x52c0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x330ff14*=0x52c0, lpOverlapped=0x0) returned 1 [0154.101] GetProcessHeap () returned 0x580000 [0154.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.101] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] WriteFile (in: hFile=0x470, lpBuffer=0x7083f88*, nNumberOfBytesToWrite=0x52c0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7083f88*, lpNumberOfBytesWritten=0x330ff14*=0x52c0, lpOverlapped=0x0) returned 1 [0154.102] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] WriteFile (in: hFile=0x470, lpBuffer=0x7089247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7089247*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.102] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.102] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.102] CloseHandle (hObject=0x470) returned 1 [0154.102] GetProcessHeap () returned 0x580000 [0154.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7083f88 | out: hHeap=0x580000) returned 1 [0154.102] GetProcessHeap () returned 0x580000 [0154.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0154.102] GetProcessHeap () returned 0x580000 [0154.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93777840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x52fe, dwReserved0=0x330fd28, dwReserved1=0x707ec98, cFileName="PDIR31F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR31~1.YOU")) returned 0x5b9630 [0154.103] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.683] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", len=0x45 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 1 [0154.683] GetProcessHeap () returned 0x580000 [0154.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.080] CloseHandle (hObject=0x448) returned 1 [0159.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0159.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WID7CB~1.YOU")) returned 0x5b9630 [0159.081] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.082] GetProcessHeap () returned 0x580000 [0159.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0159.082] GetProcessHeap () returned 0x580000 [0159.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0159.082] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.082] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x330ff14*=0x60, lpOverlapped=0x0) returned 1 [0159.083] GetProcessHeap () returned 0x580000 [0159.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.083] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.083] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x330ff14*=0x60, lpOverlapped=0x0) returned 1 [0159.083] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.083] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0159.083] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.083] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0159.083] CloseHandle (hObject=0x448) returned 1 [0159.083] GetProcessHeap () returned 0x580000 [0159.083] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0159.084] GetProcessHeap () returned 0x580000 [0159.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0159.084] GetProcessHeap () returned 0x580000 [0159.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x966ecee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x330fd28, dwReserved1=0x61b540, cFileName="WINPROJ.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WID7CB~1.YOU")) returned 0x5b9730 [0164.392] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.426] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", len=0x46 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned 1 [0164.426] GetProcessHeap () returned 0x580000 [0164.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0164.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0164.427] CloseHandle (hObject=0x448) returned 1 [0164.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0164.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.id_1622540890_.your_last_chance")) returned 1 [0164.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0164.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~1.YOU")) returned 0x5b9730 [0164.428] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0164.428] GetProcessHeap () returned 0x580000 [0164.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x6dd7c30 [0164.428] GetProcessHeap () returned 0x580000 [0164.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1001) returned 0x67ec60 [0164.428] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.428] ReadFile (in: hFile=0x448, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0xfe0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x330ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0164.450] GetProcessHeap () returned 0x580000 [0164.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0164.451] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.451] WriteFile (in: hFile=0x448, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x330ff14*=0xfe0, lpOverlapped=0x0) returned 1 [0164.451] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.451] WriteFile (in: hFile=0x448, lpBuffer=0x67fc3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc3f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0164.451] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.451] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0164.452] CloseHandle (hObject=0x448) returned 1 [0164.452] GetProcessHeap () returned 0x580000 [0164.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0164.452] GetProcessHeap () returned 0x580000 [0164.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0164.452] GetProcessHeap () returned 0x580000 [0164.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0164.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99a1a7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x100a, dwReserved0=0x330fd28, dwReserved1=0x6dd7c30, cFileName="Author2XML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~1.YOU")) returned 0x5b9730 [0164.452] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.492] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", len=0x35 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned 1 [0164.492] GetProcessHeap () returned 0x580000 [0164.492] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0164.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0165.885] CloseHandle (hObject=0x430) returned 1 [0165.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id_1622540890_.your_last_chance")) returned 1 [0165.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVCMP~1.YOU")) returned 0x5b9730 [0165.886] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0165.886] GetProcessHeap () returned 0x580000 [0165.886] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0165.887] GetProcessHeap () returned 0x580000 [0165.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0165.888] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.888] ReadFile (in: hFile=0x430, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.108] GetProcessHeap () returned 0x580000 [0169.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0169.109] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.109] WriteFile (in: hFile=0x430, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.109] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.109] WriteFile (in: hFile=0x430, lpBuffer=0x64816f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x64816f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.197] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.197] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.197] CloseHandle (hObject=0x430) returned 1 [0169.197] GetProcessHeap () returned 0x580000 [0169.197] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0169.198] GetProcessHeap () returned 0x580000 [0169.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0169.198] GetProcessHeap () returned 0x580000 [0169.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0172.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7549e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1934f2, dwReserved0=0x330fd28, dwReserved1=0x6f468d8, cFileName="ADVCMP.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVCMP~1.YOU")) returned 0x5b9770 [0172.813] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.860] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", len=0x41 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 1 [0172.860] GetProcessHeap () returned 0x580000 [0172.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2270) returned 0x6f14048 [0172.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0172.935] CloseHandle (hObject=0x454) returned 1 [0172.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b799300, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b799300, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARIN~1.YOU")) returned 0x5b9770 [0172.980] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0172.980] GetProcessHeap () returned 0x580000 [0172.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0172.980] GetProcessHeap () returned 0x580000 [0172.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0172.980] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.980] ReadFile (in: hFile=0x454, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x330ff14*=0x300, lpOverlapped=0x0) returned 1 [0172.994] GetProcessHeap () returned 0x580000 [0172.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.994] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.994] WriteFile (in: hFile=0x454, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x330ff14*=0x300, lpOverlapped=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.994] WriteFile (in: hFile=0x454, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.994] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.994] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.994] CloseHandle (hObject=0x454) returned 1 [0172.994] GetProcessHeap () returned 0x580000 [0172.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0172.995] GetProcessHeap () returned 0x580000 [0172.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0172.995] GetProcessHeap () returned 0x580000 [0172.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b799300, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eba1960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x330fd28, dwReserved1=0x6df6780, cFileName="SHARING.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARIN~1.YOU")) returned 0x5b9770 [0172.995] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.008] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", len=0x42 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 1 [0173.008] GetProcessHeap () returned 0x580000 [0173.008] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2240) returned 0x6f14048 [0173.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.012] CloseHandle (hObject=0x454) returned 1 [0173.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id_1622540890_.your_last_chance")) returned 1 [0173.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~1.YOU")) returned 0x5b9770 [0173.017] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.017] GetProcessHeap () returned 0x580000 [0173.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0173.017] GetProcessHeap () returned 0x580000 [0173.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0173.017] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.017] ReadFile (in: hFile=0x454, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x330ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.033] GetProcessHeap () returned 0x580000 [0173.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.033] WriteFile (in: hFile=0x454, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x330ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.033] WriteFile (in: hFile=0x454, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.033] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.033] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.033] CloseHandle (hObject=0x454) returned 1 [0173.039] GetProcessHeap () returned 0x580000 [0173.039] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0173.044] GetProcessHeap () returned 0x580000 [0173.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0173.044] GetProcessHeap () returned 0x580000 [0173.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ebedc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x330fd28, dwReserved1=0x660a78, cFileName="SCDRESTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~1.YOU")) returned 0x5b9770 [0173.330] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.375] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", len=0x3e | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 1 [0173.376] GetProcessHeap () returned 0x580000 [0173.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0173.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.376] CloseHandle (hObject=0x3fc) returned 1 [0173.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFLIC~1.YOU")) returned 0x5b9770 [0173.377] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.377] GetProcessHeap () returned 0x580000 [0173.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.377] GetProcessHeap () returned 0x580000 [0173.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.377] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.377] ReadFile (in: hFile=0x3fc, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x330ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.413] GetProcessHeap () returned 0x580000 [0173.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0173.413] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.413] WriteFile (in: hFile=0x3fc, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x330ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.413] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.413] WriteFile (in: hFile=0x3fc, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.413] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.413] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.413] CloseHandle (hObject=0x3fc) returned 1 [0173.414] GetProcessHeap () returned 0x580000 [0173.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.414] GetProcessHeap () returned 0x580000 [0173.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0174.661] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9efa5e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x330fd28, dwReserved1=0x5d0090, cFileName="OOFL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFLIC~1.YOU")) returned 0x5b96f0 [0174.661] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.799] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", len=0x49 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned 1 [0176.799] GetProcessHeap () returned 0x580000 [0176.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0176.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0177.934] CloseHandle (hObject=0x49c) returned 1 [0177.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.id_1622540890_.your_last_chance")) returned 1 [0177.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALARMW~1.YOU")) returned 0x5b96f0 [0177.935] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0177.936] GetProcessHeap () returned 0x580000 [0177.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8501) returned 0x6d708d8 [0177.936] GetProcessHeap () returned 0x580000 [0177.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8501) returned 0x6fa6188 [0177.936] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.936] ReadFile (in: hFile=0x49c, lpBuffer=0x6d708d8, nNumberOfBytesToRead=0x84e0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d708d8*, lpNumberOfBytesRead=0x330ff14*=0x84e0, lpOverlapped=0x0) returned 1 [0178.644] GetProcessHeap () returned 0x580000 [0178.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0178.645] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.645] WriteFile (in: hFile=0x49c, lpBuffer=0x6fa6188*, nNumberOfBytesToWrite=0x84e0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6188*, lpNumberOfBytesWritten=0x330ff14*=0x84e0, lpOverlapped=0x0) returned 1 [0178.645] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.645] WriteFile (in: hFile=0x49c, lpBuffer=0x6fae667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fae667*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0178.645] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.645] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0178.645] CloseHandle (hObject=0x49c) returned 1 [0178.645] GetProcessHeap () returned 0x580000 [0178.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa6188 | out: hHeap=0x580000) returned 1 [0178.645] GetProcessHeap () returned 0x580000 [0178.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d708d8 | out: hHeap=0x580000) returned 1 [0178.646] GetProcessHeap () returned 0x580000 [0178.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa217cb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8504, dwReserved0=0x330fd28, dwReserved1=0x6d708d8, cFileName="ALARM.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALARMW~1.YOU")) returned 0x5b96b0 [0180.054] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.112] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", len=0x6b | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned 1 [0180.112] GetProcessHeap () returned 0x580000 [0180.112] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0180.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.186] CloseHandle (hObject=0x488) returned 1 [0181.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0181.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x2e0067, dwReserved1=0x640069, cFileName="CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~3.YOU")) returned 0x5b96b0 [0181.187] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0181.187] GetProcessHeap () returned 0x580000 [0181.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3fc1) returned 0x6dec6e0 [0181.187] GetProcessHeap () returned 0x580000 [0181.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3fc1) returned 0x7058838 [0181.187] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.187] ReadFile (in: hFile=0x488, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x3fa0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x330ff14*=0x3fa0, lpOverlapped=0x0) returned 1 [0181.837] GetProcessHeap () returned 0x580000 [0181.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0181.837] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.837] WriteFile (in: hFile=0x488, lpBuffer=0x7058838*, nNumberOfBytesToWrite=0x3fa0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7058838*, lpNumberOfBytesWritten=0x330ff14*=0x3fa0, lpOverlapped=0x0) returned 1 [0181.837] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.837] WriteFile (in: hFile=0x488, lpBuffer=0x705c7d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x705c7d7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.838] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.838] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.838] CloseHandle (hObject=0x488) returned 1 [0181.838] GetProcessHeap () returned 0x580000 [0181.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7058838 | out: hHeap=0x580000) returned 1 [0181.838] GetProcessHeap () returned 0x580000 [0181.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0181.838] GetProcessHeap () returned 0x580000 [0181.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3ffc500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3fc6, dwReserved0=0x330fd28, dwReserved1=0x6dec6e0, cFileName="CalendarViewButtonImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~3.YOU")) returned 0x5b9770 [0183.331] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.350] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", len=0x60 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned 1 [0183.350] GetProcessHeap () returned 0x580000 [0183.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.382] CloseHandle (hObject=0x448) returned 1 [0183.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~2.YOU")) returned 0x5b9770 [0183.395] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.395] GetProcessHeap () returned 0x580000 [0183.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0183.395] GetProcessHeap () returned 0x580000 [0183.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0183.396] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.396] ReadFile (in: hFile=0x448, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x330ff14*=0xe00, lpOverlapped=0x0) returned 1 [0183.423] GetProcessHeap () returned 0x580000 [0183.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.423] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.423] WriteFile (in: hFile=0x448, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x330ff14*=0xe00, lpOverlapped=0x0) returned 1 [0183.423] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.423] WriteFile (in: hFile=0x448, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.423] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.423] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.423] CloseHandle (hObject=0x448) returned 1 [0183.423] GetProcessHeap () returned 0x580000 [0183.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0183.423] GetProcessHeap () returned 0x580000 [0183.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0183.424] GetProcessHeap () returned 0x580000 [0183.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4f02fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3f, dwReserved0=0x330fd28, dwReserved1=0x6f69420, cFileName="computericon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~2.YOU")) returned 0x5b96b0 [0183.424] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.460] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", len=0x76 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned 1 [0183.460] GetProcessHeap () returned 0x580000 [0183.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.461] CloseHandle (hObject=0x448) returned 1 [0183.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x6b0063, dwReserved1=0x720067, cFileName="WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~1.YOU")) returned 0x5b96b0 [0183.495] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0183.495] GetProcessHeap () returned 0x580000 [0183.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xab21) returned 0x6fb2f38 [0183.496] GetProcessHeap () returned 0x580000 [0183.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xab21) returned 0x6f976f8 [0183.496] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.496] ReadFile (in: hFile=0x448, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0xab00, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x330ff14*=0xab00, lpOverlapped=0x0) returned 1 [0185.008] GetProcessHeap () returned 0x580000 [0185.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x705f940 [0185.008] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.008] WriteFile (in: hFile=0x448, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0xab00, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x330ff14*=0xab00, lpOverlapped=0x0) returned 1 [0185.009] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.009] WriteFile (in: hFile=0x448, lpBuffer=0x6fa21f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa21f7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.013] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.013] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.013] CloseHandle (hObject=0x448) returned 1 [0185.013] GetProcessHeap () returned 0x580000 [0185.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0185.013] GetProcessHeap () returned 0x580000 [0185.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0185.013] GetProcessHeap () returned 0x580000 [0185.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f940 | out: hHeap=0x580000) returned 1 [0185.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5e2fc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xab35, dwReserved0=0x330fd28, dwReserved1=0x6fb2f38, cFileName="WSSFilesToolHomePageBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~1.YOU")) returned 0x5b9770 [0185.533] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.580] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", len=0x52 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned 1 [0185.581] GetProcessHeap () returned 0x580000 [0185.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0187.136] CloseHandle (hObject=0x39c) returned 1 [0187.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0187.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~2.YOU")) returned 0x5b96b0 [0187.137] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0187.137] GetProcessHeap () returned 0x580000 [0187.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0187.137] GetProcessHeap () returned 0x580000 [0187.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0187.137] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.137] ReadFile (in: hFile=0x39c, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x330ff14*=0x820, lpOverlapped=0x0) returned 1 [0187.145] GetProcessHeap () returned 0x580000 [0187.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce7b0 [0187.146] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x39c, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x330ff14*=0x820, lpOverlapped=0x0) returned 1 [0187.146] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x39c, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.146] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.146] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.146] CloseHandle (hObject=0x39c) returned 1 [0187.146] GetProcessHeap () returned 0x580000 [0187.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0187.146] GetProcessHeap () returned 0x580000 [0187.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0187.146] GetProcessHeap () returned 0x580000 [0187.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce7b0 | out: hHeap=0x580000) returned 1 [0187.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7291880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x330fd28, dwReserved1=0x6c79898, cFileName="InformationIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~2.YOU")) returned 0x5b96b0 [0187.146] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.185] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", len=0x74 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 1 [0187.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b0) returned 0x6f14048 [0187.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0188.702] CloseHandle (hObject=0x484) returned 1 [0188.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.745] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16b33, dwReserved0=0x620069, dwReserved1=0x610072, cFileName="Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROCES~1.YOU")) returned 0x5b9770 [0188.746] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0188.746] GetProcessHeap () returned 0x580000 [0188.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0188.746] GetProcessHeap () returned 0x580000 [0188.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0188.747] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.747] ReadFile (in: hFile=0x484, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.868] GetProcessHeap () returned 0x580000 [0191.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0191.868] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x484, lpBuffer=0x6e21520*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.868] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.868] WriteFile (in: hFile=0x484, lpBuffer=0x6e32d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d1f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.869] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.869] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.869] CloseHandle (hObject=0x484) returned 1 [0191.869] GetProcessHeap () returned 0x580000 [0191.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0191.869] GetProcessHeap () returned 0x580000 [0191.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0191.869] GetProcessHeap () returned 0x580000 [0191.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9fa5920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16b57, dwReserved0=0x330fd28, dwReserved1=0x6e0fcf0, cFileName="Process Library.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROCES~1.YOU")) returned 0x5b97b0 [0193.417] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.453] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", len=0x62 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned 1 [0193.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0193.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.453] CloseHandle (hObject=0x4a4) returned 1 [0193.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.454] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.id_1622540890_.your_last_chance")) returned 1 [0193.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b97b0 [0193.455] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.455] GetProcessHeap () returned 0x580000 [0193.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0193.455] GetProcessHeap () returned 0x580000 [0193.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0193.455] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.455] ReadFile (in: hFile=0x4a4, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x330ff14*=0x160, lpOverlapped=0x0) returned 1 [0193.457] GetProcessHeap () returned 0x580000 [0193.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.457] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x330ff14*=0x160, lpOverlapped=0x0) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f4f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.457] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.457] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.458] CloseHandle (hObject=0x4a4) returned 1 [0193.458] GetProcessHeap () returned 0x580000 [0193.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0193.458] GetProcessHeap () returned 0x580000 [0193.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0193.458] GetProcessHeap () returned 0x580000 [0193.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaed2560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x330fd28, dwReserved1=0x65f0b0, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b97b0 [0193.458] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.844] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", len=0x60 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned 1 [0193.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0193.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.845] CloseHandle (hObject=0x4b0) returned 1 [0193.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.id_1622540890_.your_last_chance")) returned 1 [0193.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b97f0 [0193.846] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.847] GetProcessHeap () returned 0x580000 [0193.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0193.847] GetProcessHeap () returned 0x580000 [0193.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x635768 [0193.847] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.847] ReadFile (in: hFile=0x4b0, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x330ff14*=0xae0, lpOverlapped=0x0) returned 1 [0193.918] GetProcessHeap () returned 0x580000 [0193.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.918] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.918] WriteFile (in: hFile=0x4b0, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x330ff14*=0xae0, lpOverlapped=0x0) returned 1 [0193.919] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.919] WriteFile (in: hFile=0x4b0, lpBuffer=0x636247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x636247*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.919] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.919] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.919] CloseHandle (hObject=0x4b0) returned 1 [0193.919] GetProcessHeap () returned 0x580000 [0193.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0193.919] GetProcessHeap () returned 0x580000 [0193.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0193.919] GetProcessHeap () returned 0x580000 [0193.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab322d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0c, dwReserved0=0x330fd28, dwReserved1=0x677cd0, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b97f0 [0193.919] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.954] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0193.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0193.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.955] CloseHandle (hObject=0x3b8) returned 1 [0193.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0195.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0195.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0042, dwReserved1=0x4e004f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0195.350] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0195.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0195.350] GetProcessHeap () returned 0x580000 [0195.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0195.350] GetProcessHeap () returned 0x580000 [0195.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0195.350] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.351] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x330ff14*=0xc0, lpOverlapped=0x0) returned 1 [0195.352] GetProcessHeap () returned 0x580000 [0195.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.352] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x330ff14*=0xc0, lpOverlapped=0x0) returned 1 [0195.352] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.352] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.353] CloseHandle (hObject=0x3b8) returned 1 [0195.353] GetProcessHeap () returned 0x580000 [0195.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0195.353] GetProcessHeap () returned 0x580000 [0195.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0195.353] GetProcessHeap () returned 0x580000 [0195.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac0d2bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x330fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0195.353] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0198.014] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", len=0x44 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned 1 [0198.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0198.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0198.068] CloseHandle (hObject=0x438) returned 1 [0198.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1377, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR46~1.YOU")) returned 0x5b97f0 [0198.069] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0198.069] GetProcessHeap () returned 0x580000 [0198.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6c9a390 [0198.069] GetProcessHeap () returned 0x580000 [0198.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6c9b798 [0198.069] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.069] ReadFile (in: hFile=0x438, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1360, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x330ff14*=0x1360, lpOverlapped=0x0) returned 1 [0198.215] GetProcessHeap () returned 0x580000 [0198.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0198.215] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.215] WriteFile (in: hFile=0x438, lpBuffer=0x6c9b798*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b798*, lpNumberOfBytesWritten=0x330ff14*=0x1360, lpOverlapped=0x0) returned 1 [0198.215] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.215] WriteFile (in: hFile=0x438, lpBuffer=0x6c9caf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9caf7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.216] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.216] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.216] CloseHandle (hObject=0x438) returned 1 [0198.614] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b798 | out: hHeap=0x580000) returned 1 [0198.614] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0198.614] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0199.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadc328c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x139b, dwReserved0=0x330fd28, dwReserved1=0x6c9a390, cFileName="PDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR46~1.YOU")) returned 0x5b96b0 [0199.653] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.960] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", len=0x69 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned 1 [0200.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc8) returned 0x6f14048 [0200.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.674] CloseHandle (hObject=0x480) returned 1 [0201.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0201.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b97b0 [0201.675] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.675] GetProcessHeap () returned 0x580000 [0201.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x677cd0 [0201.675] GetProcessHeap () returned 0x580000 [0201.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x635768 [0201.675] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.675] ReadFile (in: hFile=0x480, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x330ff14*=0xa80, lpOverlapped=0x0) returned 1 [0201.686] GetProcessHeap () returned 0x580000 [0201.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.686] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.686] WriteFile (in: hFile=0x480, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x330ff14*=0xa80, lpOverlapped=0x0) returned 1 [0201.686] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.686] WriteFile (in: hFile=0x480, lpBuffer=0x6361e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6361e7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.686] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.686] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.686] CloseHandle (hObject=0x480) returned 1 [0201.687] GetProcessHeap () returned 0x580000 [0201.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.687] GetProcessHeap () returned 0x580000 [0201.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0201.687] GetProcessHeap () returned 0x580000 [0201.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd39a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaad, dwReserved0=0x330fd28, dwReserved1=0x677cd0, cFileName="FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b9770 [0202.491] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.546] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS", len=0x45 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS") returned 1 [0202.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee0) returned 0x6f14048 [0202.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0202.547] CloseHandle (hObject=0x494) returned 1 [0202.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css.id_1622540890_.your_last_chance")) returned 1 [0202.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4c100, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ce4c100, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x202f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7284~1.YOU")) returned 0x5b9770 [0202.549] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0202.549] GetProcessHeap () returned 0x580000 [0202.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e9be70 [0202.549] GetProcessHeap () returned 0x580000 [0202.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead6a0 [0202.550] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.550] ReadFile (in: hFile=0x494, lpBuffer=0x6e9be70, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be70*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.948] GetProcessHeap () returned 0x580000 [0208.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0208.949] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.949] WriteFile (in: hFile=0x494, lpBuffer=0x6ead6a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead6a0*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.949] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.949] WriteFile (in: hFile=0x494, lpBuffer=0x6ebee9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebee9f*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.950] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.950] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.950] CloseHandle (hObject=0x494) returned 1 [0208.950] GetProcessHeap () returned 0x580000 [0208.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead6a0 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9be70 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0210.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4c100, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb428dac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20314, dwReserved0=0x330fd28, dwReserved1=0x6e9be70, cFileName="SCHEME35.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7284~1.YOU")) returned 0x5b97b0 [0210.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.123] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", len=0x60 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned 1 [0210.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0210.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.323] CloseHandle (hObject=0x3b8) returned 1 [0215.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.id_1622540890_.your_last_chance")) returned 1 [0215.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b97b0 [0215.325] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.325] GetProcessHeap () returned 0x580000 [0215.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x7461878 [0215.325] GetProcessHeap () returned 0x580000 [0215.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6c6e0f8 [0215.325] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.325] ReadFile (in: hFile=0x3b8, lpBuffer=0x7461878, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461878*, lpNumberOfBytesRead=0x330ff14*=0x1600, lpOverlapped=0x0) returned 1 [0215.345] GetProcessHeap () returned 0x580000 [0215.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.345] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.346] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x330ff14*=0x1600, lpOverlapped=0x0) returned 1 [0215.346] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.346] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c6f6f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f6f7*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.346] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.346] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.346] CloseHandle (hObject=0x3b8) returned 1 [0215.346] GetProcessHeap () returned 0x580000 [0215.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0215.346] GetProcessHeap () returned 0x580000 [0215.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7461878 | out: hHeap=0x580000) returned 1 [0215.346] GetProcessHeap () returned 0x580000 [0215.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f8ce80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1641, dwReserved0=0x330fd28, dwReserved1=0x7461878, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b9770 [0217.529] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.551] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", len=0x5b | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 1 [0217.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0217.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0217.552] CloseHandle (hObject=0x4a8) returned 1 [0217.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id_1622540890_.your_last_chance")) returned 1 [0217.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b9770 [0217.553] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0217.553] GetProcessHeap () returned 0x580000 [0217.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x6efc3f8 [0217.553] GetProcessHeap () returned 0x580000 [0217.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x6f1ad48 [0217.553] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.553] ReadFile (in: hFile=0x4a8, lpBuffer=0x6efc3f8, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc3f8*, lpNumberOfBytesRead=0x330ff14*=0x120, lpOverlapped=0x0) returned 1 [0217.555] GetProcessHeap () returned 0x580000 [0217.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.555] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.555] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f1ad48*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ad48*, lpNumberOfBytesWritten=0x330ff14*=0x120, lpOverlapped=0x0) returned 1 [0217.555] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.555] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f1ae67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ae67*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.555] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.555] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.556] CloseHandle (hObject=0x4a8) returned 1 [0217.556] GetProcessHeap () returned 0x580000 [0217.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1ad48 | out: hHeap=0x580000) returned 1 [0217.556] GetProcessHeap () returned 0x580000 [0217.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efc3f8 | out: hHeap=0x580000) returned 1 [0217.556] GetProcessHeap () returned 0x580000 [0217.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9487060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x330fd28, dwReserved1=0x6efc3f8, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b9770 [0217.556] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.610] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", len=0x5c | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned 1 [0217.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0217.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.611] CloseHandle (hObject=0x440) returned 1 [0217.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js.id_1622540890_.your_last_chance")) returned 1 [0217.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14307, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9770 [0217.612] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.613] GetProcessHeap () returned 0x580000 [0217.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71a3328 [0217.613] GetProcessHeap () returned 0x580000 [0217.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71b4b58 [0217.614] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.614] ReadFile (in: hFile=0x440, lpBuffer=0x71a3328, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x71a3328*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.920] GetProcessHeap () returned 0x580000 [0220.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0220.921] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.921] WriteFile (in: hFile=0x440, lpBuffer=0x71b4b58*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x71b4b58*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.921] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.921] WriteFile (in: hFile=0x440, lpBuffer=0x71c6357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x71c6357*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.921] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.922] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.922] CloseHandle (hObject=0x440) returned 1 [0220.989] GetProcessHeap () returned 0x580000 [0220.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71b4b58 | out: hHeap=0x580000) returned 1 [0220.990] GetProcessHeap () returned 0x580000 [0220.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71a3328 | out: hHeap=0x580000) returned 1 [0220.990] GetProcessHeap () returned 0x580000 [0220.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb4a9960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1432b, dwReserved0=0x330fd28, dwReserved1=0x71a3328, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9730 [0221.904] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.957] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", len=0x8b | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned 1 [0221.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0221.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0221.958] CloseHandle (hObject=0x494) returned 1 [0221.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.id_1622540890_.your_last_chance")) returned 1 [0221.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACER~1.YOU")) returned 0x5b9730 [0221.959] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0221.960] GetProcessHeap () returned 0x580000 [0221.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0221.960] GetProcessHeap () returned 0x580000 [0221.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0221.960] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.960] ReadFile (in: hFile=0x494, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0222.070] GetProcessHeap () returned 0x580000 [0222.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.070] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.070] WriteFile (in: hFile=0x494, lpBuffer=0x6d07028*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesWritten=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0222.070] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.070] WriteFile (in: hFile=0x494, lpBuffer=0x6d07347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07347*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.070] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.070] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.070] CloseHandle (hObject=0x494) returned 1 [0222.070] GetProcessHeap () returned 0x580000 [0222.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0222.070] GetProcessHeap () returned 0x580000 [0222.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0222.070] GetProcessHeap () returned 0x580000 [0222.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0223.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbfabf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x330fd28, dwReserved1=0x6d06cc0, cFileName="SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACER~1.YOU")) returned 0x5b96f0 [0223.444] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.460] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", len=0x65 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned 1 [0223.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0223.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0223.474] CloseHandle (hObject=0x45c) returned 1 [0223.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0223.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x275e, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b96f0 [0223.475] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0223.475] GetProcessHeap () returned 0x580000 [0223.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2761) returned 0x7160f38 [0223.475] GetProcessHeap () returned 0x580000 [0223.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2761) returned 0x745f058 [0223.476] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.476] ReadFile (in: hFile=0x45c, lpBuffer=0x7160f38, nNumberOfBytesToRead=0x2740, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7160f38*, lpNumberOfBytesRead=0x330ff14*=0x2740, lpOverlapped=0x0) returned 1 [0223.997] GetProcessHeap () returned 0x580000 [0223.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0223.997] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.997] WriteFile (in: hFile=0x45c, lpBuffer=0x745f058*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x745f058*, lpNumberOfBytesWritten=0x330ff14*=0x2740, lpOverlapped=0x0) returned 1 [0223.997] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.997] WriteFile (in: hFile=0x45c, lpBuffer=0x7461797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461797*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.997] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.997] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.998] CloseHandle (hObject=0x45c) returned 1 [0224.422] GetProcessHeap () returned 0x580000 [0224.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x745f058 | out: hHeap=0x580000) returned 1 [0224.422] GetProcessHeap () returned 0x580000 [0224.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7160f38 | out: hHeap=0x580000) returned 1 [0224.422] GetProcessHeap () returned 0x580000 [0224.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0226.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd1f8840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2782, dwReserved0=0x330fd28, dwReserved1=0x7160f38, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b9730 [0226.191] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.272] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", len=0x40 | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned 1 [0226.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db0) returned 0x6dee6e0 [0226.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.273] CloseHandle (hObject=0x454) returned 1 [0226.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.id_1622540890_.your_last_chance")) returned 1 [0226.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EUROTO~1.YOU")) returned 0x5b9630 [0226.317] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.317] GetProcessHeap () returned 0x580000 [0226.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x721ed58 [0226.318] GetProcessHeap () returned 0x580000 [0226.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7230588 [0226.318] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.318] ReadFile (in: hFile=0x454, lpBuffer=0x721ed58, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x721ed58*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.590] GetProcessHeap () returned 0x580000 [0236.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0236.590] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.590] WriteFile (in: hFile=0x454, lpBuffer=0x7230588*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7230588*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.591] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.591] WriteFile (in: hFile=0x454, lpBuffer=0x7241d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x7241d87*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.119] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.119] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.119] CloseHandle (hObject=0x454) returned 1 [0239.121] GetProcessHeap () returned 0x580000 [0239.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7230588 | out: hHeap=0x580000) returned 1 [0239.126] GetProcessHeap () returned 0x580000 [0239.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x721ed58 | out: hHeap=0x580000) returned 1 [0239.143] GetProcessHeap () returned 0x580000 [0239.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0240.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc60cb040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x626ac, dwReserved0=0x330fd28, dwReserved1=0x580000, cFileName="EUROTOOL.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EUROTO~1.YOU")) returned 0x5b9730 [0240.549] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.552] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML", len=0x4b | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned 1 [0240.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0240.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.553] CloseHandle (hObject=0x428) returned 1 [0240.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml.id_1622540890_.your_last_chance")) returned 1 [0240.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOON~1.YOU")) returned 0x5b9730 [0240.554] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.555] GetProcessHeap () returned 0x580000 [0240.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.555] GetProcessHeap () returned 0x580000 [0240.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.555] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.555] ReadFile (in: hFile=0x428, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.559] GetProcessHeap () returned 0x580000 [0240.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.559] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.559] WriteFile (in: hFile=0x428, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.559] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.559] WriteFile (in: hFile=0x428, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.559] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.559] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.559] CloseHandle (hObject=0x428) returned 1 [0240.559] GetProcessHeap () returned 0x580000 [0240.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.559] GetProcessHeap () returned 0x580000 [0240.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.559] GetProcessHeap () returned 0x580000 [0240.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6e7aec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x330fd28, dwReserved1=0x6d07028, cFileName="YAHOO.NO.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOON~1.YOU")) returned 0x5b9730 [0240.560] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.568] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML", len=0x4c | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned 1 [0240.568] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0240.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.595] CloseHandle (hObject=0x414) returned 1 [0240.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.596] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml.id_1622540890_.your_last_chance")) returned 1 [0240.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x450043, dwReserved1=0x0, cFileName="YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~2.YOU")) returned 0x5b9730 [0240.597] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.597] GetProcessHeap () returned 0x580000 [0240.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08ed0 [0240.597] GetProcessHeap () returned 0x580000 [0240.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09238 [0240.597] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.597] ReadFile (in: hFile=0x414, lpBuffer=0x6d08ed0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08ed0*, lpNumberOfBytesRead=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.619] GetProcessHeap () returned 0x580000 [0240.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0240.619] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.619] WriteFile (in: hFile=0x414, lpBuffer=0x6d09238*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09238*, lpNumberOfBytesWritten=0x330ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.619] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.619] WriteFile (in: hFile=0x414, lpBuffer=0x6d09557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09557*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.619] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.619] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.619] CloseHandle (hObject=0x414) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09238 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08ed0 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0241.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f13440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x330fd28, dwReserved1=0x6d08ed0, cFileName="YAHOO.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~2.YOU")) returned 0x5b9630 [0241.569] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.669] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML", len=0x3f | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned 1 [0241.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0241.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.670] CloseHandle (hObject=0x488) returned 1 [0241.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml.id_1622540890_.your_last_chance")) returned 1 [0241.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9d600, ftCreationTime.dwHighDateTime=0x1c6c5a1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96f9d600, ftLastWriteTime.dwHighDateTime=0x1c6c5a1, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG4132~1.YOU")) returned 0x5b9630 [0241.726] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0241.726] GetProcessHeap () returned 0x580000 [0241.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8881) returned 0x6ff1300 [0241.726] GetProcessHeap () returned 0x580000 [0241.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8881) returned 0x6ff9b90 [0241.726] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.726] ReadFile (in: hFile=0x488, lpBuffer=0x6ff1300, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff1300*, lpNumberOfBytesRead=0x330ff14*=0x8860, lpOverlapped=0x0) returned 1 [0243.808] GetProcessHeap () returned 0x580000 [0243.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0243.808] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.808] WriteFile (in: hFile=0x488, lpBuffer=0x6ff9b90*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff9b90*, lpNumberOfBytesWritten=0x330ff14*=0x8860, lpOverlapped=0x0) returned 1 [0243.808] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.808] WriteFile (in: hFile=0x488, lpBuffer=0x70023ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x70023ef*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0243.809] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.809] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0243.809] CloseHandle (hObject=0x488) returned 1 [0244.229] GetProcessHeap () returned 0x580000 [0244.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff9b90 | out: hHeap=0x580000) returned 1 [0244.229] GetProcessHeap () returned 0x580000 [0244.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff1300 | out: hHeap=0x580000) returned 1 [0244.229] GetProcessHeap () returned 0x580000 [0244.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0248.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9d600, ftCreationTime.dwHighDateTime=0x1c6c5a1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d6ccc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x330fd28, dwReserved1=0x6ff1300, cFileName="PGMN102.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG4132~1.YOU")) returned 0x5b9730 [0248.353] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.390] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR", len=0x3c | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 1 [0248.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0248.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0248.391] CloseHandle (hObject=0x268) returned 1 [0248.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.id_1622540890_.your_last_chance")) returned 1 [0248.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x2476, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB5~1.YOU")) returned 0x5b9730 [0248.392] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0248.392] GetProcessHeap () returned 0x580000 [0248.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2481) returned 0x6fc14d0 [0248.392] GetProcessHeap () returned 0x580000 [0248.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2481) returned 0x70692d8 [0248.393] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.393] ReadFile (in: hFile=0x268, lpBuffer=0x6fc14d0, nNumberOfBytesToRead=0x2460, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc14d0*, lpNumberOfBytesRead=0x330ff14*=0x2460, lpOverlapped=0x0) returned 1 [0248.476] GetProcessHeap () returned 0x580000 [0248.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0248.476] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.476] WriteFile (in: hFile=0x268, lpBuffer=0x70692d8*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x70692d8*, lpNumberOfBytesWritten=0x330ff14*=0x2460, lpOverlapped=0x0) returned 1 [0248.476] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.476] WriteFile (in: hFile=0x268, lpBuffer=0x706b737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x706b737*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.477] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.477] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.477] CloseHandle (hObject=0x268) returned 1 [0248.477] GetProcessHeap () returned 0x580000 [0248.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70692d8 | out: hHeap=0x580000) returned 1 [0248.477] GetProcessHeap () returned 0x580000 [0248.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc14d0 | out: hHeap=0x580000) returned 1 [0248.477] GetProcessHeap () returned 0x580000 [0248.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0248.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb9e87e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x249a, dwReserved0=0x330fd28, dwReserved1=0x6fc14d0, cFileName="MSPUB5B.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB5~1.YOU")) returned 0x5b9730 [0248.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.426] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV", len=0x3e | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV") returned 1 [0254.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe8) returned 0x72e5948 [0254.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0254.427] CloseHandle (hObject=0x4a8) returned 1 [0254.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0254.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv.id_1622540890_.your_last_chance")) returned 1 [0254.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0254.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1cb200, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x24efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENVELO~1.YOU")) returned 0x5b9730 [0254.429] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0254.429] GetProcessHeap () returned 0x580000 [0254.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fed290 [0254.429] GetProcessHeap () returned 0x580000 [0254.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0254.431] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.431] ReadFile (in: hFile=0x4a8, lpBuffer=0x6fed290, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fed290*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.113] GetProcessHeap () returned 0x580000 [0258.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0258.113] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.113] WriteFile (in: hFile=0x4a8, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.114] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.114] WriteFile (in: hFile=0x4a8, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x330ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.114] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.114] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x330ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.114] CloseHandle (hObject=0x4a8) returned 1 [0258.431] GetProcessHeap () returned 0x580000 [0258.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0258.431] GetProcessHeap () returned 0x580000 [0258.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fed290 | out: hHeap=0x580000) returned 1 [0258.432] GetProcessHeap () returned 0x580000 [0258.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0259.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fccc | out: lpFindFileData=0x330fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd15d99a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24f1f, dwReserved0=0x330fd28, dwReserved1=0x6fed290, cFileName="ENVELOPE.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENVELO~1.YOU")) returned 0x5b9630 [0259.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.233] SysReAllocStringLen (in: pbstr=0x330ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC", len=0x3b | out: pbstr=0x330ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC") returned 1 [0259.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b4) returned 0x72e5948 [0259.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.371] CloseHandle (hObject=0x390) returned 1 [0259.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.371] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc.id_1622540890_.your_last_chance")) returned 1 [0259.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x330ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x330fc74 | out: lpFindFileData=0x330fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a8fe00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a8fe00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x166484, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEB11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEB11P~1.YOU")) returned 0x5b9630 [0259.372] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0259.372] GetProcessHeap () returned 0x580000 [0259.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e675e0 [0259.373] GetProcessHeap () returned 0x580000 [0259.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e78e10 [0259.373] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.373] ReadFile (in: hFile=0x390, lpBuffer=0x6e675e0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x330ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesRead=0x330ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 18 os_tid = 0xa40 [0039.061] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.127] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.675] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.294] Sleep (dwMilliseconds=0x1) [0040.352] Sleep (dwMilliseconds=0x1) [0040.375] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.354] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.633] Sleep (dwMilliseconds=0x1) [0042.650] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.826] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.193] Sleep (dwMilliseconds=0x1) [0043.200] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.324] Sleep (dwMilliseconds=0x1) [0043.340] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.433] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.527] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.838] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.916] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.979] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.493] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.651] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.851] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.782] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x344ff84*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.806] GetProcessHeap () returned 0x580000 [0059.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x24) returned 0x5dc550 [0059.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.807] CloseHandle (hObject=0x444) returned 1 [0059.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.807] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0059.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.808] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.808] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0059.808] GetProcessHeap () returned 0x580000 [0059.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6d33678 [0059.808] GetProcessHeap () returned 0x580000 [0059.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c56108 [0059.808] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.808] ReadFile (in: hFile=0x444, lpBuffer=0x6d33678, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesRead=0x344ff14*=0x720, lpOverlapped=0x0) returned 1 [0059.816] GetProcessHeap () returned 0x580000 [0059.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.816] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.816] WriteFile (in: hFile=0x444, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x344ff14*=0x720, lpOverlapped=0x0) returned 1 [0059.816] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.817] WriteFile (in: hFile=0x444, lpBuffer=0x6c56827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56827*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.817] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.817] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.817] CloseHandle (hObject=0x444) returned 1 [0059.817] GetProcessHeap () returned 0x580000 [0059.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0059.817] GetProcessHeap () returned 0x580000 [0059.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0059.818] GetProcessHeap () returned 0x580000 [0059.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.818] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b741d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x344fd28, dwReserved1=0x6d33678, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.818] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.839] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x344ff84*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.839] GetProcessHeap () returned 0x580000 [0059.839] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0059.839] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.839] CloseHandle (hObject=0x448) returned 1 [0059.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.839] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0059.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.840] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.840] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.840] GetProcessHeap () returned 0x580000 [0059.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6d33678 [0059.840] GetProcessHeap () returned 0x580000 [0059.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6c56108 [0059.840] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.840] ReadFile (in: hFile=0x448, lpBuffer=0x6d33678, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesRead=0x344ff14*=0x920, lpOverlapped=0x0) returned 1 [0059.850] GetProcessHeap () returned 0x580000 [0059.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.850] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.850] WriteFile (in: hFile=0x448, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x344ff14*=0x920, lpOverlapped=0x0) returned 1 [0059.850] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.850] WriteFile (in: hFile=0x448, lpBuffer=0x6c56a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56a27*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.850] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.850] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.850] CloseHandle (hObject=0x448) returned 1 [0059.851] GetProcessHeap () returned 0x580000 [0059.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0059.851] GetProcessHeap () returned 0x580000 [0059.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0059.851] GetProcessHeap () returned 0x580000 [0059.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.851] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b78e000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95e, dwReserved0=0x344fd28, dwReserved1=0x6d33678, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0059.851] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.873] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", len=0x4e | out: pbstr=0x344ff84*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 1 [0059.873] GetProcessHeap () returned 0x580000 [0059.873] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0059.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0059.874] CloseHandle (hObject=0x44c) returned 1 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.874] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id_1622540890_.your_last_chance")) returned 1 [0059.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.874] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0059.875] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0059.875] GetProcessHeap () returned 0x580000 [0059.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6d33678 [0059.875] GetProcessHeap () returned 0x580000 [0059.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6c56108 [0059.875] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.875] ReadFile (in: hFile=0x44c, lpBuffer=0x6d33678, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesRead=0x344ff14*=0x560, lpOverlapped=0x0) returned 1 [0059.881] GetProcessHeap () returned 0x580000 [0059.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.881] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.881] WriteFile (in: hFile=0x44c, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x344ff14*=0x560, lpOverlapped=0x0) returned 1 [0059.881] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.881] WriteFile (in: hFile=0x44c, lpBuffer=0x6c56667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56667*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.882] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.882] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.882] CloseHandle (hObject=0x44c) returned 1 [0059.882] GetProcessHeap () returned 0x580000 [0059.882] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0059.883] GetProcessHeap () returned 0x580000 [0059.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0059.883] GetProcessHeap () returned 0x580000 [0059.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.883] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b7da2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x344fd28, dwReserved1=0x6d33678, cFileName="Office32MUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0059.883] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.660] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x344ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.660] GetProcessHeap () returned 0x580000 [0061.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x78) returned 0x5b5bc8 [0061.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.661] CloseHandle (hObject=0x458) returned 1 [0061.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.661] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0061.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.662] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0061.662] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.662] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.662] GetProcessHeap () returned 0x580000 [0061.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x6f03bb0 [0061.663] GetProcessHeap () returned 0x580000 [0061.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x6f07d00 [0061.663] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.663] ReadFile (in: hFile=0x458, lpBuffer=0x6f03bb0, nNumberOfBytesToRead=0x4120, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bb0*, lpNumberOfBytesRead=0x344ff14*=0x4120, lpOverlapped=0x0) returned 1 [0062.845] GetProcessHeap () returned 0x580000 [0062.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0062.845] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.845] WriteFile (in: hFile=0x458, lpBuffer=0x6f07d00*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f07d00*, lpNumberOfBytesWritten=0x344ff14*=0x4120, lpOverlapped=0x0) returned 1 [0064.321] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.321] WriteFile (in: hFile=0x458, lpBuffer=0x6f0be1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0be1f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0064.321] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.321] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0064.321] CloseHandle (hObject=0x458) returned 1 [0065.692] GetProcessHeap () returned 0x580000 [0065.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f07d00 | out: hHeap=0x580000) returned 1 [0065.692] GetProcessHeap () returned 0x580000 [0065.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bb0 | out: hHeap=0x580000) returned 1 [0065.693] GetProcessHeap () returned 0x580000 [0065.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0066.490] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0x5e1a8520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x414f, dwReserved0=0x344fd28, dwReserved1=0x6f03bb0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0066.491] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.504] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x344ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0066.504] GetProcessHeap () returned 0x580000 [0066.504] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x30) returned 0x5e9710 [0066.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0071.842] CloseHandle (hObject=0x474) returned 1 [0071.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0071.842] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance")) returned 1 [0075.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.303] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0075.303] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.303] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0075.303] GetProcessHeap () returned 0x580000 [0075.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e2f350 [0075.303] GetProcessHeap () returned 0x580000 [0075.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c330a8 [0075.303] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.303] ReadFile (in: hFile=0x474, lpBuffer=0x6e2f350, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2f350*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.494] GetProcessHeap () returned 0x580000 [0078.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0078.494] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.494] WriteFile (in: hFile=0x474, lpBuffer=0x6c330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c330a8*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.495] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.495] WriteFile (in: hFile=0x474, lpBuffer=0x6c448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448a7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0078.853] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.853] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0078.853] CloseHandle (hObject=0x474) returned 1 [0078.854] GetProcessHeap () returned 0x580000 [0078.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c330a8 | out: hHeap=0x580000) returned 1 [0078.854] GetProcessHeap () returned 0x580000 [0078.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e2f350 | out: hHeap=0x580000) returned 1 [0078.857] GetProcessHeap () returned 0x580000 [0078.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0079.437] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x669c8f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaec5e, dwReserved0=0x580000, dwReserved1=0x6f03890, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0079.437] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.961] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", len=0x46 | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 1 [0085.961] GetProcessHeap () returned 0x580000 [0085.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xa4) returned 0x614a48 [0085.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.963] Sleep (dwMilliseconds=0x1) [0085.978] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", len=0x4b | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 1 [0085.978] GetProcessHeap () returned 0x580000 [0085.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x38) returned 0x614a48 [0085.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.485] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", len=0x4d | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 1 [0086.485] GetProcessHeap () returned 0x580000 [0086.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0086.593] CloseHandle (hObject=0x41c) returned 1 [0086.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id_1622540890_.your_last_chance")) returned 1 [0090.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0090.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUECA~2.YOU")) returned 0x5b9730 [0090.237] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0090.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0090.237] GetProcessHeap () returned 0x580000 [0090.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6e40cc0 [0090.238] GetProcessHeap () returned 0x580000 [0090.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x636198 [0090.238] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.238] ReadFile (in: hFile=0x41c, lpBuffer=0x6e40cc0, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40cc0*, lpNumberOfBytesRead=0x344ff14*=0x220, lpOverlapped=0x0) returned 1 [0090.766] GetProcessHeap () returned 0x580000 [0090.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0090.766] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.767] WriteFile (in: hFile=0x41c, lpBuffer=0x636198*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x636198*, lpNumberOfBytesWritten=0x344ff14*=0x220, lpOverlapped=0x0) returned 1 [0091.440] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.440] WriteFile (in: hFile=0x41c, lpBuffer=0x6363b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6363b7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.620] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.620] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.620] CloseHandle (hObject=0x41c) returned 1 [0091.620] GetProcessHeap () returned 0x580000 [0091.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636198 | out: hHeap=0x580000) returned 1 [0091.621] GetProcessHeap () returned 0x580000 [0091.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e40cc0 | out: hHeap=0x580000) returned 1 [0091.621] GetProcessHeap () returned 0x580000 [0091.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0091.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3a1560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x344fd28, dwReserved1=0x6e40cc0, cFileName="BLUECALM.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUECA~2.YOU")) returned 0x5b96f0 [0091.632] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.410] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", len=0x49 | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 1 [0092.410] GetProcessHeap () returned 0x580000 [0092.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f6c0 [0092.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0092.523] CloseHandle (hObject=0x47c) returned 1 [0092.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id_1622540890_.your_last_chance")) returned 1 [0092.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDUST~2.YOU")) returned 0x5b96f0 [0092.524] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0092.524] GetProcessHeap () returned 0x580000 [0092.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d4dc10 [0092.524] GetProcessHeap () returned 0x580000 [0092.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d5f440 [0092.524] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.524] ReadFile (in: hFile=0x47c, lpBuffer=0x6d4dc10, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4dc10*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.688] GetProcessHeap () returned 0x580000 [0099.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0099.689] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.689] WriteFile (in: hFile=0x47c, lpBuffer=0x6d5f440*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d5f440*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.689] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.689] WriteFile (in: hFile=0x47c, lpBuffer=0x6d70c3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d70c3f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.689] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.689] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.689] CloseHandle (hObject=0x47c) returned 1 [0099.690] GetProcessHeap () returned 0x580000 [0099.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d5f440 | out: hHeap=0x580000) returned 1 [0099.690] GetProcessHeap () returned 0x580000 [0099.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d4dc10 | out: hHeap=0x580000) returned 1 [0099.690] GetProcessHeap () returned 0x580000 [0099.690] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0099.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7308bc40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1850d, dwReserved0=0x344fd28, dwReserved1=0x6d4dc10, cFileName="INDUST.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDUST~2.YOU")) returned 0x5b9730 [0099.691] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0104.037] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", len=0x44 | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 1 [0104.037] GetProcessHeap () returned 0x580000 [0104.037] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5e85f8 [0104.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.037] CloseHandle (hObject=0x39c) returned 1 [0104.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id_1622540890_.your_last_chance")) returned 1 [0104.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1CA~1.YOU")) returned 0x5b9630 [0104.038] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.039] GetProcessHeap () returned 0x580000 [0104.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6f0c4f8 [0104.039] GetProcessHeap () returned 0x580000 [0104.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6c676b8 [0104.039] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.039] ReadFile (in: hFile=0x39c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x344ff14*=0x600, lpOverlapped=0x0) returned 1 [0104.050] GetProcessHeap () returned 0x580000 [0104.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0104.050] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.050] WriteFile (in: hFile=0x39c, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x344ff14*=0x600, lpOverlapped=0x0) returned 1 [0104.050] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.050] WriteFile (in: hFile=0x39c, lpBuffer=0x6c67cb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67cb7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0104.050] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.050] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0104.050] CloseHandle (hObject=0x39c) returned 1 [0104.051] GetProcessHeap () returned 0x580000 [0104.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0104.051] GetProcessHeap () returned 0x580000 [0104.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0104.051] GetProcessHeap () returned 0x580000 [0104.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0104.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75a0dbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x624, dwReserved0=0x344fd28, dwReserved1=0x6f0c4f8, cFileName="MSB1CACH.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1CA~1.YOU")) returned 0x5b9630 [0104.051] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.670] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", len=0x34 | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 1 [0109.670] GetProcessHeap () returned 0x580000 [0109.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x28) returned 0x5dc550 [0109.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.708] Sleep (dwMilliseconds=0x1) [0110.465] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", len=0x36 | out: pbstr=0x344ff84*="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 1 [0110.465] GetProcessHeap () returned 0x580000 [0110.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94c8 | out: hHeap=0x580000) returned 1 [0110.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.466] Sleep (dwMilliseconds=0x1) [0111.109] Sleep (dwMilliseconds=0x1) [0111.120] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.791] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\desktop.ini", len=0x1c | out: pbstr=0x344ff84*="C:\\Program Files\\desktop.ini") returned 1 [0111.792] GetProcessHeap () returned 0x580000 [0111.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.792] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0111.792] CloseHandle (hObject=0x45c) returned 1 [0111.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0111.792] MoveFileW (lpExistingFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), lpNewFileName="C:\\Program Files\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\desktop.ini.id_1622540890_.your_last_chance")) returned 1 [0111.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0111.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="")) returned 0x5b96f0 [0111.793] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.793] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\desktop.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0111.793] GetProcessHeap () returned 0x580000 [0111.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0111.793] GetProcessHeap () returned 0x580000 [0111.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0111.793] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.793] ReadFile (in: hFile=0x45c, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x344ff14*=0xa0, lpOverlapped=0x0) returned 1 [0111.795] GetProcessHeap () returned 0x580000 [0111.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0111.795] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.795] WriteFile (in: hFile=0x45c, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x344ff14*=0xa0, lpOverlapped=0x0) returned 1 [0111.795] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.795] WriteFile (in: hFile=0x45c, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.795] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.795] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.795] CloseHandle (hObject=0x45c) returned 1 [0111.795] GetProcessHeap () returned 0x580000 [0111.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0111.795] GetProcessHeap () returned 0x580000 [0111.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0111.795] GetProcessHeap () returned 0x580000 [0111.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0111.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x7a3fe740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x344fd28, dwReserved1=0x60e978, cFileName="desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="")) returned 0x5b96f0 [0111.796] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.884] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", len=0x4a | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 1 [0111.884] GetProcessHeap () returned 0x580000 [0111.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x28) returned 0x5dc550 [0111.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.889] Sleep (dwMilliseconds=0x1) [0111.900] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", len=0x4a | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 1 [0111.900] GetProcessHeap () returned 0x580000 [0111.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ab70, Size=0x38) returned 0x5b96b0 [0111.900] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.906] Sleep (dwMilliseconds=0x1) [0111.915] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", len=0x4d | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 1 [0111.915] GetProcessHeap () returned 0x580000 [0111.915] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.917] Sleep (dwMilliseconds=0x1) [0111.955] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", len=0x41 | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 1 [0111.955] GetProcessHeap () returned 0x580000 [0111.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x80) returned 0x5fa058 [0111.955] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.956] Sleep (dwMilliseconds=0x1) [0111.966] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", len=0x44 | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 1 [0111.966] GetProcessHeap () returned 0x580000 [0111.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x5c) returned 0x6c564c8 [0111.966] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.969] Sleep (dwMilliseconds=0x1) [0112.131] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", len=0x4c | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 1 [0112.131] GetProcessHeap () returned 0x580000 [0112.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.131] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.139] Sleep (dwMilliseconds=0x1) [0112.220] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", len=0x52 | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned 1 [0112.220] GetProcessHeap () returned 0x580000 [0112.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.220] Sleep (dwMilliseconds=0x1) [0112.238] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", len=0x4f | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned 1 [0112.238] GetProcessHeap () returned 0x580000 [0112.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b9730 [0112.238] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.249] Sleep (dwMilliseconds=0x1) [0112.365] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", len=0x49 | out: pbstr=0x344ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png") returned 1 [0112.365] GetProcessHeap () returned 0x580000 [0112.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x28) returned 0x5dc550 [0112.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.386] Sleep (dwMilliseconds=0x1) [0113.311] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", len=0x3f | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 1 [0113.312] GetProcessHeap () returned 0x580000 [0113.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xfc) returned 0x6f0ceb8 [0113.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0113.495] CloseHandle (hObject=0x460) returned 1 [0113.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.496] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~2.YOU")) returned 0x5b9630 [0115.063] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0115.063] GetProcessHeap () returned 0x580000 [0115.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1221) returned 0x6d035f8 [0115.063] GetProcessHeap () returned 0x580000 [0115.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1221) returned 0x6d06ca8 [0115.063] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.063] ReadFile (in: hFile=0x460, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1200, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x344ff14*=0x1200, lpOverlapped=0x0) returned 1 [0115.080] GetProcessHeap () returned 0x580000 [0115.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.080] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.081] WriteFile (in: hFile=0x460, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x1200, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x344ff14*=0x1200, lpOverlapped=0x0) returned 1 [0115.081] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.081] WriteFile (in: hFile=0x460, lpBuffer=0x6d07ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07ea7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.081] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.081] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.081] CloseHandle (hObject=0x460) returned 1 [0115.081] GetProcessHeap () returned 0x580000 [0115.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0115.081] GetProcessHeap () returned 0x580000 [0115.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0115.081] GetProcessHeap () returned 0x580000 [0115.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c33c800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1228, dwReserved0=0x344fd28, dwReserved1=0x6d035f8, cFileName="AN04195_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~2.YOU")) returned 0x5b9630 [0116.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0116.236] CloseHandle (hObject=0x460) returned 1 [0116.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0139~2.YOU")) returned 0x5b9630 [0116.237] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0116.238] GetProcessHeap () returned 0x580000 [0116.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6c54578 [0116.238] GetProcessHeap () returned 0x580000 [0116.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6e063d0 [0116.238] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.238] ReadFile (in: hFile=0x460, lpBuffer=0x6c54578, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c54578*, lpNumberOfBytesRead=0x344ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0116.263] GetProcessHeap () returned 0x580000 [0116.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.263] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.263] WriteFile (in: hFile=0x460, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x344ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0116.263] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.263] WriteFile (in: hFile=0x460, lpBuffer=0x6e07ecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e07ecf*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.263] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.263] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.263] CloseHandle (hObject=0x460) returned 1 [0116.263] GetProcessHeap () returned 0x580000 [0116.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0116.263] GetProcessHeap () returned 0x580000 [0116.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c54578 | out: hHeap=0x580000) returned 1 [0116.264] GetProcessHeap () returned 0x580000 [0116.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ce8b080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x344fd28, dwReserved1=0x6c54578, cFileName="SL01394_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0139~2.YOU")) returned 0x5b9630 [0116.264] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0116.268] CloseHandle (hObject=0x460) returned 1 [0116.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0104~1.YOU")) returned 0x5b9630 [0116.271] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0116.271] GetProcessHeap () returned 0x580000 [0116.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6c6f268 [0116.272] GetProcessHeap () returned 0x580000 [0116.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6e023e8 [0116.272] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.272] ReadFile (in: hFile=0x460, lpBuffer=0x6c6f268, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f268*, lpNumberOfBytesRead=0x344ff14*=0x600, lpOverlapped=0x0) returned 1 [0117.189] GetProcessHeap () returned 0x580000 [0117.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.189] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.189] WriteFile (in: hFile=0x460, lpBuffer=0x6e023e8*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesWritten=0x344ff14*=0x600, lpOverlapped=0x0) returned 1 [0117.189] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.189] WriteFile (in: hFile=0x460, lpBuffer=0x6e029e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e029e7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.190] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.190] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.190] CloseHandle (hObject=0x460) returned 1 [0117.190] GetProcessHeap () returned 0x580000 [0117.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0117.190] GetProcessHeap () returned 0x580000 [0117.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6f268 | out: hHeap=0x580000) returned 1 [0117.190] GetProcessHeap () returned 0x580000 [0117.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d778300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x344fd28, dwReserved1=0x6c6f268, cFileName="SL01041_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0104~1.YOU")) returned 0x5b9630 [0118.982] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0119.027] CloseHandle (hObject=0x43c) returned 1 [0119.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO1324~1.YOU")) returned 0x5b9630 [0119.028] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0119.029] GetProcessHeap () returned 0x580000 [0119.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x6c6ec88 [0119.029] GetProcessHeap () returned 0x580000 [0119.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x677cd0 [0119.029] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.029] ReadFile (in: hFile=0x43c, lpBuffer=0x6c6ec88, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6ec88*, lpNumberOfBytesRead=0x344ff14*=0xa80, lpOverlapped=0x0) returned 1 [0119.045] GetProcessHeap () returned 0x580000 [0119.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.045] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.045] WriteFile (in: hFile=0x43c, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x344ff14*=0xa80, lpOverlapped=0x0) returned 1 [0119.046] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.046] WriteFile (in: hFile=0x43c, lpBuffer=0x67874f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x67874f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.046] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.046] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.046] CloseHandle (hObject=0x43c) returned 1 [0119.046] GetProcessHeap () returned 0x580000 [0119.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0119.046] GetProcessHeap () returned 0x580000 [0119.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6ec88 | out: hHeap=0x580000) returned 1 [0119.046] GetProcessHeap () returned 0x580000 [0119.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0119.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e92c6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xab8, dwReserved0=0x344fd28, dwReserved1=0x6c6ec88, cFileName="SO02263_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO1324~1.YOU")) returned 0x5b9630 [0119.107] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.175] CloseHandle (hObject=0x470) returned 1 [0121.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id_1622540890_.your_last_chance")) returned 1 [0121.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x0, dwReserved1=0x0, cFileName="WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WNTER_~1.YOU")) returned 0x5b9730 [0121.703] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.703] GetProcessHeap () returned 0x580000 [0121.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6e063d0 [0121.703] GetProcessHeap () returned 0x580000 [0121.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6dd6d00 [0121.703] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.703] ReadFile (in: hFile=0x470, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x344ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0121.728] GetProcessHeap () returned 0x580000 [0121.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0121.728] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.729] WriteFile (in: hFile=0x470, lpBuffer=0x6dd6d00*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd6d00*, lpNumberOfBytesWritten=0x344ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0121.729] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.729] WriteFile (in: hFile=0x470, lpBuffer=0x6dd87ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd87ff*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.729] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.729] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.729] CloseHandle (hObject=0x470) returned 1 [0121.729] GetProcessHeap () returned 0x580000 [0121.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd6d00 | out: hHeap=0x580000) returned 1 [0121.729] GetProcessHeap () returned 0x580000 [0121.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0121.729] GetProcessHeap () returned 0x580000 [0121.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0122.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802c3320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b27, dwReserved0=0x344fd28, dwReserved1=0x6e063d0, cFileName="WNTER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WNTER_~1.YOU")) returned 0x5b9730 [0122.239] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.252] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", len=0x4d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 1 [0122.252] GetProcessHeap () returned 0x580000 [0122.252] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c0) returned 0x6e00ac0 [0122.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0122.289] CloseHandle (hObject=0x4a4) returned 1 [0122.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id_1622540890_.your_last_chance")) returned 1 [0122.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEE~1.YOU")) returned 0x5b9730 [0122.290] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0122.290] GetProcessHeap () returned 0x580000 [0122.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a01) returned 0x6f976f8 [0122.291] GetProcessHeap () returned 0x580000 [0122.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a01) returned 0x6f9f108 [0122.291] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.291] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x79e0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x344ff14*=0x79e0, lpOverlapped=0x0) returned 1 [0123.105] GetProcessHeap () returned 0x580000 [0123.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0123.105] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.105] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f9f108*, nNumberOfBytesToWrite=0x79e0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f108*, lpNumberOfBytesWritten=0x344ff14*=0x79e0, lpOverlapped=0x0) returned 1 [0123.105] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.105] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fa6ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6ae7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0123.105] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.105] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0123.105] CloseHandle (hObject=0x4a4) returned 1 [0123.106] GetProcessHeap () returned 0x580000 [0123.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9f108 | out: hHeap=0x580000) returned 1 [0123.106] GetProcessHeap () returned 0x580000 [0123.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0123.106] GetProcessHeap () returned 0x580000 [0123.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80fdac20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7a1c, dwReserved0=0x344fd28, dwReserved1=0x6f976f8, cFileName="Verve.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEE~1.YOU")) returned 0x5b9730 [0124.819] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.855] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", len=0x4c | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 1 [0124.855] GetProcessHeap () returned 0x580000 [0124.856] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b8) returned 0x6f42f08 [0124.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.856] CloseHandle (hObject=0x484) returned 1 [0124.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id_1622540890_.your_last_chance")) returned 1 [0124.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKEF~1.YOU")) returned 0x5b9730 [0124.857] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.857] GetProcessHeap () returned 0x580000 [0124.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de0f50 [0124.858] GetProcessHeap () returned 0x580000 [0124.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eef008 [0124.858] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.858] ReadFile (in: hFile=0x484, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.824] GetProcessHeap () returned 0x580000 [0127.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0127.824] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.824] WriteFile (in: hFile=0x484, lpBuffer=0x6eef008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.824] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.824] WriteFile (in: hFile=0x484, lpBuffer=0x6f00807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f00807*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0127.824] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.825] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0127.825] CloseHandle (hObject=0x484) returned 1 [0127.825] GetProcessHeap () returned 0x580000 [0127.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0127.825] GetProcessHeap () returned 0x580000 [0127.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0127.825] GetProcessHeap () returned 0x580000 [0127.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0127.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83cc8b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fba8, dwReserved0=0x344fd28, dwReserved1=0x6de0f50, cFileName="Trek.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKEF~1.YOU")) returned 0x5b9730 [0127.825] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.049] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", len=0x3d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned 1 [0128.049] GetProcessHeap () returned 0x580000 [0128.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b8) returned 0x667250 [0128.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0129.286] CloseHandle (hObject=0x454) returned 1 [0129.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.id_1622540890_.your_last_chance")) returned 1 [0136.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02991~2.YOU")) returned 0x5b96b0 [0136.127] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0136.127] GetProcessHeap () returned 0x580000 [0136.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x6d035f8 [0136.128] GetProcessHeap () returned 0x580000 [0136.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x6f77710 [0136.128] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.128] ReadFile (in: hFile=0x454, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1620, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x344ff14*=0x1620, lpOverlapped=0x0) returned 1 [0136.148] GetProcessHeap () returned 0x580000 [0136.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0136.148] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.148] WriteFile (in: hFile=0x454, lpBuffer=0x6f77710*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f77710*, lpNumberOfBytesWritten=0x344ff14*=0x1620, lpOverlapped=0x0) returned 1 [0136.149] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.149] WriteFile (in: hFile=0x454, lpBuffer=0x6f78d2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f78d2f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0136.149] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.149] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0136.149] CloseHandle (hObject=0x454) returned 1 [0136.149] GetProcessHeap () returned 0x580000 [0136.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f77710 | out: hHeap=0x580000) returned 1 [0136.149] GetProcessHeap () returned 0x580000 [0136.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0136.149] GetProcessHeap () returned 0x580000 [0136.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0136.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88c3a9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1660, dwReserved0=0x344fd28, dwReserved1=0x6d035f8, cFileName="J0299125.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02991~2.YOU")) returned 0x5b96b0 [0136.393] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.410] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF", len=0x49 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF") returned 1 [0136.410] GetProcessHeap () returned 0x580000 [0136.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0136.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0136.411] CloseHandle (hObject=0x3b8) returned 1 [0136.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.id_1622540890_.your_last_chance")) returned 1 [0136.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b96b0 [0136.412] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0136.412] GetProcessHeap () returned 0x580000 [0136.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x6fa8f28 [0136.412] GetProcessHeap () returned 0x580000 [0136.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x6de0f50 [0136.412] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.412] ReadFile (in: hFile=0x3b8, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x344ff14*=0x6140, lpOverlapped=0x0) returned 1 [0137.663] GetProcessHeap () returned 0x580000 [0137.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0137.664] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.664] WriteFile (in: hFile=0x3b8, lpBuffer=0x6de0f50*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesWritten=0x344ff14*=0x6140, lpOverlapped=0x0) returned 1 [0138.512] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.512] WriteFile (in: hFile=0x3b8, lpBuffer=0x6de708f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de708f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.512] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.512] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.512] CloseHandle (hObject=0x3b8) returned 1 [0138.512] GetProcessHeap () returned 0x580000 [0138.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0138.512] GetProcessHeap () returned 0x580000 [0138.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0138.512] GetProcessHeap () returned 0x580000 [0138.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0138.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2b1940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6172, dwReserved0=0x344fd28, dwReserved1=0x6fa8f28, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b96b0 [0138.512] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.666] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x5d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0138.666] GetProcessHeap () returned 0x580000 [0138.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0138.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.667] CloseHandle (hObject=0x3a8) returned 1 [0138.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0138.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0138.686] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.686] GetProcessHeap () returned 0x580000 [0138.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0138.686] GetProcessHeap () returned 0x580000 [0138.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0138.686] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.686] ReadFile (in: hFile=0x3a8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x344ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.688] GetProcessHeap () returned 0x580000 [0138.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0138.688] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.688] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x344ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.688] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.688] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.688] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.688] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.688] CloseHandle (hObject=0x3a8) returned 1 [0138.688] GetProcessHeap () returned 0x580000 [0138.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0138.688] GetProcessHeap () returned 0x580000 [0138.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0138.688] GetProcessHeap () returned 0x580000 [0138.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0139.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a47a9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x344fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0139.882] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.909] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", len=0x53 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css") returned 1 [0139.909] GetProcessHeap () returned 0x580000 [0139.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0139.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.959] CloseHandle (hObject=0x3b4) returned 1 [0139.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.id_1622540890_.your_last_chance")) returned 1 [0139.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b9770 [0139.960] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.960] GetProcessHeap () returned 0x580000 [0139.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb21) returned 0x6e063d0 [0139.961] GetProcessHeap () returned 0x580000 [0139.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb21) returned 0x677cd0 [0139.961] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.961] ReadFile (in: hFile=0x3b4, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xb00, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x344ff14*=0xb00, lpOverlapped=0x0) returned 1 [0139.980] GetProcessHeap () returned 0x580000 [0139.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0139.980] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.980] WriteFile (in: hFile=0x3b4, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x344ff14*=0xb00, lpOverlapped=0x0) returned 1 [0139.980] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.980] WriteFile (in: hFile=0x3b4, lpBuffer=0x6787cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6787cf*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.980] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.980] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.980] CloseHandle (hObject=0x3b4) returned 1 [0139.980] GetProcessHeap () returned 0x580000 [0139.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0139.980] GetProcessHeap () returned 0x580000 [0139.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0139.980] GetProcessHeap () returned 0x580000 [0139.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b0d3be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb32, dwReserved0=0x344fd28, dwReserved1=0x6e063d0, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b9770 [0140.406] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0141.013] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC", len=0x40 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 1 [0141.013] GetProcessHeap () returned 0x580000 [0141.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd4) returned 0x6f14048 [0141.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.262] CloseHandle (hObject=0x478) returned 1 [0144.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0144.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~4.YOU")) returned 0x5b96f0 [0144.263] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.264] GetProcessHeap () returned 0x580000 [0144.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0144.264] GetProcessHeap () returned 0x580000 [0144.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0144.264] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.264] ReadFile (in: hFile=0x478, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x344ff14*=0x260, lpOverlapped=0x0) returned 1 [0144.274] GetProcessHeap () returned 0x580000 [0144.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.274] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.274] WriteFile (in: hFile=0x478, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x344ff14*=0x260, lpOverlapped=0x0) returned 1 [0144.275] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.275] WriteFile (in: hFile=0x478, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.275] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.275] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.275] CloseHandle (hObject=0x478) returned 1 [0144.275] GetProcessHeap () returned 0x580000 [0144.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0144.275] GetProcessHeap () returned 0x580000 [0144.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0144.275] GetProcessHeap () returned 0x580000 [0144.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9bd600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x344fd28, dwReserved1=0x6d08520, cFileName="INFOPATH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~4.YOU")) returned 0x5b9730 [0144.275] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.366] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK", len=0x45 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 1 [0144.378] GetProcessHeap () returned 0x580000 [0144.378] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0144.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.407] CloseHandle (hObject=0x484) returned 1 [0144.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0144.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU9657~1.YOU")) returned 0x5b9730 [0144.412] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.412] GetProcessHeap () returned 0x580000 [0144.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0144.412] GetProcessHeap () returned 0x580000 [0144.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0144.412] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.412] ReadFile (in: hFile=0x484, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x344ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.413] GetProcessHeap () returned 0x580000 [0144.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.413] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.413] WriteFile (in: hFile=0x484, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x344ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.414] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.414] WriteFile (in: hFile=0x484, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.414] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.414] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.414] CloseHandle (hObject=0x484) returned 1 [0144.414] GetProcessHeap () returned 0x580000 [0144.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0144.414] GetProcessHeap () returned 0x580000 [0144.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0144.414] GetProcessHeap () returned 0x580000 [0144.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8db14260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x344fd28, dwReserved1=0x61b540, cFileName="OUTLOOK.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU9657~1.YOU")) returned 0x5b9730 [0144.414] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.465] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL", len=0x45 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 1 [0144.465] GetProcessHeap () returned 0x580000 [0144.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0144.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.465] CloseHandle (hObject=0x484) returned 1 [0144.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0144.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x46f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLLI~1.YOU")) returned 0x5b9730 [0144.467] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.467] GetProcessHeap () returned 0x580000 [0144.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0144.467] GetProcessHeap () returned 0x580000 [0144.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0144.467] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.467] ReadFile (in: hFile=0x484, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.778] GetProcessHeap () returned 0x580000 [0147.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0147.779] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.779] WriteFile (in: hFile=0x484, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.779] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.779] WriteFile (in: hFile=0x484, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0148.624] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.624] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0148.624] CloseHandle (hObject=0x484) returned 1 [0148.624] GetProcessHeap () returned 0x580000 [0148.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0148.624] GetProcessHeap () returned 0x580000 [0148.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0148.624] GetProcessHeap () returned 0x580000 [0148.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0148.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9033f5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46fa4, dwReserved0=0x344fd28, dwReserved1=0x6fd5f98, cFileName="OUTLLIBR.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLLI~1.YOU")) returned 0x5b96f0 [0148.624] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0149.355] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", len=0x43 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned 1 [0149.356] GetProcessHeap () returned 0x580000 [0149.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0149.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.463] CloseHandle (hObject=0x3a8) returned 1 [0150.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x76cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR4F~1.YOU")) returned 0x5b96f0 [0150.464] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.464] GetProcessHeap () returned 0x580000 [0150.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x76e1) returned 0x6fa8f28 [0150.464] GetProcessHeap () returned 0x580000 [0150.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x76e1) returned 0x6dbf1d0 [0150.465] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.465] ReadFile (in: hFile=0x3a8, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x76c0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x344ff14*=0x76c0, lpOverlapped=0x0) returned 1 [0151.722] GetProcessHeap () returned 0x580000 [0151.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0151.722] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.722] WriteFile (in: hFile=0x3a8, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0x76c0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x344ff14*=0x76c0, lpOverlapped=0x0) returned 1 [0151.722] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.722] WriteFile (in: hFile=0x3a8, lpBuffer=0x6dc688f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc688f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.722] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.723] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.723] CloseHandle (hObject=0x3a8) returned 1 [0152.353] GetProcessHeap () returned 0x580000 [0152.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0152.353] GetProcessHeap () returned 0x580000 [0152.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0152.353] GetProcessHeap () returned 0x580000 [0152.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0153.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x920b45e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x76f1, dwReserved0=0x344fd28, dwReserved1=0x6fa8f28, cFileName="PDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR4F~1.YOU")) returned 0x5b9730 [0153.550] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.306] CloseHandle (hObject=0x488) returned 1 [0155.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0155.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414a0a00, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x414a0a00, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x5db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLINTL~1.YOU")) returned 0x5b9730 [0155.307] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.307] GetProcessHeap () returned 0x580000 [0155.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0155.308] GetProcessHeap () returned 0x580000 [0155.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0155.308] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.308] ReadFile (in: hFile=0x488, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.729] GetProcessHeap () returned 0x580000 [0159.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0159.730] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.730] WriteFile (in: hFile=0x488, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.730] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.730] WriteFile (in: hFile=0x488, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0161.243] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.243] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0161.243] CloseHandle (hObject=0x488) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0161.243] GetProcessHeap () returned 0x580000 [0161.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0164.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414a0a00, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x97b9ae00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5dba4, dwReserved0=0x344fd28, dwReserved1=0x636970, cFileName="XLINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLINTL~1.YOU")) returned 0x5b9730 [0164.569] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.549] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", len=0x3d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 1 [0166.549] GetProcessHeap () returned 0x580000 [0166.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x223c) returned 0x6f14048 [0166.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0166.553] CloseHandle (hObject=0x480) returned 1 [0166.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id_1622540890_.your_last_chance")) returned 1 [0166.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCCFG~1.YOU")) returned 0x5b9730 [0166.554] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0166.554] GetProcessHeap () returned 0x580000 [0166.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0166.554] GetProcessHeap () returned 0x580000 [0166.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6df6780 [0166.554] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.554] ReadFile (in: hFile=0x480, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x344ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0166.558] GetProcessHeap () returned 0x580000 [0166.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.558] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.559] WriteFile (in: hFile=0x480, lpBuffer=0x6df6780*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesWritten=0x344ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.559] WriteFile (in: hFile=0x480, lpBuffer=0x6df6a5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a5f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.559] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.559] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.559] CloseHandle (hObject=0x480) returned 1 [0166.559] GetProcessHeap () returned 0x580000 [0166.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0166.559] GetProcessHeap () returned 0x580000 [0166.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0166.559] GetProcessHeap () returned 0x580000 [0166.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ae30180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x344fd28, dwReserved1=0x67c940, cFileName="DOC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCCFG~1.YOU")) returned 0x5b9730 [0166.559] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.562] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", len=0x42 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 1 [0166.562] GetProcessHeap () returned 0x580000 [0166.562] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2230) returned 0x6f14048 [0166.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.563] CloseHandle (hObject=0x41c) returned 1 [0166.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id_1622540890_.your_last_chance")) returned 1 [0166.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLI~1.YOU")) returned 0x5b9730 [0166.564] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.564] GetProcessHeap () returned 0x580000 [0166.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0166.564] GetProcessHeap () returned 0x580000 [0166.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0166.564] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.564] ReadFile (in: hFile=0x41c, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x344ff14*=0x320, lpOverlapped=0x0) returned 1 [0166.568] GetProcessHeap () returned 0x580000 [0166.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.568] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.568] WriteFile (in: hFile=0x41c, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x344ff14*=0x320, lpOverlapped=0x0) returned 1 [0166.568] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.568] WriteFile (in: hFile=0x41c, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.569] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.569] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.569] CloseHandle (hObject=0x41c) returned 1 [0166.569] GetProcessHeap () returned 0x580000 [0166.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0166.569] GetProcessHeap () returned 0x580000 [0166.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0166.569] GetProcessHeap () returned 0x580000 [0166.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ae562e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x344fd28, dwReserved1=0x6c59120, cFileName="DISTLIST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLI~1.YOU")) returned 0x5b9730 [0166.569] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.577] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", len=0x42 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 1 [0166.577] GetProcessHeap () returned 0x580000 [0166.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x222c) returned 0x6f14048 [0166.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0166.578] CloseHandle (hObject=0x464) returned 1 [0166.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.579] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id_1622540890_.your_last_chance")) returned 1 [0166.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b9730 [0166.579] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0166.580] GetProcessHeap () returned 0x580000 [0166.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0166.580] GetProcessHeap () returned 0x580000 [0166.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0166.580] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.580] ReadFile (in: hFile=0x464, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x344ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.591] GetProcessHeap () returned 0x580000 [0166.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.591] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.591] WriteFile (in: hFile=0x464, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x344ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.592] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.592] WriteFile (in: hFile=0x464, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.592] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.592] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.592] CloseHandle (hObject=0x464) returned 1 [0166.592] GetProcessHeap () returned 0x580000 [0166.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0166.592] GetProcessHeap () returned 0x580000 [0166.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0166.592] GetProcessHeap () returned 0x580000 [0166.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ae7c440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x344fd28, dwReserved1=0x660a78, cFileName="CONTACTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b9730 [0166.592] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.594] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", len=0x42 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 1 [0166.595] GetProcessHeap () returned 0x580000 [0166.595] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2228) returned 0x6f14048 [0166.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0169.127] CloseHandle (hObject=0x4ac) returned 1 [0169.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id_1622540890_.your_last_chance")) returned 1 [0169.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~3.YOU")) returned 0x5b96b0 [0169.128] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0169.128] GetProcessHeap () returned 0x580000 [0169.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0169.128] GetProcessHeap () returned 0x580000 [0169.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0169.128] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.128] ReadFile (in: hFile=0x4ac, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x344ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.133] GetProcessHeap () returned 0x580000 [0169.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0169.133] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.133] WriteFile (in: hFile=0x4ac, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x344ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.133] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.134] WriteFile (in: hFile=0x4ac, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.134] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.134] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.134] CloseHandle (hObject=0x4ac) returned 1 [0169.134] GetProcessHeap () returned 0x580000 [0169.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0169.134] GetProcessHeap () returned 0x580000 [0169.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0169.134] GetProcessHeap () returned 0x580000 [0169.134] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0170.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c6bc460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x344fd28, dwReserved1=0x5cf780, cFileName="CONTACTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~3.YOU")) returned 0x5b9770 [0172.810] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0176.753] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", len=0x49 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned 1 [0176.753] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0176.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0177.657] CloseHandle (hObject=0x3fc) returned 1 [0177.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.id_1622540890_.your_last_chance")) returned 1 [0177.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd686, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LASERW~1.YOU")) returned 0x5b96f0 [0177.658] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0177.658] GetProcessHeap () returned 0x580000 [0177.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd6a1) returned 0x636970 [0177.658] GetProcessHeap () returned 0x580000 [0177.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd6a1) returned 0x644020 [0177.658] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.658] ReadFile (in: hFile=0x3fc, lpBuffer=0x636970, nNumberOfBytesToRead=0xd680, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x344ff14*=0xd680, lpOverlapped=0x0) returned 1 [0179.040] GetProcessHeap () returned 0x580000 [0179.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.040] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.040] WriteFile (in: hFile=0x3fc, lpBuffer=0x644020*, nNumberOfBytesToWrite=0xd680, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x644020*, lpNumberOfBytesWritten=0x344ff14*=0xd680, lpOverlapped=0x0) returned 1 [0179.040] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.040] WriteFile (in: hFile=0x3fc, lpBuffer=0x65169f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x65169f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.041] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.041] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.041] CloseHandle (hObject=0x3fc) returned 1 [0179.041] GetProcessHeap () returned 0x580000 [0179.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x644020 | out: hHeap=0x580000) returned 1 [0179.041] GetProcessHeap () returned 0x580000 [0179.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0179.041] GetProcessHeap () returned 0x580000 [0179.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2534d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd6aa, dwReserved0=0x344fd28, dwReserved1=0x636970, cFileName="LASER.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LASERW~1.YOU")) returned 0x5b96b0 [0180.146] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.193] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", len=0x4b | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned 1 [0180.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0180.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0180.194] CloseHandle (hObject=0x428) returned 1 [0180.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x45, dwReserved1=0x0, cFileName="VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~1.YOU")) returned 0x5b9770 [0180.195] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0180.195] GetProcessHeap () returned 0x580000 [0180.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6dcfb90 [0180.196] GetProcessHeap () returned 0x580000 [0180.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6d9cc48 [0180.196] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.196] ReadFile (in: hFile=0x428, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x344ff14*=0x440, lpOverlapped=0x0) returned 1 [0180.312] GetProcessHeap () returned 0x580000 [0180.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.312] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.312] WriteFile (in: hFile=0x428, lpBuffer=0x6d9cc48*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9cc48*, lpNumberOfBytesWritten=0x344ff14*=0x440, lpOverlapped=0x0) returned 1 [0180.312] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.312] WriteFile (in: hFile=0x428, lpBuffer=0x6d9d087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9d087*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.313] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.313] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.313] CloseHandle (hObject=0x428) returned 1 [0180.313] GetProcessHeap () returned 0x580000 [0180.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9cc48 | out: hHeap=0x580000) returned 1 [0180.313] GetProcessHeap () returned 0x580000 [0180.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0180.313] GetProcessHeap () returned 0x580000 [0180.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3167e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x344fd28, dwReserved1=0x6dcfb90, cFileName="VeriSignLogo.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~1.YOU")) returned 0x5b96b0 [0180.313] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.350] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", len=0x66 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned 1 [0181.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0181.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.351] CloseHandle (hObject=0x3fc) returned 1 [0181.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.351] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.id_1622540890_.your_last_chance")) returned 1 [0181.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefeaa500, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~4.YOU")) returned 0x5b9770 [0181.352] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0181.352] GetProcessHeap () returned 0x580000 [0181.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x6d98da8 [0181.352] GetProcessHeap () returned 0x580000 [0181.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x6f62698 [0181.352] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.352] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d98da8, nNumberOfBytesToRead=0x41c0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98da8*, lpNumberOfBytesRead=0x344ff14*=0x41c0, lpOverlapped=0x0) returned 1 [0181.872] GetProcessHeap () returned 0x580000 [0181.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0181.873] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f62698*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62698*, lpNumberOfBytesWritten=0x344ff14*=0x41c0, lpOverlapped=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f66857*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66857*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.873] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.873] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.873] CloseHandle (hObject=0x3fc) returned 1 [0182.448] GetProcessHeap () returned 0x580000 [0182.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f62698 | out: hHeap=0x580000) returned 1 [0182.448] GetProcessHeap () returned 0x580000 [0182.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98da8 | out: hHeap=0x580000) returned 1 [0182.448] GetProcessHeap () returned 0x580000 [0182.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa40487c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4202, dwReserved0=0x344fd28, dwReserved1=0x6d98da8, cFileName="AlertImage_Medium.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~4.YOU")) returned 0x5b9770 [0183.699] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.733] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", len=0x6f | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned 1 [0183.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0183.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.733] CloseHandle (hObject=0x488) returned 1 [0183.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3983, dwReserved0=0x2e0041, dwReserved1=0x50004a, cFileName="TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTAR~1.YOU")) returned 0x5b96b0 [0186.082] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0186.082] GetProcessHeap () returned 0x580000 [0186.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39a1) returned 0x6d10048 [0186.082] GetProcessHeap () returned 0x580000 [0186.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39a1) returned 0x6d139f8 [0186.082] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.082] ReadFile (in: hFile=0x488, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x3980, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x344ff14*=0x3980, lpOverlapped=0x0) returned 1 [0187.468] GetProcessHeap () returned 0x580000 [0187.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce7b0 [0187.468] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.468] WriteFile (in: hFile=0x488, lpBuffer=0x6d139f8*, nNumberOfBytesToWrite=0x3980, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d139f8*, lpNumberOfBytesWritten=0x344ff14*=0x3980, lpOverlapped=0x0) returned 1 [0187.468] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.468] WriteFile (in: hFile=0x488, lpBuffer=0x6d17377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d17377*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.468] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.468] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.468] CloseHandle (hObject=0x488) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d139f8 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce7b0 | out: hHeap=0x580000) returned 1 [0188.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa75b1560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39a7, dwReserved0=0x344fd28, dwReserved1=0x6d10048, cFileName="TEXTAREA.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTAR~1.YOU")) returned 0x5b9770 [0188.059] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.076] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", len=0x45 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned 1 [0188.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2080) returned 0x6f14048 [0188.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0191.916] CloseHandle (hObject=0x46c) returned 1 [0191.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b99, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP9B02~1.YOU")) returned 0x5b97b0 [0194.812] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0194.812] GetProcessHeap () returned 0x580000 [0194.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ba1) returned 0x6dc71d0 [0194.812] GetProcessHeap () returned 0x580000 [0194.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ba1) returned 0x6dc8d80 [0194.812] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.812] ReadFile (in: hFile=0x46c, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x1b80, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x344ff14*=0x1b80, lpOverlapped=0x0) returned 1 [0194.838] GetProcessHeap () returned 0x580000 [0194.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0194.838] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x46c, lpBuffer=0x6dc8d80*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc8d80*, lpNumberOfBytesWritten=0x344ff14*=0x1b80, lpOverlapped=0x0) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x46c, lpBuffer=0x6dca8ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dca8ff*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.838] CloseHandle (hObject=0x46c) returned 1 [0194.838] GetProcessHeap () returned 0x580000 [0194.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc8d80 | out: hHeap=0x580000) returned 1 [0194.838] GetProcessHeap () returned 0x580000 [0194.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0194.838] GetProcessHeap () returned 0x580000 [0194.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0194.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabbe9e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bbd, dwReserved0=0x344fd28, dwReserved1=0x6dc71d0, cFileName="ZPDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP9B02~1.YOU")) returned 0x5b97b0 [0194.839] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.877] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", len=0x70 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0194.877] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0194.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.203] CloseHandle (hObject=0x480) returned 1 [0196.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0196.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x520045, dwReserved1=0x47002e, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0196.422] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.422] GetProcessHeap () returned 0x580000 [0196.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6f3bec0 [0196.422] GetProcessHeap () returned 0x580000 [0196.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6f3bf70 [0196.422] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.422] ReadFile (in: hFile=0x480, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x344ff14*=0x80, lpOverlapped=0x0) returned 1 [0196.423] GetProcessHeap () returned 0x580000 [0196.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.423] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.423] WriteFile (in: hFile=0x480, lpBuffer=0x6f3bf70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bf70*, lpNumberOfBytesWritten=0x344ff14*=0x80, lpOverlapped=0x0) returned 1 [0196.424] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.424] WriteFile (in: hFile=0x480, lpBuffer=0x6f3bfef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bfef*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.424] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.424] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.424] CloseHandle (hObject=0x480) returned 1 [0196.424] GetProcessHeap () returned 0x580000 [0196.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bf70 | out: hHeap=0x580000) returned 1 [0196.424] GetProcessHeap () returned 0x580000 [0196.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0196.424] GetProcessHeap () returned 0x580000 [0196.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacb16aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x344fd28, dwReserved1=0x6f3bec0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0199.655] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.038] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", len=0x73 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned 1 [0201.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0201.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.255] CloseHandle (hObject=0x170) returned 1 [0203.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0203.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x6f0072, dwReserved1=0x6e0075, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97b0 [0203.264] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.265] GetProcessHeap () returned 0x580000 [0203.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0203.265] GetProcessHeap () returned 0x580000 [0203.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0203.265] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.265] ReadFile (in: hFile=0x170, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x344ff14*=0x320, lpOverlapped=0x0) returned 1 [0203.269] GetProcessHeap () returned 0x580000 [0203.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.269] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.269] WriteFile (in: hFile=0x170, lpBuffer=0x6d07028*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesWritten=0x344ff14*=0x320, lpOverlapped=0x0) returned 1 [0203.269] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.269] WriteFile (in: hFile=0x170, lpBuffer=0x6d07347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07347*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.270] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.270] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.270] CloseHandle (hObject=0x170) returned 1 [0203.270] GetProcessHeap () returned 0x580000 [0203.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0203.270] GetProcessHeap () returned 0x580000 [0203.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0203.270] GetProcessHeap () returned 0x580000 [0203.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0203.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c66640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x344fd28, dwReserved1=0x6d06cc0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97b0 [0203.270] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.284] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", len=0x5f | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned 1 [0203.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0203.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0203.714] CloseHandle (hObject=0x448) returned 1 [0203.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.id_1622540890_.your_last_chance")) returned 1 [0203.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b97b0 [0203.719] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0203.737] GetProcessHeap () returned 0x580000 [0203.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6599e8 [0203.737] GetProcessHeap () returned 0x580000 [0203.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x659db0 [0203.737] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.737] ReadFile (in: hFile=0x390, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x344ff14*=0x380, lpOverlapped=0x0) returned 1 [0203.741] GetProcessHeap () returned 0x580000 [0203.741] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.742] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.742] WriteFile (in: hFile=0x390, lpBuffer=0x659db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x659db0*, lpNumberOfBytesWritten=0x344ff14*=0x380, lpOverlapped=0x0) returned 1 [0203.742] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.742] WriteFile (in: hFile=0x390, lpBuffer=0x65a12f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a12f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.742] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.742] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.742] CloseHandle (hObject=0x390) returned 1 [0206.545] GetProcessHeap () returned 0x580000 [0206.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659db0 | out: hHeap=0x580000) returned 1 [0206.545] GetProcessHeap () returned 0x580000 [0206.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0206.545] GetProcessHeap () returned 0x580000 [0206.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0209.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb10dcf80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x344fd28, dwReserved1=0x6599e8, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b97f0 [0209.744] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.792] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", len=0x64 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned 1 [0209.792] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0209.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.792] CloseHandle (hObject=0x458) returned 1 [0209.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.id_1622540890_.your_last_chance")) returned 1 [0209.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b97f0 [0209.793] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.793] GetProcessHeap () returned 0x580000 [0209.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6e063d0 [0209.794] GetProcessHeap () returned 0x580000 [0209.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6e0a060 [0209.794] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.794] ReadFile (in: hFile=0x458, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x344ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0209.973] GetProcessHeap () returned 0x580000 [0209.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.973] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.973] WriteFile (in: hFile=0x458, lpBuffer=0x6e0a060*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0a060*, lpNumberOfBytesWritten=0x344ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0209.974] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.974] WriteFile (in: hFile=0x458, lpBuffer=0x6e0dcbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0dcbf*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.974] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.974] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.974] CloseHandle (hObject=0x458) returned 1 [0209.974] GetProcessHeap () returned 0x580000 [0209.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0a060 | out: hHeap=0x580000) returned 1 [0209.974] GetProcessHeap () returned 0x580000 [0209.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0209.974] GetProcessHeap () returned 0x580000 [0209.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0210.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c39420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c88, dwReserved0=0x344fd28, dwReserved1=0x6e063d0, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b97b0 [0213.898] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.699] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", len=0x61 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned 1 [0217.699] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0217.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.046] CloseHandle (hObject=0x3e4) returned 1 [0221.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.046] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.id_1622540890_.your_last_chance")) returned 1 [0221.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b97f0 [0221.047] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.047] GetProcessHeap () returned 0x580000 [0221.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.047] GetProcessHeap () returned 0x580000 [0221.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.047] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.047] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x344ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.051] GetProcessHeap () returned 0x580000 [0221.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.051] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.051] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x344ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.052] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.052] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.052] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.052] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.052] CloseHandle (hObject=0x3e4) returned 1 [0221.052] GetProcessHeap () returned 0x580000 [0221.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.052] GetProcessHeap () returned 0x580000 [0221.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.052] GetProcessHeap () returned 0x580000 [0221.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0222.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb5da460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x344fd28, dwReserved1=0x6dcfb90, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b96f0 [0222.656] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.665] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", len=0x8d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned 1 [0222.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0222.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.666] CloseHandle (hObject=0x49c) returned 1 [0222.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.id_1622540890_.your_last_chance")) returned 1 [0222.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIERAR~2.YOU")) returned 0x5b96f0 [0222.667] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.668] GetProcessHeap () returned 0x580000 [0222.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x6f468f0 [0222.668] GetProcessHeap () returned 0x580000 [0222.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x6f47ff8 [0222.668] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.668] ReadFile (in: hFile=0x49c, lpBuffer=0x6f468f0, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468f0*, lpNumberOfBytesRead=0x344ff14*=0x16c0, lpOverlapped=0x0) returned 1 [0222.719] GetProcessHeap () returned 0x580000 [0222.719] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.719] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.719] WriteFile (in: hFile=0x49c, lpBuffer=0x6f47ff8*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f47ff8*, lpNumberOfBytesWritten=0x344ff14*=0x16c0, lpOverlapped=0x0) returned 1 [0222.720] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.720] WriteFile (in: hFile=0x49c, lpBuffer=0x6f496b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f496b7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.720] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.720] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.720] CloseHandle (hObject=0x49c) returned 1 [0222.720] GetProcessHeap () returned 0x580000 [0222.720] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f47ff8 | out: hHeap=0x580000) returned 1 [0222.720] GetProcessHeap () returned 0x580000 [0222.720] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468f0 | out: hHeap=0x580000) returned 1 [0222.720] GetProcessHeap () returned 0x580000 [0222.720] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0222.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc5c5780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16e9, dwReserved0=0x344fd28, dwReserved1=0x6f468f0, cFileName="Hierarchy.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIERAR~2.YOU")) returned 0x5b96f0 [0222.720] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.762] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", len=0x6a | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned 1 [0222.762] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0222.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0222.763] CloseHandle (hObject=0x460) returned 1 [0222.763] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0222.764] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26ba, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEETIN~2.YOU")) returned 0x5b96f0 [0222.764] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0222.764] GetProcessHeap () returned 0x580000 [0222.764] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26c1) returned 0x6f976f8 [0222.765] GetProcessHeap () returned 0x580000 [0222.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26c1) returned 0x7111f48 [0222.765] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.765] ReadFile (in: hFile=0x460, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x26a0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x344ff14*=0x26a0, lpOverlapped=0x0) returned 1 [0222.967] GetProcessHeap () returned 0x580000 [0222.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.967] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.967] WriteFile (in: hFile=0x460, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x26a0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x344ff14*=0x26a0, lpOverlapped=0x0) returned 1 [0222.967] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.967] WriteFile (in: hFile=0x460, lpBuffer=0x71145e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x71145e7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.967] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.967] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.968] CloseHandle (hObject=0x460) returned 1 [0223.112] GetProcessHeap () returned 0x580000 [0223.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0223.112] GetProcessHeap () returned 0x580000 [0223.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0223.112] GetProcessHeap () returned 0x580000 [0223.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc826d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26de, dwReserved0=0x344fd28, dwReserved1=0x6f976f8, cFileName="MeetingIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEETIN~2.YOU")) returned 0x5b9630 [0225.837] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.875] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", len=0x67 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned 1 [0225.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0225.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.876] CloseHandle (hObject=0x44c) returned 1 [0225.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.id_1622540890_.your_last_chance")) returned 1 [0225.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b9630 [0225.878] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.878] GetProcessHeap () returned 0x580000 [0225.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd9e78 [0225.878] GetProcessHeap () returned 0x580000 [0225.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dda600 [0225.878] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.878] ReadFile (in: hFile=0x44c, lpBuffer=0x6dd9e78, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e78*, lpNumberOfBytesRead=0x344ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.910] GetProcessHeap () returned 0x580000 [0225.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.910] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.910] WriteFile (in: hFile=0x44c, lpBuffer=0x6dda600*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dda600*, lpNumberOfBytesWritten=0x344ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.910] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.910] WriteFile (in: hFile=0x44c, lpBuffer=0x6ddad1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ddad1f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.910] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.910] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.910] CloseHandle (hObject=0x44c) returned 1 [0225.910] GetProcessHeap () returned 0x580000 [0225.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dda600 | out: hHeap=0x580000) returned 1 [0225.910] GetProcessHeap () returned 0x580000 [0225.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd9e78 | out: hHeap=0x580000) returned 1 [0225.911] GetProcessHeap () returned 0x580000 [0225.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe2c83a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x344fd28, dwReserved1=0x6dd9e78, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b9630 [0225.911] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.970] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT", len=0x41 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 1 [0225.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0225.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.007] CloseHandle (hObject=0x448) returned 1 [0226.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0226.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~4.YOU")) returned 0x5b9630 [0226.008] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.008] GetProcessHeap () returned 0x580000 [0226.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0226.008] GetProcessHeap () returned 0x580000 [0226.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0226.008] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.008] ReadFile (in: hFile=0x448, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x344ff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.010] GetProcessHeap () returned 0x580000 [0226.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.010] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x448, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x344ff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.010] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x448, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.010] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.010] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.010] CloseHandle (hObject=0x448) returned 1 [0226.010] GetProcessHeap () returned 0x580000 [0226.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0226.010] GetProcessHeap () returned 0x580000 [0226.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0226.010] GetProcessHeap () returned 0x580000 [0226.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe3acbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x344fd28, dwReserved1=0x5ae2f0, cFileName="MSPUB.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~4.YOU")) returned 0x5b9630 [0226.011] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.017] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS", len=0x3c | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 1 [0226.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dbc) returned 0x6dee6e0 [0226.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.024] CloseHandle (hObject=0x448) returned 1 [0226.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.024] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id_1622540890_.your_last_chance")) returned 1 [0226.025] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN4C76~1.YOU")) returned 0x5b9630 [0226.025] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.025] GetProcessHeap () returned 0x580000 [0226.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8a640 [0226.026] GetProcessHeap () returned 0x580000 [0226.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e9be70 [0226.026] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.027] ReadFile (in: hFile=0x448, lpBuffer=0x6e8a640, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a640*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.648] GetProcessHeap () returned 0x580000 [0235.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0235.649] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.649] WriteFile (in: hFile=0x448, lpBuffer=0x6e9be70*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be70*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.649] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.650] WriteFile (in: hFile=0x448, lpBuffer=0x6ead66f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead66f*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.152] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.152] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.152] CloseHandle (hObject=0x448) returned 1 [0239.152] GetProcessHeap () returned 0x580000 [0239.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9be70 | out: hHeap=0x580000) returned 1 [0239.152] GetProcessHeap () returned 0x580000 [0239.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8a640 | out: hHeap=0x580000) returned 1 [0239.155] GetProcessHeap () returned 0x580000 [0239.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0240.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6117300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x174d2a, dwReserved0=0x344fd28, dwReserved1=0x580000, cFileName="INFOPATH.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN4C76~1.YOU")) returned 0x5b9730 [0240.570] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.442] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML", len=0x36 | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned 1 [0241.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0241.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0241.570] CloseHandle (hObject=0x47c) returned 1 [0241.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.id_1622540890_.your_last_chance")) returned 1 [0241.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTIRM~1.YOU")) returned 0x5b9630 [0241.571] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pptirmv.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0241.571] GetProcessHeap () returned 0x580000 [0241.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x709cfd8 [0241.571] GetProcessHeap () returned 0x580000 [0241.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70ae808 [0241.571] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.571] ReadFile (in: hFile=0x47c, lpBuffer=0x709cfd8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x709cfd8*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.534] GetProcessHeap () returned 0x580000 [0244.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0244.534] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.534] WriteFile (in: hFile=0x47c, lpBuffer=0x70ae808*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x70ae808*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.534] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.535] WriteFile (in: hFile=0x47c, lpBuffer=0x70c0007*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0007*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.535] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.535] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.535] CloseHandle (hObject=0x47c) returned 1 [0244.535] GetProcessHeap () returned 0x580000 [0244.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70ae808 | out: hHeap=0x580000) returned 1 [0244.542] GetProcessHeap () returned 0x580000 [0244.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709cfd8 | out: hHeap=0x580000) returned 1 [0244.543] GetProcessHeap () returned 0x580000 [0244.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0249.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc946ad60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x135d8, dwReserved0=0x344fd28, dwReserved1=0x709cfd8, cFileName="PPTIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTIRM~1.YOU")) returned 0x5b9730 [0249.273] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.367] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC", len=0x3d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 1 [0249.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0249.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0249.368] CloseHandle (hObject=0x480) returned 1 [0249.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.id_1622540890_.your_last_chance")) returned 1 [0249.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde565e00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde565e00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3caa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCRD9~1.YOU")) returned 0x5b9730 [0249.369] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0249.369] GetProcessHeap () returned 0x580000 [0249.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0249.369] GetProcessHeap () returned 0x580000 [0249.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e37d00 [0249.370] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.370] ReadFile (in: hFile=0x480, lpBuffer=0x703b9b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesRead=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.807] GetProcessHeap () returned 0x580000 [0252.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0252.807] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.807] WriteFile (in: hFile=0x480, lpBuffer=0x6e37d00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e37d00*, lpNumberOfBytesWritten=0x344ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.808] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.808] WriteFile (in: hFile=0x480, lpBuffer=0x6e494ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e494ff*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.808] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.808] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.808] CloseHandle (hObject=0x480) returned 1 [0252.911] GetProcessHeap () returned 0x580000 [0252.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e37d00 | out: hHeap=0x580000) returned 1 [0252.912] GetProcessHeap () returned 0x580000 [0252.912] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0252.916] GetProcessHeap () returned 0x580000 [0252.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fccc | out: lpFindFileData=0x344fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde565e00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce344620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3cac6, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="BZCRD98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCRD9~1.YOU")) returned 0x5b9730 [0254.425] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.363] SysReAllocStringLen (in: pbstr=0x344ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV", len=0x3d | out: pbstr=0x344ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 1 [0255.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f58) returned 0x72e5948 [0255.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.601] CloseHandle (hObject=0x488) returned 1 [0258.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x344ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x344fc74 | out: lpFindFileData=0x344fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e97a00, ftCreationTime.dwHighDateTime=0x1c7e417, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36e97a00, ftLastWriteTime.dwHighDateTime=0x1c7e417, nFileSizeHigh=0x0, nFileSizeLow=0x938f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPQUO~1.YOU")) returned 0x5b96f0 [0258.602] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.602] GetProcessHeap () returned 0x580000 [0258.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x93a1) returned 0x6fb2e00 [0258.603] GetProcessHeap () returned 0x580000 [0258.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x93a1) returned 0x7061928 [0258.603] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.603] ReadFile (in: hFile=0x488, lpBuffer=0x6fb2e00, nNumberOfBytesToRead=0x9380, lpNumberOfBytesRead=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2e00*, lpNumberOfBytesRead=0x344ff14*=0x9380, lpOverlapped=0x0) returned 1 [0264.035] GetProcessHeap () returned 0x580000 [0264.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0264.036] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.036] WriteFile (in: hFile=0x488, lpBuffer=0x7061928*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesWritten=0x344ff14*=0x9380, lpOverlapped=0x0) returned 1 [0264.036] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.036] WriteFile (in: hFile=0x488, lpBuffer=0x706aca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x706aca7*, lpNumberOfBytesWritten=0x344ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.036] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.036] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x344ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x344ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.036] CloseHandle (hObject=0x488) returned 1 [0265.883] GetProcessHeap () returned 0x580000 [0265.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0265.884] GetProcessHeap () returned 0x580000 [0265.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2e00 | out: hHeap=0x580000) returned 1 [0265.884] GetProcessHeap () returned 0x580000 [0265.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 Thread: id = 19 os_tid = 0xa44 [0039.061] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.127] Sleep (dwMilliseconds=0x1) [0039.204] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.676] Sleep (dwMilliseconds=0x1) [0039.723] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.753] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.920] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.058] Sleep (dwMilliseconds=0x1) [0040.294] Sleep (dwMilliseconds=0x1) [0040.352] Sleep (dwMilliseconds=0x1) [0040.376] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.164] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.354] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.633] Sleep (dwMilliseconds=0x1) [0042.650] Sleep (dwMilliseconds=0x1) [0042.661] Sleep (dwMilliseconds=0x1) [0042.701] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.827] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.913] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.193] Sleep (dwMilliseconds=0x1) [0043.200] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.340] Sleep (dwMilliseconds=0x1) [0043.356] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.402] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.480] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.016] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.041] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.390] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.649] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.805] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.883] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.008] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.039] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.164] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.476] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.866] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.944] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.991] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.022] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.568] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.809] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", len=0x4e | out: pbstr=0x358ff84*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 1 [0059.809] GetProcessHeap () returned 0x580000 [0059.809] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x615348 [0059.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.823] CloseHandle (hObject=0x448) returned 1 [0059.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.823] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id_1622540890_.your_last_chance")) returned 1 [0059.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.824] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x1, dwReserved1=0x450043, cFileName="InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~2.YOU")) returned 0x5b96b0 [0059.824] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.824] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.824] GetProcessHeap () returned 0x580000 [0059.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6d33678 [0059.824] GetProcessHeap () returned 0x580000 [0059.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6d33b68 [0059.824] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.824] ReadFile (in: hFile=0x448, lpBuffer=0x6d33678, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesRead=0x358ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0059.830] GetProcessHeap () returned 0x580000 [0059.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0059.830] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.831] WriteFile (in: hFile=0x448, lpBuffer=0x6d33b68*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33b68*, lpNumberOfBytesWritten=0x358ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0059.831] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.831] WriteFile (in: hFile=0x448, lpBuffer=0x6d34027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d34027*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.837] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.837] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.837] CloseHandle (hObject=0x448) returned 1 [0059.838] GetProcessHeap () returned 0x580000 [0059.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33b68 | out: hHeap=0x580000) returned 1 [0059.838] GetProcessHeap () returned 0x580000 [0059.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0059.838] GetProcessHeap () returned 0x580000 [0059.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0059.838] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b767ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x358fd28, dwReserved1=0x6d33678, cFileName="InfoPathMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~2.YOU")) returned 0x5b96b0 [0059.838] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.851] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", len=0x4b | out: pbstr=0x358ff84*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 1 [0059.851] GetProcessHeap () returned 0x580000 [0059.851] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0059.851] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.851] CloseHandle (hObject=0x448) returned 1 [0059.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id_1622540890_.your_last_chance")) returned 1 [0059.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.852] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x45, dwReserved1=0x0, cFileName="OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96b0 [0059.852] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0059.852] GetProcessHeap () returned 0x580000 [0059.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dfaac0 [0059.853] GetProcessHeap () returned 0x580000 [0059.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0c2f0 [0059.854] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.854] ReadFile (in: hFile=0x448, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0065.643] GetProcessHeap () returned 0x580000 [0065.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0065.644] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.644] WriteFile (in: hFile=0x448, lpBuffer=0x6e0c2f0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c2f0*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.354] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.354] WriteFile (in: hFile=0x448, lpBuffer=0x6e1daef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1daef*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.867] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.868] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.868] CloseHandle (hObject=0x448) returned 1 [0068.109] GetProcessHeap () returned 0x580000 [0068.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c2f0 | out: hHeap=0x580000) returned 1 [0068.109] GetProcessHeap () returned 0x580000 [0068.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0068.109] GetProcessHeap () returned 0x580000 [0068.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0068.846] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x6055cf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2cb15f, dwReserved0=0x358fd28, dwReserved1=0x6dfaac0, cFileName="OWOW32LR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96f0 [0068.847] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.899] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", len=0x3e | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 1 [0068.899] GetProcessHeap () returned 0x580000 [0068.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a8a0 [0068.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.938] Sleep (dwMilliseconds=0x1) [0068.955] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", len=0x42 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 1 [0068.956] GetProcessHeap () returned 0x580000 [0068.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x58) returned 0x5a4778 [0068.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.957] Sleep (dwMilliseconds=0x1) [0068.969] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", len=0x53 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 1 [0068.969] GetProcessHeap () returned 0x580000 [0068.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x68) returned 0x5f7468 [0068.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.970] Sleep (dwMilliseconds=0x1) [0068.984] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", len=0x4e | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 1 [0068.984] GetProcessHeap () returned 0x580000 [0068.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x60) returned 0x5f7468 [0068.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.985] Sleep (dwMilliseconds=0x1) [0069.000] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", len=0x53 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 1 [0069.000] GetProcessHeap () returned 0x580000 [0069.000] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x58) returned 0x5f7468 [0069.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.000] Sleep (dwMilliseconds=0x1) [0069.015] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", len=0x41 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 1 [0069.015] GetProcessHeap () returned 0x580000 [0069.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x54) returned 0x5f7468 [0069.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.015] Sleep (dwMilliseconds=0x1) [0069.031] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", len=0x44 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 1 [0069.031] GetProcessHeap () returned 0x580000 [0069.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x4c) returned 0x5f7468 [0069.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0070.045] Sleep (dwMilliseconds=0x1) [0072.141] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", len=0x55 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 1 [0072.142] GetProcessHeap () returned 0x580000 [0072.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x74) returned 0x5b5d08 [0072.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.001] Sleep (dwMilliseconds=0x1) [0073.073] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", len=0x49 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 1 [0073.073] GetProcessHeap () returned 0x580000 [0073.073] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x40) returned 0x5b5d08 [0073.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.073] Sleep (dwMilliseconds=0x1) [0073.087] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", len=0x3d | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 1 [0073.087] GetProcessHeap () returned 0x580000 [0073.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x24) returned 0x5b5d08 [0073.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.682] CloseHandle (hObject=0x464) returned 1 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id_1622540890_.your_last_chance")) returned 1 [0074.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSEPSI~1.YOU")) returned 0x5b9730 [0074.683] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.683] GetProcessHeap () returned 0x580000 [0074.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3ae1) returned 0x6f094f0 [0074.683] GetProcessHeap () returned 0x580000 [0074.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3ae1) returned 0x6599d0 [0074.683] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.683] ReadFile (in: hFile=0x464, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x3ac0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x358ff14*=0x3ac0, lpOverlapped=0x0) returned 1 [0075.267] GetProcessHeap () returned 0x580000 [0075.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0075.267] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.267] WriteFile (in: hFile=0x464, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x3ac0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x358ff14*=0x3ac0, lpOverlapped=0x0) returned 1 [0075.268] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.268] WriteFile (in: hFile=0x464, lpBuffer=0x65d48f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x65d48f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.268] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.268] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.268] CloseHandle (hObject=0x464) returned 1 [0075.880] GetProcessHeap () returned 0x580000 [0075.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0075.880] GetProcessHeap () returned 0x580000 [0075.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0075.880] GetProcessHeap () returned 0x580000 [0075.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0079.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x64791300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3aff, dwReserved0=0x358fd28, dwReserved1=0x6f094f0, cFileName="MS.EPS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSEPSI~1.YOU")) returned 0x5b96f0 [0079.341] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.533] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 1 [0079.533] GetProcessHeap () returned 0x580000 [0079.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0079.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.553] CloseHandle (hObject=0x478) returned 1 [0079.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0079.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0079.559] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.559] GetProcessHeap () returned 0x580000 [0079.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f094f0 [0079.559] GetProcessHeap () returned 0x580000 [0079.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f0c4f8 [0079.559] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.559] ReadFile (in: hFile=0x478, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x358ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0079.572] GetProcessHeap () returned 0x580000 [0079.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.573] WriteFile (in: hFile=0x478, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x358ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0079.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.573] WriteFile (in: hFile=0x478, lpBuffer=0x6f0ca97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca97*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.573] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.573] CloseHandle (hObject=0x478) returned 1 [0079.573] GetProcessHeap () returned 0x580000 [0079.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0079.573] GetProcessHeap () returned 0x580000 [0079.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0079.573] GetProcessHeap () returned 0x580000 [0079.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x670a0e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x358fd28, dwReserved1=0x6f094f0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0079.574] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.967] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", len=0x43 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 1 [0085.967] GetProcessHeap () returned 0x580000 [0085.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x80) returned 0x614a48 [0085.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.968] Sleep (dwMilliseconds=0x1) [0085.983] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", len=0x4b | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 1 [0085.983] GetProcessHeap () returned 0x580000 [0085.983] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x10) returned 0x614a48 [0085.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.992] Sleep (dwMilliseconds=0x1) [0086.909] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", len=0x4c | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 1 [0086.914] GetProcessHeap () returned 0x580000 [0086.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.940] CloseHandle (hObject=0x448) returned 1 [0086.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0086.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.941] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.941] GetProcessHeap () returned 0x580000 [0086.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6c79768 [0086.941] GetProcessHeap () returned 0x580000 [0086.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x67ec60 [0086.941] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.941] ReadFile (in: hFile=0x448, lpBuffer=0x6c79768, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79768*, lpNumberOfBytesRead=0x358ff14*=0x780, lpOverlapped=0x0) returned 1 [0086.951] GetProcessHeap () returned 0x580000 [0086.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0086.951] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] WriteFile (in: hFile=0x448, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x358ff14*=0x780, lpOverlapped=0x0) returned 1 [0086.951] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] WriteFile (in: hFile=0x448, lpBuffer=0x67f3df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f3df*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.951] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.951] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.951] CloseHandle (hObject=0x448) returned 1 [0086.953] GetProcessHeap () returned 0x580000 [0086.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0086.953] GetProcessHeap () returned 0x580000 [0086.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79768 | out: hHeap=0x580000) returned 1 [0086.953] GetProcessHeap () returned 0x580000 [0086.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0086.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b6ff8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7a9, dwReserved0=0x358fd28, dwReserved1=0x6c79768, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.958] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.224] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", len=0x4d | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 1 [0088.224] GetProcessHeap () returned 0x580000 [0088.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x2c) returned 0x61f6c0 [0088.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0089.017] CloseHandle (hObject=0x440) returned 1 [0089.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0089.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id_1622540890_.your_last_chance")) returned 1 [0089.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAPSUL~2.YOU")) returned 0x5b96b0 [0089.062] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0089.062] GetProcessHeap () returned 0x580000 [0089.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f0440 [0089.062] GetProcessHeap () returned 0x580000 [0089.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f1130 [0089.063] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.063] ReadFile (in: hFile=0x440, lpBuffer=0x5f0440, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f0440*, lpNumberOfBytesRead=0x358ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0089.065] GetProcessHeap () returned 0x580000 [0089.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0089.065] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.065] WriteFile (in: hFile=0x440, lpBuffer=0x5f1130*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f1130*, lpNumberOfBytesWritten=0x358ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0089.065] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.065] WriteFile (in: hFile=0x440, lpBuffer=0x5f130f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f130f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0089.071] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.071] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0089.072] CloseHandle (hObject=0x440) returned 1 [0089.072] GetProcessHeap () returned 0x580000 [0089.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f1130 | out: hHeap=0x580000) returned 1 [0089.072] GetProcessHeap () returned 0x580000 [0089.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f0440 | out: hHeap=0x580000) returned 1 [0089.072] GetProcessHeap () returned 0x580000 [0089.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0089.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cb3b3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x219, dwReserved0=0x358fd28, dwReserved1=0x5f0440, cFileName="CAPSULES.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAPSUL~2.YOU")) returned 0x5b96b0 [0089.072] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 1 [0092.137] GetProcessHeap () returned 0x580000 [0092.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61d550, Size=0x88) returned 0x61b540 [0092.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0097.173] CloseHandle (hObject=0x460) returned 1 [0097.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0097.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0099.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0099.474] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0099.474] GetProcessHeap () returned 0x580000 [0099.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5501) returned 0x6c5e398 [0099.474] GetProcessHeap () returned 0x580000 [0099.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5501) returned 0x6d458e0 [0099.475] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.475] ReadFile (in: hFile=0x448, lpBuffer=0x6c5e398, nNumberOfBytesToRead=0x54e0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5e398*, lpNumberOfBytesRead=0x358ff14*=0x54e0, lpOverlapped=0x0) returned 1 [0100.120] GetProcessHeap () returned 0x580000 [0100.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0100.120] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.120] WriteFile (in: hFile=0x448, lpBuffer=0x6d458e0*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesWritten=0x358ff14*=0x54e0, lpOverlapped=0x0) returned 1 [0100.120] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.121] WriteFile (in: hFile=0x448, lpBuffer=0x6d4adbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4adbf*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.121] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.121] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.121] CloseHandle (hObject=0x448) returned 1 [0100.121] GetProcessHeap () returned 0x580000 [0100.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0100.536] GetProcessHeap () returned 0x580000 [0100.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5e398 | out: hHeap=0x580000) returned 1 [0100.538] GetProcessHeap () returned 0x580000 [0100.538] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73490160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5515, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.840] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.165] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", len=0x49 | out: pbstr=0x358ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 1 [0106.166] GetProcessHeap () returned 0x580000 [0106.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0106.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0107.251] CloseHandle (hObject=0x498) returned 1 [0107.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id_1622540890_.your_last_chance")) returned 1 [0107.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBENDF~1.YOU")) returned 0x5b9630 [0107.252] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0107.252] GetProcessHeap () returned 0x580000 [0107.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c21878 [0107.252] GetProcessHeap () returned 0x580000 [0107.252] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c330a8 [0107.252] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.252] ReadFile (in: hFile=0x498, lpBuffer=0x6c21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21878*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.293] GetProcessHeap () returned 0x580000 [0111.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0111.293] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.293] WriteFile (in: hFile=0x498, lpBuffer=0x6c330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c330a8*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.293] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.293] WriteFile (in: hFile=0x498, lpBuffer=0x6c448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448a7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.294] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.294] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.294] CloseHandle (hObject=0x498) returned 1 [0111.294] GetProcessHeap () returned 0x580000 [0111.294] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c330a8 | out: hHeap=0x580000) returned 1 [0111.299] GetProcessHeap () returned 0x580000 [0111.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21878 | out: hHeap=0x580000) returned 1 [0111.299] GetProcessHeap () returned 0x580000 [0111.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0111.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79f3bb40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11983, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="VBENDF98.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBENDF~1.YOU")) returned 0x5b96f0 [0111.300] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.977] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", len=0x4b | out: pbstr=0x358ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 1 [0111.977] GetProcessHeap () returned 0x580000 [0111.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61abb8 [0111.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.038] Sleep (dwMilliseconds=0x1) [0112.132] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", len=0x48 | out: pbstr=0x358ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 1 [0112.132] GetProcessHeap () returned 0x580000 [0112.132] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.139] Sleep (dwMilliseconds=0x1) [0112.221] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", len=0x51 | out: pbstr=0x358ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.221] GetProcessHeap () returned 0x580000 [0112.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.221] Sleep (dwMilliseconds=0x1) [0112.240] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", len=0x49 | out: pbstr=0x358ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 1 [0112.240] GetProcessHeap () returned 0x580000 [0112.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x2c) returned 0x61f848 [0112.240] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.248] Sleep (dwMilliseconds=0x1) [0112.363] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", len=0x3f | out: pbstr=0x358ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png") returned 1 [0112.364] GetProcessHeap () returned 0x580000 [0112.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f8b8 [0112.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.386] Sleep (dwMilliseconds=0x1) [0112.656] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", len=0x53 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 1 [0112.656] GetProcessHeap () returned 0x580000 [0112.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92d0 | out: hHeap=0x580000) returned 1 [0112.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0112.680] CloseHandle (hObject=0x3fc) returned 1 [0112.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id_1622540890_.your_last_chance")) returned 1 [0112.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSMDSR~1.YOU")) returned 0x5b96f0 [0112.977] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0112.978] GetProcessHeap () returned 0x580000 [0112.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f1bea8 [0112.978] GetProcessHeap () returned 0x580000 [0112.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f2d6d8 [0112.979] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.979] ReadFile (in: hFile=0x3fc, lpBuffer=0x6f1bea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0113.251] GetProcessHeap () returned 0x580000 [0113.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.251] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.252] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f2d6d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2d6d8*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0113.252] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.252] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f3eed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3eed7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.600] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.600] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.600] CloseHandle (hObject=0x3fc) returned 1 [0113.600] GetProcessHeap () returned 0x580000 [0113.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2d6d8 | out: hHeap=0x580000) returned 1 [0113.600] GetProcessHeap () returned 0x580000 [0113.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0113.600] GetProcessHeap () returned 0x580000 [0113.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b5406c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa2b7c, dwReserved0=0x358fd28, dwReserved1=0x6f1bea8, cFileName="msmdsrv.rll.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSMDSR~1.YOU")) returned 0x5b9630 [0113.835] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0113.939] CloseHandle (hObject=0x440) returned 1 [0113.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0038~1.YOU")) returned 0x5b9630 [0114.147] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0114.210] GetProcessHeap () returned 0x580000 [0114.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6cfec68 [0114.210] GetProcessHeap () returned 0x580000 [0114.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6c75898 [0114.210] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.210] ReadFile (in: hFile=0x440, lpBuffer=0x6cfec68, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfec68*, lpNumberOfBytesRead=0x358ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0115.473] GetProcessHeap () returned 0x580000 [0115.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.473] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.473] WriteFile (in: hFile=0x440, lpBuffer=0x6c75898*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75898*, lpNumberOfBytesWritten=0x358ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0115.473] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.473] WriteFile (in: hFile=0x440, lpBuffer=0x6c77977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c77977*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.473] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.474] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.474] CloseHandle (hObject=0x440) returned 1 [0115.474] GetProcessHeap () returned 0x580000 [0115.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75898 | out: hHeap=0x580000) returned 1 [0115.474] GetProcessHeap () returned 0x580000 [0115.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfec68 | out: hHeap=0x580000) returned 1 [0115.474] GetProcessHeap () returned 0x580000 [0115.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c71abc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x358fd28, dwReserved1=0x6cfec68, cFileName="FD00382_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0038~1.YOU")) returned 0x5b9630 [0117.325] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.348] CloseHandle (hObject=0x49c) returned 1 [0117.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0012~1.YOU")) returned 0x5b9630 [0117.349] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.349] GetProcessHeap () returned 0x580000 [0117.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6e00ac0 [0117.349] GetProcessHeap () returned 0x580000 [0117.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6f42f08 [0117.350] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.350] ReadFile (in: hFile=0x49c, lpBuffer=0x6e00ac0, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesRead=0x358ff14*=0x1840, lpOverlapped=0x0) returned 1 [0117.371] GetProcessHeap () returned 0x580000 [0117.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.371] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.371] WriteFile (in: hFile=0x49c, lpBuffer=0x6f42f08*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesWritten=0x358ff14*=0x1840, lpOverlapped=0x0) returned 1 [0117.371] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.371] WriteFile (in: hFile=0x49c, lpBuffer=0x6f44747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f44747*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.371] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.371] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.371] CloseHandle (hObject=0x49c) returned 1 [0117.371] GetProcessHeap () returned 0x580000 [0117.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0117.371] GetProcessHeap () returned 0x580000 [0117.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0117.371] GetProcessHeap () returned 0x580000 [0117.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0119.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d91b220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x358fd28, dwReserved1=0x6e00ac0, cFileName="SY00127_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0012~1.YOU")) returned 0x5b9630 [0119.121] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0119.991] CloseHandle (hObject=0x4a0) returned 1 [0119.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TR0009~2.YOU")) returned 0x5b96b0 [0119.992] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0119.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0119.992] GetProcessHeap () returned 0x580000 [0119.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c676b8 [0119.992] GetProcessHeap () returned 0x580000 [0119.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c3a820 [0119.992] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.992] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x358ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0120.002] GetProcessHeap () returned 0x580000 [0120.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0120.002] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.003] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c3a820*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesWritten=0x358ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0120.005] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.005] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c3b1ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b1ff*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.006] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.006] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.006] CloseHandle (hObject=0x4a0) returned 1 [0120.006] GetProcessHeap () returned 0x580000 [0120.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0120.006] GetProcessHeap () returned 0x580000 [0120.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0120.006] GetProcessHeap () returned 0x580000 [0120.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f23fa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x358fd28, dwReserved1=0x6c676b8, cFileName="TR00097_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TR0009~2.YOU")) returned 0x5b96f0 [0120.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.159] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", len=0x4c | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 1 [0120.159] GetProcessHeap () returned 0x580000 [0120.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1770) returned 0x6d06ca8 [0120.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.467] CloseHandle (hObject=0x460) returned 1 [0120.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.467] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.id_1622540890_.your_last_chance")) returned 1 [0120.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~1.YOU")) returned 0x5b9630 [0120.468] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.468] GetProcessHeap () returned 0x580000 [0120.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596cd8 [0120.468] GetProcessHeap () returned 0x580000 [0120.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596828 [0120.469] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.469] ReadFile (in: hFile=0x460, lpBuffer=0x596cd8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x596cd8*, lpNumberOfBytesRead=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.469] GetProcessHeap () returned 0x580000 [0120.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.470] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.470] WriteFile (in: hFile=0x460, lpBuffer=0x596828*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x596828*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.470] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.470] WriteFile (in: hFile=0x460, lpBuffer=0x596847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x596847*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.470] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.470] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.470] CloseHandle (hObject=0x460) returned 1 [0120.470] GetProcessHeap () returned 0x580000 [0120.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596828 | out: hHeap=0x580000) returned 1 [0120.470] GetProcessHeap () returned 0x580000 [0120.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596cd8 | out: hHeap=0x580000) returned 1 [0120.470] GetProcessHeap () returned 0x580000 [0120.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f6b63c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x358fd28, dwReserved1=0x596cd8, cFileName="J0143744.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~1.YOU")) returned 0x5b9630 [0120.470] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0121.701] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", len=0x4d | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 1 [0121.701] GetProcessHeap () returned 0x580000 [0121.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1834) returned 0x6e00ac0 [0121.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.708] CloseHandle (hObject=0x484) returned 1 [0122.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.id_1622540890_.your_last_chance")) returned 1 [0123.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0123.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0123.040] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0123.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0123.040] GetProcessHeap () returned 0x580000 [0123.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0123.040] GetProcessHeap () returned 0x580000 [0123.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0123.040] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.040] ReadFile (in: hFile=0x484, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x358ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0123.045] GetProcessHeap () returned 0x580000 [0123.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0123.045] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.045] WriteFile (in: hFile=0x484, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x358ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0123.045] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.045] WriteFile (in: hFile=0x484, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0123.045] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.045] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0123.046] CloseHandle (hObject=0x484) returned 1 [0123.046] GetProcessHeap () returned 0x580000 [0123.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0123.046] GetProcessHeap () returned 0x580000 [0123.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0123.046] GetProcessHeap () returned 0x580000 [0123.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80f426a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e6, dwReserved0=0x358fd28, dwReserved1=0x678958, cFileName="Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0124.806] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.822] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", len=0x4b | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned 1 [0124.822] GetProcessHeap () returned 0x580000 [0124.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c0) returned 0x6f42f08 [0124.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.822] CloseHandle (hObject=0x460) returned 1 [0124.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.id_1622540890_.your_last_chance")) returned 1 [0124.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x45, dwReserved1=0x0, cFileName="Angles.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ANGLES~1.YOU")) returned 0x5b9730 [0124.823] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.824] GetProcessHeap () returned 0x580000 [0124.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x67ec60 [0124.824] GetProcessHeap () returned 0x580000 [0124.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6f19958 [0124.824] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.824] ReadFile (in: hFile=0x460, lpBuffer=0x67ec60, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x358ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.852] GetProcessHeap () returned 0x580000 [0124.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.852] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.852] WriteFile (in: hFile=0x460, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x358ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.852] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.852] WriteFile (in: hFile=0x460, lpBuffer=0x6f1a777*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a777*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.852] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.852] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.852] CloseHandle (hObject=0x460) returned 1 [0124.852] GetProcessHeap () returned 0x580000 [0124.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0124.852] GetProcessHeap () returned 0x580000 [0124.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0124.852] GetProcessHeap () returned 0x580000 [0124.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0124.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82084620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x358fd28, dwReserved1=0x67ec60, cFileName="Angles.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ANGLES~1.YOU")) returned 0x5b9730 [0124.852] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.925] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", len=0x50 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 1 [0124.925] GetProcessHeap () returned 0x580000 [0124.925] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ac) returned 0x6f42f08 [0124.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.926] CloseHandle (hObject=0x460) returned 1 [0124.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id_1622540890_.your_last_chance")) returned 1 [0124.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0124.927] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.928] GetProcessHeap () returned 0x580000 [0124.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ca1) returned 0x6f52238 [0124.928] GetProcessHeap () returned 0x580000 [0124.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ca1) returned 0x6f58ee8 [0124.928] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.928] ReadFile (in: hFile=0x460, lpBuffer=0x6f52238, nNumberOfBytesToRead=0x6c80, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f52238*, lpNumberOfBytesRead=0x358ff14*=0x6c80, lpOverlapped=0x0) returned 1 [0126.367] GetProcessHeap () returned 0x580000 [0126.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0126.367] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.367] WriteFile (in: hFile=0x460, lpBuffer=0x6f58ee8*, nNumberOfBytesToWrite=0x6c80, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58ee8*, lpNumberOfBytesWritten=0x358ff14*=0x6c80, lpOverlapped=0x0) returned 1 [0126.367] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.367] WriteFile (in: hFile=0x460, lpBuffer=0x6f5fb67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5fb67*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.367] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.367] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.368] CloseHandle (hObject=0x460) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58ee8 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f52238 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0126.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82ef2b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6ca9, dwReserved0=0x358fd28, dwReserved1=0x6f52238, cFileName="Solstice.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0126.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.719] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", len=0x3d | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned 1 [0126.720] GetProcessHeap () returned 0x580000 [0126.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d8) returned 0x667250 [0126.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0128.872] CloseHandle (hObject=0x42c) returned 1 [0128.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03010~2.YOU")) returned 0x5b9730 [0129.748] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0129.749] GetProcessHeap () returned 0x580000 [0129.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x6d98c08 [0129.749] GetProcessHeap () returned 0x580000 [0129.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x6ef3008 [0129.749] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.749] ReadFile (in: hFile=0x42c, lpBuffer=0x6d98c08, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98c08*, lpNumberOfBytesRead=0x358ff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0129.791] GetProcessHeap () returned 0x580000 [0129.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.791] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.791] WriteFile (in: hFile=0x42c, lpBuffer=0x6ef3008*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesWritten=0x358ff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0129.791] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.791] WriteFile (in: hFile=0x42c, lpBuffer=0x6ef5fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef5fc7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.791] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.791] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.791] CloseHandle (hObject=0x42c) returned 1 [0129.791] GetProcessHeap () returned 0x580000 [0129.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0129.792] GetProcessHeap () returned 0x580000 [0129.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98c08 | out: hHeap=0x580000) returned 1 [0129.792] GetProcessHeap () returned 0x580000 [0129.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84f878a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ffc, dwReserved0=0x358fd28, dwReserved1=0x6d98c08, cFileName="J0301050.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03010~2.YOU")) returned 0x5b9730 [0129.792] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.672] CloseHandle (hObject=0x428) returned 1 [0132.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id_1622540890_.your_last_chance")) returned 1 [0132.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELH~1.YOU")) returned 0x5b9730 [0132.673] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.673] GetProcessHeap () returned 0x580000 [0132.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0132.674] GetProcessHeap () returned 0x580000 [0132.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0132.675] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.675] ReadFile (in: hFile=0x428, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.083] GetProcessHeap () returned 0x580000 [0137.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0137.084] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.084] WriteFile (in: hFile=0x428, lpBuffer=0x6fe77c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.473] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.473] WriteFile (in: hFile=0x428, lpBuffer=0x6ff8fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8fc7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.540] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.540] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.541] CloseHandle (hObject=0x428) returned 1 [0138.604] GetProcessHeap () returned 0x580000 [0138.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0138.606] GetProcessHeap () returned 0x580000 [0138.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0138.607] GetProcessHeap () returned 0x580000 [0138.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x77710a, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="EXCEL.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELH~1.YOU")) returned 0x5b9770 [0139.879] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.908] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x5d | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0139.908] GetProcessHeap () returned 0x580000 [0139.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0139.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.918] CloseHandle (hObject=0x470) returned 1 [0139.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0139.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0139.928] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.928] GetProcessHeap () returned 0x580000 [0139.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5bad00 [0139.928] GetProcessHeap () returned 0x580000 [0139.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5b0428 [0139.928] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.928] ReadFile (in: hFile=0x470, lpBuffer=0x5bad00, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesRead=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0139.930] GetProcessHeap () returned 0x580000 [0139.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce698 [0139.930] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.930] WriteFile (in: hFile=0x470, lpBuffer=0x5b0428*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b0428*, lpNumberOfBytesWritten=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0139.931] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.931] WriteFile (in: hFile=0x470, lpBuffer=0x5b05c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b05c7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.931] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.931] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.931] CloseHandle (hObject=0x470) returned 1 [0139.931] GetProcessHeap () returned 0x580000 [0139.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b0428 | out: hHeap=0x580000) returned 1 [0139.931] GetProcessHeap () returned 0x580000 [0139.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0139.931] GetProcessHeap () returned 0x580000 [0139.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce698 | out: hHeap=0x580000) returned 1 [0140.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b03b660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x358fd28, dwReserved1=0x5bad00, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0140.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.178] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", len=0x43 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned 1 [0140.178] GetProcessHeap () returned 0x580000 [0140.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.184] CloseHandle (hObject=0x3a8) returned 1 [0140.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0150b00, ftCreationTime.dwHighDateTime=0x1bd4f54, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0150b00, ftLastWriteTime.dwHighDateTime=0x1bd4f54, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~3.YOU")) returned 0x5b9770 [0140.185] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.185] GetProcessHeap () returned 0x580000 [0140.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6e023e8 [0140.185] GetProcessHeap () returned 0x580000 [0140.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6e02a30 [0140.186] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.186] ReadFile (in: hFile=0x3a8, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x358ff14*=0x600, lpOverlapped=0x0) returned 1 [0140.192] GetProcessHeap () returned 0x580000 [0140.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce698 [0140.192] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.192] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e02a30*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02a30*, lpNumberOfBytesWritten=0x358ff14*=0x600, lpOverlapped=0x0) returned 1 [0140.192] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.192] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e0302f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0302f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.193] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.193] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.193] CloseHandle (hObject=0x3a8) returned 1 [0140.193] GetProcessHeap () returned 0x580000 [0140.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02a30 | out: hHeap=0x580000) returned 1 [0140.193] GetProcessHeap () returned 0x580000 [0140.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0140.193] GetProcessHeap () returned 0x580000 [0140.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce698 | out: hHeap=0x580000) returned 1 [0140.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0150b00, ftCreationTime.dwHighDateTime=0x1bd4f54, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b2c2dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x63a, dwReserved0=0x358fd28, dwReserved1=0x6e023e8, cFileName="BD21305_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~3.YOU")) returned 0x5b9770 [0140.475] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.490] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", len=0x43 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned 1 [0140.490] GetProcessHeap () returned 0x580000 [0140.490] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db0) returned 0x6f14048 [0140.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.557] CloseHandle (hObject=0x428) returned 1 [0140.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1488~1.YOU")) returned 0x5b9770 [0140.558] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.558] GetProcessHeap () returned 0x580000 [0140.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0140.558] GetProcessHeap () returned 0x580000 [0140.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0140.558] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.558] ReadFile (in: hFile=0x428, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x358ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.560] GetProcessHeap () returned 0x580000 [0140.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.560] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.560] WriteFile (in: hFile=0x428, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x358ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.560] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.561] WriteFile (in: hFile=0x428, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.561] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.561] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.561] CloseHandle (hObject=0x428) returned 1 [0140.561] GetProcessHeap () returned 0x580000 [0140.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0140.561] GetProcessHeap () returned 0x580000 [0140.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0140.561] GetProcessHeap () returned 0x580000 [0140.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b654ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x168, dwReserved0=0x358fd28, dwReserved1=0x6f3bec0, cFileName="BD14883_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1488~1.YOU")) returned 0x5b9730 [0140.935] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.972] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS", len=0x38 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS") returned 1 [0140.972] GetProcessHeap () returned 0x580000 [0140.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.137] CloseHandle (hObject=0x478) returned 1 [0144.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.id_1622540890_.your_last_chance")) returned 1 [0144.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JADECS~1.YOU")) returned 0x5b96f0 [0144.138] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\jade.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.138] GetProcessHeap () returned 0x580000 [0144.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0144.138] GetProcessHeap () returned 0x580000 [0144.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0144.138] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.138] ReadFile (in: hFile=0x478, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x358ff14*=0xd60, lpOverlapped=0x0) returned 1 [0144.152] GetProcessHeap () returned 0x580000 [0144.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.152] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.152] WriteFile (in: hFile=0x478, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x358ff14*=0xd60, lpOverlapped=0x0) returned 1 [0144.152] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.152] WriteFile (in: hFile=0x478, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.152] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.152] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.152] CloseHandle (hObject=0x478) returned 1 [0144.152] GetProcessHeap () returned 0x580000 [0144.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0144.152] GetProcessHeap () returned 0x580000 [0144.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0144.152] GetProcessHeap () returned 0x580000 [0144.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8d88cb00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x358fd28, dwReserved1=0x635768, cFileName="JADE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JADECS~1.YOU")) returned 0x5b96f0 [0146.864] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.878] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", len=0x44 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned 1 [0146.878] GetProcessHeap () returned 0x580000 [0146.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0146.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.129] CloseHandle (hObject=0x480) returned 1 [0153.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.id_1622540890_.your_last_chance")) returned 1 [0153.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR21~1.YOU")) returned 0x5b9730 [0153.131] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.131] GetProcessHeap () returned 0x580000 [0153.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x70990f8 [0153.131] GetProcessHeap () returned 0x580000 [0153.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x709be88 [0153.131] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.131] ReadFile (in: hFile=0x480, lpBuffer=0x70990f8, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x70990f8*, lpNumberOfBytesRead=0x358ff14*=0x2d60, lpOverlapped=0x0) returned 1 [0154.151] GetProcessHeap () returned 0x580000 [0154.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.151] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.151] WriteFile (in: hFile=0x480, lpBuffer=0x709be88*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x709be88*, lpNumberOfBytesWritten=0x358ff14*=0x2d60, lpOverlapped=0x0) returned 1 [0154.151] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.151] WriteFile (in: hFile=0x480, lpBuffer=0x709ebe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x709ebe7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.152] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.152] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.152] CloseHandle (hObject=0x480) returned 1 [0154.152] GetProcessHeap () returned 0x580000 [0154.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709be88 | out: hHeap=0x580000) returned 1 [0154.152] GetProcessHeap () returned 0x580000 [0154.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70990f8 | out: hHeap=0x580000) returned 1 [0154.152] GetProcessHeap () returned 0x580000 [0154.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937e9c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2da2, dwReserved0=0x358fd28, dwReserved1=0x70990f8, cFileName="PDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR21~1.YOU")) returned 0x5b9630 [0154.152] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.684] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC", len=0x43 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 1 [0154.684] GetProcessHeap () returned 0x580000 [0154.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0154.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.074] CloseHandle (hObject=0x448) returned 1 [0159.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0159.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI2785~1.YOU")) returned 0x5b9630 [0159.075] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.075] GetProcessHeap () returned 0x580000 [0159.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0159.076] GetProcessHeap () returned 0x580000 [0159.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0159.076] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.076] ReadFile (in: hFile=0x448, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x358ff14*=0x280, lpOverlapped=0x0) returned 1 [0159.079] GetProcessHeap () returned 0x580000 [0159.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.079] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.079] WriteFile (in: hFile=0x448, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x358ff14*=0x280, lpOverlapped=0x0) returned 1 [0159.079] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.079] WriteFile (in: hFile=0x448, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0159.080] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.080] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0159.080] CloseHandle (hObject=0x448) returned 1 [0159.080] GetProcessHeap () returned 0x580000 [0159.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0159.080] GetProcessHeap () returned 0x580000 [0159.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0159.080] GetProcessHeap () returned 0x580000 [0159.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x966ecee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x358fd28, dwReserved1=0x6c4a820, cFileName="WINPROJ.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI2785~1.YOU")) returned 0x5b9730 [0164.391] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.425] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", len=0x47 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned 1 [0164.425] GetProcessHeap () returned 0x580000 [0164.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0164.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0164.488] CloseHandle (hObject=0x448) returned 1 [0164.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0164.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl.id_1622540890_.your_last_chance")) returned 1 [0164.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0164.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~1.YOU")) returned 0x5b9730 [0164.490] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0164.490] GetProcessHeap () returned 0x580000 [0164.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8b81) returned 0x720a268 [0164.490] GetProcessHeap () returned 0x580000 [0164.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8b81) returned 0x6fb2f38 [0164.491] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.491] ReadFile (in: hFile=0x448, lpBuffer=0x720a268, nNumberOfBytesToRead=0x8b60, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x720a268*, lpNumberOfBytesRead=0x358ff14*=0x8b60, lpOverlapped=0x0) returned 1 [0165.829] GetProcessHeap () returned 0x580000 [0165.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.829] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.829] WriteFile (in: hFile=0x448, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x8b60, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x358ff14*=0x8b60, lpOverlapped=0x0) returned 1 [0165.830] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.830] WriteFile (in: hFile=0x448, lpBuffer=0x6fbba97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbba97*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.830] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.830] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.830] CloseHandle (hObject=0x448) returned 1 [0165.830] GetProcessHeap () returned 0x580000 [0165.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0165.830] GetProcessHeap () returned 0x580000 [0165.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x720a268 | out: hHeap=0x580000) returned 1 [0165.832] GetProcessHeap () returned 0x580000 [0165.832] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a758240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8b86, dwReserved0=0x358fd28, dwReserved1=0x720a268, cFileName="AUTHOR.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~1.YOU")) returned 0x5b9730 [0169.606] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.661] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", len=0x3b | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 1 [0169.661] GetProcessHeap () returned 0x580000 [0169.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0169.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0169.663] CloseHandle (hObject=0x428) returned 1 [0169.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id_1622540890_.your_last_chance")) returned 1 [0169.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ODBCSA~1.YOU")) returned 0x5b9730 [0169.664] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0169.664] GetProcessHeap () returned 0x580000 [0169.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf981) returned 0x6fee918 [0169.664] GetProcessHeap () returned 0x580000 [0169.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf981) returned 0x6ffe2a8 [0169.665] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.665] ReadFile (in: hFile=0x428, lpBuffer=0x6fee918, nNumberOfBytesToRead=0xf960, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fee918*, lpNumberOfBytesRead=0x358ff14*=0xf960, lpOverlapped=0x0) returned 1 [0174.052] GetProcessHeap () returned 0x580000 [0174.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0174.052] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.052] WriteFile (in: hFile=0x428, lpBuffer=0x6ffe2a8*, nNumberOfBytesToWrite=0xf960, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffe2a8*, lpNumberOfBytesWritten=0x358ff14*=0xf960, lpOverlapped=0x0) returned 1 [0174.053] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.053] WriteFile (in: hFile=0x428, lpBuffer=0x700dc07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x700dc07*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.053] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.053] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.053] CloseHandle (hObject=0x428) returned 1 [0174.053] GetProcessHeap () returned 0x580000 [0174.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ffe2a8 | out: hHeap=0x580000) returned 1 [0174.054] GetProcessHeap () returned 0x580000 [0174.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fee918 | out: hHeap=0x580000) returned 1 [0174.054] GetProcessHeap () returned 0x580000 [0174.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0176.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f5bf6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf99c, dwReserved0=0x358fd28, dwReserved1=0x6fee918, cFileName="ODBC.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ODBCSA~1.YOU")) returned 0x5b96f0 [0176.796] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.817] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS", len=0x3d | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 1 [0176.817] GetProcessHeap () returned 0x580000 [0176.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0176.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0176.818] CloseHandle (hObject=0x430) returned 1 [0176.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id_1622540890_.your_last_chance")) returned 1 [0176.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62b3700, ftCreationTime.dwHighDateTime=0x1ca5009, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe62b3700, ftLastWriteTime.dwHighDateTime=0x1ca5009, nFileSizeHigh=0x0, nFileSizeLow=0x22e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI1678~1.YOU")) returned 0x5b96f0 [0176.819] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0176.819] GetProcessHeap () returned 0x580000 [0176.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0176.819] GetProcessHeap () returned 0x580000 [0176.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x704a3b8 [0176.820] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.820] ReadFile (in: hFile=0x430, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0179.047] GetProcessHeap () returned 0x580000 [0179.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.048] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.048] WriteFile (in: hFile=0x430, lpBuffer=0x704a3b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x704a3b8*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0179.048] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.048] WriteFile (in: hFile=0x430, lpBuffer=0x705bbb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x705bbb7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.352] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.352] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.352] CloseHandle (hObject=0x430) returned 1 [0179.352] GetProcessHeap () returned 0x580000 [0179.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704a3b8 | out: hHeap=0x580000) returned 1 [0179.352] GetProcessHeap () returned 0x580000 [0179.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0179.352] GetProcessHeap () returned 0x580000 [0179.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62b3700, ftCreationTime.dwHighDateTime=0x1ca5009, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa282e900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22e7a4, dwReserved0=0x358fd28, dwReserved1=0x6d10048, cFileName="VISIO_PRM.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI1678~1.YOU")) returned 0x5b96b0 [0180.421] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.464] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", len=0x67 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned 1 [0180.464] GetProcessHeap () returned 0x580000 [0180.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0180.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.465] CloseHandle (hObject=0x43c) returned 1 [0180.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.466] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c468e00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~4.YOU")) returned 0x5b96b0 [0180.466] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.466] GetProcessHeap () returned 0x580000 [0180.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e1) returned 0x6d29f58 [0180.466] GetProcessHeap () returned 0x580000 [0180.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e1) returned 0x6d2c248 [0180.466] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.466] ReadFile (in: hFile=0x43c, lpBuffer=0x6d29f58, nNumberOfBytesToRead=0x22c0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29f58*, lpNumberOfBytesRead=0x358ff14*=0x22c0, lpOverlapped=0x0) returned 1 [0180.524] GetProcessHeap () returned 0x580000 [0180.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.524] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2c248*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2c248*, lpNumberOfBytesWritten=0x358ff14*=0x22c0, lpOverlapped=0x0) returned 1 [0180.525] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2e507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2e507*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.525] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.525] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.525] CloseHandle (hObject=0x43c) returned 1 [0180.525] GetProcessHeap () returned 0x580000 [0180.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2c248 | out: hHeap=0x580000) returned 1 [0180.525] GetProcessHeap () returned 0x580000 [0180.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d29f58 | out: hHeap=0x580000) returned 1 [0180.525] GetProcessHeap () returned 0x580000 [0180.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa337d180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22e4, dwReserved0=0x358fd28, dwReserved1=0x6d29f58, cFileName="CommsOutgoingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~4.YOU")) returned 0x5b96b0 [0180.525] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.194] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", len=0x4f | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned 1 [0183.194] GetProcessHeap () returned 0x580000 [0183.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0183.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.195] CloseHandle (hObject=0x3fc) returned 1 [0183.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUESTI~1.YOU")) returned 0x5b9770 [0183.196] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.196] GetProcessHeap () returned 0x580000 [0183.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0183.196] GetProcessHeap () returned 0x580000 [0183.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0183.196] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.196] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x358ff14*=0x820, lpOverlapped=0x0) returned 1 [0183.245] GetProcessHeap () returned 0x580000 [0183.245] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.245] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.245] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x358ff14*=0x820, lpOverlapped=0x0) returned 1 [0183.245] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.246] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.246] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.246] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.246] CloseHandle (hObject=0x3fc) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d600c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x358fd28, dwReserved1=0x6c79898, cFileName="QuestionIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUESTI~1.YOU")) returned 0x5b9770 [0183.807] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.824] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", len=0x66 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned 1 [0183.824] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0183.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0183.827] CloseHandle (hObject=0x464) returned 1 [0183.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.id_1622540890_.your_last_chance")) returned 1 [0183.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b9770 [0183.828] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0183.828] GetProcessHeap () returned 0x580000 [0183.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0183.828] GetProcessHeap () returned 0x580000 [0183.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0183.828] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.828] ReadFile (in: hFile=0x464, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x358ff14*=0x400, lpOverlapped=0x0) returned 1 [0183.833] GetProcessHeap () returned 0x580000 [0183.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0183.833] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.833] WriteFile (in: hFile=0x464, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x358ff14*=0x400, lpOverlapped=0x0) returned 1 [0183.834] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.834] WriteFile (in: hFile=0x464, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.834] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.834] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.834] CloseHandle (hObject=0x464) returned 1 [0183.834] GetProcessHeap () returned 0x580000 [0183.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0183.834] GetProcessHeap () returned 0x580000 [0183.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0183.834] GetProcessHeap () returned 0x580000 [0183.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0183.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5307500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x358fd28, dwReserved1=0x6c6a110, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b9770 [0183.834] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.846] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", len=0x61 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned 1 [0183.847] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0183.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.847] CloseHandle (hObject=0x450) returned 1 [0183.847] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.id_1622540890_.your_last_chance")) returned 1 [0183.848] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b9770 [0183.848] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.848] GetProcessHeap () returned 0x580000 [0183.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0183.848] GetProcessHeap () returned 0x580000 [0183.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0183.848] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.848] ReadFile (in: hFile=0x450, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x358ff14*=0x260, lpOverlapped=0x0) returned 1 [0183.852] GetProcessHeap () returned 0x580000 [0183.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0183.852] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x450, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x358ff14*=0x260, lpOverlapped=0x0) returned 1 [0183.852] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x450, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.852] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.852] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.852] CloseHandle (hObject=0x450) returned 1 [0183.852] GetProcessHeap () returned 0x580000 [0183.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0183.852] GetProcessHeap () returned 0x580000 [0183.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0183.852] GetProcessHeap () returned 0x580000 [0183.852] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa532d660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x358fd28, dwReserved1=0x6df2798, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b9770 [0183.853] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.862] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", len=0x62 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned 1 [0183.862] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0183.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.865] CloseHandle (hObject=0x450) returned 1 [0183.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.id_1622540890_.your_last_chance")) returned 1 [0183.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b9770 [0183.866] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.866] GetProcessHeap () returned 0x580000 [0183.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6d6aca8 [0183.867] GetProcessHeap () returned 0x580000 [0183.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x6d6fe18 [0183.867] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.867] ReadFile (in: hFile=0x450, lpBuffer=0x6d6aca8, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6aca8*, lpNumberOfBytesRead=0x358ff14*=0x5140, lpOverlapped=0x0) returned 1 [0184.801] GetProcessHeap () returned 0x580000 [0184.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x705fa58 [0184.801] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.801] WriteFile (in: hFile=0x450, lpBuffer=0x6d6fe18*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6fe18*, lpNumberOfBytesWritten=0x358ff14*=0x5140, lpOverlapped=0x0) returned 1 [0184.801] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.802] WriteFile (in: hFile=0x450, lpBuffer=0x6d74f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d74f57*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.802] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.802] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.802] CloseHandle (hObject=0x450) returned 1 [0185.088] GetProcessHeap () returned 0x580000 [0185.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6fe18 | out: hHeap=0x580000) returned 1 [0185.088] GetProcessHeap () returned 0x580000 [0185.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6aca8 | out: hHeap=0x580000) returned 1 [0185.088] GetProcessHeap () returned 0x580000 [0185.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705fa58 | out: hHeap=0x580000) returned 1 [0185.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5c40a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x358fd28, dwReserved1=0x6d6aca8, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b9770 [0185.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.581] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", len=0x53 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned 1 [0185.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.069] CloseHandle (hObject=0x3b4) returned 1 [0187.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0187.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3618, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_S~2.YOU")) returned 0x5b96b0 [0187.070] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.070] GetProcessHeap () returned 0x580000 [0187.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3621) returned 0x7012678 [0187.071] GetProcessHeap () returned 0x580000 [0187.071] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3621) returned 0x7015ca8 [0187.071] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.071] ReadFile (in: hFile=0x3b4, lpBuffer=0x7012678, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7012678*, lpNumberOfBytesRead=0x358ff14*=0x3600, lpOverlapped=0x0) returned 1 [0187.744] GetProcessHeap () returned 0x580000 [0187.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf930 [0187.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] WriteFile (in: hFile=0x3b4, lpBuffer=0x7015ca8*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7015ca8*, lpNumberOfBytesWritten=0x358ff14*=0x3600, lpOverlapped=0x0) returned 1 [0187.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] WriteFile (in: hFile=0x3b4, lpBuffer=0x70192a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x70192a7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.744] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.744] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.744] CloseHandle (hObject=0x3b4) returned 1 [0187.744] GetProcessHeap () returned 0x580000 [0187.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7015ca8 | out: hHeap=0x580000) returned 1 [0187.744] GetProcessHeap () returned 0x580000 [0187.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7012678 | out: hHeap=0x580000) returned 1 [0187.744] GetProcessHeap () returned 0x580000 [0187.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf930 | out: hHeap=0x580000) returned 1 [0188.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7838cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x363c, dwReserved0=0x358fd28, dwReserved1=0x7012678, cFileName="Form_StatusImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_S~2.YOU")) returned 0x5b9770 [0188.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.186] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", len=0x45 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned 1 [0188.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0188.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0189.268] CloseHandle (hObject=0x49c) returned 1 [0189.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0189.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~2.YOU")) returned 0x5b97b0 [0194.567] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0194.567] GetProcessHeap () returned 0x580000 [0194.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x7116638 [0194.568] GetProcessHeap () returned 0x580000 [0194.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6dcd1d0 [0194.568] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.568] ReadFile (in: hFile=0x390, lpBuffer=0x7116638, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7116638*, lpNumberOfBytesRead=0x358ff14*=0x980, lpOverlapped=0x0) returned 1 [0194.577] GetProcessHeap () returned 0x580000 [0194.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.577] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x390, lpBuffer=0x6dcd1d0*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesWritten=0x358ff14*=0x980, lpOverlapped=0x0) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x390, lpBuffer=0x6dcdb4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcdb4f*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.577] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.577] CloseHandle (hObject=0x390) returned 1 [0194.578] GetProcessHeap () returned 0x580000 [0194.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0194.578] GetProcessHeap () returned 0x580000 [0194.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7116638 | out: hHeap=0x580000) returned 1 [0194.578] GetProcessHeap () returned 0x580000 [0194.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab962700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9bb, dwReserved0=0x358fd28, dwReserved1=0x7116638, cFileName="ZPDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~2.YOU")) returned 0x5b97b0 [0194.578] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.579] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0194.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0194.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.206] CloseHandle (hObject=0x4ac) returned 1 [0196.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0196.605] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.605] GetProcessHeap () returned 0x580000 [0196.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.605] GetProcessHeap () returned 0x580000 [0196.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.606] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.606] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x358ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.608] GetProcessHeap () returned 0x580000 [0196.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.608] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.608] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x358ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.608] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.608] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.608] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.608] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.608] CloseHandle (hObject=0x4ac) returned 1 [0196.608] GetProcessHeap () returned 0x580000 [0196.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.608] GetProcessHeap () returned 0x580000 [0196.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.608] GetProcessHeap () returned 0x580000 [0196.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccdfb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x358fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0199.132] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.141] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", len=0x44 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned 1 [0199.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0199.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0199.198] CloseHandle (hObject=0x454) returned 1 [0199.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb819, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR38~1.YOU")) returned 0x5b97b0 [0199.199] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0199.200] GetProcessHeap () returned 0x580000 [0199.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb821) returned 0x7062940 [0199.200] GetProcessHeap () returned 0x580000 [0199.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb821) returned 0x6d630a8 [0199.200] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.200] ReadFile (in: hFile=0x454, lpBuffer=0x7062940, nNumberOfBytesToRead=0xb800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesRead=0x358ff14*=0xb800, lpOverlapped=0x0) returned 1 [0200.614] GetProcessHeap () returned 0x580000 [0200.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.614] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.614] WriteFile (in: hFile=0x454, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0xb800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x358ff14*=0xb800, lpOverlapped=0x0) returned 1 [0200.615] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x454, lpBuffer=0x6d6e8a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6e8a7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.615] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.615] CloseHandle (hObject=0x454) returned 1 [0200.615] GetProcessHeap () returned 0x580000 [0200.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0200.615] GetProcessHeap () returned 0x580000 [0200.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0200.615] GetProcessHeap () returned 0x580000 [0200.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf2f5b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb83d, dwReserved0=0x358fd28, dwReserved1=0x7062940, cFileName="PDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR38~1.YOU")) returned 0x5b9770 [0201.395] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.398] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x75 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0201.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0201.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.427] CloseHandle (hObject=0x480) returned 1 [0201.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0201.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x42005c, dwReserved1=0x540055, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0201.443] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.443] GetProcessHeap () returned 0x580000 [0201.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c59120 [0201.444] GetProcessHeap () returned 0x580000 [0201.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c592f8 [0201.444] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.444] ReadFile (in: hFile=0x480, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0201.446] GetProcessHeap () returned 0x580000 [0201.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.446] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.446] WriteFile (in: hFile=0x480, lpBuffer=0x6c592f8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c592f8*, lpNumberOfBytesWritten=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0201.446] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.446] WriteFile (in: hFile=0x480, lpBuffer=0x6c59497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59497*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.446] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.446] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.447] CloseHandle (hObject=0x480) returned 1 [0201.447] GetProcessHeap () returned 0x580000 [0201.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c592f8 | out: hHeap=0x580000) returned 1 [0201.447] GetProcessHeap () returned 0x580000 [0201.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0201.447] GetProcessHeap () returned 0x580000 [0201.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafafe560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x358fd28, dwReserved1=0x6c59120, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0202.085] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.189] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS", len=0x45 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS") returned 1 [0202.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0202.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0202.259] CloseHandle (hObject=0x440) returned 1 [0202.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css.id_1622540890_.your_last_chance")) returned 1 [0202.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56343000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56343000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d920, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCE0E8~1.YOU")) returned 0x5b9770 [0202.260] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0202.260] GetProcessHeap () returned 0x580000 [0202.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0202.261] GetProcessHeap () returned 0x580000 [0202.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0202.262] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.262] ReadFile (in: hFile=0x440, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.724] GetProcessHeap () returned 0x580000 [0208.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.724] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.725] WriteFile (in: hFile=0x440, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.725] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.725] WriteFile (in: hFile=0x440, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.725] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.725] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.725] CloseHandle (hObject=0x440) returned 1 [0208.725] GetProcessHeap () returned 0x580000 [0208.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0208.725] GetProcessHeap () returned 0x580000 [0208.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0208.726] GetProcessHeap () returned 0x580000 [0208.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56343000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4052620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d944, dwReserved0=0x358fd28, dwReserved1=0x6fb2f38, cFileName="SCHEME42.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCE0E8~1.YOU")) returned 0x5b97b0 [0210.087] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.120] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x73 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0210.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0210.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.787] CloseHandle (hObject=0x450) returned 1 [0210.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0212.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0212.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x410045, dwReserved1=0x450044, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0212.704] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0212.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0212.704] GetProcessHeap () returned 0x580000 [0212.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c59120 [0212.704] GetProcessHeap () returned 0x580000 [0212.704] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c592f8 [0212.704] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.705] ReadFile (in: hFile=0x450, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0212.707] GetProcessHeap () returned 0x580000 [0212.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0212.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.707] WriteFile (in: hFile=0x450, lpBuffer=0x6c592f8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c592f8*, lpNumberOfBytesWritten=0x358ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0212.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.707] WriteFile (in: hFile=0x450, lpBuffer=0x6c59497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59497*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0212.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.707] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0212.707] CloseHandle (hObject=0x450) returned 1 [0212.707] GetProcessHeap () returned 0x580000 [0212.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c592f8 | out: hHeap=0x580000) returned 1 [0212.708] GetProcessHeap () returned 0x580000 [0212.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0212.708] GetProcessHeap () returned 0x580000 [0212.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6668620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x358fd28, dwReserved1=0x6c59120, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0214.697] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.772] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS", len=0x45 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS") returned 1 [0214.772] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0214.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0214.773] CloseHandle (hObject=0x480) returned 1 [0214.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css.id_1622540890_.your_last_chance")) returned 1 [0214.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47994900, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47994900, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1eea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC516D~1.YOU")) returned 0x5b97b0 [0214.774] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0214.774] GetProcessHeap () returned 0x580000 [0214.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0214.774] GetProcessHeap () returned 0x580000 [0214.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0214.774] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.774] ReadFile (in: hFile=0x480, lpBuffer=0x702a188, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.677] GetProcessHeap () returned 0x580000 [0220.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0220.677] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.677] WriteFile (in: hFile=0x480, lpBuffer=0x703b9b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.678] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x480, lpBuffer=0x704d1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x704d1b7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.678] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.678] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.678] CloseHandle (hObject=0x480) returned 1 [0220.678] GetProcessHeap () returned 0x580000 [0220.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0220.678] GetProcessHeap () returned 0x580000 [0220.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0220.678] GetProcessHeap () returned 0x580000 [0220.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47994900, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb26e4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eeca, dwReserved0=0x358fd28, dwReserved1=0x702a188, cFileName="SCHEME01.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC516D~1.YOU")) returned 0x5b9730 [0221.793] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.817] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", len=0x48 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 1 [0221.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0221.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.867] CloseHandle (hObject=0x49c) returned 1 [0222.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id_1622540890_.your_last_chance")) returned 1 [0222.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~1.YOU")) returned 0x5b96f0 [0222.868] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.869] GetProcessHeap () returned 0x580000 [0222.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c11570 [0222.869] GetProcessHeap () returned 0x580000 [0222.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c11ff8 [0222.869] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.869] ReadFile (in: hFile=0x49c, lpBuffer=0x6c11570, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11570*, lpNumberOfBytesRead=0x358ff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.889] GetProcessHeap () returned 0x580000 [0222.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.890] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.890] WriteFile (in: hFile=0x49c, lpBuffer=0x6c11ff8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11ff8*, lpNumberOfBytesWritten=0x358ff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.890] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.890] WriteFile (in: hFile=0x49c, lpBuffer=0x6c12a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c12a17*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.890] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.890] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.890] CloseHandle (hObject=0x49c) returned 1 [0222.890] GetProcessHeap () returned 0x580000 [0222.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11ff8 | out: hHeap=0x580000) returned 1 [0222.890] GetProcessHeap () returned 0x580000 [0222.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11570 | out: hHeap=0x580000) returned 1 [0222.890] GetProcessHeap () returned 0x580000 [0222.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7686a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x358fd28, dwReserved1=0x6c11570, cFileName="COMPUTER.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPUT~1.YOU")) returned 0x5b9630 [0225.416] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.457] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", len=0x84 | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned 1 [0225.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0225.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0225.751] CloseHandle (hObject=0x41c) returned 1 [0225.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.751] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance")) returned 1 [0227.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0227.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x6f0072, dwReserved1=0x6f0073, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0227.673] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0227.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0227.673] GetProcessHeap () returned 0x580000 [0227.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72aabe8 [0227.674] GetProcessHeap () returned 0x580000 [0227.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7461878 [0227.674] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.674] ReadFile (in: hFile=0x41c, lpBuffer=0x72aabe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x72aabe8*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.538] GetProcessHeap () returned 0x580000 [0236.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0236.538] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.539] WriteFile (in: hFile=0x41c, lpBuffer=0x7461878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461878*, lpNumberOfBytesWritten=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.539] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.539] WriteFile (in: hFile=0x41c, lpBuffer=0x7473077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7473077*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0236.539] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.540] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0236.540] CloseHandle (hObject=0x41c) returned 1 [0236.540] GetProcessHeap () returned 0x580000 [0236.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7461878 | out: hHeap=0x580000) returned 1 [0236.540] GetProcessHeap () returned 0x580000 [0236.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72aabe8 | out: hHeap=0x580000) returned 1 [0236.541] GetProcessHeap () returned 0x580000 [0236.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0240.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4818c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3de03, dwReserved0=0x358fd28, dwReserved1=0x72aabe8, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0240.544] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.563] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML", len=0x4b | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned 1 [0240.563] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0240.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0240.592] CloseHandle (hObject=0x470) returned 1 [0240.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml.id_1622540890_.your_last_chance")) returned 1 [0240.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOH~1.YOU")) returned 0x5b9730 [0240.593] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0240.594] GetProcessHeap () returned 0x580000 [0240.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08800 [0240.594] GetProcessHeap () returned 0x580000 [0240.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08b68 [0240.594] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.594] ReadFile (in: hFile=0x470, lpBuffer=0x6d08800, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08800*, lpNumberOfBytesRead=0x358ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.615] GetProcessHeap () returned 0x580000 [0240.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0240.615] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.616] WriteFile (in: hFile=0x470, lpBuffer=0x6d08b68*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08b68*, lpNumberOfBytesWritten=0x358ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.616] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.616] WriteFile (in: hFile=0x470, lpBuffer=0x6d08e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08e87*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.616] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.616] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.616] CloseHandle (hObject=0x470) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08b68 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08800 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0241.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f13440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x358fd28, dwReserved1=0x6d08800, cFileName="YAHOO.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOH~1.YOU")) returned 0x5b9630 [0241.614] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.671] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML", len=0x3f | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned 1 [0241.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0241.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0241.688] CloseHandle (hObject=0x428) returned 1 [0241.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml.id_1622540890_.your_last_chance")) returned 1 [0241.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7ad200, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf7ad200, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0x11424, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~1.YOU")) returned 0x5b9630 [0241.689] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0241.689] GetProcessHeap () returned 0x580000 [0241.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11441) returned 0x6fcea60 [0241.689] GetProcessHeap () returned 0x580000 [0241.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11441) returned 0x6fdfeb0 [0241.690] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.690] ReadFile (in: hFile=0x428, lpBuffer=0x6fcea60, nNumberOfBytesToRead=0x11420, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fcea60*, lpNumberOfBytesRead=0x358ff14*=0x11420, lpOverlapped=0x0) returned 1 [0244.414] GetProcessHeap () returned 0x580000 [0244.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0244.415] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x428, lpBuffer=0x6fdfeb0*, nNumberOfBytesToWrite=0x11420, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdfeb0*, lpNumberOfBytesWritten=0x358ff14*=0x11420, lpOverlapped=0x0) returned 1 [0244.415] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.415] WriteFile (in: hFile=0x428, lpBuffer=0x6ff12cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff12cf*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.415] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.416] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.416] CloseHandle (hObject=0x428) returned 1 [0244.536] GetProcessHeap () returned 0x580000 [0244.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fdfeb0 | out: hHeap=0x580000) returned 1 [0244.543] GetProcessHeap () returned 0x580000 [0244.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fcea60 | out: hHeap=0x580000) returned 1 [0244.544] GetProcessHeap () returned 0x580000 [0244.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0249.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7ad200, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc933a260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11448, dwReserved0=0x358fd28, dwReserved1=0x6fcea60, cFileName="PGMN097.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~1.YOU")) returned 0x5b9730 [0249.274] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.371] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC", len=0x3e | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 1 [0249.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0249.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0249.372] CloseHandle (hObject=0x48c) returned 1 [0249.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.id_1622540890_.your_last_chance")) returned 1 [0249.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x6214, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCD98~1.YOU")) returned 0x5b9730 [0249.374] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0249.374] GetProcessHeap () returned 0x580000 [0249.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6221) returned 0x7110038 [0249.374] GetProcessHeap () returned 0x580000 [0249.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6221) returned 0x6d71778 [0249.374] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.374] ReadFile (in: hFile=0x48c, lpBuffer=0x7110038, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x7110038*, lpNumberOfBytesRead=0x358ff14*=0x6200, lpOverlapped=0x0) returned 1 [0251.136] GetProcessHeap () returned 0x580000 [0251.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0251.136] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.136] WriteFile (in: hFile=0x48c, lpBuffer=0x6d71778*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71778*, lpNumberOfBytesWritten=0x358ff14*=0x6200, lpOverlapped=0x0) returned 1 [0251.136] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.137] WriteFile (in: hFile=0x48c, lpBuffer=0x6d77977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77977*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0251.137] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.137] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0251.137] CloseHandle (hObject=0x48c) returned 1 [0252.284] GetProcessHeap () returned 0x580000 [0252.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d71778 | out: hHeap=0x580000) returned 1 [0252.284] GetProcessHeap () returned 0x580000 [0252.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7110038 | out: hHeap=0x580000) returned 1 [0252.291] GetProcessHeap () returned 0x580000 [0252.291] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0254.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd359300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6238, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="BZCD98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCD98~1.YOU")) returned 0x5b9730 [0254.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.360] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML", len=0x3d | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML") returned 1 [0255.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f7c) returned 0x72e5948 [0255.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.852] CloseHandle (hObject=0x4a8) returned 1 [0258.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml.id_1622540890_.your_last_chance")) returned 1 [0258.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd73700, ftCreationTime.dwHighDateTime=0x1c976e8, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdd73700, ftLastWriteTime.dwHighDateTime=0x1c976e8, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSTOR~1.YOU")) returned 0x5b96f0 [0258.853] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.853] GetProcessHeap () returned 0x580000 [0258.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x677cd0 [0258.853] GetProcessHeap () returned 0x580000 [0258.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x635768 [0258.853] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.853] ReadFile (in: hFile=0x4a8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x358ff14*=0xb80, lpOverlapped=0x0) returned 1 [0258.865] GetProcessHeap () returned 0x580000 [0258.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.865] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.865] WriteFile (in: hFile=0x4a8, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x358ff14*=0xb80, lpOverlapped=0x0) returned 1 [0258.865] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.865] WriteFile (in: hFile=0x4a8, lpBuffer=0x6362e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x6362e7*, lpNumberOfBytesWritten=0x358ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.865] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.865] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x358ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.865] CloseHandle (hObject=0x4a8) returned 1 [0258.865] GetProcessHeap () returned 0x580000 [0258.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0258.865] GetProcessHeap () returned 0x580000 [0258.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0258.865] GetProcessHeap () returned 0x580000 [0258.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fccc | out: lpFindFileData=0x358fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd73700, ftCreationTime.dwHighDateTime=0x1c976e8, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1cfdba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba8, dwReserved0=0x358fd28, dwReserved1=0x677cd0, cFileName="DGSTORY.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSTOR~1.YOU")) returned 0x5b9630 [0259.224] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.237] SysReAllocStringLen (in: pbstr=0x358ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV", len=0x3a | out: pbstr=0x358ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV") returned 1 [0259.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2080) returned 0x72e5948 [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0259.416] CloseHandle (hObject=0x42c) returned 1 [0259.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x358ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x358fc74 | out: lpFindFileData=0x358fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ba5800, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17ba5800, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x17e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNDP~1.YOU")) returned 0x5b9630 [0259.417] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0259.417] GetProcessHeap () returned 0x580000 [0259.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71fd698 [0259.418] GetProcessHeap () returned 0x580000 [0259.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x720eec8 [0259.418] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.418] ReadFile (in: hFile=0x42c, lpBuffer=0x71fd698, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x358ff14, lpOverlapped=0x0 | out: lpBuffer=0x71fd698*, lpNumberOfBytesRead=0x358ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 20 os_tid = 0xa48 [0039.061] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.127] Sleep (dwMilliseconds=0x1) [0039.205] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.413] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.676] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0039.928] Sleep (dwMilliseconds=0x1) [0040.059] Sleep (dwMilliseconds=0x1) [0040.294] Sleep (dwMilliseconds=0x1) [0040.352] Sleep (dwMilliseconds=0x1) [0040.376] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.536] Sleep (dwMilliseconds=0x1) [0040.551] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.165] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.354] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.514] Sleep (dwMilliseconds=0x1) [0042.633] Sleep (dwMilliseconds=0x1) [0042.650] Sleep (dwMilliseconds=0x1) [0042.662] Sleep (dwMilliseconds=0x1) [0042.702] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.827] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.858] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0042.999] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.112] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.193] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.342] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.371] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.449] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.512] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.543] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.574] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.697] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.728] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.807] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.885] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.963] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.998] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.060] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.618] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.696] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.961] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.117] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.273] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.320] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.351] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.414] Sleep (dwMilliseconds=0x1) [0045.429] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.554] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.913] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.069] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.178] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.256] Sleep (dwMilliseconds=0x1) [0046.274] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.303] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.334] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.490] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.615] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.646] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.802] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.849] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.880] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.958] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.825] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", len=0x48 | out: pbstr=0x36cff84*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 1 [0059.838] GetProcessHeap () returned 0x580000 [0059.838] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615320, Size=0x18) returned 0x5a58e8 [0059.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0059.856] CloseHandle (hObject=0x44c) returned 1 [0059.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.883] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id_1622540890_.your_last_chance")) returned 1 [0059.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.884] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFLRC~1.YOU")) returned 0x5b96b0 [0059.884] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0059.884] GetProcessHeap () returned 0x580000 [0059.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e1db20 [0059.885] GetProcessHeap () returned 0x580000 [0059.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e2f350 [0059.885] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.885] ReadFile (in: hFile=0x44c, lpBuffer=0x6e1db20, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1db20*, lpNumberOfBytesRead=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0065.700] GetProcessHeap () returned 0x580000 [0065.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0065.700] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.700] WriteFile (in: hFile=0x44c, lpBuffer=0x6e2f350*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2f350*, lpNumberOfBytesWritten=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.433] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.433] WriteFile (in: hFile=0x44c, lpBuffer=0x6e40b4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40b4f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0067.362] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.362] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0067.362] CloseHandle (hObject=0x44c) returned 1 [0074.913] GetProcessHeap () returned 0x580000 [0074.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e2f350 | out: hHeap=0x580000) returned 1 [0074.913] GetProcessHeap () returned 0x580000 [0074.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1db20 | out: hHeap=0x580000) returned 1 [0074.913] GetProcessHeap () returned 0x580000 [0074.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0079.334] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63f3c600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1200228, dwReserved0=0x36cfd28, dwReserved1=0x6e1db20, cFileName="InfLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFLRC~1.YOU")) returned 0x5b96f0 [0079.335] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.350] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", len=0x41 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 1 [0079.350] GetProcessHeap () returned 0x580000 [0079.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x34) returned 0x5f76f0 [0079.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.351] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.958] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", len=0x42 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 1 [0085.958] GetProcessHeap () returned 0x580000 [0085.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb8) returned 0x614a48 [0085.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.959] Sleep (dwMilliseconds=0x1) [0085.975] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", len=0x49 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 1 [0085.975] GetProcessHeap () returned 0x580000 [0085.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x48) returned 0x614a48 [0085.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.987] Sleep (dwMilliseconds=0x1) [0086.487] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", len=0x49 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 1 [0086.487] GetProcessHeap () returned 0x580000 [0086.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.583] CloseHandle (hObject=0x474) returned 1 [0086.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id_1622540890_.your_last_chance")) returned 1 [0086.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLENDS~1.YOU")) returned 0x5b96f0 [0086.584] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.584] GetProcessHeap () returned 0x580000 [0086.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0086.584] GetProcessHeap () returned 0x580000 [0086.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0086.584] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.584] ReadFile (in: hFile=0x474, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x36cff14*=0x200, lpOverlapped=0x0) returned 1 [0086.587] GetProcessHeap () returned 0x580000 [0086.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0086.587] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.587] WriteFile (in: hFile=0x474, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x36cff14*=0x200, lpOverlapped=0x0) returned 1 [0086.587] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.587] WriteFile (in: hFile=0x474, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0086.587] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.587] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0086.587] CloseHandle (hObject=0x474) returned 1 [0086.588] GetProcessHeap () returned 0x580000 [0086.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0086.588] GetProcessHeap () returned 0x580000 [0086.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0086.588] GetProcessHeap () returned 0x580000 [0086.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0086.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b393940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23a, dwReserved0=0x36cfd28, dwReserved1=0x6107d8, cFileName="BLENDS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLENDS~1.YOU")) returned 0x5b96f0 [0086.588] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.908] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 1 [0086.908] GetProcessHeap () returned 0x580000 [0086.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.910] CloseHandle (hObject=0x474) returned 1 [0086.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0086.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x1, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0086.912] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.912] GetProcessHeap () returned 0x580000 [0086.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b21) returned 0x6f2c538 [0086.913] GetProcessHeap () returned 0x580000 [0086.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b21) returned 0x6f33068 [0086.913] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.913] ReadFile (in: hFile=0x474, lpBuffer=0x6f2c538, nNumberOfBytesToRead=0x6b00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2c538*, lpNumberOfBytesRead=0x36cff14*=0x6b00, lpOverlapped=0x0) returned 1 [0087.949] GetProcessHeap () returned 0x580000 [0087.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0087.949] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.949] WriteFile (in: hFile=0x474, lpBuffer=0x6f33068*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f33068*, lpNumberOfBytesWritten=0x36cff14*=0x6b00, lpOverlapped=0x0) returned 1 [0087.949] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.950] WriteFile (in: hFile=0x474, lpBuffer=0x6f39b67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f39b67*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0087.950] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.950] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0087.950] CloseHandle (hObject=0x474) returned 1 [0087.950] GetProcessHeap () returned 0x580000 [0087.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f33068 | out: hHeap=0x580000) returned 1 [0087.950] GetProcessHeap () returned 0x580000 [0087.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2c538 | out: hHeap=0x580000) returned 1 [0087.951] GetProcessHeap () returned 0x580000 [0087.951] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c0850e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b33, dwReserved0=0x36cfd28, dwReserved1=0x6f2c538, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0088.230] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.964] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", len=0x45 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 1 [0091.964] GetProcessHeap () returned 0x580000 [0091.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x44) returned 0x596cd8 [0091.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.972] CloseHandle (hObject=0x4a0) returned 1 [0091.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id_1622540890_.your_last_chance")) returned 1 [0091.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IRISIN~1.YOU")) returned 0x5b9730 [0091.973] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.973] GetProcessHeap () returned 0x580000 [0091.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0091.973] GetProcessHeap () returned 0x580000 [0091.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04eb8 [0091.973] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.973] ReadFile (in: hFile=0x4a0, lpBuffer=0x6d04cc0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesRead=0x36cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0091.976] GetProcessHeap () returned 0x580000 [0091.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.976] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d04eb8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04eb8*, lpNumberOfBytesWritten=0x36cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0091.976] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d05077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d05077*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0091.976] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0091.976] CloseHandle (hObject=0x4a0) returned 1 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04eb8 | out: hHeap=0x580000) returned 1 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0091.977] GetProcessHeap () returned 0x580000 [0091.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e6e73a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x36cfd28, dwReserved1=0x6d04cc0, cFileName="IRIS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IRISIN~1.YOU")) returned 0x5b9730 [0091.977] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.978] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", len=0x4b | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 1 [0091.978] GetProcessHeap () returned 0x580000 [0091.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669420, Size=0x48) returned 0x596c88 [0091.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0091.998] CloseHandle (hObject=0x450) returned 1 [0091.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.998] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0091.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0091.999] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.999] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0091.999] GetProcessHeap () returned 0x580000 [0091.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6c79b98 [0091.999] GetProcessHeap () returned 0x580000 [0091.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6f0c4f8 [0091.999] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.999] ReadFile (in: hFile=0x450, lpBuffer=0x6c79b98, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79b98*, lpNumberOfBytesRead=0x36cff14*=0x4c0, lpOverlapped=0x0) returned 1 [0092.005] GetProcessHeap () returned 0x580000 [0092.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.005] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.005] WriteFile (in: hFile=0x450, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x36cff14*=0x4c0, lpOverlapped=0x0) returned 1 [0092.005] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.005] WriteFile (in: hFile=0x450, lpBuffer=0x6f0c9b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c9b7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.005] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.005] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.005] CloseHandle (hObject=0x450) returned 1 [0092.005] GetProcessHeap () returned 0x580000 [0092.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0092.005] GetProcessHeap () returned 0x580000 [0092.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79b98 | out: hHeap=0x580000) returned 1 [0092.005] GetProcessHeap () returned 0x580000 [0092.005] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e733660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x36cfd28, dwReserved1=0x6c79b98, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.006] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.009] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", len=0x49 | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 1 [0092.009] GetProcessHeap () returned 0x580000 [0092.009] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c56120 [0092.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0092.139] CloseHandle (hObject=0x48c) returned 1 [0092.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.140] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0092.141] GetProcessHeap () returned 0x580000 [0092.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6c79b98 [0092.141] GetProcessHeap () returned 0x580000 [0092.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6f0c4f8 [0092.141] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.141] ReadFile (in: hFile=0x48c, lpBuffer=0x6c79b98, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79b98*, lpNumberOfBytesRead=0x36cff14*=0x560, lpOverlapped=0x0) returned 1 [0092.151] GetProcessHeap () returned 0x580000 [0092.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.151] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.151] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x36cff14*=0x560, lpOverlapped=0x0) returned 1 [0092.151] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.151] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0ca57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca57*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.151] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.152] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.152] CloseHandle (hObject=0x48c) returned 1 [0092.152] GetProcessHeap () returned 0x580000 [0092.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0092.152] GetProcessHeap () returned 0x580000 [0092.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79b98 | out: hHeap=0x580000) returned 1 [0092.152] GetProcessHeap () returned 0x580000 [0092.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e8b0420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x36cfd28, dwReserved1=0x6c79b98, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.152] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.183] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", len=0x4b | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 1 [0092.183] GetProcessHeap () returned 0x580000 [0092.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d62d8, Size=0x74) returned 0x5d6258 [0092.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.208] CloseHandle (hObject=0x464) returned 1 [0092.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.209] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.210] GetProcessHeap () returned 0x580000 [0092.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0092.210] GetProcessHeap () returned 0x580000 [0092.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c55668 [0092.210] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.210] ReadFile (in: hFile=0x464, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x36cff14*=0xa00, lpOverlapped=0x0) returned 1 [0092.317] GetProcessHeap () returned 0x580000 [0092.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.317] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.317] WriteFile (in: hFile=0x464, lpBuffer=0x6c55668*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55668*, lpNumberOfBytesWritten=0x36cff14*=0xa00, lpOverlapped=0x0) returned 1 [0092.317] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.317] WriteFile (in: hFile=0x464, lpBuffer=0x6c56067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56067*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.317] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.317] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.317] CloseHandle (hObject=0x464) returned 1 [0092.317] GetProcessHeap () returned 0x580000 [0092.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c55668 | out: hHeap=0x580000) returned 1 [0092.317] GetProcessHeap () returned 0x580000 [0092.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0092.318] GetProcessHeap () returned 0x580000 [0092.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea2d1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x36cfd28, dwReserved1=0x6c676b8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.318] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.332] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", len=0x4a | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 1 [0092.332] GetProcessHeap () returned 0x580000 [0092.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x668d98 [0092.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0099.251] CloseHandle (hObject=0x46c) returned 1 [0099.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0099.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.252] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0099.253] GetProcessHeap () returned 0x580000 [0099.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6d04600 [0099.253] GetProcessHeap () returned 0x580000 [0099.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6f0c4f8 [0099.253] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.253] ReadFile (in: hFile=0x46c, lpBuffer=0x6d04600, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04600*, lpNumberOfBytesRead=0x36cff14*=0x660, lpOverlapped=0x0) returned 1 [0099.260] GetProcessHeap () returned 0x580000 [0099.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.260] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.260] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x36cff14*=0x660, lpOverlapped=0x0) returned 1 [0099.260] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.260] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0cb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cb57*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0099.260] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.260] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0099.260] CloseHandle (hObject=0x46c) returned 1 [0099.260] GetProcessHeap () returned 0x580000 [0099.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0099.260] GetProcessHeap () returned 0x580000 [0099.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04600 | out: hHeap=0x580000) returned 1 [0099.260] GetProcessHeap () returned 0x580000 [0099.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72c615c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x36cfd28, dwReserved1=0x6d04600, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.261] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.402] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x36cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 1 [0101.402] GetProcessHeap () returned 0x580000 [0101.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0101.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0102.228] CloseHandle (hObject=0x43c) returned 1 [0102.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0103.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0103.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0103.894] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0103.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0103.928] GetProcessHeap () returned 0x580000 [0103.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82e1) returned 0x6f10048 [0103.928] GetProcessHeap () returned 0x580000 [0103.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x82e1) returned 0x6c4b0c8 [0103.929] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.929] ReadFile (in: hFile=0x4b0, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x82c0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x36cff14*=0x82c0, lpOverlapped=0x0) returned 1 [0105.375] GetProcessHeap () returned 0x580000 [0105.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0105.375] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.375] WriteFile (in: hFile=0x4b0, lpBuffer=0x6c4b0c8*, nNumberOfBytesToWrite=0x82c0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4b0c8*, lpNumberOfBytesWritten=0x36cff14*=0x82c0, lpOverlapped=0x0) returned 1 [0105.375] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.375] WriteFile (in: hFile=0x4b0, lpBuffer=0x6c53387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c53387*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0105.375] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.375] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0105.376] CloseHandle (hObject=0x4b0) returned 1 [0105.376] GetProcessHeap () returned 0x580000 [0105.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4b0c8 | out: hHeap=0x580000) returned 1 [0105.376] GetProcessHeap () returned 0x580000 [0105.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0105.376] GetProcessHeap () returned 0x580000 [0105.376] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0105.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x766b30c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x82eb, dwReserved0=0x36cfd28, dwReserved1=0x6f10048, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0105.376] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.054] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", len=0x58 | out: pbstr=0x36cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.054] GetProcessHeap () returned 0x580000 [0112.054] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.066] Sleep (dwMilliseconds=0x1) [0112.160] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", len=0x4d | out: pbstr=0x36cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 1 [0112.160] GetProcessHeap () returned 0x580000 [0112.160] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9630 [0112.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.187] Sleep (dwMilliseconds=0x1) [0112.339] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x36cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.339] GetProcessHeap () returned 0x580000 [0112.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.340] Sleep (dwMilliseconds=0x1) [0112.357] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", len=0x3d | out: pbstr=0x36cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png") returned 1 [0112.357] GetProcessHeap () returned 0x580000 [0112.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x58) returned 0x5a4778 [0112.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.357] Sleep (dwMilliseconds=0x1) [0112.388] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", len=0x47 | out: pbstr=0x36cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned 1 [0112.388] GetProcessHeap () returned 0x580000 [0112.388] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f810, Size=0x2c) returned 0x61f8f0 [0112.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.388] Sleep (dwMilliseconds=0x1) [0113.315] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", len=0x3f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 1 [0113.315] GetProcessHeap () returned 0x580000 [0113.315] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xe8) returned 0x6f0ceb8 [0113.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0113.492] CloseHandle (hObject=0x470) returned 1 [0113.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0410~1.YOU")) returned 0x5b9630 [0114.966] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0114.966] GetProcessHeap () returned 0x580000 [0114.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6c676b8 [0114.966] GetProcessHeap () returned 0x580000 [0114.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6c2a820 [0114.966] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.966] ReadFile (in: hFile=0x470, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x36cff14*=0x920, lpOverlapped=0x0) returned 1 [0114.976] GetProcessHeap () returned 0x580000 [0114.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.976] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.976] WriteFile (in: hFile=0x470, lpBuffer=0x6c2a820*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesWritten=0x36cff14*=0x920, lpOverlapped=0x0) returned 1 [0114.976] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.976] WriteFile (in: hFile=0x470, lpBuffer=0x6c2b13f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2b13f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.976] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.976] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.976] CloseHandle (hObject=0x470) returned 1 [0114.985] GetProcessHeap () returned 0x580000 [0114.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0114.985] GetProcessHeap () returned 0x580000 [0114.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0114.985] GetProcessHeap () returned 0x580000 [0114.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c257fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x94c, dwReserved0=0x36cfd28, dwReserved1=0x6c676b8, cFileName="AN04108_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0410~1.YOU")) returned 0x5b9630 [0116.063] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0116.065] CloseHandle (hObject=0x3fc) returned 1 [0116.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~3.YOU")) returned 0x5b9630 [0116.066] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0116.066] GetProcessHeap () returned 0x580000 [0116.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7aa1) returned 0x6da5d70 [0116.066] GetProcessHeap () returned 0x580000 [0116.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7aa1) returned 0x6dad820 [0116.066] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.066] ReadFile (in: hFile=0x3fc, lpBuffer=0x6da5d70, nNumberOfBytesToRead=0x7a80, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6da5d70*, lpNumberOfBytesRead=0x36cff14*=0x7a80, lpOverlapped=0x0) returned 1 [0117.748] GetProcessHeap () returned 0x580000 [0117.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0117.748] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.748] WriteFile (in: hFile=0x3fc, lpBuffer=0x6dad820*, nNumberOfBytesToWrite=0x7a80, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dad820*, lpNumberOfBytesWritten=0x36cff14*=0x7a80, lpOverlapped=0x0) returned 1 [0117.748] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.748] WriteFile (in: hFile=0x3fc, lpBuffer=0x6db529f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db529f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0117.748] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.748] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0117.748] CloseHandle (hObject=0x3fc) returned 1 [0117.928] GetProcessHeap () returned 0x580000 [0117.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dad820 | out: hHeap=0x580000) returned 1 [0117.928] GetProcessHeap () returned 0x580000 [0117.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6da5d70 | out: hHeap=0x580000) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dcad320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7aa4, dwReserved0=0x36cfd28, dwReserved1=0x6da5d70, cFileName="SO00152_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~3.YOU")) returned 0x5b96f0 [0120.014] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.031] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", len=0x3f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF") returned 1 [0120.031] GetProcessHeap () returned 0x580000 [0120.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1794) returned 0x6d06ca8 [0120.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.920] CloseHandle (hObject=0x470) returned 1 [0121.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0183~2.YOU")) returned 0x5b9730 [0121.922] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.922] GetProcessHeap () returned 0x580000 [0121.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6c65108 [0121.922] GetProcessHeap () returned 0x580000 [0121.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6c79898 [0121.922] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.922] ReadFile (in: hFile=0x470, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x36cff14*=0x440, lpOverlapped=0x0) returned 1 [0121.927] GetProcessHeap () returned 0x580000 [0121.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.927] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.927] WriteFile (in: hFile=0x470, lpBuffer=0x6c79898*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesWritten=0x36cff14*=0x440, lpOverlapped=0x0) returned 1 [0121.927] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.927] WriteFile (in: hFile=0x470, lpBuffer=0x6c79cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79cd7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0121.927] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.927] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0121.928] CloseHandle (hObject=0x470) returned 1 [0121.928] GetProcessHeap () returned 0x580000 [0121.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0121.928] GetProcessHeap () returned 0x580000 [0121.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0121.928] GetProcessHeap () returned 0x580000 [0121.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8048c3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x36cfd28, dwReserved1=0x6c65108, cFileName="WB01839_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0183~2.YOU")) returned 0x5b9730 [0122.564] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.564] Sleep (dwMilliseconds=0x1) [0122.607] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", len=0x4f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned 1 [0122.607] GetProcessHeap () returned 0x580000 [0122.607] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1944) returned 0x6f42f08 [0122.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.694] CloseHandle (hObject=0x440) returned 1 [0124.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.id_1622540890_.your_last_chance")) returned 1 [0125.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0125.412] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0125.412] GetProcessHeap () returned 0x580000 [0125.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0125.412] GetProcessHeap () returned 0x580000 [0125.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0125.412] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.412] ReadFile (in: hFile=0x440, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x36cff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.426] GetProcessHeap () returned 0x580000 [0125.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.426] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.426] WriteFile (in: hFile=0x440, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x36cff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.426] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.426] WriteFile (in: hFile=0x440, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0125.426] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.426] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0125.426] CloseHandle (hObject=0x440) returned 1 [0125.426] GetProcessHeap () returned 0x580000 [0125.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0125.426] GetProcessHeap () returned 0x580000 [0125.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0125.426] GetProcessHeap () returned 0x580000 [0125.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82605900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x36cfd28, dwReserved1=0x6f69420, cFileName="Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0125.426] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.443] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", len=0x3d | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned 1 [0125.443] GetProcessHeap () returned 0x580000 [0125.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a00) returned 0x667250 [0125.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0128.616] CloseHandle (hObject=0x43c) returned 1 [0128.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03322~1.YOU")) returned 0x5b9730 [0130.760] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0130.760] GetProcessHeap () returned 0x580000 [0130.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5181) returned 0x6e38520 [0130.760] GetProcessHeap () returned 0x580000 [0130.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5181) returned 0x6e3d6b0 [0130.761] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.761] ReadFile (in: hFile=0x43c, lpBuffer=0x6e38520, nNumberOfBytesToRead=0x5160, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e38520*, lpNumberOfBytesRead=0x36cff14*=0x5160, lpOverlapped=0x0) returned 1 [0131.778] GetProcessHeap () returned 0x580000 [0131.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0131.778] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.778] WriteFile (in: hFile=0x43c, lpBuffer=0x6e3d6b0*, nNumberOfBytesToWrite=0x5160, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3d6b0*, lpNumberOfBytesWritten=0x36cff14*=0x5160, lpOverlapped=0x0) returned 1 [0131.779] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.779] WriteFile (in: hFile=0x43c, lpBuffer=0x6e4280f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4280f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0131.779] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.779] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0131.779] CloseHandle (hObject=0x43c) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3d6b0 | out: hHeap=0x580000) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e38520 | out: hHeap=0x580000) returned 1 [0132.907] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0135.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x862928a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x518c, dwReserved0=0x36cfd28, dwReserved1=0x6e38520, cFileName="J0332268.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03322~1.YOU")) returned 0x5b96f0 [0135.293] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.293] Sleep (dwMilliseconds=0x1) [0135.302] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", len=0x43 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned 1 [0135.302] GetProcessHeap () returned 0x580000 [0135.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.153] CloseHandle (hObject=0x4a0) returned 1 [0139.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89da00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5b89da00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2149~1.YOU")) returned 0x5b97b0 [0139.803] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0139.803] GetProcessHeap () returned 0x580000 [0139.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61120 [0139.804] GetProcessHeap () returned 0x580000 [0139.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61428 [0139.809] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.809] ReadFile (in: hFile=0x428, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x36cff14*=0x2c0, lpOverlapped=0x0) returned 1 [0139.813] GetProcessHeap () returned 0x580000 [0139.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.813] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.813] WriteFile (in: hFile=0x428, lpBuffer=0x6c61428*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61428*, lpNumberOfBytesWritten=0x36cff14*=0x2c0, lpOverlapped=0x0) returned 1 [0139.813] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.813] WriteFile (in: hFile=0x428, lpBuffer=0x6c616e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c616e7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0139.813] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.813] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0139.813] CloseHandle (hObject=0x428) returned 1 [0139.813] GetProcessHeap () returned 0x580000 [0139.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61428 | out: hHeap=0x580000) returned 1 [0139.813] GetProcessHeap () returned 0x580000 [0139.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0139.813] GetProcessHeap () returned 0x580000 [0139.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89da00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8af30cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x36cfd28, dwReserved1=0x6c61120, cFileName="BD21495_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2149~1.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.174] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", len=0x5f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned 1 [0140.174] GetProcessHeap () returned 0x580000 [0140.174] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.720] CloseHandle (hObject=0x490) returned 1 [0140.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.id_1622540890_.your_last_chance")) returned 1 [0140.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="Document.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCUME~1.YOU")) returned 0x5b9730 [0140.721] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.721] GetProcessHeap () returned 0x580000 [0140.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6cf6cf0 [0140.721] GetProcessHeap () returned 0x580000 [0140.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6cf7678 [0140.721] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.721] ReadFile (in: hFile=0x490, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x36cff14*=0x920, lpOverlapped=0x0) returned 1 [0140.730] GetProcessHeap () returned 0x580000 [0140.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf930 [0140.731] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.731] WriteFile (in: hFile=0x490, lpBuffer=0x6cf7678*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7678*, lpNumberOfBytesWritten=0x36cff14*=0x920, lpOverlapped=0x0) returned 1 [0140.731] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.731] WriteFile (in: hFile=0x490, lpBuffer=0x6cf7f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7f97*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.731] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.731] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.731] CloseHandle (hObject=0x490) returned 1 [0140.731] GetProcessHeap () returned 0x580000 [0140.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf7678 | out: hHeap=0x580000) returned 1 [0140.731] GetProcessHeap () returned 0x580000 [0140.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0140.731] GetProcessHeap () returned 0x580000 [0140.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf930 | out: hHeap=0x580000) returned 1 [0141.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b7f7de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x955, dwReserved0=0x36cfd28, dwReserved1=0x6cf6cf0, cFileName="Document.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCUME~1.YOU")) returned 0x5b9730 [0141.617] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.665] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", len=0x3c | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned 1 [0141.665] GetProcessHeap () returned 0x580000 [0141.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0141.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.702] CloseHandle (hObject=0x4a0) returned 1 [0141.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.id_1622540890_.your_last_chance")) returned 1 [0141.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45f1aa00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~3.YOU")) returned 0x5b9730 [0141.703] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.703] GetProcessHeap () returned 0x580000 [0141.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e21) returned 0x6ec4068 [0141.703] GetProcessHeap () returned 0x580000 [0141.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e21) returned 0x6599d0 [0141.703] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.703] ReadFile (in: hFile=0x4a0, lpBuffer=0x6ec4068, nNumberOfBytesToRead=0x4e00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesRead=0x36cff14*=0x4e00, lpOverlapped=0x0) returned 1 [0142.287] GetProcessHeap () returned 0x580000 [0142.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0142.287] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.287] WriteFile (in: hFile=0x4a0, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x36cff14*=0x4e00, lpOverlapped=0x0) returned 1 [0142.287] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.287] WriteFile (in: hFile=0x4a0, lpBuffer=0x65e7cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x65e7cf*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0142.287] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.287] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0142.287] CloseHandle (hObject=0x4a0) returned 1 [0142.976] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0142.976] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0142.976] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0146.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c6b2600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4e24, dwReserved0=0x36cfd28, dwReserved1=0x6ec4068, cFileName="PROTTPLV.DOC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~3.YOU")) returned 0x5b96f0 [0146.860] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.875] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", len=0x44 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned 1 [0146.875] GetProcessHeap () returned 0x580000 [0146.875] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0146.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0152.924] CloseHandle (hObject=0x46c) returned 1 [0152.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR30~1.YOU")) returned 0x5b9730 [0152.925] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0152.925] GetProcessHeap () returned 0x580000 [0152.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4be1) returned 0x7089278 [0152.925] GetProcessHeap () returned 0x580000 [0152.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4be1) returned 0x708de68 [0152.925] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.925] ReadFile (in: hFile=0x46c, lpBuffer=0x7089278, nNumberOfBytesToRead=0x4bc0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7089278*, lpNumberOfBytesRead=0x36cff14*=0x4bc0, lpOverlapped=0x0) returned 1 [0154.137] GetProcessHeap () returned 0x580000 [0154.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.137] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.137] WriteFile (in: hFile=0x46c, lpBuffer=0x708de68*, nNumberOfBytesToWrite=0x4bc0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x708de68*, lpNumberOfBytesWritten=0x36cff14*=0x4bc0, lpOverlapped=0x0) returned 1 [0154.138] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.138] WriteFile (in: hFile=0x46c, lpBuffer=0x7092a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7092a27*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0154.138] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.138] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0154.138] CloseHandle (hObject=0x46c) returned 1 [0154.138] GetProcessHeap () returned 0x580000 [0154.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708de68 | out: hHeap=0x580000) returned 1 [0154.138] GetProcessHeap () returned 0x580000 [0154.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7089278 | out: hHeap=0x580000) returned 1 [0154.138] GetProcessHeap () returned 0x580000 [0154.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937c3b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4bfe, dwReserved0=0x36cfd28, dwReserved1=0x7089278, cFileName="PDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR30~1.YOU")) returned 0x5b9630 [0154.138] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.684] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", len=0x45 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 1 [0154.684] GetProcessHeap () returned 0x580000 [0154.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0154.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0159.186] CloseHandle (hObject=0x410) returned 1 [0159.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0159.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIC124~1.YOU")) returned 0x5b9630 [0159.215] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0159.215] GetProcessHeap () returned 0x580000 [0159.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0159.215] GetProcessHeap () returned 0x580000 [0159.215] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0159.215] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.215] ReadFile (in: hFile=0x410, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x36cff14*=0x60, lpOverlapped=0x0) returned 1 [0159.216] GetProcessHeap () returned 0x580000 [0159.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.217] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.217] WriteFile (in: hFile=0x410, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x36cff14*=0x60, lpOverlapped=0x0) returned 1 [0159.217] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.217] WriteFile (in: hFile=0x410, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0159.217] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.217] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0159.217] CloseHandle (hObject=0x410) returned 1 [0159.217] GetProcessHeap () returned 0x580000 [0159.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0159.217] GetProcessHeap () returned 0x580000 [0159.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0159.217] GetProcessHeap () returned 0x580000 [0159.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96843b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x36cfd28, dwReserved1=0x61b540, cFileName="WINPROJ.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIC124~1.YOU")) returned 0x5b9730 [0164.393] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.436] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", len=0x35 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned 1 [0164.436] GetProcessHeap () returned 0x580000 [0164.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0164.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.656] CloseHandle (hObject=0x460) returned 1 [0166.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id_1622540890_.your_last_chance")) returned 1 [0166.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVZIP~1.YOU")) returned 0x5b9730 [0166.657] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.657] GetProcessHeap () returned 0x580000 [0166.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d49338 [0166.657] GetProcessHeap () returned 0x580000 [0166.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d5ab68 [0166.657] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.657] ReadFile (in: hFile=0x460, lpBuffer=0x6d49338, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d49338*, lpNumberOfBytesRead=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.085] GetProcessHeap () returned 0x580000 [0169.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0169.085] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.086] WriteFile (in: hFile=0x460, lpBuffer=0x6d5ab68*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d5ab68*, lpNumberOfBytesWritten=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.086] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.086] WriteFile (in: hFile=0x460, lpBuffer=0x6d6c367*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6c367*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0169.171] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.171] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0169.171] CloseHandle (hObject=0x460) returned 1 [0169.171] GetProcessHeap () returned 0x580000 [0169.171] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d5ab68 | out: hHeap=0x580000) returned 1 [0169.172] GetProcessHeap () returned 0x580000 [0169.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d49338 | out: hHeap=0x580000) returned 1 [0169.172] GetProcessHeap () returned 0x580000 [0169.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0172.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c72e880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2e2608, dwReserved0=0x36cfd28, dwReserved1=0x6d49338, cFileName="ADVZIP.DIC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADVZIP~1.YOU")) returned 0x5b9770 [0172.812] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.860] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", len=0x3e | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 1 [0172.860] GetProcessHeap () returned 0x580000 [0172.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2274) returned 0x6f14048 [0172.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0172.913] CloseHandle (hObject=0x4a4) returned 1 [0172.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNCF~1.YOU")) returned 0x5b9770 [0172.926] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0172.926] GetProcessHeap () returned 0x580000 [0172.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4adb0 [0172.926] GetProcessHeap () returned 0x580000 [0172.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4b078 [0172.926] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.926] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c4adb0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4adb0*, lpNumberOfBytesRead=0x36cff14*=0x280, lpOverlapped=0x0) returned 1 [0172.930] GetProcessHeap () returned 0x580000 [0172.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0172.930] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.930] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c4b078*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4b078*, lpNumberOfBytesWritten=0x36cff14*=0x280, lpOverlapped=0x0) returned 1 [0172.930] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.930] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c4b2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4b2f7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0172.930] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.930] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0172.930] CloseHandle (hObject=0x4a4) returned 1 [0172.930] GetProcessHeap () returned 0x580000 [0172.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4b078 | out: hHeap=0x580000) returned 1 [0172.930] GetProcessHeap () returned 0x580000 [0172.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4adb0 | out: hHeap=0x580000) returned 1 [0172.930] GetProcessHeap () returned 0x580000 [0172.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb093e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x36cfd28, dwReserved1=0x6c4adb0, cFileName="SIGN.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNCF~1.YOU")) returned 0x5b9770 [0173.243] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.254] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", len=0x3e | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 1 [0173.254] GetProcessHeap () returned 0x580000 [0173.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0173.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.257] CloseHandle (hObject=0x490) returned 1 [0173.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id_1622540890_.your_last_chance")) returned 1 [0173.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECSIC~1.YOU")) returned 0x5b9770 [0173.258] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.258] GetProcessHeap () returned 0x580000 [0173.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.258] GetProcessHeap () returned 0x580000 [0173.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.258] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.258] ReadFile (in: hFile=0x490, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x36cff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.269] GetProcessHeap () returned 0x580000 [0173.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.269] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.269] WriteFile (in: hFile=0x490, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x36cff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.269] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.269] WriteFile (in: hFile=0x490, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.269] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.270] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.270] CloseHandle (hObject=0x490) returned 1 [0173.270] GetProcessHeap () returned 0x580000 [0173.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0173.270] GetProcessHeap () returned 0x580000 [0173.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0173.270] GetProcessHeap () returned 0x580000 [0173.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ee4f220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x36cfd28, dwReserved1=0x662288, cFileName="RECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECSIC~1.YOU")) returned 0x5b9730 [0174.460] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.471] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK", len=0x43 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 1 [0174.471] GetProcessHeap () returned 0x580000 [0174.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0174.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.472] CloseHandle (hObject=0x440) returned 1 [0174.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0174.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~3.YOU")) returned 0x5b9730 [0174.473] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.473] GetProcessHeap () returned 0x580000 [0174.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0174.473] GetProcessHeap () returned 0x580000 [0174.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0174.473] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.473] ReadFile (in: hFile=0x440, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x36cff14*=0x60, lpOverlapped=0x0) returned 1 [0174.474] GetProcessHeap () returned 0x580000 [0174.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.474] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.474] WriteFile (in: hFile=0x440, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x36cff14*=0x60, lpOverlapped=0x0) returned 1 [0174.475] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.475] WriteFile (in: hFile=0x440, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.475] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.475] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.475] CloseHandle (hObject=0x440) returned 1 [0174.475] GetProcessHeap () returned 0x580000 [0174.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0174.475] GetProcessHeap () returned 0x580000 [0174.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0174.475] GetProcessHeap () returned 0x580000 [0174.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f9c3c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x36cfd28, dwReserved1=0x61b540, cFileName="VISIO_STD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~3.YOU")) returned 0x5b9730 [0174.475] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.486] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC", len=0x41 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 1 [0174.486] GetProcessHeap () returned 0x580000 [0174.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0174.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.487] CloseHandle (hObject=0x484) returned 1 [0174.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0174.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI30A9~1.YOU")) returned 0x5b96b0 [0174.488] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.488] GetProcessHeap () returned 0x580000 [0174.488] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0174.489] GetProcessHeap () returned 0x580000 [0174.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0174.489] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.489] ReadFile (in: hFile=0x484, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x36cff14*=0x280, lpOverlapped=0x0) returned 1 [0174.492] GetProcessHeap () returned 0x580000 [0174.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.492] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.492] WriteFile (in: hFile=0x484, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x36cff14*=0x280, lpOverlapped=0x0) returned 1 [0174.492] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.493] WriteFile (in: hFile=0x484, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.493] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.493] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.493] CloseHandle (hObject=0x484) returned 1 [0174.493] GetProcessHeap () returned 0x580000 [0174.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0174.493] GetProcessHeap () returned 0x580000 [0174.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0174.493] GetProcessHeap () returned 0x580000 [0174.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f9e9d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x36cfd28, dwReserved1=0x6c4a820, cFileName="VISIO_STD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI30A9~1.YOU")) returned 0x5b96b0 [0174.493] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0176.846] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", len=0x3c | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM") returned 1 [0176.846] GetProcessHeap () returned 0x580000 [0176.846] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0176.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0179.652] CloseHandle (hObject=0x46c) returned 1 [0179.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.id_1622540890_.your_last_chance")) returned 1 [0179.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d3a600, ftCreationTime.dwHighDateTime=0x1be1dd7, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1d3a600, ftLastWriteTime.dwHighDateTime=0x1be1dd7, nFileSizeHigh=0x0, nFileSizeLow=0xc06d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RPLBRF~1.YOU")) returned 0x5b96f0 [0179.653] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0179.654] GetProcessHeap () returned 0x580000 [0179.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc081) returned 0x6d10048 [0179.654] GetProcessHeap () returned 0x580000 [0179.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc081) returned 0x6d1c0d8 [0179.654] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.654] ReadFile (in: hFile=0x46c, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xc060, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x36cff14*=0xc060, lpOverlapped=0x0) returned 1 [0181.901] GetProcessHeap () returned 0x580000 [0181.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0181.901] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.901] WriteFile (in: hFile=0x46c, lpBuffer=0x6d1c0d8*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1c0d8*, lpNumberOfBytesWritten=0x36cff14*=0xc060, lpOverlapped=0x0) returned 1 [0181.901] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.901] WriteFile (in: hFile=0x46c, lpBuffer=0x6d28137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d28137*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0181.902] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.902] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0181.902] CloseHandle (hObject=0x46c) returned 1 [0181.902] GetProcessHeap () returned 0x580000 [0181.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1c0d8 | out: hHeap=0x580000) returned 1 [0181.902] GetProcessHeap () returned 0x580000 [0181.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0181.902] GetProcessHeap () returned 0x580000 [0181.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d3a600, ftCreationTime.dwHighDateTime=0x1be1dd7, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4094a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc091, dwReserved0=0x36cfd28, dwReserved1=0x6d10048, cFileName="RPLBRF35.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RPLBRF~1.YOU")) returned 0x5b96b0 [0183.424] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.461] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", len=0x6d | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned 1 [0183.462] GetProcessHeap () returned 0x580000 [0183.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0183.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0183.462] CloseHandle (hObject=0x480) returned 1 [0183.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x70006a, dwReserved1=0x2e0067, cFileName="DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b96b0 [0183.464] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0183.464] GetProcessHeap () returned 0x580000 [0183.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3941) returned 0x708b6b8 [0183.464] GetProcessHeap () returned 0x580000 [0183.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3941) returned 0x6e10830 [0183.464] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.464] ReadFile (in: hFile=0x480, lpBuffer=0x708b6b8, nNumberOfBytesToRead=0x3920, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x708b6b8*, lpNumberOfBytesRead=0x36cff14*=0x3920, lpOverlapped=0x0) returned 1 [0184.338] GetProcessHeap () returned 0x580000 [0184.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.338] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.338] WriteFile (in: hFile=0x480, lpBuffer=0x6e10830*, nNumberOfBytesToWrite=0x3920, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e10830*, lpNumberOfBytesWritten=0x36cff14*=0x3920, lpOverlapped=0x0) returned 1 [0184.338] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.338] WriteFile (in: hFile=0x480, lpBuffer=0x6e1414f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1414f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.339] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.339] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.339] CloseHandle (hObject=0x480) returned 1 [0184.339] GetProcessHeap () returned 0x580000 [0184.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e10830 | out: hHeap=0x580000) returned 1 [0184.339] GetProcessHeap () returned 0x580000 [0184.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708b6b8 | out: hHeap=0x580000) returned 1 [0184.339] GetProcessHeap () returned 0x580000 [0184.339] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa57ca100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x36cfd28, dwReserved1=0x708b6b8, cFileName="DiscussionToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~2.YOU")) returned 0x5b9770 [0184.339] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.736] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", len=0x51 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned 1 [0184.736] GetProcessHeap () returned 0x580000 [0184.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x211c) returned 0x6f14048 [0184.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.103] CloseHandle (hObject=0x43c) returned 1 [0185.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46b7a400, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x3efd, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOA388~1.YOU")) returned 0x5b9770 [0185.104] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.104] GetProcessHeap () returned 0x580000 [0185.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f01) returned 0x715c008 [0185.104] GetProcessHeap () returned 0x580000 [0185.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f01) returned 0x715ff18 [0185.104] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.104] ReadFile (in: hFile=0x43c, lpBuffer=0x715c008, nNumberOfBytesToRead=0x3ee0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x36cff14*=0x3ee0, lpOverlapped=0x0) returned 1 [0185.299] GetProcessHeap () returned 0x580000 [0185.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.299] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.299] WriteFile (in: hFile=0x43c, lpBuffer=0x715ff18*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x715ff18*, lpNumberOfBytesWritten=0x36cff14*=0x3ee0, lpOverlapped=0x0) returned 1 [0185.300] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.300] WriteFile (in: hFile=0x43c, lpBuffer=0x7163df7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7163df7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0185.300] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.300] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0185.300] CloseHandle (hObject=0x43c) returned 1 [0185.300] GetProcessHeap () returned 0x580000 [0185.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715ff18 | out: hHeap=0x580000) returned 1 [0185.300] GetProcessHeap () returned 0x580000 [0185.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0185.300] GetProcessHeap () returned 0x580000 [0185.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6103640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3f21, dwReserved0=0x36cfd28, dwReserved1=0x715c008, cFileName="NotifierBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOA388~1.YOU")) returned 0x5b9770 [0185.535] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.583] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", len=0x55 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned 1 [0185.583] GetProcessHeap () returned 0x580000 [0185.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0185.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.977] CloseHandle (hObject=0x4a8) returned 1 [0186.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATALI~2.YOU")) returned 0x5b96b0 [0186.978] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.978] GetProcessHeap () returned 0x580000 [0186.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef020 [0186.978] GetProcessHeap () returned 0x580000 [0186.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef768 [0186.978] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.978] ReadFile (in: hFile=0x4a8, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x36cff14*=0x700, lpOverlapped=0x0) returned 1 [0186.986] GetProcessHeap () returned 0x580000 [0186.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0186.986] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.986] WriteFile (in: hFile=0x4a8, lpBuffer=0x6eef768*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef768*, lpNumberOfBytesWritten=0x36cff14*=0x700, lpOverlapped=0x0) returned 1 [0186.986] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.986] WriteFile (in: hFile=0x4a8, lpBuffer=0x6eefe67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefe67*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0186.986] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.986] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0186.986] CloseHandle (hObject=0x4a8) returned 1 [0186.986] GetProcessHeap () returned 0x580000 [0186.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef768 | out: hHeap=0x580000) returned 1 [0186.986] GetProcessHeap () returned 0x580000 [0186.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0186.986] GetProcessHeap () returned 0x580000 [0186.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0186.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7114ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x36cfd28, dwReserved1=0x6eef020, cFileName="DataListIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATALI~2.YOU")) returned 0x5b96b0 [0186.987] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.016] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", len=0x65 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned 1 [0187.016] GetProcessHeap () returned 0x580000 [0187.016] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0187.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.625] CloseHandle (hObject=0x478) returned 1 [0188.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.id_1622540890_.your_last_chance")) returned 1 [0188.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfa1, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b9770 [0188.626] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.626] GetProcessHeap () returned 0x580000 [0188.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x658970 [0188.626] GetProcessHeap () returned 0x580000 [0188.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x6efb008 [0188.627] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.627] ReadFile (in: hFile=0x478, lpBuffer=0x658970, nNumberOfBytesToRead=0xfa0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesRead=0x36cff14*=0xfa0, lpOverlapped=0x0) returned 1 [0188.641] GetProcessHeap () returned 0x580000 [0188.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.641] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.641] WriteFile (in: hFile=0x478, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x36cff14*=0xfa0, lpOverlapped=0x0) returned 1 [0188.641] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.641] WriteFile (in: hFile=0x478, lpBuffer=0x6efbfa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efbfa7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.642] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.642] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0188.642] CloseHandle (hObject=0x478) returned 1 [0188.642] GetProcessHeap () returned 0x580000 [0188.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0188.642] GetProcessHeap () returned 0x580000 [0188.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0188.642] GetProcessHeap () returned 0x580000 [0188.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80d9c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfc5, dwReserved0=0x36cfd28, dwReserved1=0x658970, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b9770 [0191.678] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.681] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", len=0x45 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned 1 [0191.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0191.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0191.709] CloseHandle (hObject=0x440) returned 1 [0191.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~4.YOU")) returned 0x5b9770 [0191.711] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0191.711] GetProcessHeap () returned 0x580000 [0191.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2081) returned 0x706c418 [0191.711] GetProcessHeap () returned 0x580000 [0191.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2081) returned 0x6f202d0 [0191.711] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.711] ReadFile (in: hFile=0x440, lpBuffer=0x706c418, nNumberOfBytesToRead=0x2060, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x706c418*, lpNumberOfBytesRead=0x36cff14*=0x2060, lpOverlapped=0x0) returned 1 [0191.749] GetProcessHeap () returned 0x580000 [0191.749] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0191.749] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x440, lpBuffer=0x6f202d0*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f202d0*, lpNumberOfBytesWritten=0x36cff14*=0x2060, lpOverlapped=0x0) returned 1 [0191.749] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x440, lpBuffer=0x6f2232f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2232f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0191.749] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.749] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0191.749] CloseHandle (hObject=0x440) returned 1 [0191.749] GetProcessHeap () returned 0x580000 [0191.749] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f202d0 | out: hHeap=0x580000) returned 1 [0191.749] GetProcessHeap () returned 0x580000 [0191.749] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706c418 | out: hHeap=0x580000) returned 1 [0191.749] GetProcessHeap () returned 0x580000 [0191.749] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0191.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e74e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2096, dwReserved0=0x36cfd28, dwReserved1=0x706c418, cFileName="ZPDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~4.YOU")) returned 0x5b9770 [0193.113] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.128] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", len=0x5f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned 1 [0193.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0193.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0193.130] CloseHandle (hObject=0x43c) returned 1 [0193.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.id_1622540890_.your_last_chance")) returned 1 [0193.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b9770 [0193.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0193.132] GetProcessHeap () returned 0x580000 [0193.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x7057378 [0193.132] GetProcessHeap () returned 0x580000 [0193.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x6d71658 [0193.132] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.132] ReadFile (in: hFile=0x43c, lpBuffer=0x7057378, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7057378*, lpNumberOfBytesRead=0x36cff14*=0x6140, lpOverlapped=0x0) returned 1 [0195.804] GetProcessHeap () returned 0x580000 [0195.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.804] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.804] WriteFile (in: hFile=0x43c, lpBuffer=0x6d71658*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71658*, lpNumberOfBytesWritten=0x36cff14*=0x6140, lpOverlapped=0x0) returned 1 [0195.805] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.805] WriteFile (in: hFile=0x43c, lpBuffer=0x6d77797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77797*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0195.805] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.805] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0195.805] CloseHandle (hObject=0x43c) returned 1 [0195.805] GetProcessHeap () returned 0x580000 [0195.805] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d71658 | out: hHeap=0x580000) returned 1 [0195.805] GetProcessHeap () returned 0x580000 [0195.805] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7057378 | out: hHeap=0x580000) returned 1 [0195.805] GetProcessHeap () returned 0x580000 [0195.805] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac5233a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6172, dwReserved0=0x36cfd28, dwReserved1=0x7057378, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b97b0 [0197.152] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.185] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", len=0x43 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned 1 [0197.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0197.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.871] CloseHandle (hObject=0x450) returned 1 [0197.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.id_1622540890_.your_last_chance")) returned 1 [0197.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6054, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR7B~1.YOU")) returned 0x5b9830 [0197.872] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0197.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.872] GetProcessHeap () returned 0x580000 [0197.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6061) returned 0x7062940 [0197.872] GetProcessHeap () returned 0x580000 [0197.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6061) returned 0x70689b0 [0197.872] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.872] ReadFile (in: hFile=0x450, lpBuffer=0x7062940, nNumberOfBytesToRead=0x6040, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesRead=0x36cff14*=0x6040, lpOverlapped=0x0) returned 1 [0198.364] GetProcessHeap () returned 0x580000 [0198.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0198.364] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.364] WriteFile (in: hFile=0x450, lpBuffer=0x70689b0*, nNumberOfBytesToWrite=0x6040, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x70689b0*, lpNumberOfBytesWritten=0x36cff14*=0x6040, lpOverlapped=0x0) returned 1 [0198.364] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.364] WriteFile (in: hFile=0x450, lpBuffer=0x706e9ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x706e9ef*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0198.364] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.364] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0198.364] CloseHandle (hObject=0x450) returned 1 [0198.800] GetProcessHeap () returned 0x580000 [0198.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70689b0 | out: hHeap=0x580000) returned 1 [0198.800] GetProcessHeap () returned 0x580000 [0198.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0198.800] GetProcessHeap () returned 0x580000 [0198.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0199.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd89520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6078, dwReserved0=0x36cfd28, dwReserved1=0x7062940, cFileName="PDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR7B~1.YOU")) returned 0x5b96b0 [0199.654] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.964] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", len=0x6f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned 1 [0200.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb0) returned 0x6f14048 [0200.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.387] CloseHandle (hObject=0x440) returned 1 [0201.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance")) returned 1 [0201.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37b, dwReserved0=0x2e0065, dwReserved1=0x730063, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9770 [0201.389] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.389] GetProcessHeap () returned 0x580000 [0201.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.389] GetProcessHeap () returned 0x580000 [0201.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.389] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.389] ReadFile (in: hFile=0x440, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x36cff14*=0x360, lpOverlapped=0x0) returned 1 [0201.393] GetProcessHeap () returned 0x580000 [0201.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0201.393] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x440, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x36cff14*=0x360, lpOverlapped=0x0) returned 1 [0201.393] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x440, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.394] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.394] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.394] CloseHandle (hObject=0x440) returned 1 [0201.394] GetProcessHeap () returned 0x580000 [0201.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.394] GetProcessHeap () returned 0x580000 [0201.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.394] GetProcessHeap () returned 0x580000 [0201.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0202.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafa65fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x36cfd28, dwReserved1=0x6eef020, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9770 [0202.027] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.084] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", len=0x44 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned 1 [0202.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0202.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.626] CloseHandle (hObject=0x170) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.id_1622540890_.your_last_chance")) returned 1 [0203.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d13, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR33~2.YOU")) returned 0x5b97b0 [0203.627] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.627] GetProcessHeap () returned 0x580000 [0203.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d21) returned 0x706bf30 [0203.627] GetProcessHeap () returned 0x580000 [0203.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d21) returned 0x7301a38 [0203.627] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.627] ReadFile (in: hFile=0x170, lpBuffer=0x706bf30, nNumberOfBytesToRead=0x2d00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x706bf30*, lpNumberOfBytesRead=0x36cff14*=0x2d00, lpOverlapped=0x0) returned 1 [0205.042] GetProcessHeap () returned 0x580000 [0205.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0205.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.042] WriteFile (in: hFile=0x170, lpBuffer=0x7301a38*, nNumberOfBytesToWrite=0x2d00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesWritten=0x36cff14*=0x2d00, lpOverlapped=0x0) returned 1 [0205.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.042] WriteFile (in: hFile=0x170, lpBuffer=0x7304737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7304737*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0205.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.042] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0205.042] CloseHandle (hObject=0x170) returned 1 [0205.043] GetProcessHeap () returned 0x580000 [0205.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0205.043] GetProcessHeap () returned 0x580000 [0205.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706bf30 | out: hHeap=0x580000) returned 1 [0205.043] GetProcessHeap () returned 0x580000 [0205.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0205.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d361a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d37, dwReserved0=0x36cfd28, dwReserved1=0x706bf30, cFileName="PDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR33~2.YOU")) returned 0x5b97b0 [0205.043] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0209.656] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned 1 [0209.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0209.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.656] CloseHandle (hObject=0x3b8) returned 1 [0209.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0209.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5c0065, dwReserved1=0x410054, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.657] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.658] GetProcessHeap () returned 0x580000 [0209.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0209.658] GetProcessHeap () returned 0x580000 [0209.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0209.658] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.658] ReadFile (in: hFile=0x3b8, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x36cff14*=0x140, lpOverlapped=0x0) returned 1 [0209.660] GetProcessHeap () returned 0x580000 [0209.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0209.660] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.660] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x36cff14*=0x140, lpOverlapped=0x0) returned 1 [0209.660] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.660] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0209.660] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.660] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0209.660] CloseHandle (hObject=0x3b8) returned 1 [0209.660] GetProcessHeap () returned 0x580000 [0209.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0209.660] GetProcessHeap () returned 0x580000 [0209.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0209.660] GetProcessHeap () returned 0x580000 [0209.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0209.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb493f8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x36cfd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.660] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.685] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0209.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0209.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0210.038] CloseHandle (hObject=0x484) returned 1 [0210.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0210.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0042, dwReserved1=0x46004f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.779] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0210.780] GetProcessHeap () returned 0x580000 [0210.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0210.780] GetProcessHeap () returned 0x580000 [0210.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0210.780] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.780] ReadFile (in: hFile=0x484, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x36cff14*=0x140, lpOverlapped=0x0) returned 1 [0210.782] GetProcessHeap () returned 0x580000 [0210.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0210.782] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.782] WriteFile (in: hFile=0x484, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x36cff14*=0x140, lpOverlapped=0x0) returned 1 [0210.782] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.782] WriteFile (in: hFile=0x484, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0210.782] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.782] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0210.782] CloseHandle (hObject=0x484) returned 1 [0210.782] GetProcessHeap () returned 0x580000 [0210.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0210.782] GetProcessHeap () returned 0x580000 [0210.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0210.782] GetProcessHeap () returned 0x580000 [0210.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb53f5ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x36cfd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.646] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.751] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS", len=0x45 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS") returned 1 [0214.751] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0214.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0214.752] CloseHandle (hObject=0x41c) returned 1 [0214.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css.id_1622540890_.your_last_chance")) returned 1 [0214.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29344d00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29344d00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCB968~1.YOU")) returned 0x5b97b0 [0214.753] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0214.754] GetProcessHeap () returned 0x580000 [0214.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0214.754] GetProcessHeap () returned 0x580000 [0214.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0214.755] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.755] ReadFile (in: hFile=0x41c, lpBuffer=0x72d6838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.067] GetProcessHeap () returned 0x580000 [0220.067] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0220.068] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.068] WriteFile (in: hFile=0x41c, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.068] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.068] WriteFile (in: hFile=0x41c, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0220.068] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.068] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0220.068] CloseHandle (hObject=0x41c) returned 1 [0220.068] GetProcessHeap () returned 0x580000 [0220.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0220.068] GetProcessHeap () returned 0x580000 [0220.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0220.068] GetProcessHeap () returned 0x580000 [0220.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29344d00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbac7adc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f506, dwReserved0=0x36cfd28, dwReserved1=0x72d6838, cFileName="SCHEME04.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCB968~1.YOU")) returned 0x5b9730 [0221.567] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.625] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", len=0x4d | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 1 [0221.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f3c) returned 0x6dee6e0 [0221.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.625] CloseHandle (hObject=0x458) returned 1 [0221.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id_1622540890_.your_last_chance")) returned 1 [0221.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SESSIO~2.YOU")) returned 0x5b9730 [0221.627] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.627] GetProcessHeap () returned 0x580000 [0221.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38178 [0221.627] GetProcessHeap () returned 0x580000 [0221.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38d00 [0221.627] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.627] ReadFile (in: hFile=0x458, lpBuffer=0x6d38178, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38178*, lpNumberOfBytesRead=0x36cff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.649] GetProcessHeap () returned 0x580000 [0221.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0221.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.649] WriteFile (in: hFile=0x458, lpBuffer=0x6d38d00*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38d00*, lpNumberOfBytesWritten=0x36cff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.649] WriteFile (in: hFile=0x458, lpBuffer=0x6d3981f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3981f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.650] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.650] CloseHandle (hObject=0x458) returned 1 [0221.651] GetProcessHeap () returned 0x580000 [0221.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38d00 | out: hHeap=0x580000) returned 1 [0221.651] GetProcessHeap () returned 0x580000 [0221.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38178 | out: hHeap=0x580000) returned 1 [0221.651] GetProcessHeap () returned 0x580000 [0221.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0221.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbba7a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x36cfd28, dwReserved1=0x6d38178, cFileName="SessionMember.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SESSIO~2.YOU")) returned 0x5b9730 [0221.666] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.709] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", len=0x51 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 1 [0221.710] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0221.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.710] CloseHandle (hObject=0x458) returned 1 [0221.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id_1622540890_.your_last_chance")) returned 1 [0221.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODIFI~1.YOU")) returned 0x5b9730 [0221.711] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.711] GetProcessHeap () returned 0x580000 [0221.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10060 [0221.712] GetProcessHeap () returned 0x580000 [0221.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10ae8 [0221.712] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.712] ReadFile (in: hFile=0x458, lpBuffer=0x6c10060, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x36cff14*=0x9e0, lpOverlapped=0x0) returned 1 [0221.765] GetProcessHeap () returned 0x580000 [0221.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.765] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.765] WriteFile (in: hFile=0x458, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x36cff14*=0x9e0, lpOverlapped=0x0) returned 1 [0221.765] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.765] WriteFile (in: hFile=0x458, lpBuffer=0x6c114c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c114c7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.766] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.766] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.766] CloseHandle (hObject=0x458) returned 1 [0221.766] GetProcessHeap () returned 0x580000 [0221.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0221.766] GetProcessHeap () returned 0x580000 [0221.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0221.766] GetProcessHeap () returned 0x580000 [0221.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbcb23a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x36cfd28, dwReserved1=0x6c10060, cFileName="ModifiedTelespace.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODIFI~1.YOU")) returned 0x5b9730 [0221.766] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.811] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", len=0x50 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 1 [0221.811] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0221.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.890] CloseHandle (hObject=0x480) returned 1 [0222.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id_1622540890_.your_last_chance")) returned 1 [0222.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GFSERR~1.YOU")) returned 0x5b96f0 [0222.892] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.892] GetProcessHeap () returned 0x580000 [0222.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6dcd1d0 [0222.892] GetProcessHeap () returned 0x580000 [0222.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c676b8 [0222.892] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.892] ReadFile (in: hFile=0x480, lpBuffer=0x6dcd1d0, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesRead=0x36cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0222.899] GetProcessHeap () returned 0x580000 [0222.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.899] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.899] WriteFile (in: hFile=0x480, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x36cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0222.899] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.900] WriteFile (in: hFile=0x480, lpBuffer=0x6c67d57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67d57*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.900] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.900] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.900] CloseHandle (hObject=0x480) returned 1 [0222.900] GetProcessHeap () returned 0x580000 [0222.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0222.900] GetProcessHeap () returned 0x580000 [0222.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0222.900] GetProcessHeap () returned 0x580000 [0222.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc78e800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6da, dwReserved0=0x36cfd28, dwReserved1=0x6dcd1d0, cFileName="gfserrortogroove.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GFSERR~1.YOU")) returned 0x5b9630 [0225.416] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.457] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned 1 [0225.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0225.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0225.458] CloseHandle (hObject=0x4ac) returned 1 [0225.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance")) returned 1 [0225.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0f34200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x2e0073, dwReserved1=0x70006a, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9630 [0225.459] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0225.460] GetProcessHeap () returned 0x580000 [0225.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6f19958 [0225.460] GetProcessHeap () returned 0x580000 [0225.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6efb008 [0225.460] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.460] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x36cff14*=0x1480, lpOverlapped=0x0) returned 1 [0225.769] GetProcessHeap () returned 0x580000 [0225.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.769] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.769] WriteFile (in: hFile=0x4ac, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x36cff14*=0x1480, lpOverlapped=0x0) returned 1 [0225.769] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.769] WriteFile (in: hFile=0x4ac, lpBuffer=0x6efc487*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc487*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0225.770] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.770] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0225.770] CloseHandle (hObject=0x4ac) returned 1 [0225.770] GetProcessHeap () returned 0x580000 [0225.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0225.770] GetProcessHeap () returned 0x580000 [0225.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0225.770] GetProcessHeap () returned 0x580000 [0225.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe171740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14bd, dwReserved0=0x36cfd28, dwReserved1=0x6f19958, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9630 [0225.770] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.798] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", len=0x66 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned 1 [0225.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0225.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0225.799] CloseHandle (hObject=0x4ac) returned 1 [0225.799] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.id_1622540890_.your_last_chance")) returned 1 [0225.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x164a, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9630 [0225.800] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0225.801] GetProcessHeap () returned 0x580000 [0225.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1661) returned 0x6de8f50 [0225.801] GetProcessHeap () returned 0x580000 [0225.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1661) returned 0x6c6e0f8 [0225.801] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.801] ReadFile (in: hFile=0x4ac, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x1640, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x36cff14*=0x1640, lpOverlapped=0x0) returned 1 [0227.341] GetProcessHeap () returned 0x580000 [0227.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0227.341] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.341] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x36cff14*=0x1640, lpOverlapped=0x0) returned 1 [0227.341] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.341] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6f737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f737*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0227.342] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.342] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0227.342] CloseHandle (hObject=0x4ac) returned 1 [0227.342] GetProcessHeap () returned 0x580000 [0227.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0227.342] GetProcessHeap () returned 0x580000 [0227.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0227.342] GetProcessHeap () returned 0x580000 [0227.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf078220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x36cfd28, dwReserved1=0x6de8f50, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9630 [0230.948] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.029] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", len=0x3a | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 1 [0231.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0231.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.113] CloseHandle (hObject=0x268) returned 1 [0231.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.id_1622540890_.your_last_chance")) returned 1 [0231.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD429~1.YOU")) returned 0x5b9630 [0231.114] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.114] GetProcessHeap () returned 0x580000 [0231.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0231.115] GetProcessHeap () returned 0x580000 [0231.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0231.115] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.115] ReadFile (in: hFile=0x268, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x36cff14*=0xa00, lpOverlapped=0x0) returned 1 [0231.129] GetProcessHeap () returned 0x580000 [0231.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.129] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.129] WriteFile (in: hFile=0x268, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x36cff14*=0xa00, lpOverlapped=0x0) returned 1 [0231.129] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.129] WriteFile (in: hFile=0x268, lpBuffer=0x62f717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x62f717*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0231.130] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.130] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0231.130] CloseHandle (hObject=0x268) returned 1 [0231.130] GetProcessHeap () returned 0x580000 [0231.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0231.130] GetProcessHeap () returned 0x580000 [0231.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0231.130] GetProcessHeap () returned 0x580000 [0231.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc1478ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x36cfd28, dwReserved1=0x6c676b8, cFileName="mscss7cm_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD429~1.YOU")) returned 0x5b9630 [0231.130] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.159] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", len=0x36 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 1 [0231.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0231.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.159] CloseHandle (hObject=0x268) returned 1 [0231.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.id_1622540890_.your_last_chance")) returned 1 [0231.161] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCOL1~2.YOU")) returned 0x5b9630 [0231.161] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.161] GetProcessHeap () returned 0x580000 [0231.161] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c11570 [0231.161] GetProcessHeap () returned 0x580000 [0231.161] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c11ff8 [0231.161] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.161] ReadFile (in: hFile=0x268, lpBuffer=0x6c11570, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11570*, lpNumberOfBytesRead=0x36cff14*=0xa40, lpOverlapped=0x0) returned 1 [0231.173] GetProcessHeap () returned 0x580000 [0231.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.173] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.173] WriteFile (in: hFile=0x268, lpBuffer=0x6c11ff8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11ff8*, lpNumberOfBytesWritten=0x36cff14*=0xa40, lpOverlapped=0x0) returned 1 [0231.173] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.173] WriteFile (in: hFile=0x268, lpBuffer=0x6c12a37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c12a37*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0231.173] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.173] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0231.173] CloseHandle (hObject=0x268) returned 1 [0231.173] GetProcessHeap () returned 0x580000 [0231.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11ff8 | out: hHeap=0x580000) returned 1 [0231.173] GetProcessHeap () returned 0x580000 [0231.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11570 | out: hHeap=0x580000) returned 1 [0231.173] GetProcessHeap () returned 0x580000 [0231.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14eb300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x36cfd28, dwReserved1=0x6c11570, cFileName="MSCOL11.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCOL1~2.YOU")) returned 0x5b9630 [0231.174] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.177] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", len=0x34 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 1 [0231.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0231.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.178] CloseHandle (hObject=0x268) returned 1 [0231.178] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.id_1622540890_.your_last_chance")) returned 1 [0231.179] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCO~1.YOU")) returned 0x5b9630 [0231.179] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msacc.olb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.179] GetProcessHeap () returned 0x580000 [0231.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x763b0b8 [0231.180] GetProcessHeap () returned 0x580000 [0231.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x764c8e8 [0231.180] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.180] ReadFile (in: hFile=0x268, lpBuffer=0x763b0b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x763b0b8*, lpNumberOfBytesRead=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.427] GetProcessHeap () returned 0x580000 [0238.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0238.427] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.427] WriteFile (in: hFile=0x268, lpBuffer=0x764c8e8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x764c8e8*, lpNumberOfBytesWritten=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.337] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.337] WriteFile (in: hFile=0x268, lpBuffer=0x765e0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x765e0e7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0239.385] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.385] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0239.385] CloseHandle (hObject=0x268) returned 1 [0239.440] GetProcessHeap () returned 0x580000 [0239.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x764c8e8 | out: hHeap=0x580000) returned 1 [0239.441] GetProcessHeap () returned 0x580000 [0239.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x763b0b8 | out: hHeap=0x580000) returned 1 [0239.441] GetProcessHeap () returned 0x580000 [0239.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0240.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc63527a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa55a4, dwReserved0=0x36cfd28, dwReserved1=0x763b0b8, cFileName="MSACC.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCO~1.YOU")) returned 0x5b9730 [0240.673] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.725] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML", len=0x4b | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned 1 [0240.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0240.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.726] CloseHandle (hObject=0x418) returned 1 [0240.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WANSNE~1.YOU")) returned 0x5b9730 [0240.727] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.727] GetProcessHeap () returned 0x580000 [0240.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c63330 [0240.728] GetProcessHeap () returned 0x580000 [0240.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c63698 [0240.728] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.728] ReadFile (in: hFile=0x418, lpBuffer=0x6c63330, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c63330*, lpNumberOfBytesRead=0x36cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.787] GetProcessHeap () returned 0x580000 [0240.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.787] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.787] WriteFile (in: hFile=0x418, lpBuffer=0x6c63698*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c63698*, lpNumberOfBytesWritten=0x36cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.787] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.787] WriteFile (in: hFile=0x418, lpBuffer=0x6c639b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c639b7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.787] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.787] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.787] CloseHandle (hObject=0x418) returned 1 [0240.787] GetProcessHeap () returned 0x580000 [0240.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c63698 | out: hHeap=0x580000) returned 1 [0240.787] GetProcessHeap () returned 0x580000 [0240.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c63330 | out: hHeap=0x580000) returned 1 [0240.787] GetProcessHeap () returned 0x580000 [0240.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc70b6360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x36cfd28, dwReserved1=0x6c63330, cFileName="WANS.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WANSNE~1.YOU")) returned 0x5b9730 [0240.788] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.821] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", len=0x44 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 1 [0240.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0240.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.934] CloseHandle (hObject=0x470) returned 1 [0241.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.id_1622540890_.your_last_chance")) returned 1 [0241.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SE5D04~1.YOU")) returned 0x5b9630 [0241.935] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.935] GetProcessHeap () returned 0x580000 [0241.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25a1) returned 0x6e35a00 [0241.935] GetProcessHeap () returned 0x580000 [0241.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25a1) returned 0x7002420 [0241.935] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.935] ReadFile (in: hFile=0x470, lpBuffer=0x6e35a00, nNumberOfBytesToRead=0x2580, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e35a00*, lpNumberOfBytesRead=0x36cff14*=0x2580, lpOverlapped=0x0) returned 1 [0241.969] GetProcessHeap () returned 0x580000 [0241.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.969] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.969] WriteFile (in: hFile=0x470, lpBuffer=0x7002420*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7002420*, lpNumberOfBytesWritten=0x36cff14*=0x2580, lpOverlapped=0x0) returned 1 [0241.969] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.969] WriteFile (in: hFile=0x470, lpBuffer=0x700499f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x700499f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0241.969] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.969] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0241.969] CloseHandle (hObject=0x470) returned 1 [0241.969] GetProcessHeap () returned 0x580000 [0241.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7002420 | out: hHeap=0x580000) returned 1 [0241.970] GetProcessHeap () returned 0x580000 [0241.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e35a00 | out: hHeap=0x580000) returned 1 [0241.970] GetProcessHeap () returned 0x580000 [0241.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7bdea80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25a4, dwReserved0=0x36cfd28, dwReserved1=0x6e35a00, cFileName="SendToOneNote.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SE5D04~1.YOU")) returned 0x5b9630 [0241.970] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.706] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML", len=0x40 | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned 1 [0242.706] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0245.393] CloseHandle (hObject=0x448) returned 1 [0245.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml.id_1622540890_.your_last_chance")) returned 1 [0248.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b48300, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x1a1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG39D6~1.YOU")) returned 0x5b96f0 [0248.822] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0248.822] GetProcessHeap () returned 0x580000 [0248.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7287008 [0248.823] GetProcessHeap () returned 0x580000 [0248.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7298838 [0248.823] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.823] ReadFile (in: hFile=0x448, lpBuffer=0x7287008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7287008*, lpNumberOfBytesRead=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.618] GetProcessHeap () returned 0x580000 [0252.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.618] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.618] WriteFile (in: hFile=0x448, lpBuffer=0x7298838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x7298838*, lpNumberOfBytesWritten=0x36cff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.619] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.619] WriteFile (in: hFile=0x448, lpBuffer=0x72aa037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x72aa037*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0252.619] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.619] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0252.619] CloseHandle (hObject=0x448) returned 1 [0252.619] GetProcessHeap () returned 0x580000 [0252.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7298838 | out: hHeap=0x580000) returned 1 [0252.620] GetProcessHeap () returned 0x580000 [0252.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7287008 | out: hHeap=0x580000) returned 1 [0252.620] GetProcessHeap () returned 0x580000 [0252.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce17b5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a20c, dwReserved0=0x36cfd28, dwReserved1=0x7287008, cFileName="PGLBL095.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG39D6~1.YOU")) returned 0x5b9730 [0254.424] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.361] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML", len=0x3e | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML") returned 1 [0255.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f6c) returned 0x72e5948 [0255.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.727] CloseHandle (hObject=0x3b4) returned 1 [0258.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml.id_1622540890_.your_last_chance")) returned 1 [0258.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cff600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6cff600, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGREPF~2.YOU")) returned 0x5b96f0 [0258.728] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.728] GetProcessHeap () returned 0x580000 [0258.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6dd8f68 [0258.728] GetProcessHeap () returned 0x580000 [0258.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6dd96f0 [0258.728] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.728] ReadFile (in: hFile=0x3b4, lpBuffer=0x6dd8f68, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesRead=0x36cff14*=0x740, lpOverlapped=0x0) returned 1 [0258.736] GetProcessHeap () returned 0x580000 [0258.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.736] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.736] WriteFile (in: hFile=0x3b4, lpBuffer=0x6dd96f0*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd96f0*, lpNumberOfBytesWritten=0x36cff14*=0x740, lpOverlapped=0x0) returned 1 [0258.737] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.737] WriteFile (in: hFile=0x3b4, lpBuffer=0x6dd9e2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e2f*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0258.737] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.737] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0258.737] CloseHandle (hObject=0x3b4) returned 1 [0258.737] GetProcessHeap () returned 0x580000 [0258.737] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd96f0 | out: hHeap=0x580000) returned 1 [0258.737] GetProcessHeap () returned 0x580000 [0258.737] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0258.737] GetProcessHeap () returned 0x580000 [0258.737] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfccc | out: lpFindFileData=0x36cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cff600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1bcd0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x36cfd28, dwReserved1=0x6dd8f68, cFileName="DGREPFRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGREPF~2.YOU")) returned 0x5b9630 [0259.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.236] SysReAllocStringLen (in: pbstr=0x36cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC", len=0x3c | out: pbstr=0x36cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC") returned 1 [0259.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x208c) returned 0x72e5948 [0259.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0259.335] CloseHandle (hObject=0x49c) returned 1 [0259.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc.id_1622540890_.your_last_chance")) returned 1 [0259.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x36cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x36cfc74 | out: lpFindFileData=0x36cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x6d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNHM~1.YOU")) returned 0x5b9630 [0259.336] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0259.336] GetProcessHeap () returned 0x580000 [0259.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6d81) returned 0x70963f8 [0259.336] GetProcessHeap () returned 0x580000 [0259.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6d81) returned 0x709d188 [0259.336] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.336] ReadFile (in: hFile=0x49c, lpBuffer=0x70963f8, nNumberOfBytesToRead=0x6d60, lpNumberOfBytesRead=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x70963f8*, lpNumberOfBytesRead=0x36cff14*=0x6d60, lpOverlapped=0x0) returned 1 [0263.080] GetProcessHeap () returned 0x580000 [0263.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0263.080] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.080] WriteFile (in: hFile=0x49c, lpBuffer=0x709d188*, nNumberOfBytesToWrite=0x6d60, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x709d188*, lpNumberOfBytesWritten=0x36cff14*=0x6d60, lpOverlapped=0x0) returned 1 [0264.701] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.702] WriteFile (in: hFile=0x49c, lpBuffer=0x70a3ee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x70a3ee7*, lpNumberOfBytesWritten=0x36cff14*=0x20, lpOverlapped=0x0) returned 1 [0264.702] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.702] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x36cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x36cff14*=0x4, lpOverlapped=0x0) returned 1 [0264.702] CloseHandle (hObject=0x49c) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709d188 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70963f8 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 Thread: id = 21 os_tid = 0xa4c [0039.062] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.127] Sleep (dwMilliseconds=0x1) [0039.205] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.414] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.676] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0039.999] Sleep (dwMilliseconds=0x1) [0040.287] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.165] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.354] Sleep (dwMilliseconds=0x1) [0042.471] Sleep (dwMilliseconds=0x1) [0042.515] Sleep (dwMilliseconds=0x1) [0042.633] Sleep (dwMilliseconds=0x1) [0042.650] Sleep (dwMilliseconds=0x1) [0042.662] Sleep (dwMilliseconds=0x1) [0042.702] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.827] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.193] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.293] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.342] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.418] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.854] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.431] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.462] Sleep (dwMilliseconds=0x1) [0044.478] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.509] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.587] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.634] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.774] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.102] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.202] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.242] Sleep (dwMilliseconds=0x1) [0045.258] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.674] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.835] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.960] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.038] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.225] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.381] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.662] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.699] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0059.887] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", len=0x4e | out: pbstr=0x380ff84*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 1 [0059.887] GetProcessHeap () returned 0x580000 [0059.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0059.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0059.921] CloseHandle (hObject=0x450) returned 1 [0059.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0059.921] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id_1622540890_.your_last_chance")) returned 1 [0059.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0059.921] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96b0 [0059.922] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0059.922] GetProcessHeap () returned 0x580000 [0059.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e40b80 [0059.922] GetProcessHeap () returned 0x580000 [0059.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e523b0 [0059.923] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.923] ReadFile (in: hFile=0x450, lpBuffer=0x6e40b80, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40b80*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0064.844] GetProcessHeap () returned 0x580000 [0064.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0064.844] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x450, lpBuffer=0x6e523b0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e523b0*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0064.845] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.845] WriteFile (in: hFile=0x450, lpBuffer=0x6e63baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e63baf*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.434] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.434] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.435] CloseHandle (hObject=0x450) returned 1 [0067.411] GetProcessHeap () returned 0x580000 [0067.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e523b0 | out: hHeap=0x580000) returned 1 [0067.411] GetProcessHeap () returned 0x580000 [0067.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e40b80 | out: hHeap=0x580000) returned 1 [0067.412] GetProcessHeap () returned 0x580000 [0067.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0067.412] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5fed12a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd5624, dwReserved0=0x380fd28, dwReserved1=0x6e40b80, cFileName="Office32MUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b9630 [0067.412] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.634] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", len=0x4f | out: pbstr=0x380ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 1 [0068.634] GetProcessHeap () returned 0x580000 [0068.634] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x1c) returned 0x5e9710 [0068.634] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0068.634] CloseHandle (hObject=0x444) returned 1 [0068.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.635] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id_1622540890_.your_last_chance")) returned 1 [0068.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.635] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96b0 [0068.635] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0068.636] GetProcessHeap () returned 0x580000 [0068.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dd3a60 [0068.636] GetProcessHeap () returned 0x580000 [0068.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de5290 [0068.636] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.636] ReadFile (in: hFile=0x444, lpBuffer=0x6dd3a60, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a60*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.911] GetProcessHeap () returned 0x580000 [0073.911] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616c28 [0073.912] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.912] WriteFile (in: hFile=0x444, lpBuffer=0x6de5290*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5290*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.912] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.912] WriteFile (in: hFile=0x444, lpBuffer=0x6df6a8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a8f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.356] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.356] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.356] CloseHandle (hObject=0x444) returned 1 [0074.356] GetProcessHeap () returned 0x580000 [0074.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5290 | out: hHeap=0x580000) returned 1 [0074.356] GetProcessHeap () returned 0x580000 [0074.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd3a60 | out: hHeap=0x580000) returned 1 [0074.357] GetProcessHeap () returned 0x580000 [0074.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616c28 | out: hHeap=0x580000) returned 1 [0074.925] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63f3c600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd4224, dwReserved0=0x380fd28, dwReserved1=0x6dd3a60, cFileName="OfficeMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b9730 [0074.925] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.938] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", len=0x54 | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 1 [0074.938] GetProcessHeap () returned 0x580000 [0074.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0074.939] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.940] Sleep (dwMilliseconds=0x1) [0074.949] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", len=0x53 | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 1 [0074.950] GetProcessHeap () returned 0x580000 [0074.950] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x30) returned 0x5b5d08 [0074.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.965] Sleep (dwMilliseconds=0x1) [0079.336] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x7c) returned 0x5f76f0 [0079.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.336] Sleep (dwMilliseconds=0x1) [0079.353] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", len=0x4e | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 1 [0079.353] GetProcessHeap () returned 0x580000 [0079.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x24) returned 0x5f76f0 [0079.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.353] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.959] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", len=0x44 | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 1 [0085.959] GetProcessHeap () returned 0x580000 [0085.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb0) returned 0x614a48 [0085.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.960] Sleep (dwMilliseconds=0x1) [0085.976] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", len=0x49 | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 1 [0085.976] GetProcessHeap () returned 0x580000 [0085.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x44) returned 0x614a48 [0085.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.987] Sleep (dwMilliseconds=0x1) [0086.487] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", len=0x4a | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 1 [0086.487] GetProcessHeap () returned 0x580000 [0086.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.588] CloseHandle (hObject=0x474) returned 1 [0086.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0086.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.589] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0086.589] GetProcessHeap () returned 0x580000 [0086.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6c79768 [0086.589] GetProcessHeap () returned 0x580000 [0086.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6d0e508 [0086.589] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.589] ReadFile (in: hFile=0x474, lpBuffer=0x6c79768, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79768*, lpNumberOfBytesRead=0x380ff14*=0x880, lpOverlapped=0x0) returned 1 [0086.608] GetProcessHeap () returned 0x580000 [0086.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0086.608] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.608] WriteFile (in: hFile=0x474, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x380ff14*=0x880, lpOverlapped=0x0) returned 1 [0086.608] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.608] WriteFile (in: hFile=0x474, lpBuffer=0x6d0ed87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ed87*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.608] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.608] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.609] CloseHandle (hObject=0x474) returned 1 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79768 | out: hHeap=0x580000) returned 1 [0086.609] GetProcessHeap () returned 0x580000 [0086.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0086.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b3b9aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8a9, dwReserved0=0x380fd28, dwReserved1=0x6c79768, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.609] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.362] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", len=0x4d | out: pbstr=0x380ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 1 [0088.362] GetProcessHeap () returned 0x580000 [0088.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0088.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0090.704] CloseHandle (hObject=0x478) returned 1 [0090.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0090.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id_1622540890_.your_last_chance")) returned 1 [0100.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCRE~1.YOU")) returned 0x5b9770 [0101.043] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0101.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0101.043] GetProcessHeap () returned 0x580000 [0101.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb1e1) returned 0x6f29458 [0101.044] GetProcessHeap () returned 0x580000 [0101.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb1e1) returned 0x6f34648 [0101.044] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.044] ReadFile (in: hFile=0x488, lpBuffer=0x6f29458, nNumberOfBytesToRead=0xb1c0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f29458*, lpNumberOfBytesRead=0x380ff14*=0xb1c0, lpOverlapped=0x0) returned 1 [0103.354] GetProcessHeap () returned 0x580000 [0103.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.355] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.355] WriteFile (in: hFile=0x488, lpBuffer=0x6f34648*, nNumberOfBytesToWrite=0xb1c0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f34648*, lpNumberOfBytesWritten=0x380ff14*=0xb1c0, lpOverlapped=0x0) returned 1 [0103.355] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.355] WriteFile (in: hFile=0x488, lpBuffer=0x6f3f807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f807*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.355] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.355] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.355] CloseHandle (hObject=0x488) returned 1 [0103.356] GetProcessHeap () returned 0x580000 [0103.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f34648 | out: hHeap=0x580000) returned 1 [0103.356] GetProcessHeap () returned 0x580000 [0103.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f29458 | out: hHeap=0x580000) returned 1 [0103.356] GetProcessHeap () returned 0x580000 [0103.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75381f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb1fc, dwReserved0=0x380fd28, dwReserved1=0x6f29458, cFileName="CONCRETE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCRE~1.YOU")) returned 0x5b9630 [0103.356] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.052] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", len=0x55 | out: pbstr=0x380ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.053] GetProcessHeap () returned 0x580000 [0112.053] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f848 [0112.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.065] Sleep (dwMilliseconds=0x1) [0112.159] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", len=0x4d | out: pbstr=0x380ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 1 [0112.159] GetProcessHeap () returned 0x580000 [0112.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.186] Sleep (dwMilliseconds=0x1) [0112.322] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", len=0x4a | out: pbstr=0x380ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned 1 [0112.322] GetProcessHeap () returned 0x580000 [0112.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.322] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.330] Sleep (dwMilliseconds=0x1) [0113.339] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", len=0x3f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 1 [0113.339] GetProcessHeap () returned 0x580000 [0113.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x74) returned 0x6f0ceb8 [0113.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0113.474] CloseHandle (hObject=0x4b0) returned 1 [0113.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id_1622540890_.your_last_chance")) returned 1 [0115.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG7216~1.YOU")) returned 0x5b9630 [0115.287] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0115.287] GetProcessHeap () returned 0x580000 [0115.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1501) returned 0x6d035f8 [0115.287] GetProcessHeap () returned 0x580000 [0115.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1501) returned 0x6d06ca8 [0115.287] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.287] ReadFile (in: hFile=0x4b0, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x14e0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x380ff14*=0x14e0, lpOverlapped=0x0) returned 1 [0115.307] GetProcessHeap () returned 0x580000 [0115.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.307] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.307] WriteFile (in: hFile=0x4b0, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x14e0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x380ff14*=0x14e0, lpOverlapped=0x0) returned 1 [0115.307] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.307] WriteFile (in: hFile=0x4b0, lpBuffer=0x6d08187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08187*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.307] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.307] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.307] CloseHandle (hObject=0x4b0) returned 1 [0115.307] GetProcessHeap () returned 0x580000 [0115.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0115.307] GetProcessHeap () returned 0x580000 [0115.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0115.307] GetProcessHeap () returned 0x580000 [0115.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c577ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1523, dwReserved0=0x380fd28, dwReserved1=0x6d035f8, cFileName="AG00169_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG7216~1.YOU")) returned 0x5b9630 [0117.325] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.531] CloseHandle (hObject=0x4a0) returned 1 [0118.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.532] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0056~1.YOU")) returned 0x5b9730 [0118.532] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.532] GetProcessHeap () returned 0x580000 [0118.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6037d8 [0118.532] GetProcessHeap () returned 0x580000 [0118.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x603d20 [0118.533] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.533] ReadFile (in: hFile=0x4a0, lpBuffer=0x6037d8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6037d8*, lpNumberOfBytesRead=0x380ff14*=0x500, lpOverlapped=0x0) returned 1 [0118.538] GetProcessHeap () returned 0x580000 [0118.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.538] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.538] WriteFile (in: hFile=0x4a0, lpBuffer=0x603d20*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x603d20*, lpNumberOfBytesWritten=0x380ff14*=0x500, lpOverlapped=0x0) returned 1 [0118.539] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.539] WriteFile (in: hFile=0x4a0, lpBuffer=0x60421f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x60421f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.539] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.539] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.539] CloseHandle (hObject=0x4a0) returned 1 [0118.539] GetProcessHeap () returned 0x580000 [0118.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x603d20 | out: hHeap=0x580000) returned 1 [0118.539] GetProcessHeap () returned 0x580000 [0118.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6037d8 | out: hHeap=0x580000) returned 1 [0118.539] GetProcessHeap () returned 0x580000 [0118.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e443940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x380fd28, dwReserved1=0x6037d8, cFileName="SY00560_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0056~1.YOU")) returned 0x5b96f0 [0120.125] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.151] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", len=0x4c | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 1 [0120.151] GetProcessHeap () returned 0x580000 [0120.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c8) returned 0x6d06ca8 [0120.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.078] CloseHandle (hObject=0x438) returned 1 [0122.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0208~2.YOU")) returned 0x5b9730 [0122.083] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.083] GetProcessHeap () returned 0x580000 [0122.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6c676b8 [0122.083] GetProcessHeap () returned 0x580000 [0122.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x62ed18 [0122.083] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.084] ReadFile (in: hFile=0x440, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x380ff14*=0x980, lpOverlapped=0x0) returned 1 [0122.093] GetProcessHeap () returned 0x580000 [0122.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.093] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.093] WriteFile (in: hFile=0x440, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x380ff14*=0x980, lpOverlapped=0x0) returned 1 [0122.094] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.094] WriteFile (in: hFile=0x440, lpBuffer=0x62f697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f697*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.094] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.094] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.094] CloseHandle (hObject=0x440) returned 1 [0122.096] GetProcessHeap () returned 0x580000 [0122.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0122.096] GetProcessHeap () returned 0x580000 [0122.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0122.096] GetProcessHeap () returned 0x580000 [0122.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8062f2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ba, dwReserved0=0x380fd28, dwReserved1=0x6c676b8, cFileName="WB02082_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0208~2.YOU")) returned 0x5b9730 [0124.354] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.380] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", len=0x4e | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned 1 [0124.381] GetProcessHeap () returned 0x580000 [0124.381] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1908) returned 0x6f42f08 [0124.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.463] CloseHandle (hObject=0x470) returned 1 [0124.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.id_1622540890_.your_last_chance")) returned 1 [0124.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDCO~1.YOU")) returned 0x5b9730 [0124.464] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.464] GetProcessHeap () returned 0x580000 [0124.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf21) returned 0x6c29878 [0124.464] GetProcessHeap () returned 0x580000 [0124.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf21) returned 0x6ce2378 [0124.464] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.464] ReadFile (in: hFile=0x470, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf00, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x380ff14*=0xf00, lpOverlapped=0x0) returned 1 [0124.479] GetProcessHeap () returned 0x580000 [0124.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.479] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.479] WriteFile (in: hFile=0x470, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x380ff14*=0xf00, lpOverlapped=0x0) returned 1 [0124.479] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.479] WriteFile (in: hFile=0x470, lpBuffer=0x6ce3277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3277*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.479] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.479] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.479] CloseHandle (hObject=0x470) returned 1 [0124.480] GetProcessHeap () returned 0x580000 [0124.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.480] GetProcessHeap () returned 0x580000 [0124.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.480] GetProcessHeap () returned 0x580000 [0124.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81cf2520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf2d, dwReserved0=0x380fd28, dwReserved1=0x6c29878, cFileName="Hardcover.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDCO~1.YOU")) returned 0x5b9730 [0125.317] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.341] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned 1 [0125.341] GetProcessHeap () returned 0x580000 [0125.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1960) returned 0x6f42f08 [0125.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0128.617] CloseHandle (hObject=0x48c) returned 1 [0128.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02353~1.YOU")) returned 0x5b9730 [0130.905] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0130.905] GetProcessHeap () returned 0x580000 [0130.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x62ed18 [0130.905] GetProcessHeap () returned 0x580000 [0130.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c3a820 [0130.905] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.906] ReadFile (in: hFile=0x48c, lpBuffer=0x62ed18, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesRead=0x380ff14*=0xa20, lpOverlapped=0x0) returned 1 [0130.916] GetProcessHeap () returned 0x580000 [0130.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.916] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.916] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3a820*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesWritten=0x380ff14*=0xa20, lpOverlapped=0x0) returned 1 [0130.916] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.916] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3b23f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b23f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.916] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.916] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.916] CloseHandle (hObject=0x48c) returned 1 [0130.916] GetProcessHeap () returned 0x580000 [0130.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0130.916] GetProcessHeap () returned 0x580000 [0130.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0130.916] GetProcessHeap () returned 0x580000 [0130.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85a63d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa48, dwReserved0=0x380fd28, dwReserved1=0x62ed18, cFileName="J0235319.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02353~1.YOU")) returned 0x5b9730 [0130.917] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.783] CloseHandle (hObject=0x430) returned 1 [0132.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id_1622540890_.your_last_chance")) returned 1 [0132.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FACILI~1.YOU")) returned 0x5b9730 [0132.784] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.785] GetProcessHeap () returned 0x580000 [0132.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x701c058 [0132.785] GetProcessHeap () returned 0x580000 [0132.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702d888 [0132.786] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.786] ReadFile (in: hFile=0x430, lpBuffer=0x701c058, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x701c058*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.612] GetProcessHeap () returned 0x580000 [0137.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0137.613] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.613] WriteFile (in: hFile=0x430, lpBuffer=0x702d888*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x702d888*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.496] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.496] WriteFile (in: hFile=0x430, lpBuffer=0x703f087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x703f087*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.496] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.496] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.496] CloseHandle (hObject=0x430) returned 1 [0138.571] GetProcessHeap () returned 0x580000 [0138.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702d888 | out: hHeap=0x580000) returned 1 [0138.571] GetProcessHeap () returned 0x580000 [0138.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x701c058 | out: hHeap=0x580000) returned 1 [0138.571] GetProcessHeap () returned 0x580000 [0138.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0139.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13f8c, dwReserved0=0x380fd28, dwReserved1=0x701c058, cFileName="FACILITY.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FACILI~1.YOU")) returned 0x5b9770 [0139.877] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.903] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", len=0x54 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css") returned 1 [0139.903] GetProcessHeap () returned 0x580000 [0139.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0139.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.106] CloseHandle (hObject=0x3b4) returned 1 [0140.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.id_1622540890_.your_last_chance")) returned 1 [0140.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b9770 [0140.107] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.107] GetProcessHeap () returned 0x580000 [0140.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef020 [0140.107] GetProcessHeap () returned 0x580000 [0140.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef768 [0140.107] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.107] ReadFile (in: hFile=0x3b4, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x380ff14*=0x700, lpOverlapped=0x0) returned 1 [0140.114] GetProcessHeap () returned 0x580000 [0140.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.115] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.115] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eef768*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef768*, lpNumberOfBytesWritten=0x380ff14*=0x700, lpOverlapped=0x0) returned 1 [0140.115] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.115] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eefe67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefe67*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.115] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.115] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.115] CloseHandle (hObject=0x3b4) returned 1 [0140.115] GetProcessHeap () returned 0x580000 [0140.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef768 | out: hHeap=0x580000) returned 1 [0140.115] GetProcessHeap () returned 0x580000 [0140.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0140.115] GetProcessHeap () returned 0x580000 [0140.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b2046e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x729, dwReserved0=0x380fd28, dwReserved1=0x6eef020, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b9770 [0140.409] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.449] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", len=0x43 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned 1 [0140.449] GetProcessHeap () returned 0x580000 [0140.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dbc) returned 0x6f14048 [0140.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.574] CloseHandle (hObject=0x428) returned 1 [0140.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1503~2.YOU")) returned 0x5b9770 [0140.581] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.581] GetProcessHeap () returned 0x580000 [0140.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6dd8c38 [0140.581] GetProcessHeap () returned 0x580000 [0140.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x678958 [0140.581] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.581] ReadFile (in: hFile=0x428, lpBuffer=0x6dd8c38, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8c38*, lpNumberOfBytesRead=0x380ff14*=0x220, lpOverlapped=0x0) returned 1 [0140.584] GetProcessHeap () returned 0x580000 [0140.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.584] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.584] WriteFile (in: hFile=0x428, lpBuffer=0x678958*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesWritten=0x380ff14*=0x220, lpOverlapped=0x0) returned 1 [0140.584] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.584] WriteFile (in: hFile=0x428, lpBuffer=0x678b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x678b77*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.584] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.584] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.584] CloseHandle (hObject=0x428) returned 1 [0140.585] GetProcessHeap () returned 0x580000 [0140.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0140.585] GetProcessHeap () returned 0x580000 [0140.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8c38 | out: hHeap=0x580000) returned 1 [0140.585] GetProcessHeap () returned 0x580000 [0140.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0141.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b67b020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x380fd28, dwReserved1=0x6dd8c38, cFileName="BD15034_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1503~2.YOU")) returned 0x5b9730 [0141.010] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.944] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC", len=0x40 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 1 [0141.944] GetProcessHeap () returned 0x580000 [0141.944] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed0) returned 0x6f14048 [0141.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.945] CloseHandle (hObject=0x470) returned 1 [0141.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0141.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~4.YOU")) returned 0x5b9730 [0141.946] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.946] GetProcessHeap () returned 0x580000 [0141.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0141.946] GetProcessHeap () returned 0x580000 [0141.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0141.947] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.947] ReadFile (in: hFile=0x470, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x380ff14*=0x260, lpOverlapped=0x0) returned 1 [0141.965] GetProcessHeap () returned 0x580000 [0141.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.965] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.965] WriteFile (in: hFile=0x470, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x380ff14*=0x260, lpOverlapped=0x0) returned 1 [0141.965] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.966] WriteFile (in: hFile=0x470, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.966] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.966] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.966] CloseHandle (hObject=0x470) returned 1 [0141.966] GetProcessHeap () returned 0x580000 [0141.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0141.966] GetProcessHeap () returned 0x580000 [0141.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0141.966] GetProcessHeap () returned 0x580000 [0141.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c3b8a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x380fd28, dwReserved1=0x6d08520, cFileName="POWERPNT_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~4.YOU")) returned 0x5b9730 [0141.966] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.997] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT", len=0x44 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 1 [0141.997] GetProcessHeap () returned 0x580000 [0141.997] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0141.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.997] CloseHandle (hObject=0x470) returned 1 [0141.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0141.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO33AA~1.YOU")) returned 0x5b9730 [0141.998] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.999] GetProcessHeap () returned 0x580000 [0141.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0141.999] GetProcessHeap () returned 0x580000 [0141.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0141.999] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.999] ReadFile (in: hFile=0x470, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0142.000] GetProcessHeap () returned 0x580000 [0142.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0142.000] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.000] WriteFile (in: hFile=0x470, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0142.000] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.000] WriteFile (in: hFile=0x470, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.001] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.001] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.001] CloseHandle (hObject=0x470) returned 1 [0142.001] GetProcessHeap () returned 0x580000 [0142.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0142.001] GetProcessHeap () returned 0x580000 [0142.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0142.001] GetProcessHeap () returned 0x580000 [0142.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0142.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c404d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x380fd28, dwReserved1=0x5ad8a0, cFileName="POWERPNT.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO33AA~1.YOU")) returned 0x5b9730 [0142.001] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.008] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS", len=0x3c | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS") returned 1 [0142.008] GetProcessHeap () returned 0x580000 [0142.008] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb0) returned 0x6f14048 [0142.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.009] CloseHandle (hObject=0x410) returned 1 [0142.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0142.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.id_1622540890_.your_last_chance")) returned 1 [0142.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0142.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASSPO~1.YOU")) returned 0x5b9730 [0142.010] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\passport.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.010] GetProcessHeap () returned 0x580000 [0142.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0142.010] GetProcessHeap () returned 0x580000 [0142.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0142.010] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.010] ReadFile (in: hFile=0x410, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x380ff14*=0xd60, lpOverlapped=0x0) returned 1 [0142.023] GetProcessHeap () returned 0x580000 [0142.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0142.023] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.023] WriteFile (in: hFile=0x410, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x380ff14*=0xd60, lpOverlapped=0x0) returned 1 [0142.023] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.023] WriteFile (in: hFile=0x410, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.023] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.023] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.024] CloseHandle (hObject=0x410) returned 1 [0142.024] GetProcessHeap () returned 0x580000 [0142.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0142.024] GetProcessHeap () returned 0x580000 [0142.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0142.024] GetProcessHeap () returned 0x580000 [0142.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0142.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8c451000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x380fd28, dwReserved1=0x635768, cFileName="PASSPORT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASSPO~1.YOU")) returned 0x5b9730 [0142.024] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.038] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT", len=0x3f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 1 [0142.039] GetProcessHeap () returned 0x580000 [0142.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e9c) returned 0x6f14048 [0142.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.192] CloseHandle (hObject=0x478) returned 1 [0144.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0144.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~4.YOU")) returned 0x5b96f0 [0144.193] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.193] GetProcessHeap () returned 0x580000 [0144.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0144.193] GetProcessHeap () returned 0x580000 [0144.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0144.193] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.193] ReadFile (in: hFile=0x478, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.248] GetProcessHeap () returned 0x580000 [0144.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.248] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.248] WriteFile (in: hFile=0x478, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.248] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.248] WriteFile (in: hFile=0x478, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.248] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.249] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.249] CloseHandle (hObject=0x478) returned 1 [0144.249] GetProcessHeap () returned 0x580000 [0144.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0144.249] GetProcessHeap () returned 0x580000 [0144.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0144.249] GetProcessHeap () returned 0x580000 [0144.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d971340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x380fd28, dwReserved1=0x5ad8a0, cFileName="OUTLOOK_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~4.YOU")) returned 0x5b96f0 [0146.864] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.879] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", len=0x43 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned 1 [0146.879] GetProcessHeap () returned 0x580000 [0146.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0146.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.208] CloseHandle (hObject=0x460) returned 1 [0153.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.id_1622540890_.your_last_chance")) returned 1 [0153.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd98, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR1B~1.YOU")) returned 0x5b9730 [0153.209] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.210] GetProcessHeap () returned 0x580000 [0153.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706ecb0 [0153.210] GetProcessHeap () returned 0x580000 [0153.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706fab8 [0153.210] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.210] ReadFile (in: hFile=0x460, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x380ff14*=0xd80, lpOverlapped=0x0) returned 1 [0153.225] GetProcessHeap () returned 0x580000 [0153.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.225] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.225] WriteFile (in: hFile=0x460, lpBuffer=0x706fab8*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fab8*, lpNumberOfBytesWritten=0x380ff14*=0xd80, lpOverlapped=0x0) returned 1 [0153.225] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.225] WriteFile (in: hFile=0x460, lpBuffer=0x7070837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7070837*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.225] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.225] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.225] CloseHandle (hObject=0x460) returned 1 [0153.225] GetProcessHeap () returned 0x580000 [0153.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706fab8 | out: hHeap=0x580000) returned 1 [0153.225] GetProcessHeap () returned 0x580000 [0153.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0153.225] GetProcessHeap () returned 0x580000 [0153.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f22b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdbc, dwReserved0=0x380fd28, dwReserved1=0x706ecb0, cFileName="PDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR1B~1.YOU")) returned 0x5b9630 [0153.754] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.319] CloseHandle (hObject=0x45c) returned 1 [0155.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI7C35~1.YOU")) returned 0x5b9730 [0155.321] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.321] GetProcessHeap () returned 0x580000 [0155.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.321] GetProcessHeap () returned 0x580000 [0155.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.321] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.321] ReadFile (in: hFile=0x45c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x380ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.322] GetProcessHeap () returned 0x580000 [0155.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.322] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.322] WriteFile (in: hFile=0x45c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x380ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.322] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.323] WriteFile (in: hFile=0x45c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.323] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.323] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.323] CloseHandle (hObject=0x45c) returned 1 [0155.323] GetProcessHeap () returned 0x580000 [0155.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.323] GetProcessHeap () returned 0x580000 [0155.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.323] GetProcessHeap () returned 0x580000 [0155.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94312380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x380fd28, dwReserved1=0x61b540, cFileName="WINWORD.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI7C35~1.YOU")) returned 0x5b9630 [0155.971] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.986] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 1 [0155.986] GetProcessHeap () returned 0x580000 [0155.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0155.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0158.737] CloseHandle (hObject=0x438) returned 1 [0158.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART5~1.YOU")) returned 0x5b9630 [0158.778] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0158.779] GetProcessHeap () returned 0x580000 [0158.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3dc1) returned 0x6d60068 [0158.779] GetProcessHeap () returned 0x580000 [0158.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3dc1) returned 0x7037dc8 [0158.779] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.779] ReadFile (in: hFile=0x438, lpBuffer=0x6d60068, nNumberOfBytesToRead=0x3da0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d60068*, lpNumberOfBytesRead=0x380ff14*=0x3da0, lpOverlapped=0x0) returned 1 [0160.206] GetProcessHeap () returned 0x580000 [0160.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0160.206] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.206] WriteFile (in: hFile=0x438, lpBuffer=0x7037dc8*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7037dc8*, lpNumberOfBytesWritten=0x380ff14*=0x3da0, lpOverlapped=0x0) returned 1 [0160.206] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.206] WriteFile (in: hFile=0x438, lpBuffer=0x703bb67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x703bb67*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0160.207] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.207] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0160.207] CloseHandle (hObject=0x438) returned 1 [0161.976] GetProcessHeap () returned 0x580000 [0161.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7037dc8 | out: hHeap=0x580000) returned 1 [0161.976] GetProcessHeap () returned 0x580000 [0161.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d60068 | out: hHeap=0x580000) returned 1 [0161.976] GetProcessHeap () returned 0x580000 [0161.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0166.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x971a31e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3dd0, dwReserved0=0x380fd28, dwReserved1=0x6d60068, cFileName="MSART5.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART5~1.YOU")) returned 0x5b9730 [0166.130] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.172] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", len=0x3b | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 1 [0166.172] GetProcessHeap () returned 0x580000 [0166.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0166.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0166.174] CloseHandle (hObject=0x458) returned 1 [0166.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id_1622540890_.your_last_chance")) returned 1 [0166.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTEXE~1.YOU")) returned 0x5b9730 [0166.175] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0166.175] GetProcessHeap () returned 0x580000 [0166.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef3020 [0166.175] GetProcessHeap () returned 0x580000 [0166.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef37e8 [0166.176] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.176] ReadFile (in: hFile=0x458, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x380ff14*=0x780, lpOverlapped=0x0) returned 1 [0166.184] GetProcessHeap () returned 0x580000 [0166.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.184] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] WriteFile (in: hFile=0x458, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x380ff14*=0x780, lpOverlapped=0x0) returned 1 [0166.184] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] WriteFile (in: hFile=0x458, lpBuffer=0x6ef3f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f67*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.184] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.184] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.184] CloseHandle (hObject=0x458) returned 1 [0166.184] GetProcessHeap () returned 0x580000 [0166.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0166.184] GetProcessHeap () returned 0x580000 [0166.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0166.184] GetProcessHeap () returned 0x580000 [0166.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aa9e080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7aa, dwReserved0=0x380fd28, dwReserved1=0x6ef3020, cFileName="OUTEX.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTEXE~1.YOU")) returned 0x5b9730 [0166.185] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.205] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 1 [0166.205] GetProcessHeap () returned 0x580000 [0166.205] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0166.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0166.298] CloseHandle (hObject=0x4a8) returned 1 [0166.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id_1622540890_.your_last_chance")) returned 1 [0166.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLTASK~1.YOU")) returned 0x5b9730 [0166.300] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0166.300] GetProcessHeap () returned 0x580000 [0166.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0166.301] GetProcessHeap () returned 0x580000 [0166.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0166.301] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.301] ReadFile (in: hFile=0x4a8, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.166] GetProcessHeap () returned 0x580000 [0169.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0169.166] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.166] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0169.167] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.167] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.167] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.167] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.167] CloseHandle (hObject=0x4a8) returned 1 [0169.167] GetProcessHeap () returned 0x580000 [0169.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0169.170] GetProcessHeap () returned 0x580000 [0169.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0169.171] GetProcessHeap () returned 0x580000 [0169.171] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0172.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c72e880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c3bc, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="OLTASK.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLTASK~1.YOU")) returned 0x5b9770 [0172.812] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.859] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", len=0x3f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 1 [0172.859] GetProcessHeap () returned 0x580000 [0172.859] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2278) returned 0x6f14048 [0172.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.909] CloseHandle (hObject=0x48c) returned 1 [0172.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id_1622540890_.your_last_chance")) returned 1 [0172.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNLI~1.YOU")) returned 0x5b9770 [0172.911] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.912] GetProcessHeap () returned 0x580000 [0172.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0172.912] GetProcessHeap () returned 0x580000 [0172.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0172.912] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.912] ReadFile (in: hFile=0x48c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x380ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.924] GetProcessHeap () returned 0x580000 [0172.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0172.924] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0x48c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x380ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.924] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0x48c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.924] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.924] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.924] CloseHandle (hObject=0x48c) returned 1 [0172.924] GetProcessHeap () returned 0x580000 [0172.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0172.924] GetProcessHeap () returned 0x580000 [0172.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0172.925] GetProcessHeap () returned 0x580000 [0172.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0173.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eae3280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x380fd28, dwReserved1=0x5cf780, cFileName="SIGNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNLI~1.YOU")) returned 0x5b9770 [0173.243] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.552] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 1 [0174.552] GetProcessHeap () returned 0x580000 [0174.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0174.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.554] CloseHandle (hObject=0x484) returned 1 [0174.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id_1622540890_.your_last_chance")) returned 1 [0174.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x26745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VID96A~1.YOU")) returned 0x5b9730 [0174.555] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.555] GetProcessHeap () returned 0x580000 [0174.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0174.556] GetProcessHeap () returned 0x580000 [0174.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0174.556] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.556] ReadFile (in: hFile=0x484, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0177.491] GetProcessHeap () returned 0x580000 [0177.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0177.491] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.491] WriteFile (in: hFile=0x484, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0177.491] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.491] WriteFile (in: hFile=0x484, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.755] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.755] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.755] CloseHandle (hObject=0x484) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0180.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa1901cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x267482, dwReserved0=0x380fd28, dwReserved1=0x6d7cfe8, cFileName="VISIO_STD.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VID96A~1.YOU")) returned 0x5b96f0 [0180.049] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.111] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", len=0x67 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned 1 [0180.111] GetProcessHeap () returned 0x580000 [0180.111] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0180.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.153] CloseHandle (hObject=0x448) returned 1 [0180.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GLOBEB~1.YOU")) returned 0x5b96b0 [0180.155] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.155] GetProcessHeap () returned 0x580000 [0180.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0180.155] GetProcessHeap () returned 0x580000 [0180.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0180.155] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.155] ReadFile (in: hFile=0x448, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x380ff14*=0x760, lpOverlapped=0x0) returned 1 [0180.163] GetProcessHeap () returned 0x580000 [0180.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0180.164] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.164] WriteFile (in: hFile=0x448, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x380ff14*=0x760, lpOverlapped=0x0) returned 1 [0180.164] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.164] WriteFile (in: hFile=0x448, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.164] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.164] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.164] CloseHandle (hObject=0x448) returned 1 [0180.164] GetProcessHeap () returned 0x580000 [0180.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0180.164] GetProcessHeap () returned 0x580000 [0180.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0180.164] GetProcessHeap () returned 0x580000 [0180.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2feb080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x380fd28, dwReserved1=0x6ef3020, cFileName="GlobeButtonImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GLOBEB~1.YOU")) returned 0x5b96b0 [0180.164] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.165] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", len=0x6d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned 1 [0180.165] GetProcessHeap () returned 0x580000 [0180.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0180.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.166] CloseHandle (hObject=0x3fc) returned 1 [0180.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb2cb800, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x6d0062, dwReserved1=0x2e0070, cFileName="CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b96b0 [0180.167] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.167] GetProcessHeap () returned 0x580000 [0180.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x677cd0 [0180.168] GetProcessHeap () returned 0x580000 [0180.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x706e008 [0180.168] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.168] ReadFile (in: hFile=0x3fc, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x380ff14*=0xc20, lpOverlapped=0x0) returned 1 [0180.179] GetProcessHeap () returned 0x580000 [0180.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0180.180] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.180] WriteFile (in: hFile=0x3fc, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x380ff14*=0xc20, lpOverlapped=0x0) returned 1 [0180.180] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.180] WriteFile (in: hFile=0x3fc, lpBuffer=0x706ec27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ec27*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.180] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.180] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.180] CloseHandle (hObject=0x3fc) returned 1 [0180.180] GetProcessHeap () returned 0x580000 [0180.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0180.180] GetProcessHeap () returned 0x580000 [0180.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0180.180] GetProcessHeap () returned 0x580000 [0180.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30111e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5c, dwReserved0=0x380fd28, dwReserved1=0x677cd0, cFileName="CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b96b0 [0180.181] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.196] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", len=0x4c | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned 1 [0180.196] GetProcessHeap () returned 0x580000 [0180.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0180.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0180.197] CloseHandle (hObject=0x478) returned 1 [0180.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x450043, dwReserved1=0x0, cFileName="TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIPSIM~1.YOU")) returned 0x5b9770 [0180.198] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0180.198] GetProcessHeap () returned 0x580000 [0180.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6dcd2e0 [0180.198] GetProcessHeap () returned 0x580000 [0180.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0180.198] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.199] ReadFile (in: hFile=0x478, lpBuffer=0x6dcd2e0, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd2e0*, lpNumberOfBytesRead=0x380ff14*=0x820, lpOverlapped=0x0) returned 1 [0180.207] GetProcessHeap () returned 0x580000 [0180.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.207] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.207] WriteFile (in: hFile=0x478, lpBuffer=0x6c79898*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesWritten=0x380ff14*=0x820, lpOverlapped=0x0) returned 1 [0180.207] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.207] WriteFile (in: hFile=0x478, lpBuffer=0x6c7a0b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a0b7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.207] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.207] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.207] CloseHandle (hObject=0x478) returned 1 [0180.207] GetProcessHeap () returned 0x580000 [0180.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0180.208] GetProcessHeap () returned 0x580000 [0180.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd2e0 | out: hHeap=0x580000) returned 1 [0180.208] GetProcessHeap () returned 0x580000 [0180.208] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa305d4a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x380fd28, dwReserved1=0x6dcd2e0, cFileName="TipsImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIPSIM~1.YOU")) returned 0x5b9770 [0180.208] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.670] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", len=0x4f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned 1 [0182.670] GetProcessHeap () returned 0x580000 [0182.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0182.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.671] CloseHandle (hObject=0x3fc) returned 1 [0182.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.id_1622540890_.your_last_chance")) returned 1 [0182.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEB~1.YOU")) returned 0x5b9770 [0182.672] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.672] GetProcessHeap () returned 0x580000 [0182.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706ecb0 [0182.672] GetProcessHeap () returned 0x580000 [0182.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706fab8 [0182.672] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.672] ReadFile (in: hFile=0x3fc, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x380ff14*=0xd80, lpOverlapped=0x0) returned 1 [0182.685] GetProcessHeap () returned 0x580000 [0182.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.685] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.685] WriteFile (in: hFile=0x3fc, lpBuffer=0x706fab8*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fab8*, lpNumberOfBytesWritten=0x380ff14*=0xd80, lpOverlapped=0x0) returned 1 [0182.685] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.685] WriteFile (in: hFile=0x3fc, lpBuffer=0x7070837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7070837*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.685] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.686] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.686] CloseHandle (hObject=0x3fc) returned 1 [0182.686] GetProcessHeap () returned 0x580000 [0182.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706fab8 | out: hHeap=0x580000) returned 1 [0182.686] GetProcessHeap () returned 0x580000 [0182.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0182.686] GetProcessHeap () returned 0x580000 [0182.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0182.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4804f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdbb, dwReserved0=0x380fd28, dwReserved1=0x706ecb0, cFileName="spacebackupicons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEB~1.YOU")) returned 0x5b9770 [0182.686] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.802] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", len=0x6f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned 1 [0183.802] GetProcessHeap () returned 0x580000 [0183.802] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0183.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0186.280] CloseHandle (hObject=0x440) returned 1 [0186.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x2e0044, dwReserved1=0x50004a, cFileName="PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASSWO~1.YOU")) returned 0x5b96b0 [0186.282] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0186.282] GetProcessHeap () returned 0x580000 [0186.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1301) returned 0x6dd7c30 [0186.282] GetProcessHeap () returned 0x580000 [0186.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1301) returned 0x67ec60 [0186.282] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.282] ReadFile (in: hFile=0x440, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x12e0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x380ff14*=0x12e0, lpOverlapped=0x0) returned 1 [0186.301] GetProcessHeap () returned 0x580000 [0186.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.301] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.301] WriteFile (in: hFile=0x440, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x12e0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x380ff14*=0x12e0, lpOverlapped=0x0) returned 1 [0186.302] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.302] WriteFile (in: hFile=0x440, lpBuffer=0x67ff3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ff3f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.302] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.302] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.302] CloseHandle (hObject=0x440) returned 1 [0186.302] GetProcessHeap () returned 0x580000 [0186.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0186.302] GetProcessHeap () returned 0x580000 [0186.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0186.302] GetProcessHeap () returned 0x580000 [0186.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.302] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6a88e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1319, dwReserved0=0x380fd28, dwReserved1=0x6dd7c30, cFileName="PASSWORD.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASSWO~1.YOU")) returned 0x5b96b0 [0186.302] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.343] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", len=0x61 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned 1 [0186.343] GetProcessHeap () returned 0x580000 [0186.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0186.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.344] CloseHandle (hObject=0x454) returned 1 [0186.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.id_1622540890_.your_last_chance")) returned 1 [0186.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWDB~1.YOU")) returned 0x5b96b0 [0186.345] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.345] GetProcessHeap () returned 0x580000 [0186.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6dd7c48 [0186.345] GetProcessHeap () returned 0x580000 [0186.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6dd7cb8 [0186.345] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.345] ReadFile (in: hFile=0x454, lpBuffer=0x6dd7c48, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c48*, lpNumberOfBytesRead=0x380ff14*=0x40, lpOverlapped=0x0) returned 1 [0186.346] GetProcessHeap () returned 0x580000 [0186.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.346] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.346] WriteFile (in: hFile=0x454, lpBuffer=0x6dd7cb8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7cb8*, lpNumberOfBytesWritten=0x380ff14*=0x40, lpOverlapped=0x0) returned 1 [0186.347] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.347] WriteFile (in: hFile=0x454, lpBuffer=0x6dd7cf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7cf7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.347] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.347] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.347] CloseHandle (hObject=0x454) returned 1 [0186.347] GetProcessHeap () returned 0x580000 [0186.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7cb8 | out: hHeap=0x580000) returned 1 [0186.347] GetProcessHeap () returned 0x580000 [0186.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c48 | out: hHeap=0x580000) returned 1 [0186.347] GetProcessHeap () returned 0x580000 [0186.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6afb260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x380fd28, dwReserved1=0x6dd7c48, cFileName="viewDblClick.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWDB~1.YOU")) returned 0x5b96b0 [0186.347] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.363] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", len=0x5c | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned 1 [0186.363] GetProcessHeap () returned 0x580000 [0186.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0186.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.364] CloseHandle (hObject=0x48c) returned 1 [0186.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.id_1622540890_.your_last_chance")) returned 1 [0186.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWBY~1.YOU")) returned 0x5b96b0 [0186.365] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.365] GetProcessHeap () returned 0x580000 [0186.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6f10060 [0186.365] GetProcessHeap () returned 0x580000 [0186.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6f102a8 [0186.365] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.365] ReadFile (in: hFile=0x48c, lpBuffer=0x6f10060, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10060*, lpNumberOfBytesRead=0x380ff14*=0x200, lpOverlapped=0x0) returned 1 [0186.368] GetProcessHeap () returned 0x580000 [0186.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0186.368] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.368] WriteFile (in: hFile=0x48c, lpBuffer=0x6f102a8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f102a8*, lpNumberOfBytesWritten=0x380ff14*=0x200, lpOverlapped=0x0) returned 1 [0186.368] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.368] WriteFile (in: hFile=0x48c, lpBuffer=0x6f104a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f104a7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.368] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.368] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.368] CloseHandle (hObject=0x48c) returned 1 [0186.368] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f102a8 | out: hHeap=0x580000) returned 1 [0186.369] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10060 | out: hHeap=0x580000) returned 1 [0186.369] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0186.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6b213c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x380fd28, dwReserved1=0x6f10060, cFileName="VIEWBY.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWBY~1.YOU")) returned 0x5b96b0 [0186.369] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.406] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", len=0x59 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned 1 [0186.406] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0186.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.406] CloseHandle (hObject=0x390) returned 1 [0186.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js.id_1622540890_.your_last_chance")) returned 1 [0186.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x505b, dwReserved0=0x1, dwReserved1=0x5f0052, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b96b0 [0186.407] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0186.407] GetProcessHeap () returned 0x580000 [0186.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5061) returned 0x6fc8a78 [0186.408] GetProcessHeap () returned 0x580000 [0186.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5061) returned 0x6fcdae8 [0186.408] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.408] ReadFile (in: hFile=0x390, lpBuffer=0x6fc8a78, nNumberOfBytesToRead=0x5040, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc8a78*, lpNumberOfBytesRead=0x380ff14*=0x5040, lpOverlapped=0x0) returned 1 [0188.002] GetProcessHeap () returned 0x580000 [0188.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.003] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x390, lpBuffer=0x6fcdae8*, nNumberOfBytesToWrite=0x5040, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fcdae8*, lpNumberOfBytesWritten=0x380ff14*=0x5040, lpOverlapped=0x0) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x390, lpBuffer=0x6fd2b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd2b27*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.003] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.003] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.003] CloseHandle (hObject=0x390) returned 1 [0188.003] GetProcessHeap () returned 0x580000 [0188.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fcdae8 | out: hHeap=0x580000) returned 1 [0188.004] GetProcessHeap () returned 0x580000 [0188.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc8a78 | out: hHeap=0x580000) returned 1 [0188.004] GetProcessHeap () returned 0x580000 [0188.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7ac0420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x507f, dwReserved0=0x380fd28, dwReserved1=0x6fc8a78, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b9770 [0191.106] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.183] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", len=0x45 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned 1 [0191.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0191.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0191.184] CloseHandle (hObject=0x45c) returned 1 [0191.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdc9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~3.YOU")) returned 0x5b9770 [0191.185] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0191.185] GetProcessHeap () returned 0x580000 [0191.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdca1) returned 0x6d23568 [0191.185] GetProcessHeap () returned 0x580000 [0191.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdca1) returned 0x70b2a68 [0191.185] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.185] ReadFile (in: hFile=0x45c, lpBuffer=0x6d23568, nNumberOfBytesToRead=0xdc80, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d23568*, lpNumberOfBytesRead=0x380ff14*=0xdc80, lpOverlapped=0x0) returned 1 [0195.471] GetProcessHeap () returned 0x580000 [0195.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.471] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.471] WriteFile (in: hFile=0x45c, lpBuffer=0x70b2a68*, nNumberOfBytesToWrite=0xdc80, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b2a68*, lpNumberOfBytesWritten=0x380ff14*=0xdc80, lpOverlapped=0x0) returned 1 [0195.472] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.472] WriteFile (in: hFile=0x45c, lpBuffer=0x70c06e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c06e7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.472] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.472] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.472] CloseHandle (hObject=0x45c) returned 1 [0195.472] GetProcessHeap () returned 0x580000 [0195.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b2a68 | out: hHeap=0x580000) returned 1 [0195.472] GetProcessHeap () returned 0x580000 [0195.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d23568 | out: hHeap=0x580000) returned 1 [0195.472] GetProcessHeap () returned 0x580000 [0195.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac2036c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdcbe, dwReserved0=0x380fd28, dwReserved1=0x6d23568, cFileName="ZPDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~3.YOU")) returned 0x5b97b0 [0196.620] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.637] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x70 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0196.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0196.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.638] CloseHandle (hObject=0x488) returned 1 [0196.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.638] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0196.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x4e004f, dwReserved1=0x47002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.639] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.639] GetProcessHeap () returned 0x580000 [0196.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0196.639] GetProcessHeap () returned 0x580000 [0196.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0196.639] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.639] ReadFile (in: hFile=0x488, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.641] GetProcessHeap () returned 0x580000 [0196.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.641] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.641] WriteFile (in: hFile=0x488, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x380ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.641] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.641] WriteFile (in: hFile=0x488, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.641] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.641] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.642] CloseHandle (hObject=0x488) returned 1 [0196.642] GetProcessHeap () returned 0x580000 [0196.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0196.642] GetProcessHeap () returned 0x580000 [0196.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0196.642] GetProcessHeap () returned 0x580000 [0196.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd2bde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x380fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.642] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.669] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", len=0x45 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned 1 [0196.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fec) returned 0x6f14048 [0196.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.670] CloseHandle (hObject=0x3e4) returned 1 [0196.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP98F7~1.YOU")) returned 0x5b97b0 [0196.671] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.671] GetProcessHeap () returned 0x580000 [0196.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a81) returned 0x6d06ca8 [0196.672] GetProcessHeap () returned 0x580000 [0196.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a81) returned 0x6e063d0 [0196.672] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.672] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x2a60, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x380ff14*=0x2a60, lpOverlapped=0x0) returned 1 [0197.292] GetProcessHeap () returned 0x580000 [0197.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0197.292] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.292] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x380ff14*=0x2a60, lpOverlapped=0x0) returned 1 [0197.292] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.292] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e08e2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e08e2f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.292] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.292] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.292] CloseHandle (hObject=0x3e4) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0197.769] GetProcessHeap () returned 0x580000 [0197.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad345640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a95, dwReserved0=0x380fd28, dwReserved1=0x6d06ca8, cFileName="ZPDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP98F7~1.YOU")) returned 0x5b96b0 [0199.651] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.955] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", len=0x5f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned 1 [0200.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe8) returned 0x6f14048 [0200.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.734] CloseHandle (hObject=0x488) returned 1 [0201.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.id_1622540890_.your_last_chance")) returned 1 [0201.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b97b0 [0201.735] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.735] GetProcessHeap () returned 0x580000 [0201.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.735] GetProcessHeap () returned 0x580000 [0201.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.735] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.735] ReadFile (in: hFile=0x488, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x380ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.739] GetProcessHeap () returned 0x580000 [0201.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.739] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.740] WriteFile (in: hFile=0x488, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x380ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.740] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.740] WriteFile (in: hFile=0x488, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.740] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.740] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.740] CloseHandle (hObject=0x488) returned 1 [0201.740] GetProcessHeap () returned 0x580000 [0201.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.740] GetProcessHeap () returned 0x580000 [0201.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.740] GetProcessHeap () returned 0x580000 [0201.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdd1f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x380fd28, dwReserved1=0x6eef020, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b9770 [0202.541] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.614] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS", len=0x45 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS") returned 1 [0202.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed8) returned 0x6f14048 [0202.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0202.647] CloseHandle (hObject=0x490) returned 1 [0202.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css.id_1622540890_.your_last_chance")) returned 1 [0202.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8755100, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8755100, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC12A8~1.YOU")) returned 0x5b9770 [0202.648] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0202.648] GetProcessHeap () returned 0x580000 [0202.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7166de8 [0202.649] GetProcessHeap () returned 0x580000 [0202.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7178618 [0202.649] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.649] ReadFile (in: hFile=0x490, lpBuffer=0x7166de8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7166de8*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.968] GetProcessHeap () returned 0x580000 [0208.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0208.968] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.968] WriteFile (in: hFile=0x490, lpBuffer=0x7178618*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7178618*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.968] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.969] WriteFile (in: hFile=0x490, lpBuffer=0x7189e17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e17*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.969] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.969] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.969] CloseHandle (hObject=0x490) returned 1 [0208.969] GetProcessHeap () returned 0x580000 [0208.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7178618 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7166de8 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0210.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8755100, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb42b3c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dcd4, dwReserved0=0x380fd28, dwReserved1=0x7166de8, cFileName="SCHEME33.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC12A8~1.YOU")) returned 0x5b97b0 [0210.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.124] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", len=0x5f | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned 1 [0210.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0210.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0214.361] CloseHandle (hObject=0x4a4) returned 1 [0214.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.id_1622540890_.your_last_chance")) returned 1 [0214.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b9830 [0214.363] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0214.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0214.363] GetProcessHeap () returned 0x580000 [0214.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x7062940 [0214.364] GetProcessHeap () returned 0x580000 [0214.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x7068ab0 [0214.364] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.364] ReadFile (in: hFile=0x4a4, lpBuffer=0x7062940, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesRead=0x380ff14*=0x6140, lpOverlapped=0x0) returned 1 [0216.669] GetProcessHeap () returned 0x580000 [0216.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0216.669] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.670] WriteFile (in: hFile=0x4a4, lpBuffer=0x7068ab0*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7068ab0*, lpNumberOfBytesWritten=0x380ff14*=0x6140, lpOverlapped=0x0) returned 1 [0216.670] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.670] WriteFile (in: hFile=0x4a4, lpBuffer=0x706ebef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ebef*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0216.670] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.670] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0216.670] CloseHandle (hObject=0x4a4) returned 1 [0216.670] GetProcessHeap () returned 0x580000 [0216.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7068ab0 | out: hHeap=0x580000) returned 1 [0216.670] GetProcessHeap () returned 0x580000 [0216.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0216.670] GetProcessHeap () returned 0x580000 [0216.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0217.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8c32360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6172, dwReserved0=0x380fd28, dwReserved1=0x7062940, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b9770 [0220.320] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.864] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", len=0x45 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 1 [0221.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0221.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.864] CloseHandle (hObject=0x480) returned 1 [0222.864] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.864] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id_1622540890_.your_last_chance")) returned 1 [0222.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~1.YOU")) returned 0x5b96f0 [0222.865] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.866] GetProcessHeap () returned 0x580000 [0222.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10060 [0222.866] GetProcessHeap () returned 0x580000 [0222.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10ae8 [0222.866] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.866] ReadFile (in: hFile=0x480, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x380ff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.879] GetProcessHeap () returned 0x580000 [0222.879] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.879] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.879] WriteFile (in: hFile=0x480, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x380ff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.879] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.879] WriteFile (in: hFile=0x480, lpBuffer=0x6c11507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11507*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.879] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.879] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.879] CloseHandle (hObject=0x480) returned 1 [0222.879] GetProcessHeap () returned 0x580000 [0222.879] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0222.879] GetProcessHeap () returned 0x580000 [0222.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0222.880] GetProcessHeap () returned 0x580000 [0222.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7686a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x380fd28, dwReserved1=0x6c10060, cFileName="ALERT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~1.YOU")) returned 0x5b9630 [0225.415] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.455] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", len=0x6a | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned 1 [0225.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0225.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0225.456] CloseHandle (hObject=0x39c) returned 1 [0225.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance")) returned 1 [0228.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0228.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0228.777] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0228.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0228.777] GetProcessHeap () returned 0x580000 [0228.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0228.777] GetProcessHeap () returned 0x580000 [0228.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0228.777] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.777] ReadFile (in: hFile=0x39c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.668] GetProcessHeap () returned 0x580000 [0237.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0237.668] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.669] WriteFile (in: hFile=0x39c, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.265] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.265] WriteFile (in: hFile=0x39c, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.265] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.265] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.265] CloseHandle (hObject=0x39c) returned 1 [0239.265] GetProcessHeap () returned 0x580000 [0239.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0239.265] GetProcessHeap () returned 0x580000 [0239.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0239.265] GetProcessHeap () returned 0x580000 [0239.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0241.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6221ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3de03, dwReserved0=0x380fd28, dwReserved1=0x6d21878, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9630 [0241.353] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.442] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML", len=0x35 | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned 1 [0241.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0241.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0242.450] CloseHandle (hObject=0x264) returned 1 [0242.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0242.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.id_1622540890_.your_last_chance")) returned 1 [0242.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0242.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTIRM~2.YOU")) returned 0x5b9630 [0242.452] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pptirm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0242.452] GetProcessHeap () returned 0x580000 [0242.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0242.452] GetProcessHeap () returned 0x580000 [0242.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0242.452] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.452] ReadFile (in: hFile=0x264, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.555] GetProcessHeap () returned 0x580000 [0244.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0244.556] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.556] WriteFile (in: hFile=0x264, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.556] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.556] WriteFile (in: hFile=0x264, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.556] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.556] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.557] CloseHandle (hObject=0x264) returned 1 [0244.557] GetProcessHeap () returned 0x580000 [0244.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0244.557] GetProcessHeap () returned 0x580000 [0244.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0244.557] GetProcessHeap () returned 0x580000 [0244.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0249.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9490ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13788, dwReserved0=0x380fd28, dwReserved1=0x72f0208, cFileName="PPTIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTIRM~2.YOU")) returned 0x5b9730 [0249.274] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.380] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC", len=0x3e | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 1 [0249.380] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0249.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0249.381] CloseHandle (hObject=0x428) returned 1 [0249.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.id_1622540890_.your_last_chance")) returned 1 [0249.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x12c2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCARD~2.YOU")) returned 0x5b9730 [0249.382] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0249.382] GetProcessHeap () returned 0x580000 [0249.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e57c40 [0249.383] GetProcessHeap () returned 0x580000 [0249.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e69470 [0249.383] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.383] ReadFile (in: hFile=0x428, lpBuffer=0x6e57c40, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e57c40*, lpNumberOfBytesRead=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.839] GetProcessHeap () returned 0x580000 [0252.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0252.839] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.839] WriteFile (in: hFile=0x428, lpBuffer=0x6e69470*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e69470*, lpNumberOfBytesWritten=0x380ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.840] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.840] WriteFile (in: hFile=0x428, lpBuffer=0x6e7ac6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7ac6f*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.840] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.840] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.840] CloseHandle (hObject=0x428) returned 1 [0252.911] GetProcessHeap () returned 0x580000 [0252.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e69470 | out: hHeap=0x580000) returned 1 [0252.911] GetProcessHeap () returned 0x580000 [0252.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e57c40 | out: hHeap=0x580000) returned 1 [0252.911] GetProcessHeap () returned 0x580000 [0252.911] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce3908e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12c4e, dwReserved0=0x380fd28, dwReserved1=0x6e57c40, cFileName="BZCARD11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCARD~2.YOU")) returned 0x5b9730 [0254.425] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.363] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML") returned 1 [0255.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f5c) returned 0x72e5948 [0255.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.633] CloseHandle (hObject=0x170) returned 1 [0258.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml.id_1622540890_.your_last_chance")) returned 1 [0258.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3150300, ftCreationTime.dwHighDateTime=0x1c97a05, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3150300, ftLastWriteTime.dwHighDateTime=0x1c97a05, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPQUO~2.YOU")) returned 0x5b96f0 [0258.635] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.636] GetProcessHeap () returned 0x580000 [0258.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x6cba390 [0258.636] GetProcessHeap () returned 0x580000 [0258.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x6cbbf98 [0258.636] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.636] ReadFile (in: hFile=0x170, lpBuffer=0x6cba390, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesRead=0x380ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0258.661] GetProcessHeap () returned 0x580000 [0258.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.661] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.661] WriteFile (in: hFile=0x170, lpBuffer=0x6cbbf98*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbbf98*, lpNumberOfBytesWritten=0x380ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0258.661] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.661] WriteFile (in: hFile=0x170, lpBuffer=0x6cbdb37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdb37*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.661] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.661] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.661] CloseHandle (hObject=0x170) returned 1 [0258.661] GetProcessHeap () returned 0x580000 [0258.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbbf98 | out: hHeap=0x580000) returned 1 [0258.661] GetProcessHeap () returned 0x580000 [0258.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0258.661] GetProcessHeap () returned 0x580000 [0258.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fccc | out: lpFindFileData=0x380fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3150300, ftCreationTime.dwHighDateTime=0x1c97a05, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b0e9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x380fd28, dwReserved1=0x6cba390, cFileName="DGPQUOT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPQUO~2.YOU")) returned 0x5b9630 [0259.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.235] SysReAllocStringLen (in: pbstr=0x380ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC", len=0x3d | out: pbstr=0x380ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC") returned 1 [0259.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2098) returned 0x72e5948 [0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0259.346] CloseHandle (hObject=0x39c) returned 1 [0259.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc.id_1622540890_.your_last_chance")) returned 1 [0259.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x380ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x380fc74 | out: lpFindFileData=0x380fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc012a00, ftCreationTime.dwHighDateTime=0x1ca1012, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc012a00, ftLastWriteTime.dwHighDateTime=0x1ca1012, nFileSizeHigh=0x0, nFileSizeLow=0x7d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STORYB~2.YOU")) returned 0x5b9630 [0259.347] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0259.348] GetProcessHeap () returned 0x580000 [0259.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d41) returned 0x70b2b78 [0259.348] GetProcessHeap () returned 0x580000 [0259.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d41) returned 0x702a188 [0259.348] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.348] ReadFile (in: hFile=0x39c, lpBuffer=0x70b2b78, nNumberOfBytesToRead=0x7d20, lpNumberOfBytesRead=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b2b78*, lpNumberOfBytesRead=0x380ff14*=0x7d20, lpOverlapped=0x0) returned 1 [0263.276] GetProcessHeap () returned 0x580000 [0263.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0263.276] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.276] WriteFile (in: hFile=0x39c, lpBuffer=0x702a188*, nNumberOfBytesToWrite=0x7d20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesWritten=0x380ff14*=0x7d20, lpOverlapped=0x0) returned 1 [0264.703] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.703] WriteFile (in: hFile=0x39c, lpBuffer=0x7031ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x7031ea7*, lpNumberOfBytesWritten=0x380ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.703] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.703] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x380ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x380ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.703] CloseHandle (hObject=0x39c) Thread: id = 22 os_tid = 0xa50 [0039.062] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.109] Sleep (dwMilliseconds=0x1) [0039.127] Sleep (dwMilliseconds=0x1) [0039.205] Sleep (dwMilliseconds=0x1) [0039.288] Sleep (dwMilliseconds=0x1) [0039.414] Sleep (dwMilliseconds=0x1) [0039.583] Sleep (dwMilliseconds=0x1) [0039.676] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.743] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.288] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.591] Sleep (dwMilliseconds=0x1) [0042.165] Sleep (dwMilliseconds=0x1) [0042.328] Sleep (dwMilliseconds=0x1) [0042.354] Sleep (dwMilliseconds=0x1) [0042.472] Sleep (dwMilliseconds=0x1) [0042.515] Sleep (dwMilliseconds=0x1) [0042.633] Sleep (dwMilliseconds=0x1) [0042.650] Sleep (dwMilliseconds=0x1) [0042.662] Sleep (dwMilliseconds=0x1) [0042.702] Sleep (dwMilliseconds=0x1) [0042.795] Sleep (dwMilliseconds=0x1) [0042.827] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.823] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.665] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.743] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.852] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.930] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.086] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.367] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.398] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.523] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.726] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.804] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.116] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.147] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.200] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.350] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.428] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.459] Sleep (dwMilliseconds=0x1) [0046.477] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.585] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.693] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.740] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.771] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.145] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.142] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.891] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.123] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.435] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.734] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.890] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.062] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.501] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.529] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.153] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.309] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.372] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.202] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.745] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", len=0x4b | out: pbstr=0x394ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 1 [0061.745] GetProcessHeap () returned 0x580000 [0061.745] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x74) returned 0x5b5bc8 [0061.745] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0066.816] CloseHandle (hObject=0x488) returned 1 [0066.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.816] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id_1622540890_.your_last_chance")) returned 1 [0076.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0076.426] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x45, dwReserved1=0x0, cFileName="PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRR~1.YOU")) returned 0x5b96f0 [0076.426] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0076.426] GetProcessHeap () returned 0x580000 [0076.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0076.427] GetProcessHeap () returned 0x580000 [0076.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0076.427] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.427] ReadFile (in: hFile=0x488, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.185] GetProcessHeap () returned 0x580000 [0079.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0079.185] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.185] WriteFile (in: hFile=0x488, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.186] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.186] WriteFile (in: hFile=0x488, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.953] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.953] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.953] CloseHandle (hObject=0x488) returned 1 [0079.953] GetProcessHeap () returned 0x580000 [0079.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0079.953] GetProcessHeap () returned 0x580000 [0079.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0079.955] GetProcessHeap () returned 0x580000 [0079.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0079.955] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0x674590e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9b6bac3, dwReserved0=0x394fd34, dwReserved1=0x7718ba87, cFileName="PrjPrrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRR~1.YOU")) returned 0x5b9730 [0079.955] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.680] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", len=0x66 | out: pbstr=0x394ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 1 [0080.680] GetProcessHeap () returned 0x580000 [0080.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x24) returned 0x5dc550 [0080.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.951] CloseHandle (hObject=0x488) returned 1 [0081.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id_1622540890_.your_last_chance")) returned 1 [0081.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPC~1.YOU")) returned 0x5b96f0 [0081.952] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.952] GetProcessHeap () returned 0x580000 [0081.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10681) returned 0x6f58108 [0081.952] GetProcessHeap () returned 0x580000 [0081.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10681) returned 0x6c57108 [0081.953] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.953] ReadFile (in: hFile=0x488, lpBuffer=0x6f58108, nNumberOfBytesToRead=0x10660, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x394ff14*=0x10660, lpOverlapped=0x0) returned 1 [0083.204] GetProcessHeap () returned 0x580000 [0083.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0083.204] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.204] WriteFile (in: hFile=0x488, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x394ff14*=0x10660, lpOverlapped=0x0) returned 1 [0083.205] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.205] WriteFile (in: hFile=0x488, lpBuffer=0x6c67767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67767*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.205] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.205] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.205] CloseHandle (hObject=0x488) returned 1 [0083.205] GetProcessHeap () returned 0x580000 [0083.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0083.206] GetProcessHeap () returned 0x580000 [0083.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0083.206] GetProcessHeap () returned 0x580000 [0083.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0083.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6934aee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1069a, dwReserved0=0x394fd28, dwReserved1=0x6f58108, cFileName="SETUP.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPC~1.YOU")) returned 0x5b9730 [0083.206] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0088.239] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x394ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 1 [0088.239] GetProcessHeap () returned 0x580000 [0088.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0088.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0088.239] CloseHandle (hObject=0x49c) returned 1 [0088.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0089.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0089.202] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0089.202] GetProcessHeap () returned 0x580000 [0089.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4fa1) returned 0x6c50cb8 [0089.202] GetProcessHeap () returned 0x580000 [0089.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4fa1) returned 0x6f3dd68 [0089.202] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.202] ReadFile (in: hFile=0x49c, lpBuffer=0x6c50cb8, nNumberOfBytesToRead=0x4f80, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c50cb8*, lpNumberOfBytesRead=0x394ff14*=0x4f80, lpOverlapped=0x0) returned 1 [0090.117] GetProcessHeap () returned 0x580000 [0090.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0090.118] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.118] WriteFile (in: hFile=0x49c, lpBuffer=0x6f3dd68*, nNumberOfBytesToWrite=0x4f80, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3dd68*, lpNumberOfBytesWritten=0x394ff14*=0x4f80, lpOverlapped=0x0) returned 1 [0090.118] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.118] WriteFile (in: hFile=0x49c, lpBuffer=0x6f42ce7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42ce7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0090.118] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.118] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0090.118] CloseHandle (hObject=0x49c) returned 1 [0090.119] GetProcessHeap () returned 0x580000 [0090.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3dd68 | out: hHeap=0x580000) returned 1 [0090.119] GetProcessHeap () returned 0x580000 [0090.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c50cb8 | out: hHeap=0x580000) returned 1 [0090.119] GetProcessHeap () returned 0x580000 [0090.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0090.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d533000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4fb7, dwReserved0=0x394fd28, dwReserved1=0x6c50cb8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0090.809] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.142] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", len=0x47 | out: pbstr=0x394ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 1 [0092.142] GetProcessHeap () returned 0x580000 [0092.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x80) returned 0x5f9fd0 [0092.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0099.516] CloseHandle (hObject=0x46c) returned 1 [0099.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.516] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id_1622540890_.your_last_chance")) returned 1 [0099.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIXELI~1.YOU")) returned 0x5b9730 [0099.562] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0099.562] GetProcessHeap () returned 0x580000 [0099.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0099.563] GetProcessHeap () returned 0x580000 [0099.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0099.563] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.563] ReadFile (in: hFile=0x46c, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x394ff14*=0x200, lpOverlapped=0x0) returned 1 [0099.565] GetProcessHeap () returned 0x580000 [0099.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.565] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.565] WriteFile (in: hFile=0x46c, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x394ff14*=0x200, lpOverlapped=0x0) returned 1 [0099.566] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.566] WriteFile (in: hFile=0x46c, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.566] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.566] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.566] CloseHandle (hObject=0x46c) returned 1 [0099.566] GetProcessHeap () returned 0x580000 [0099.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0099.566] GetProcessHeap () returned 0x580000 [0099.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0099.566] GetProcessHeap () returned 0x580000 [0099.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f5b140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x394fd28, dwReserved1=0x6107d8, cFileName="PIXEL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIXELI~1.YOU")) returned 0x5b9730 [0099.567] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.760] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", len=0x49 | out: pbstr=0x394ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 1 [0101.760] GetProcessHeap () returned 0x580000 [0101.760] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0101.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0106.067] CloseHandle (hObject=0x41c) returned 1 [0106.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0106.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0106.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0106.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0106.356] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0106.356] GetProcessHeap () returned 0x580000 [0106.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x677cd0 [0106.356] GetProcessHeap () returned 0x580000 [0106.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x6f0efe0 [0106.356] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.356] ReadFile (in: hFile=0x41c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xa60, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x394ff14*=0xa60, lpOverlapped=0x0) returned 1 [0106.368] GetProcessHeap () returned 0x580000 [0106.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0106.368] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.368] WriteFile (in: hFile=0x41c, lpBuffer=0x6f0efe0*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0efe0*, lpNumberOfBytesWritten=0x394ff14*=0xa60, lpOverlapped=0x0) returned 1 [0106.368] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.368] WriteFile (in: hFile=0x41c, lpBuffer=0x6f0fa3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0fa3f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.368] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.368] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.368] CloseHandle (hObject=0x41c) returned 1 [0106.369] GetProcessHeap () returned 0x580000 [0106.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0efe0 | out: hHeap=0x580000) returned 1 [0106.369] GetProcessHeap () returned 0x580000 [0106.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0106.369] GetProcessHeap () returned 0x580000 [0106.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0106.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x770388c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x394fd28, dwReserved1=0x677cd0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0106.369] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.883] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", len=0x4c | out: pbstr=0x394ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 1 [0106.883] GetProcessHeap () returned 0x580000 [0106.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0106.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0107.800] CloseHandle (hObject=0x40c) returned 1 [0107.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.801] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id_1622540890_.your_last_chance")) returned 1 [0107.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x450043, dwReserved1=0x0, cFileName="GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GBCBIG~1.YOU")) returned 0x5b9730 [0107.801] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0107.802] GetProcessHeap () returned 0x580000 [0107.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7a170 [0107.802] GetProcessHeap () returned 0x580000 [0107.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d8b9a0 [0107.802] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.802] ReadFile (in: hFile=0x40c, lpBuffer=0x6d7a170, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7a170*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.691] GetProcessHeap () returned 0x580000 [0111.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0111.691] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.691] WriteFile (in: hFile=0x40c, lpBuffer=0x6d8b9a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8b9a0*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.692] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.692] WriteFile (in: hFile=0x40c, lpBuffer=0x6d9d19f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9d19f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.765] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.766] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.766] CloseHandle (hObject=0x40c) returned 1 [0111.766] GetProcessHeap () returned 0x580000 [0111.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8b9a0 | out: hHeap=0x580000) returned 1 [0111.770] GetProcessHeap () returned 0x580000 [0111.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7a170 | out: hHeap=0x580000) returned 1 [0111.773] GetProcessHeap () returned 0x580000 [0111.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0111.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a3b2480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdc6dd, dwReserved0=0x580000, dwReserved1=0x580000, cFileName="GBCBIG.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GBCBIG~1.YOU")) returned 0x5b95f0 [0111.773] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0112.050] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", len=0x47 | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 1 [0112.050] GetProcessHeap () returned 0x580000 [0112.050] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b96b0 [0112.050] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.065] Sleep (dwMilliseconds=0x1) [0112.159] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", len=0x51 | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 1 [0112.159] GetProcessHeap () returned 0x580000 [0112.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.186] Sleep (dwMilliseconds=0x1) [0112.320] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", len=0x5a | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 1 [0112.320] GetProcessHeap () returned 0x580000 [0112.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.320] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.320] Sleep (dwMilliseconds=0x1) [0112.339] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 1 [0112.339] GetProcessHeap () returned 0x580000 [0112.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.339] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.339] Sleep (dwMilliseconds=0x1) [0112.356] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", len=0x43 | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned 1 [0112.356] GetProcessHeap () returned 0x580000 [0112.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c562c0 [0112.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.356] Sleep (dwMilliseconds=0x1) [0112.387] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", len=0x38 | out: pbstr=0x394ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned 1 [0112.387] GetProcessHeap () returned 0x580000 [0112.387] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b96f0 [0112.387] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.387] Sleep (dwMilliseconds=0x1) [0113.314] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", len=0x3f | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 1 [0113.314] GetProcessHeap () returned 0x580000 [0113.314] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xf0) returned 0x6f0ceb8 [0113.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0113.493] CloseHandle (hObject=0x438) returned 1 [0113.493] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0413~1.YOU")) returned 0x5b9630 [0115.009] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0115.009] GetProcessHeap () returned 0x580000 [0115.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x635768 [0115.010] GetProcessHeap () returned 0x580000 [0115.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x6d10048 [0115.010] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.010] ReadFile (in: hFile=0x438, lpBuffer=0x635768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x394ff14*=0xd40, lpOverlapped=0x0) returned 1 [0115.023] GetProcessHeap () returned 0x580000 [0115.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.023] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.023] WriteFile (in: hFile=0x438, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x394ff14*=0xd40, lpOverlapped=0x0) returned 1 [0115.023] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.023] WriteFile (in: hFile=0x438, lpBuffer=0x6d10d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10d87*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.023] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.023] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.023] CloseHandle (hObject=0x438) returned 1 [0115.023] GetProcessHeap () returned 0x580000 [0115.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0115.023] GetProcessHeap () returned 0x580000 [0115.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0115.023] GetProcessHeap () returned 0x580000 [0115.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c2ca3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0x394fd28, dwReserved1=0x635768, cFileName="AN04134_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0413~1.YOU")) returned 0x5b9630 [0116.143] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0116.190] CloseHandle (hObject=0x45c) returned 1 [0116.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0001~2.YOU")) returned 0x5b9630 [0116.191] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0116.191] GetProcessHeap () returned 0x580000 [0116.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36c1) returned 0x6dc47d0 [0116.191] GetProcessHeap () returned 0x580000 [0116.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36c1) returned 0x6dc7ea0 [0116.191] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.191] ReadFile (in: hFile=0x45c, lpBuffer=0x6dc47d0, nNumberOfBytesToRead=0x36a0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc47d0*, lpNumberOfBytesRead=0x394ff14*=0x36a0, lpOverlapped=0x0) returned 1 [0117.183] GetProcessHeap () returned 0x580000 [0117.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.183] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.183] WriteFile (in: hFile=0x45c, lpBuffer=0x6dc7ea0*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7ea0*, lpNumberOfBytesWritten=0x394ff14*=0x36a0, lpOverlapped=0x0) returned 1 [0117.183] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.183] WriteFile (in: hFile=0x45c, lpBuffer=0x6dcb53f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb53f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.184] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.184] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.184] CloseHandle (hObject=0x45c) returned 1 [0117.184] GetProcessHeap () returned 0x580000 [0117.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7ea0 | out: hHeap=0x580000) returned 1 [0117.184] GetProcessHeap () returned 0x580000 [0117.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc47d0 | out: hHeap=0x580000) returned 1 [0117.184] GetProcessHeap () returned 0x580000 [0117.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d7521a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36ce, dwReserved0=0x394fd28, dwReserved1=0x6dc47d0, cFileName="SO00017_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0001~2.YOU")) returned 0x5b9630 [0118.899] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0118.989] CloseHandle (hObject=0x170) returned 1 [0118.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~3.YOU")) returned 0x5b9630 [0118.990] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0118.990] GetProcessHeap () returned 0x580000 [0118.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6e023e8 [0118.990] GetProcessHeap () returned 0x580000 [0118.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6e02a30 [0118.990] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.990] ReadFile (in: hFile=0x170, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x394ff14*=0x600, lpOverlapped=0x0) returned 1 [0119.021] GetProcessHeap () returned 0x580000 [0119.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.022] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.022] WriteFile (in: hFile=0x170, lpBuffer=0x6e02a30*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02a30*, lpNumberOfBytesWritten=0x394ff14*=0x600, lpOverlapped=0x0) returned 1 [0119.022] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.022] WriteFile (in: hFile=0x170, lpBuffer=0x6e0302f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0302f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.022] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.022] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.022] CloseHandle (hObject=0x170) returned 1 [0119.022] GetProcessHeap () returned 0x580000 [0119.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02a30 | out: hHeap=0x580000) returned 1 [0119.022] GetProcessHeap () returned 0x580000 [0119.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0119.022] GetProcessHeap () returned 0x580000 [0119.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0119.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e8e03e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x640, dwReserved0=0x394fd28, dwReserved1=0x6e023e8, cFileName="SO02268_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~3.YOU")) returned 0x5b9630 [0119.022] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0119.115] CloseHandle (hObject=0x4a8) returned 1 [0119.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0209~1.YOU")) returned 0x5b9630 [0119.116] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0119.116] GetProcessHeap () returned 0x580000 [0119.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x6e063d0 [0119.116] GetProcessHeap () returned 0x580000 [0119.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x65cae0 [0119.116] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.117] ReadFile (in: hFile=0x4a8, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x1b40, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x394ff14*=0x1b40, lpOverlapped=0x0) returned 1 [0119.164] GetProcessHeap () returned 0x580000 [0119.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0119.164] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.164] WriteFile (in: hFile=0x4a8, lpBuffer=0x65cae0*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65cae0*, lpNumberOfBytesWritten=0x394ff14*=0x1b40, lpOverlapped=0x0) returned 1 [0119.164] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.164] WriteFile (in: hFile=0x4a8, lpBuffer=0x65e61f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65e61f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.164] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.164] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.164] CloseHandle (hObject=0x4a8) returned 1 [0119.545] GetProcessHeap () returned 0x580000 [0119.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65cae0 | out: hHeap=0x580000) returned 1 [0119.545] GetProcessHeap () returned 0x580000 [0119.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0119.545] GetProcessHeap () returned 0x580000 [0119.545] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0120.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ea37040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e, dwReserved0=0x394fd28, dwReserved1=0x6e063d0, cFileName="SO02094_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0209~1.YOU")) returned 0x5b96f0 [0120.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.153] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", len=0x4c | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 1 [0120.154] GetProcessHeap () returned 0x580000 [0120.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b0) returned 0x6d06ca8 [0120.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.635] CloseHandle (hObject=0x48c) returned 1 [0120.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.id_1622540890_.your_last_chance")) returned 1 [0120.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~1.YOU")) returned 0x5b9630 [0120.642] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.642] GetProcessHeap () returned 0x580000 [0120.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6c29878 [0120.642] GetProcessHeap () returned 0x580000 [0120.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0120.642] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.642] ReadFile (in: hFile=0x48c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x394ff14*=0xe00, lpOverlapped=0x0) returned 1 [0120.657] GetProcessHeap () returned 0x580000 [0120.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.657] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.657] WriteFile (in: hFile=0x48c, lpBuffer=0x6f67710*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesWritten=0x394ff14*=0xe00, lpOverlapped=0x0) returned 1 [0120.657] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.657] WriteFile (in: hFile=0x48c, lpBuffer=0x6f6850f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6850f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.657] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.657] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.658] CloseHandle (hObject=0x48c) returned 1 [0120.658] GetProcessHeap () returned 0x580000 [0120.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0120.658] GetProcessHeap () returned 0x580000 [0120.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0120.658] GetProcessHeap () returned 0x580000 [0120.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f87f440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe41, dwReserved0=0x394fd28, dwReserved1=0x6c29878, cFileName="WB01741L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~1.YOU")) returned 0x5b9630 [0120.658] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.681] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", len=0x4b | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned 1 [0120.681] GetProcessHeap () returned 0x580000 [0120.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1860) returned 0x6e00ac0 [0120.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.644] CloseHandle (hObject=0x3fc) returned 1 [0122.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.644] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.id_1622540890_.your_last_chance")) returned 1 [0122.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x45, dwReserved1=0x0, cFileName="Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANX~1.YOU")) returned 0x5b9730 [0122.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.645] GetProcessHeap () returned 0x580000 [0122.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.645] GetProcessHeap () returned 0x580000 [0122.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.645] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.645] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x394ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.650] GetProcessHeap () returned 0x580000 [0122.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.650] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.650] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x394ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.650] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.650] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.650] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.650] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.651] CloseHandle (hObject=0x3fc) returned 1 [0122.651] GetProcessHeap () returned 0x580000 [0122.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.651] GetProcessHeap () returned 0x580000 [0122.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.651] GetProcessHeap () returned 0x580000 [0122.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b8a440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x394fd28, dwReserved1=0x678958, cFileName="Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANX~1.YOU")) returned 0x5b9730 [0124.520] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.541] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", len=0x4e | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned 1 [0124.541] GetProcessHeap () returned 0x580000 [0124.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ec) returned 0x6f42f08 [0124.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.560] CloseHandle (hObject=0x4a0) returned 1 [0124.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.id_1622540890_.your_last_chance")) returned 1 [0124.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ELEMEN~1.YOU")) returned 0x5b9730 [0124.561] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.561] GetProcessHeap () returned 0x580000 [0124.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6c29878 [0124.561] GetProcessHeap () returned 0x580000 [0124.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6ce2378 [0124.561] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.561] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe40, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x394ff14*=0xe40, lpOverlapped=0x0) returned 1 [0124.575] GetProcessHeap () returned 0x580000 [0124.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.575] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.575] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x394ff14*=0xe40, lpOverlapped=0x0) returned 1 [0124.575] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.575] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce31b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce31b7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.575] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.575] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.575] CloseHandle (hObject=0x4a0) returned 1 [0124.575] GetProcessHeap () returned 0x580000 [0124.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.576] GetProcessHeap () returned 0x580000 [0124.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.576] GetProcessHeap () returned 0x580000 [0124.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dd6d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x394fd28, dwReserved1=0x6c29878, cFileName="Elemental.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ELEMEN~1.YOU")) returned 0x5b9730 [0125.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.331] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", len=0x3d | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned 1 [0125.331] GetProcessHeap () returned 0x580000 [0125.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1900) returned 0x6f42f08 [0125.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0127.386] CloseHandle (hObject=0x428) returned 1 [0127.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0127.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.id_1622540890_.your_last_chance")) returned 1 [0127.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02126~1.YOU")) returned 0x5b96f0 [0128.835] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0128.835] GetProcessHeap () returned 0x580000 [0128.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x6dd00d0 [0128.835] GetProcessHeap () returned 0x580000 [0128.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x6dd2580 [0128.835] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.835] ReadFile (in: hFile=0x4a8, lpBuffer=0x6dd00d0, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd00d0*, lpNumberOfBytesRead=0x394ff14*=0x2480, lpOverlapped=0x0) returned 1 [0128.868] GetProcessHeap () returned 0x580000 [0128.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0128.868] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.868] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dd2580*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd2580*, lpNumberOfBytesWritten=0x394ff14*=0x2480, lpOverlapped=0x0) returned 1 [0128.868] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.868] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dd49ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd49ff*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.868] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.868] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.869] CloseHandle (hObject=0x4a8) returned 1 [0128.941] GetProcessHeap () returned 0x580000 [0128.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd2580 | out: hHeap=0x580000) returned 1 [0128.941] GetProcessHeap () returned 0x580000 [0128.942] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd00d0 | out: hHeap=0x580000) returned 1 [0128.942] GetProcessHeap () returned 0x580000 [0128.942] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0128.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x846c0780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24b2, dwReserved0=0x394fd28, dwReserved1=0x6dd00d0, cFileName="J0212661.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02126~1.YOU")) returned 0x5b96f0 [0129.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0131.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.651] CloseHandle (hObject=0x428) returned 1 [0132.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0132.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~3.YOU")) returned 0x5b9730 [0132.652] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.652] GetProcessHeap () returned 0x580000 [0132.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0132.652] GetProcessHeap () returned 0x580000 [0132.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0132.652] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.652] ReadFile (in: hFile=0x428, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0132.653] GetProcessHeap () returned 0x580000 [0132.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.654] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.654] WriteFile (in: hFile=0x428, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0132.654] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.654] WriteFile (in: hFile=0x428, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.654] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.654] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.654] CloseHandle (hObject=0x428) returned 1 [0132.654] GetProcessHeap () returned 0x580000 [0132.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0132.654] GetProcessHeap () returned 0x580000 [0132.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0132.654] GetProcessHeap () returned 0x580000 [0132.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86ae75a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x394fd28, dwReserved1=0x5ad8a0, cFileName="EXCEL_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~3.YOU")) returned 0x5b96f0 [0135.136] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.136] Sleep (dwMilliseconds=0x1) [0135.253] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", len=0x47 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 1 [0135.253] GetProcessHeap () returned 0x580000 [0135.253] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0135.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.254] CloseHandle (hObject=0x4ac) returned 1 [0135.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id_1622540890_.your_last_chance")) returned 1 [0135.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOLDER~1.YOU")) returned 0x5b96f0 [0135.255] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.255] GetProcessHeap () returned 0x580000 [0135.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x6c9a390 [0135.255] GetProcessHeap () returned 0x580000 [0135.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x6c9b698 [0135.255] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.255] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1260, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x394ff14*=0x1260, lpOverlapped=0x0) returned 1 [0135.273] GetProcessHeap () returned 0x580000 [0135.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.273] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.273] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c9b698*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b698*, lpNumberOfBytesWritten=0x394ff14*=0x1260, lpOverlapped=0x0) returned 1 [0135.273] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.273] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c9c8f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9c8f7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.273] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.273] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.273] CloseHandle (hObject=0x4ac) returned 1 [0135.273] GetProcessHeap () returned 0x580000 [0135.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b698 | out: hHeap=0x580000) returned 1 [0135.273] GetProcessHeap () returned 0x580000 [0135.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0135.273] GetProcessHeap () returned 0x580000 [0135.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x883e5ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x128a, dwReserved0=0x394fd28, dwReserved1=0x6c9a390, cFileName="FOLDER.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOLDER~1.YOU")) returned 0x5b96f0 [0135.274] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.274] Sleep (dwMilliseconds=0x1) [0135.294] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", len=0x5c | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned 1 [0135.294] GetProcessHeap () returned 0x580000 [0135.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0135.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.295] CloseHandle (hObject=0x4ac) returned 1 [0135.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.id_1622540890_.your_last_chance")) returned 1 [0135.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="_CONNE~1.YOU")) returned 0x5b96f0 [0135.296] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.296] GetProcessHeap () returned 0x580000 [0135.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0135.296] GetProcessHeap () returned 0x580000 [0135.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0135.296] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.296] ReadFile (in: hFile=0x4ac, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x394ff14*=0xa0, lpOverlapped=0x0) returned 1 [0135.297] GetProcessHeap () returned 0x580000 [0135.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.297] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.298] WriteFile (in: hFile=0x4ac, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x394ff14*=0xa0, lpOverlapped=0x0) returned 1 [0135.298] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.298] WriteFile (in: hFile=0x4ac, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.298] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.298] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.298] CloseHandle (hObject=0x4ac) returned 1 [0135.298] GetProcessHeap () returned 0x580000 [0135.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0135.298] GetProcessHeap () returned 0x580000 [0135.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0135.298] GetProcessHeap () returned 0x580000 [0135.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.298] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8840be00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x394fd28, dwReserved1=0x60e978, cFileName="+Connect to New Data Source.odc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="_CONNE~1.YOU")) returned 0x5b96f0 [0135.298] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.299] Sleep (dwMilliseconds=0x1) [0135.360] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", len=0x43 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned 1 [0135.360] GetProcessHeap () returned 0x580000 [0135.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0135.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0135.381] CloseHandle (hObject=0x440) returned 1 [0135.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4465be00, ftCreationTime.dwHighDateTime=0x1bd4f48, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4465be00, ftLastWriteTime.dwHighDateTime=0x1bd4f48, nFileSizeHigh=0x0, nFileSizeLow=0xaeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~2.YOU")) returned 0x5b96f0 [0135.382] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0135.382] GetProcessHeap () returned 0x580000 [0135.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0135.382] GetProcessHeap () returned 0x580000 [0135.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x635768 [0135.382] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.383] ReadFile (in: hFile=0x440, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x394ff14*=0xae0, lpOverlapped=0x0) returned 1 [0136.779] GetProcessHeap () returned 0x580000 [0136.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0136.780] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.780] WriteFile (in: hFile=0x440, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x394ff14*=0xae0, lpOverlapped=0x0) returned 1 [0138.429] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.430] WriteFile (in: hFile=0x440, lpBuffer=0x636247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x636247*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.437] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.438] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.438] CloseHandle (hObject=0x440) returned 1 [0138.565] GetProcessHeap () returned 0x580000 [0138.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0138.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4465be00, ftCreationTime.dwHighDateTime=0x1bd4f48, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0f, dwReserved0=0x394fd28, dwReserved1=0x677cd0, cFileName="BD21336_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~2.YOU")) returned 0x5b9770 [0139.574] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.664] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", len=0x43 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned 1 [0140.664] GetProcessHeap () returned 0x580000 [0140.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dac) returned 0x6f14048 [0140.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.664] CloseHandle (hObject=0x488) returned 1 [0140.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1488~2.YOU")) returned 0x5b9770 [0140.665] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.665] GetProcessHeap () returned 0x580000 [0140.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0140.665] GetProcessHeap () returned 0x580000 [0140.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0140.665] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.669] ReadFile (in: hFile=0x488, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x394ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.671] GetProcessHeap () returned 0x580000 [0140.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.671] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.671] WriteFile (in: hFile=0x488, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x394ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.672] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.672] WriteFile (in: hFile=0x488, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.672] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.672] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.672] CloseHandle (hObject=0x488) returned 1 [0140.776] GetProcessHeap () returned 0x580000 [0140.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.776] GetProcessHeap () returned 0x580000 [0140.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.776] GetProcessHeap () returned 0x580000 [0140.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b75f860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x394fd28, dwReserved1=0x5aa990, cFileName="BD14882_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1488~2.YOU")) returned 0x5b9730 [0141.855] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.939] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT", len=0x40 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 1 [0141.939] GetProcessHeap () returned 0x580000 [0141.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed4) returned 0x6f14048 [0141.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.940] CloseHandle (hObject=0x470) returned 1 [0141.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0141.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~3.YOU")) returned 0x5b9730 [0141.941] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.941] GetProcessHeap () returned 0x580000 [0141.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0141.941] GetProcessHeap () returned 0x580000 [0141.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0141.941] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.941] ReadFile (in: hFile=0x470, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0141.943] GetProcessHeap () returned 0x580000 [0141.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.943] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.943] WriteFile (in: hFile=0x470, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0141.943] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.943] WriteFile (in: hFile=0x470, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.943] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.943] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.943] CloseHandle (hObject=0x470) returned 1 [0141.944] GetProcessHeap () returned 0x580000 [0141.944] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0141.944] GetProcessHeap () returned 0x580000 [0141.944] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0141.944] GetProcessHeap () returned 0x580000 [0141.944] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c36c7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x394fd28, dwReserved1=0x5ad8a0, cFileName="POWERPNT_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~3.YOU")) returned 0x5b9730 [0141.944] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.030] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H", len=0x3a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H") returned 1 [0142.030] GetProcessHeap () returned 0x580000 [0142.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea8) returned 0x6f14048 [0142.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0142.030] CloseHandle (hObject=0x484) returned 1 [0142.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0142.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.id_1622540890_.your_last_chance")) returned 1 [0144.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLPE~2.YOU")) returned 0x5b96f0 [0144.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.127] GetProcessHeap () returned 0x580000 [0144.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x678958 [0144.127] GetProcessHeap () returned 0x580000 [0144.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x678bc0 [0144.127] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.127] ReadFile (in: hFile=0x484, lpBuffer=0x678958, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x394ff14*=0x220, lpOverlapped=0x0) returned 1 [0144.130] GetProcessHeap () returned 0x580000 [0144.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.130] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.130] WriteFile (in: hFile=0x484, lpBuffer=0x678bc0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x678bc0*, lpNumberOfBytesWritten=0x394ff14*=0x220, lpOverlapped=0x0) returned 1 [0144.130] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.130] WriteFile (in: hFile=0x484, lpBuffer=0x678ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x678ddf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.130] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.130] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.130] CloseHandle (hObject=0x484) returned 1 [0144.131] GetProcessHeap () returned 0x580000 [0144.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678bc0 | out: hHeap=0x580000) returned 1 [0144.131] GetProcessHeap () returned 0x580000 [0144.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0144.131] GetProcessHeap () returned 0x580000 [0144.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d8669a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x394fd28, dwReserved1=0x678958, cFileName="OUTLPERF.H.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLPE~2.YOU")) returned 0x5b96f0 [0146.864] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.878] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", len=0x44 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned 1 [0146.878] GetProcessHeap () returned 0x580000 [0146.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0146.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.093] CloseHandle (hObject=0x4a0) returned 1 [0153.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.id_1622540890_.your_last_chance")) returned 1 [0153.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR22~1.YOU")) returned 0x5b9730 [0153.094] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.094] GetProcessHeap () returned 0x580000 [0153.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fe1) returned 0x70990f8 [0153.094] GetProcessHeap () returned 0x580000 [0153.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fe1) returned 0x709b0e8 [0153.094] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.094] ReadFile (in: hFile=0x4a0, lpBuffer=0x70990f8, nNumberOfBytesToRead=0x1fc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70990f8*, lpNumberOfBytesRead=0x394ff14*=0x1fc0, lpOverlapped=0x0) returned 1 [0153.128] GetProcessHeap () returned 0x580000 [0153.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.128] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.128] WriteFile (in: hFile=0x4a0, lpBuffer=0x709b0e8*, nNumberOfBytesToWrite=0x1fc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x709b0e8*, lpNumberOfBytesWritten=0x394ff14*=0x1fc0, lpOverlapped=0x0) returned 1 [0153.129] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.129] WriteFile (in: hFile=0x4a0, lpBuffer=0x709d0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x709d0a7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.129] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.129] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.129] CloseHandle (hObject=0x4a0) returned 1 [0153.129] GetProcessHeap () returned 0x580000 [0153.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709b0e8 | out: hHeap=0x580000) returned 1 [0153.129] GetProcessHeap () returned 0x580000 [0153.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70990f8 | out: hHeap=0x580000) returned 1 [0153.129] GetProcessHeap () returned 0x580000 [0153.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92e181a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ffb, dwReserved0=0x394fd28, dwReserved1=0x70990f8, cFileName="PDIR22F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR22~1.YOU")) returned 0x5b9630 [0153.753] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.324] CloseHandle (hObject=0x45c) returned 1 [0155.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id_1622540890_.your_last_chance")) returned 1 [0155.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0x1e5bfa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x4ff5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI22AA~1.YOU")) returned 0x5b9730 [0155.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.325] GetProcessHeap () returned 0x580000 [0155.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70086b8 [0155.325] GetProcessHeap () returned 0x580000 [0155.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7019ee8 [0155.326] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.326] ReadFile (in: hFile=0x45c, lpBuffer=0x70086b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70086b8*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0161.520] GetProcessHeap () returned 0x580000 [0161.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0161.520] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.520] WriteFile (in: hFile=0x45c, lpBuffer=0x7019ee8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7019ee8*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0161.521] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.521] WriteFile (in: hFile=0x45c, lpBuffer=0x702b6e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x702b6e7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0162.631] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.631] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0162.631] CloseHandle (hObject=0x45c) returned 1 [0162.631] GetProcessHeap () returned 0x580000 [0162.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7019ee8 | out: hHeap=0x580000) returned 1 [0162.631] GetProcessHeap () returned 0x580000 [0162.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70086b8 | out: hHeap=0x580000) returned 1 [0162.631] GetProcessHeap () returned 0x580000 [0162.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0x1e5bfa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x988d8860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4ff609, dwReserved0=0x394fd28, dwReserved1=0x70086b8, cFileName="WINWORD.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI22AA~1.YOU")) returned 0x5b9730 [0166.172] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.201] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", len=0x3a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 1 [0166.201] GetProcessHeap () returned 0x580000 [0166.201] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0166.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0166.223] CloseHandle (hObject=0x484) returned 1 [0166.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id_1622540890_.your_last_chance")) returned 1 [0166.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CUSTOM~1.YOU")) returned 0x5b9730 [0166.235] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0166.235] GetProcessHeap () returned 0x580000 [0166.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6c65108 [0166.235] GetProcessHeap () returned 0x580000 [0166.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6cda390 [0166.236] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.236] ReadFile (in: hFile=0x484, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x394ff14*=0x520, lpOverlapped=0x0) returned 1 [0166.290] GetProcessHeap () returned 0x580000 [0166.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.290] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] WriteFile (in: hFile=0x484, lpBuffer=0x6cda390*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesWritten=0x394ff14*=0x520, lpOverlapped=0x0) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] WriteFile (in: hFile=0x484, lpBuffer=0x6cda8af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda8af*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.290] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.290] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.290] CloseHandle (hObject=0x484) returned 1 [0166.290] GetProcessHeap () returned 0x580000 [0166.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0166.290] GetProcessHeap () returned 0x580000 [0166.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0166.290] GetProcessHeap () returned 0x580000 [0166.291] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aba8a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x394fd28, dwReserved1=0x6c65108, cFileName="Custom.propdesc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CUSTOM~1.YOU")) returned 0x5b9730 [0166.291] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.422] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", len=0x40 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 1 [0166.422] GetProcessHeap () returned 0x580000 [0166.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x225c) returned 0x6f14048 [0166.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.598] CloseHandle (hObject=0x41c) returned 1 [0166.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.602] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id_1622540890_.your_last_chance")) returned 1 [0166.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1839500, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOMS~1.YOU")) returned 0x5b9730 [0166.603] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.603] GetProcessHeap () returned 0x580000 [0166.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0166.603] GetProcessHeap () returned 0x580000 [0166.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0166.603] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.603] ReadFile (in: hFile=0x41c, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x394ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.641] GetProcessHeap () returned 0x580000 [0166.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0166.641] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.641] WriteFile (in: hFile=0x41c, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x394ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.641] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.641] WriteFile (in: hFile=0x41c, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.641] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.641] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.642] CloseHandle (hObject=0x41c) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9af149c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x394fd28, dwReserved1=0x660a78, cFileName="INFOMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOMS~1.YOU")) returned 0x5b9730 [0169.809] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.866] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", len=0x42 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 1 [0169.866] GetProcessHeap () returned 0x580000 [0169.866] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0169.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0169.866] CloseHandle (hObject=0x4a4) returned 1 [0169.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id_1622540890_.your_last_chance")) returned 1 [0169.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x31a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORG97R~1.YOU")) returned 0x5b9730 [0169.868] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0169.868] GetProcessHeap () returned 0x580000 [0169.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31c1) returned 0x6dc7760 [0169.868] GetProcessHeap () returned 0x580000 [0169.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31c1) returned 0x6dca930 [0169.868] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.868] ReadFile (in: hFile=0x4a4, lpBuffer=0x6dc7760, nNumberOfBytesToRead=0x31a0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7760*, lpNumberOfBytesRead=0x394ff14*=0x31a0, lpOverlapped=0x0) returned 1 [0171.103] GetProcessHeap () returned 0x580000 [0171.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0171.103] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.103] WriteFile (in: hFile=0x4a4, lpBuffer=0x6dca930*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dca930*, lpNumberOfBytesWritten=0x394ff14*=0x31a0, lpOverlapped=0x0) returned 1 [0171.103] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.103] WriteFile (in: hFile=0x4a4, lpBuffer=0x6dcdacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcdacf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.103] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.103] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.103] CloseHandle (hObject=0x4a4) returned 1 [0171.103] GetProcessHeap () returned 0x580000 [0171.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dca930 | out: hHeap=0x580000) returned 1 [0171.104] GetProcessHeap () returned 0x580000 [0171.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7760 | out: hHeap=0x580000) returned 1 [0171.104] GetProcessHeap () returned 0x580000 [0171.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d9a1300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x31c4, dwReserved0=0x394fd28, dwReserved1=0x6dc7760, cFileName="ORG97R.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORG97R~1.YOU")) returned 0x5b9770 [0173.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.084] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", len=0x42 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 1 [0173.084] GetProcessHeap () returned 0x580000 [0173.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0173.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0173.120] CloseHandle (hObject=0x390) returned 1 [0173.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.120] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id_1622540890_.your_last_chance")) returned 1 [0173.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDCNC~2.YOU")) returned 0x5b9770 [0173.121] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0173.121] GetProcessHeap () returned 0x580000 [0173.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.121] GetProcessHeap () returned 0x580000 [0173.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.121] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.121] ReadFile (in: hFile=0x390, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x394ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.165] GetProcessHeap () returned 0x580000 [0173.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.165] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.165] WriteFile (in: hFile=0x390, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x394ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.165] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.165] WriteFile (in: hFile=0x390, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.165] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.165] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.165] CloseHandle (hObject=0x390) returned 1 [0173.166] GetProcessHeap () returned 0x580000 [0173.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.166] GetProcessHeap () returned 0x580000 [0173.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.166] GetProcessHeap () returned 0x580000 [0173.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed44880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x394fd28, dwReserved1=0x5d0090, cFileName="SCDCNCLL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDCNC~2.YOU")) returned 0x5b9770 [0173.166] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.331] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", len=0x3b | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 1 [0174.331] GetProcessHeap () returned 0x580000 [0174.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0174.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.332] CloseHandle (hObject=0x49c) returned 1 [0174.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.332] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id_1622540890_.your_last_chance")) returned 1 [0174.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSSPCE~1.YOU")) returned 0x5b9770 [0174.334] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.334] GetProcessHeap () returned 0x580000 [0174.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0174.334] GetProcessHeap () returned 0x580000 [0174.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0174.334] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.335] ReadFile (in: hFile=0x49c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x394ff14*=0x300, lpOverlapped=0x0) returned 1 [0174.414] GetProcessHeap () returned 0x580000 [0174.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.414] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x49c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x394ff14*=0x300, lpOverlapped=0x0) returned 1 [0174.414] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x49c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.414] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.414] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.414] CloseHandle (hObject=0x49c) returned 1 [0174.414] GetProcessHeap () returned 0x580000 [0174.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0174.414] GetProcessHeap () returned 0x580000 [0174.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0174.414] GetProcessHeap () returned 0x580000 [0174.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f92b680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x394fd28, dwReserved1=0x6df6780, cFileName="MSSPC.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSSPCE~1.YOU")) returned 0x5b9730 [0174.415] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.433] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", len=0x79 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned 1 [0174.433] GetProcessHeap () returned 0x580000 [0174.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0174.434] CloseHandle (hObject=0x478) returned 1 [0174.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.id_1622540890_.your_last_chance")) returned 1 [0174.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x50005f, dwReserved1=0x690072, cFileName="VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~1.YOU")) returned 0x5b9730 [0174.437] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0174.437] GetProcessHeap () returned 0x580000 [0174.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062b20 [0174.437] GetProcessHeap () returned 0x580000 [0174.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062da8 [0174.437] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.437] ReadFile (in: hFile=0x478, lpBuffer=0x7062b20, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062b20*, lpNumberOfBytesRead=0x394ff14*=0x240, lpOverlapped=0x0) returned 1 [0174.458] GetProcessHeap () returned 0x580000 [0174.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.458] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.458] WriteFile (in: hFile=0x478, lpBuffer=0x7062da8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062da8*, lpNumberOfBytesWritten=0x394ff14*=0x240, lpOverlapped=0x0) returned 1 [0174.458] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.458] WriteFile (in: hFile=0x478, lpBuffer=0x7062fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062fe7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.458] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.459] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.459] CloseHandle (hObject=0x478) returned 1 [0174.459] GetProcessHeap () returned 0x580000 [0174.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062da8 | out: hHeap=0x580000) returned 1 [0174.459] GetProcessHeap () returned 0x580000 [0174.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062b20 | out: hHeap=0x580000) returned 1 [0174.459] GetProcessHeap () returned 0x580000 [0174.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f99daa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x394fd28, dwReserved1=0x7062b20, cFileName="VeriSign_Class_3_Public_Primary_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~1.YOU")) returned 0x5b9730 [0174.459] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.549] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", len=0x4a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned 1 [0174.549] GetProcessHeap () returned 0x580000 [0174.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0175.017] CloseHandle (hObject=0x480) returned 1 [0175.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.id_1622540890_.your_last_chance")) returned 1 [0175.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THROAT~1.YOU")) returned 0x5b96f0 [0175.018] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0175.018] GetProcessHeap () returned 0x580000 [0175.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d41) returned 0x6d6ccf8 [0175.019] GetProcessHeap () returned 0x580000 [0175.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d41) returned 0x707ec98 [0175.019] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.019] ReadFile (in: hFile=0x480, lpBuffer=0x6d6ccf8, nNumberOfBytesToRead=0x8d20, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ccf8*, lpNumberOfBytesRead=0x394ff14*=0x8d20, lpOverlapped=0x0) returned 1 [0176.459] GetProcessHeap () returned 0x580000 [0176.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.459] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.459] WriteFile (in: hFile=0x480, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x8d20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x394ff14*=0x8d20, lpOverlapped=0x0) returned 1 [0176.459] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.459] WriteFile (in: hFile=0x480, lpBuffer=0x70879b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70879b7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.459] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.459] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.459] CloseHandle (hObject=0x480) returned 1 [0176.460] GetProcessHeap () returned 0x580000 [0176.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0176.460] GetProcessHeap () returned 0x580000 [0176.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6ccf8 | out: hHeap=0x580000) returned 1 [0176.460] GetProcessHeap () returned 0x580000 [0176.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ca8aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8d5a, dwReserved0=0x394fd28, dwReserved1=0x6d6ccf8, cFileName="THROAT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THROAT~1.YOU")) returned 0x5b96f0 [0179.054] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.069] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", len=0x47 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx") returned 1 [0179.069] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0179.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0181.148] CloseHandle (hObject=0x49c) returned 1 [0181.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.id_1622540890_.your_last_chance")) returned 1 [0181.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODERN~1.YOU")) returned 0x5b96b0 [0181.149] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0181.149] GetProcessHeap () returned 0x580000 [0181.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x6dcb1d0 [0181.149] GetProcessHeap () returned 0x580000 [0181.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x6f1bec0 [0181.149] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.149] ReadFile (in: hFile=0x49c, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x394ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0181.180] GetProcessHeap () returned 0x580000 [0181.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.180] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.180] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x394ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0181.181] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.181] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1e05f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e05f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.181] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.181] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.181] CloseHandle (hObject=0x49c) returned 1 [0181.181] GetProcessHeap () returned 0x580000 [0181.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0181.181] GetProcessHeap () returned 0x580000 [0181.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0181.181] GetProcessHeap () returned 0x580000 [0181.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa39bcb40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21d0, dwReserved0=0x394fd28, dwReserved1=0x6dcb1d0, cFileName="Modern.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODERN~1.YOU")) returned 0x5b9770 [0182.215] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.808] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", len=0x6b | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned 1 [0183.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0183.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.347] CloseHandle (hObject=0x48c) returned 1 [0186.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x2e0047, dwReserved1=0x640069, cFileName="LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LINEJP~1.YOU")) returned 0x5b96b0 [0186.348] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.349] GetProcessHeap () returned 0x580000 [0186.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe81) returned 0x6c29878 [0186.349] GetProcessHeap () returned 0x580000 [0186.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe81) returned 0x67ec60 [0186.349] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.349] ReadFile (in: hFile=0x48c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe60, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x394ff14*=0xe60, lpOverlapped=0x0) returned 1 [0186.362] GetProcessHeap () returned 0x580000 [0186.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.363] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.363] WriteFile (in: hFile=0x48c, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x394ff14*=0xe60, lpOverlapped=0x0) returned 1 [0186.363] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.363] WriteFile (in: hFile=0x48c, lpBuffer=0x67fabf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fabf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.363] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.363] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.363] CloseHandle (hObject=0x48c) returned 1 [0186.369] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0186.369] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0186.369] GetProcessHeap () returned 0x580000 [0186.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6b213c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe89, dwReserved0=0x394fd28, dwReserved1=0x6c29878, cFileName="LINE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LINEJP~1.YOU")) returned 0x5b96b0 [0186.369] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.409] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", len=0x5a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 1 [0186.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0186.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.410] CloseHandle (hObject=0x4a4) returned 1 [0186.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id_1622540890_.your_last_chance")) returned 1 [0186.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b96b0 [0186.411] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.411] GetProcessHeap () returned 0x580000 [0186.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5aa990 [0186.411] GetProcessHeap () returned 0x580000 [0186.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0186.411] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.411] ReadFile (in: hFile=0x4a4, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x394ff14*=0x120, lpOverlapped=0x0) returned 1 [0186.413] GetProcessHeap () returned 0x580000 [0186.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.413] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.413] WriteFile (in: hFile=0x4a4, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x394ff14*=0x120, lpOverlapped=0x0) returned 1 [0186.413] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.413] WriteFile (in: hFile=0x4a4, lpBuffer=0x65f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f1cf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.414] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.414] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.414] CloseHandle (hObject=0x4a4) returned 1 [0186.414] GetProcessHeap () returned 0x580000 [0186.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0186.414] GetProcessHeap () returned 0x580000 [0186.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0186.414] GetProcessHeap () returned 0x580000 [0186.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6b937e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x394fd28, dwReserved1=0x5aa990, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b96b0 [0186.414] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.452] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", len=0x5a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned 1 [0186.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0186.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0186.453] CloseHandle (hObject=0x420) returned 1 [0186.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css.id_1622540890_.your_last_chance")) returned 1 [0186.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWCS~1.YOU")) returned 0x5b96b0 [0186.454] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0186.455] GetProcessHeap () returned 0x580000 [0186.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0186.455] GetProcessHeap () returned 0x580000 [0186.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0186.455] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.455] ReadFile (in: hFile=0x420, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x394ff14*=0x280, lpOverlapped=0x0) returned 1 [0186.458] GetProcessHeap () returned 0x580000 [0186.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.458] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.458] WriteFile (in: hFile=0x420, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x394ff14*=0x280, lpOverlapped=0x0) returned 1 [0186.458] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.458] WriteFile (in: hFile=0x420, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.458] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.459] CloseHandle (hObject=0x420) returned 1 [0186.459] GetProcessHeap () returned 0x580000 [0186.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0186.459] GetProcessHeap () returned 0x580000 [0186.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0186.459] GetProcessHeap () returned 0x580000 [0186.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6c05c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b9, dwReserved0=0x394fd28, dwReserved1=0x6c4a820, cFileName="VIEW.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWCS~1.YOU")) returned 0x5b96b0 [0186.459] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.505] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", len=0x5f | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned 1 [0186.505] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0186.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.506] CloseHandle (hObject=0x4a4) returned 1 [0186.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.id_1622540890_.your_last_chance")) returned 1 [0186.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d6, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b96b0 [0186.508] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.508] GetProcessHeap () returned 0x580000 [0186.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35e1) returned 0x6fe2b98 [0186.508] GetProcessHeap () returned 0x580000 [0186.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35e1) returned 0x6fe6188 [0186.509] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.509] ReadFile (in: hFile=0x4a4, lpBuffer=0x6fe2b98, nNumberOfBytesToRead=0x35c0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe2b98*, lpNumberOfBytesRead=0x394ff14*=0x35c0, lpOverlapped=0x0) returned 1 [0188.054] GetProcessHeap () returned 0x580000 [0188.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.054] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.054] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fe6188*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe6188*, lpNumberOfBytesWritten=0x394ff14*=0x35c0, lpOverlapped=0x0) returned 1 [0188.055] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fe9747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe9747*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.055] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.055] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.055] CloseHandle (hObject=0x4a4) returned 1 [0188.055] GetProcessHeap () returned 0x580000 [0188.055] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe6188 | out: hHeap=0x580000) returned 1 [0188.055] GetProcessHeap () returned 0x580000 [0188.055] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe2b98 | out: hHeap=0x580000) returned 1 [0188.055] GetProcessHeap () returned 0x580000 [0188.055] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7b32840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35fa, dwReserved0=0x394fd28, dwReserved1=0x6fe2b98, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b9770 [0191.113] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.186] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", len=0x45 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned 1 [0191.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0191.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0191.187] CloseHandle (hObject=0x464) returned 1 [0191.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xcbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~4.YOU")) returned 0x5b9770 [0191.188] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0191.188] GetProcessHeap () returned 0x580000 [0191.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcbe1) returned 0x7018de8 [0191.189] GetProcessHeap () returned 0x580000 [0191.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcbe1) returned 0x70259d8 [0191.189] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.189] ReadFile (in: hFile=0x464, lpBuffer=0x7018de8, nNumberOfBytesToRead=0xcbc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018de8*, lpNumberOfBytesRead=0x394ff14*=0xcbc0, lpOverlapped=0x0) returned 1 [0195.477] GetProcessHeap () returned 0x580000 [0195.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.477] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.478] WriteFile (in: hFile=0x464, lpBuffer=0x70259d8*, nNumberOfBytesToWrite=0xcbc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70259d8*, lpNumberOfBytesWritten=0x394ff14*=0xcbc0, lpOverlapped=0x0) returned 1 [0195.478] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.478] WriteFile (in: hFile=0x464, lpBuffer=0x7032597*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7032597*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.478] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.478] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.478] CloseHandle (hObject=0x464) returned 1 [0195.478] GetProcessHeap () returned 0x580000 [0195.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70259d8 | out: hHeap=0x580000) returned 1 [0195.478] GetProcessHeap () returned 0x580000 [0195.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018de8 | out: hHeap=0x580000) returned 1 [0195.478] GetProcessHeap () returned 0x580000 [0195.479] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac2036c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcbe7, dwReserved0=0x394fd28, dwReserved1=0x7018de8, cFileName="ZPDIR38F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~4.YOU")) returned 0x5b97b0 [0196.620] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.642] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0196.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0196.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.643] CloseHandle (hObject=0x488) returned 1 [0196.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x46004f, dwReserved1=0x2e0046, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.681] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.681] GetProcessHeap () returned 0x580000 [0196.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.681] GetProcessHeap () returned 0x580000 [0196.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.681] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.681] ReadFile (in: hFile=0x488, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x394ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.683] GetProcessHeap () returned 0x580000 [0196.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0196.683] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.683] WriteFile (in: hFile=0x488, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x394ff14*=0x140, lpOverlapped=0x0) returned 1 [0196.683] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.683] WriteFile (in: hFile=0x488, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.684] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.684] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.684] CloseHandle (hObject=0x488) returned 1 [0196.684] GetProcessHeap () returned 0x580000 [0196.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.684] GetProcessHeap () returned 0x580000 [0196.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.684] GetProcessHeap () returned 0x580000 [0196.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0196.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd780a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x394fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0196.684] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.798] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", len=0x45 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned 1 [0196.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd4) returned 0x6f14048 [0196.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0196.839] CloseHandle (hObject=0x450) returned 1 [0196.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc11, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~4.YOU")) returned 0x5b97b0 [0196.840] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0196.840] GetProcessHeap () returned 0x580000 [0196.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x677cd0 [0196.840] GetProcessHeap () returned 0x580000 [0196.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x6efb008 [0196.840] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.841] ReadFile (in: hFile=0x450, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x394ff14*=0xc00, lpOverlapped=0x0) returned 1 [0196.933] GetProcessHeap () returned 0x580000 [0196.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.933] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.933] WriteFile (in: hFile=0x450, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x394ff14*=0xc00, lpOverlapped=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.933] WriteFile (in: hFile=0x450, lpBuffer=0x6efbc07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efbc07*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.933] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.933] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.933] CloseHandle (hObject=0x450) returned 1 [0196.933] GetProcessHeap () returned 0x580000 [0196.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0196.933] GetProcessHeap () returned 0x580000 [0196.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0196.934] GetProcessHeap () returned 0x580000 [0196.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacfd96a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc35, dwReserved0=0x394fd28, dwReserved1=0x677cd0, cFileName="ZPDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~4.YOU")) returned 0x5b97b0 [0196.934] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.013] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", len=0x45 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned 1 [0197.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb4) returned 0x6f14048 [0197.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0197.026] CloseHandle (hObject=0x41c) returned 1 [0197.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1706, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP8249~1.YOU")) returned 0x5b97b0 [0197.027] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0197.028] GetProcessHeap () returned 0x580000 [0197.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x706d530 [0197.028] GetProcessHeap () returned 0x580000 [0197.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x6de8f50 [0197.028] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.028] ReadFile (in: hFile=0x41c, lpBuffer=0x706d530, nNumberOfBytesToRead=0x1700, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x706d530*, lpNumberOfBytesRead=0x394ff14*=0x1700, lpOverlapped=0x0) returned 1 [0197.151] GetProcessHeap () returned 0x580000 [0197.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0197.151] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x41c, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x394ff14*=0x1700, lpOverlapped=0x0) returned 1 [0197.151] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x41c, lpBuffer=0x6dea64f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea64f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.151] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.151] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.151] CloseHandle (hObject=0x41c) returned 1 [0197.151] GetProcessHeap () returned 0x580000 [0197.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0197.151] GetProcessHeap () returned 0x580000 [0197.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706d530 | out: hHeap=0x580000) returned 1 [0197.151] GetProcessHeap () returned 0x580000 [0197.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0197.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad1ee9e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x172a, dwReserved0=0x394fd28, dwReserved1=0x706d530, cFileName="ZPDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP8249~1.YOU")) returned 0x5b97b0 [0197.152] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.475] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", len=0x68 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned 1 [0199.475] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0199.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0199.476] CloseHandle (hObject=0x428) returned 1 [0199.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.id_1622540890_.your_last_chance")) returned 1 [0199.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b96b0 [0199.477] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0199.477] GetProcessHeap () returned 0x580000 [0199.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6f668d8 [0199.477] GetProcessHeap () returned 0x580000 [0199.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0199.477] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.477] ReadFile (in: hFile=0x428, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x394ff14*=0xd60, lpOverlapped=0x0) returned 1 [0199.505] GetProcessHeap () returned 0x580000 [0199.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0199.505] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.505] WriteFile (in: hFile=0x428, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x394ff14*=0xd60, lpOverlapped=0x0) returned 1 [0199.505] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.505] WriteFile (in: hFile=0x428, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.506] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.506] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.506] CloseHandle (hObject=0x428) returned 1 [0199.507] GetProcessHeap () returned 0x580000 [0199.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0199.507] GetProcessHeap () returned 0x580000 [0199.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0199.507] GetProcessHeap () returned 0x580000 [0199.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0199.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae865980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x394fd28, dwReserved1=0x6f668d8, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b96b0 [0199.562] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.618] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", len=0x5c | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned 1 [0199.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0199.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0199.619] CloseHandle (hObject=0x480) returned 1 [0199.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js.id_1622540890_.your_last_chance")) returned 1 [0199.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12b79, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b96b0 [0199.620] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0199.620] GetProcessHeap () returned 0x580000 [0199.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7085b08 [0199.620] GetProcessHeap () returned 0x580000 [0199.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7097338 [0199.620] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.620] ReadFile (in: hFile=0x480, lpBuffer=0x7085b08, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7085b08*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0201.265] GetProcessHeap () returned 0x580000 [0201.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0201.265] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x480, lpBuffer=0x7097338*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7097338*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0201.265] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.265] WriteFile (in: hFile=0x480, lpBuffer=0x70a8b37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a8b37*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.266] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.266] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.266] CloseHandle (hObject=0x480) returned 1 [0201.352] GetProcessHeap () returned 0x580000 [0201.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7097338 | out: hHeap=0x580000) returned 1 [0201.357] GetProcessHeap () returned 0x580000 [0201.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7085b08 | out: hHeap=0x580000) returned 1 [0201.357] GetProcessHeap () returned 0x580000 [0201.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0202.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf9354e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12b9d, dwReserved0=0x394fd28, dwReserved1=0x7085b08, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9770 [0202.027] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.084] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", len=0x44 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned 1 [0202.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0202.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0202.311] CloseHandle (hObject=0x3a8) returned 1 [0202.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.id_1622540890_.your_last_chance")) returned 1 [0202.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x95dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR34~1.YOU")) returned 0x5b9770 [0202.313] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0202.313] GetProcessHeap () returned 0x580000 [0202.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x95e1) returned 0x6ff8ff8 [0202.313] GetProcessHeap () returned 0x580000 [0202.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x95e1) returned 0x7062940 [0202.314] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.314] ReadFile (in: hFile=0x3a8, lpBuffer=0x6ff8ff8, nNumberOfBytesToRead=0x95c0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesRead=0x394ff14*=0x95c0, lpOverlapped=0x0) returned 1 [0205.233] GetProcessHeap () returned 0x580000 [0205.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0205.234] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.234] WriteFile (in: hFile=0x3a8, lpBuffer=0x7062940*, nNumberOfBytesToWrite=0x95c0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesWritten=0x394ff14*=0x95c0, lpOverlapped=0x0) returned 1 [0206.451] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.451] WriteFile (in: hFile=0x3a8, lpBuffer=0x706beff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x706beff*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0206.451] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.451] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0206.451] CloseHandle (hObject=0x3a8) returned 1 [0206.451] GetProcessHeap () returned 0x580000 [0206.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0206.452] GetProcessHeap () returned 0x580000 [0206.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0206.452] GetProcessHeap () returned 0x580000 [0206.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0209.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2abfec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9601, dwReserved0=0x394fd28, dwReserved1=0x6ff8ff8, cFileName="PDIR34F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR34~1.YOU")) returned 0x5b97f0 [0209.702] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.760] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", len=0x63 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned 1 [0209.760] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f10) returned 0x6f14048 [0209.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.761] CloseHandle (hObject=0x458) returned 1 [0209.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.762] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.id_1622540890_.your_last_chance")) returned 1 [0209.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b97f0 [0209.762] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.763] GetProcessHeap () returned 0x580000 [0209.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0209.763] GetProcessHeap () returned 0x580000 [0209.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0209.763] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.763] ReadFile (in: hFile=0x458, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x394ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.765] GetProcessHeap () returned 0x580000 [0209.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0209.765] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.765] WriteFile (in: hFile=0x458, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x394ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.765] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.765] WriteFile (in: hFile=0x458, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.765] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.765] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.765] CloseHandle (hObject=0x458) returned 1 [0209.765] GetProcessHeap () returned 0x580000 [0209.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0209.765] GetProcessHeap () returned 0x580000 [0209.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0209.765] GetProcessHeap () returned 0x580000 [0209.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0209.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a4a240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x394fd28, dwReserved1=0x5b8df0, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b97f0 [0209.765] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.806] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", len=0x63 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned 1 [0209.806] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0209.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.806] CloseHandle (hObject=0x3b8) returned 1 [0209.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.id_1622540890_.your_last_chance")) returned 1 [0209.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b97f0 [0209.808] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.808] GetProcessHeap () returned 0x580000 [0209.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x715c008 [0209.808] GetProcessHeap () returned 0x580000 [0209.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x7062940 [0209.809] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.809] ReadFile (in: hFile=0x3b8, lpBuffer=0x715c008, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x394ff14*=0x5140, lpOverlapped=0x0) returned 1 [0210.018] GetProcessHeap () returned 0x580000 [0210.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0210.018] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.018] WriteFile (in: hFile=0x3b8, lpBuffer=0x7062940*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesWritten=0x394ff14*=0x5140, lpOverlapped=0x0) returned 1 [0210.018] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.018] WriteFile (in: hFile=0x3b8, lpBuffer=0x7067a7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7067a7f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.018] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.018] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.018] CloseHandle (hObject=0x3b8) returned 1 [0210.019] GetProcessHeap () returned 0x580000 [0210.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0210.019] GetProcessHeap () returned 0x580000 [0210.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0210.019] GetProcessHeap () returned 0x580000 [0210.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0214.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cab840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x394fd28, dwReserved1=0x715c008, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b97b0 [0214.535] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.553] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned 1 [0214.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0214.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.554] CloseHandle (hObject=0x438) returned 1 [0214.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0214.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0042, dwReserved1=0x4e004f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.599] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.599] GetProcessHeap () returned 0x580000 [0214.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0214.599] GetProcessHeap () returned 0x580000 [0214.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0214.599] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.599] ReadFile (in: hFile=0x438, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0214.601] GetProcessHeap () returned 0x580000 [0214.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.601] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.601] WriteFile (in: hFile=0x438, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0214.601] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.601] WriteFile (in: hFile=0x438, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.601] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.601] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.601] CloseHandle (hObject=0x438) returned 1 [0214.601] GetProcessHeap () returned 0x580000 [0214.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0214.602] GetProcessHeap () returned 0x580000 [0214.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0214.602] GetProcessHeap () returned 0x580000 [0214.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0217.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7868c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x394fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0217.165] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.185] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x75 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0217.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0217.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.186] CloseHandle (hObject=0x490) returned 1 [0217.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0217.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x54005c, dwReserved1=0x420041, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0217.203] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.204] GetProcessHeap () returned 0x580000 [0217.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0217.204] GetProcessHeap () returned 0x580000 [0217.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0217.204] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.204] ReadFile (in: hFile=0x490, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0217.205] GetProcessHeap () returned 0x580000 [0217.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.205] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.205] WriteFile (in: hFile=0x490, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x394ff14*=0xc0, lpOverlapped=0x0) returned 1 [0217.206] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.206] WriteFile (in: hFile=0x490, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.206] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.206] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.206] CloseHandle (hObject=0x490) returned 1 [0217.206] GetProcessHeap () returned 0x580000 [0217.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0217.206] GetProcessHeap () returned 0x580000 [0217.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0217.206] GetProcessHeap () returned 0x580000 [0217.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0217.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9141220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x394fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0217.206] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.215] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", len=0x72 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned 1 [0217.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0217.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.253] CloseHandle (hObject=0x490) returned 1 [0217.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0217.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x75006f, dwReserved1=0x64006e, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0217.254] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.254] GetProcessHeap () returned 0x580000 [0217.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf4d0 [0217.254] GetProcessHeap () returned 0x580000 [0217.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dced28 [0217.254] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.254] ReadFile (in: hFile=0x490, lpBuffer=0x6dcf4d0, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf4d0*, lpNumberOfBytesRead=0x394ff14*=0xe0, lpOverlapped=0x0) returned 1 [0217.256] GetProcessHeap () returned 0x580000 [0217.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.256] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.256] WriteFile (in: hFile=0x490, lpBuffer=0x6dced28*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dced28*, lpNumberOfBytesWritten=0x394ff14*=0xe0, lpOverlapped=0x0) returned 1 [0217.256] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.256] WriteFile (in: hFile=0x490, lpBuffer=0x6dcee07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcee07*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.257] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.257] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.257] CloseHandle (hObject=0x490) returned 1 [0217.257] GetProcessHeap () returned 0x580000 [0217.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0217.257] GetProcessHeap () returned 0x580000 [0217.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0217.257] GetProcessHeap () returned 0x580000 [0217.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91b3640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x394fd28, dwReserved1=0x6dcf4d0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0217.257] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.262] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned 1 [0217.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0217.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.262] CloseHandle (hObject=0x3a8) returned 1 [0217.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.id_1622540890_.your_last_chance")) returned 1 [0217.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b9770 [0217.264] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.264] GetProcessHeap () returned 0x580000 [0217.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21890 [0217.264] GetProcessHeap () returned 0x580000 [0217.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21e98 [0217.264] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.264] ReadFile (in: hFile=0x3a8, lpBuffer=0x6c21890, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesRead=0x394ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0217.270] GetProcessHeap () returned 0x580000 [0217.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.270] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.270] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c21e98*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21e98*, lpNumberOfBytesWritten=0x394ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0217.270] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.270] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c22437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c22437*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.270] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.271] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.271] CloseHandle (hObject=0x3a8) returned 1 [0217.271] GetProcessHeap () returned 0x580000 [0217.271] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21e98 | out: hHeap=0x580000) returned 1 [0217.271] GetProcessHeap () returned 0x580000 [0217.271] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0217.271] GetProcessHeap () returned 0x580000 [0217.271] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0217.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91d97a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5e3, dwReserved0=0x394fd28, dwReserved1=0x6c21890, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b9770 [0217.271] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.277] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned 1 [0217.277] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0217.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.278] CloseHandle (hObject=0x3a8) returned 1 [0217.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0217.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46ff, dwReserved0=0x6c006d, dwReserved1=0x69002e, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~4.YOU")) returned 0x5b9770 [0217.279] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.279] GetProcessHeap () returned 0x580000 [0217.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x70bb318 [0217.279] GetProcessHeap () returned 0x580000 [0217.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x715c008 [0217.279] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.279] ReadFile (in: hFile=0x3a8, lpBuffer=0x70bb318, nNumberOfBytesToRead=0x46e0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bb318*, lpNumberOfBytesRead=0x394ff14*=0x46e0, lpOverlapped=0x0) returned 1 [0219.494] GetProcessHeap () returned 0x580000 [0219.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0219.494] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.494] WriteFile (in: hFile=0x3a8, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x394ff14*=0x46e0, lpOverlapped=0x0) returned 1 [0219.495] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.495] WriteFile (in: hFile=0x3a8, lpBuffer=0x71606e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x71606e7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0219.495] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.495] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0219.495] CloseHandle (hObject=0x3a8) returned 1 [0219.495] GetProcessHeap () returned 0x580000 [0219.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0219.495] GetProcessHeap () returned 0x580000 [0219.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70bb318 | out: hHeap=0x580000) returned 1 [0219.495] GetProcessHeap () returned 0x580000 [0219.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0221.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba71fc40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4723, dwReserved0=0x394fd28, dwReserved1=0x70bb318, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~4.YOU")) returned 0x5b9730 [0221.441] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.451] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", len=0x4c | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 1 [0221.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f50) returned 0x6dee6e0 [0221.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.479] CloseHandle (hObject=0x3fc) returned 1 [0221.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id_1622540890_.your_last_chance")) returned 1 [0221.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x450043, dwReserved1=0x0, cFileName="StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~1.YOU")) returned 0x5b9730 [0221.480] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.480] GetProcessHeap () returned 0x580000 [0221.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d33c48 [0221.481] GetProcessHeap () returned 0x580000 [0221.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d347d0 [0221.481] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.481] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d33c48, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33c48*, lpNumberOfBytesRead=0x394ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.588] GetProcessHeap () returned 0x580000 [0221.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.588] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.588] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d347d0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d347d0*, lpNumberOfBytesWritten=0x394ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.588] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.588] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d352ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d352ef*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.588] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.588] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.588] CloseHandle (hObject=0x3fc) returned 1 [0221.588] GetProcessHeap () returned 0x580000 [0221.589] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d347d0 | out: hHeap=0x580000) returned 1 [0221.589] GetProcessHeap () returned 0x580000 [0221.589] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33c48 | out: hHeap=0x580000) returned 1 [0221.589] GetProcessHeap () returned 0x580000 [0221.589] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbb0f480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x394fd28, dwReserved1=0x6d33c48, cFileName="StatusOnline.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~1.YOU")) returned 0x5b9730 [0221.589] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.629] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", len=0x49 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 1 [0221.629] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f34) returned 0x6dee6e0 [0221.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.020] CloseHandle (hObject=0x49c) returned 1 [0223.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.020] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id_1622540890_.your_last_chance")) returned 1 [0223.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTSYN~1.YOU")) returned 0x5b96f0 [0223.027] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.027] GetProcessHeap () returned 0x580000 [0223.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0223.027] GetProcessHeap () returned 0x580000 [0223.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5d57a0 [0223.027] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.027] ReadFile (in: hFile=0x49c, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x394ff14*=0x120, lpOverlapped=0x0) returned 1 [0223.029] GetProcessHeap () returned 0x580000 [0223.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.029] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.029] WriteFile (in: hFile=0x49c, lpBuffer=0x5d57a0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d57a0*, lpNumberOfBytesWritten=0x394ff14*=0x120, lpOverlapped=0x0) returned 1 [0223.029] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.029] WriteFile (in: hFile=0x49c, lpBuffer=0x5d58bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d58bf*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.029] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.029] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.029] CloseHandle (hObject=0x49c) returned 1 [0223.029] GetProcessHeap () returned 0x580000 [0223.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d57a0 | out: hHeap=0x580000) returned 1 [0223.030] GetProcessHeap () returned 0x580000 [0223.030] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0223.030] GetProcessHeap () returned 0x580000 [0223.030] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc8bf300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x394fd28, dwReserved1=0x65f0b0, cFileName="OutSyncPC.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTSYN~1.YOU")) returned 0x5b9630 [0225.795] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.827] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned 1 [0225.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0225.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.827] CloseHandle (hObject=0x438) returned 1 [0225.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance")) returned 1 [0225.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x2e0073, dwReserved1=0x70006a, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b9630 [0225.828] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.829] GetProcessHeap () returned 0x580000 [0225.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6f19958 [0225.829] GetProcessHeap () returned 0x580000 [0225.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6efb008 [0225.829] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.829] ReadFile (in: hFile=0x438, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x394ff14*=0x1480, lpOverlapped=0x0) returned 1 [0225.855] GetProcessHeap () returned 0x580000 [0225.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.855] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.855] WriteFile (in: hFile=0x438, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x394ff14*=0x1480, lpOverlapped=0x0) returned 1 [0225.855] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.855] WriteFile (in: hFile=0x438, lpBuffer=0x6efc487*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc487*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.855] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.855] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.855] CloseHandle (hObject=0x438) returned 1 [0225.855] GetProcessHeap () returned 0x580000 [0225.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0225.855] GetProcessHeap () returned 0x580000 [0225.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0225.855] GetProcessHeap () returned 0x580000 [0225.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe22fe20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14bd, dwReserved0=0x394fd28, dwReserved1=0x6f19958, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b9630 [0225.856] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.879] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", len=0x68 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned 1 [0225.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0225.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.880] CloseHandle (hObject=0x438) returned 1 [0225.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.id_1622540890_.your_last_chance")) returned 1 [0225.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b9630 [0225.881] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.881] GetProcessHeap () returned 0x580000 [0225.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x6ece008 [0225.881] GetProcessHeap () returned 0x580000 [0225.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc1) returned 0x658970 [0225.881] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.881] ReadFile (in: hFile=0x438, lpBuffer=0x6ece008, nNumberOfBytesToRead=0xfa0, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesRead=0x394ff14*=0xfa0, lpOverlapped=0x0) returned 1 [0227.347] GetProcessHeap () returned 0x580000 [0227.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0227.347] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.347] WriteFile (in: hFile=0x438, lpBuffer=0x658970*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesWritten=0x394ff14*=0xfa0, lpOverlapped=0x0) returned 1 [0227.347] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.347] WriteFile (in: hFile=0x438, lpBuffer=0x65990f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x65990f*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0227.347] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.347] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0227.348] CloseHandle (hObject=0x438) returned 1 [0227.348] GetProcessHeap () returned 0x580000 [0227.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0227.348] GetProcessHeap () returned 0x580000 [0227.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0227.348] GetProcessHeap () returned 0x580000 [0227.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.527] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf078220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfdd, dwReserved0=0x394fd28, dwReserved1=0x6ece008, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b9630 [0230.528] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.631] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", len=0x36 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 1 [0230.631] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0230.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.633] CloseHandle (hObject=0x4ac) returned 1 [0230.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.id_1622540890_.your_last_chance")) returned 1 [0230.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSO012~1.YOU")) returned 0x5b9630 [0230.634] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mso0127.acl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0230.635] GetProcessHeap () returned 0x580000 [0230.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33a1) returned 0x6d748d8 [0230.635] GetProcessHeap () returned 0x580000 [0230.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33a1) returned 0x7111f48 [0230.635] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.635] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d748d8, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesRead=0x394ff14*=0x3380, lpOverlapped=0x0) returned 1 [0232.814] GetProcessHeap () returned 0x580000 [0232.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0232.814] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.814] WriteFile (in: hFile=0x4ac, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x394ff14*=0x3380, lpOverlapped=0x0) returned 1 [0232.816] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.816] WriteFile (in: hFile=0x4ac, lpBuffer=0x71152c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x71152c7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0232.817] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0232.817] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0232.817] CloseHandle (hObject=0x4ac) returned 1 [0232.817] GetProcessHeap () returned 0x580000 [0232.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0232.817] GetProcessHeap () returned 0x580000 [0232.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0232.817] GetProcessHeap () returned 0x580000 [0232.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0232.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24b04c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x33b6, dwReserved0=0x394fd28, dwReserved1=0x6d748d8, cFileName="MSO0127.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSO012~1.YOU")) returned 0x5b9630 [0232.819] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0234.687] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", len=0x37 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned 1 [0234.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0234.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0236.599] CloseHandle (hObject=0x464) returned 1 [0236.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0236.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.id_1622540890_.your_last_chance")) returned 1 [0236.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0236.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MML2OM~1.YOU")) returned 0x5b9730 [0236.602] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0236.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mml2omml.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0236.602] GetProcessHeap () returned 0x580000 [0236.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0236.602] GetProcessHeap () returned 0x580000 [0236.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7681178 [0236.603] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.603] ReadFile (in: hFile=0x464, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.833] GetProcessHeap () returned 0x580000 [0238.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0238.834] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.834] WriteFile (in: hFile=0x464, lpBuffer=0x7681178*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7681178*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.327] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.327] WriteFile (in: hFile=0x464, lpBuffer=0x7692977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7692977*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.327] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.327] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.327] CloseHandle (hObject=0x464) returned 1 [0239.390] GetProcessHeap () returned 0x580000 [0239.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7681178 | out: hHeap=0x580000) returned 1 [0239.391] GetProcessHeap () returned 0x580000 [0239.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0239.391] GetProcessHeap () returned 0x580000 [0239.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0240.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62ba220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25fab, dwReserved0=0x394fd28, dwReserved1=0x6e0fcf0, cFileName="MML2OMML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MML2OM~1.YOU")) returned 0x5b9730 [0240.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.655] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML", len=0x4f | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned 1 [0240.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0240.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0240.711] CloseHandle (hObject=0x47c) returned 1 [0240.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml.id_1622540890_.your_last_chance")) returned 1 [0240.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAA362~1.YOU")) returned 0x5b9730 [0240.712] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0240.712] GetProcessHeap () returned 0x580000 [0240.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c61120 [0240.712] GetProcessHeap () returned 0x580000 [0240.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c61488 [0240.712] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.712] ReadFile (in: hFile=0x47c, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x394ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.768] GetProcessHeap () returned 0x580000 [0240.768] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.768] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.768] WriteFile (in: hFile=0x47c, lpBuffer=0x6c61488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61488*, lpNumberOfBytesWritten=0x394ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.768] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.768] WriteFile (in: hFile=0x47c, lpBuffer=0x6c617a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c617a7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.769] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.769] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.769] CloseHandle (hObject=0x47c) returned 1 [0240.769] GetProcessHeap () returned 0x580000 [0240.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61488 | out: hHeap=0x580000) returned 1 [0240.769] GetProcessHeap () returned 0x580000 [0240.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0240.769] GetProcessHeap () returned 0x580000 [0240.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc706a0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x394fd28, dwReserved1=0x6c61120, cFileName="YAHOO.COM.AU.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAA362~1.YOU")) returned 0x5b9730 [0240.769] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.808] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", len=0x51 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned 1 [0240.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0240.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0241.859] CloseHandle (hObject=0x170) returned 1 [0241.859] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.id_1622540890_.your_last_chance")) returned 1 [0241.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BTINTE~1.YOU")) returned 0x5b9630 [0241.860] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0241.860] GetProcessHeap () returned 0x580000 [0241.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.860] GetProcessHeap () returned 0x580000 [0241.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.860] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.860] ReadFile (in: hFile=0x170, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x394ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.865] GetProcessHeap () returned 0x580000 [0241.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.865] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.866] WriteFile (in: hFile=0x170, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x394ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.866] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.866] WriteFile (in: hFile=0x170, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.866] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.866] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.866] CloseHandle (hObject=0x170) returned 1 [0241.866] GetProcessHeap () returned 0x580000 [0241.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.866] GetProcessHeap () returned 0x580000 [0241.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.866] GetProcessHeap () returned 0x580000 [0241.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7afa240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x394fd28, dwReserved1=0x6d0a340, cFileName="BTINTERNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BTINTE~1.YOU")) returned 0x5b9630 [0241.866] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.879] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML", len=0x40 | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned 1 [0241.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0241.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.874] CloseHandle (hObject=0x418) returned 1 [0244.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml.id_1622540890_.your_last_chance")) returned 1 [0244.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b1600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0b1600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGDB3B~1.YOU")) returned 0x5b96f0 [0244.875] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0244.875] GetProcessHeap () returned 0x580000 [0244.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b81) returned 0x706b438 [0244.875] GetProcessHeap () returned 0x580000 [0244.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b81) returned 0x6d748d8 [0244.875] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.875] ReadFile (in: hFile=0x418, lpBuffer=0x706b438, nNumberOfBytesToRead=0x2b60, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x706b438*, lpNumberOfBytesRead=0x394ff14*=0x2b60, lpOverlapped=0x0) returned 1 [0245.632] GetProcessHeap () returned 0x580000 [0245.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0245.632] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.632] WriteFile (in: hFile=0x418, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x394ff14*=0x2b60, lpOverlapped=0x0) returned 1 [0245.633] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.633] WriteFile (in: hFile=0x418, lpBuffer=0x6d77437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77437*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0245.633] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.633] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0245.633] CloseHandle (hObject=0x418) returned 1 [0246.793] GetProcessHeap () returned 0x580000 [0246.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0246.793] GetProcessHeap () returned 0x580000 [0246.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706b438 | out: hHeap=0x580000) returned 1 [0246.793] GetProcessHeap () returned 0x580000 [0246.793] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b1600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ed4da0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x394fd28, dwReserved1=0x706b438, cFileName="PGLBL109.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGDB3B~1.YOU")) returned 0x5b9730 [0249.282] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.288] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV", len=0x3e | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 1 [0249.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0249.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0249.292] CloseHandle (hObject=0x4ac) returned 1 [0249.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.id_1622540890_.your_last_chance")) returned 1 [0249.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b8ea00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36b8ea00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x148f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b9730 [0249.293] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0249.293] GetProcessHeap () returned 0x580000 [0249.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0249.293] GetProcessHeap () returned 0x580000 [0249.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0249.293] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.293] ReadFile (in: hFile=0x4ac, lpBuffer=0x7018958, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.726] GetProcessHeap () returned 0x580000 [0252.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.726] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.726] WriteFile (in: hFile=0x4ac, lpBuffer=0x702a188*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesWritten=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.727] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.727] WriteFile (in: hFile=0x4ac, lpBuffer=0x703b987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b987*, lpNumberOfBytesWritten=0x394ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.899] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.899] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x394ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.899] CloseHandle (hObject=0x4ac) returned 1 [0252.918] GetProcessHeap () returned 0x580000 [0252.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0252.919] GetProcessHeap () returned 0x580000 [0252.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0252.919] GetProcessHeap () returned 0x580000 [0252.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fccc | out: lpFindFileData=0x394fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b8ea00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce428e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x148f76, dwReserved0=0x394fd28, dwReserved1=0x7018958, cFileName="CALENDAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b9730 [0254.425] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.364] SysReAllocStringLen (in: pbstr=0x394ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV", len=0x3e | out: pbstr=0x394ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 1 [0255.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f50) returned 0x72e5948 [0255.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0258.529] CloseHandle (hObject=0x4a4) returned 1 [0258.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x394ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x394fc74 | out: lpFindFileData=0x394fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8e7500, ftCreationTime.dwHighDateTime=0x1c9a6a9, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb8e7500, ftLastWriteTime.dwHighDateTime=0x1c9a6a9, nFileSizeHigh=0x0, nFileSizeLow=0x1eeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPICC~1.YOU")) returned 0x5b96f0 [0258.530] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0258.530] GetProcessHeap () returned 0x580000 [0258.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0258.531] GetProcessHeap () returned 0x580000 [0258.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0258.531] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.531] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x394ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x394ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 23 os_tid = 0xa54 [0039.062] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.146] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.408] Sleep (dwMilliseconds=0x1) [0039.574] Sleep (dwMilliseconds=0x1) [0039.610] Sleep (dwMilliseconds=0x1) [0039.676] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.836] Sleep (dwMilliseconds=0x1) [0039.866] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.288] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.508] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.592] Sleep (dwMilliseconds=0x1) [0042.311] Sleep (dwMilliseconds=0x1) [0042.342] Sleep (dwMilliseconds=0x1) [0042.465] Sleep (dwMilliseconds=0x1) [0042.508] Sleep (dwMilliseconds=0x1) [0042.545] Sleep (dwMilliseconds=0x1) [0042.643] Sleep (dwMilliseconds=0x1) [0042.656] Sleep (dwMilliseconds=0x1) [0042.695] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.828] Sleep (dwMilliseconds=0x1) [0042.844] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.014] Sleep (dwMilliseconds=0x1) [0043.085] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.280] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.309] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.387] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.496] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.713] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.745] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.777] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.932] Sleep (dwMilliseconds=0x1) [0043.948] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.525] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.712] Sleep (dwMilliseconds=0x1) [0044.728] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.946] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.977] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.055] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.133] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.211] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.289] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.445] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.570] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.821] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.884] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.506] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.818] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.896] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.223] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.457] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.081] Sleep (dwMilliseconds=0x1) [0048.098] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.549] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.329] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.376] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.532] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.641] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.953] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.109] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.265] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.593] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.170] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.734] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.781] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.858] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.890] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.936] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.014] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.062] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.140] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.171] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.265] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.326] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.404] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.501] Sleep (dwMilliseconds=0x1) [0052.514] Sleep (dwMilliseconds=0x1) [0052.530] Sleep (dwMilliseconds=0x1) [0052.552] Sleep (dwMilliseconds=0x1) [0052.561] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.670] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.717] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.826] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] Sleep (dwMilliseconds=0x1) [0052.889] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.950] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.138] Sleep (dwMilliseconds=0x1) [0053.154] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.310] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.340] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.372] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.730] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.809] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.511] Sleep (dwMilliseconds=0x1) [0054.526] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.636] Sleep (dwMilliseconds=0x1) [0054.651] Sleep (dwMilliseconds=0x1) [0054.666] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.713] Sleep (dwMilliseconds=0x1) [0054.729] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.822] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.979] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.057] Sleep (dwMilliseconds=0x1) [0055.073] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.103] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.182] Sleep (dwMilliseconds=0x1) [0055.202] Sleep (dwMilliseconds=0x1) [0055.213] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] Sleep (dwMilliseconds=0x1) [0055.338] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.433] Sleep (dwMilliseconds=0x1) [0055.447] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.494] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.746] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", len=0x4c | out: pbstr=0x3a8ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 1 [0061.746] GetProcessHeap () returned 0x580000 [0061.746] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x70) returned 0x5b5bc8 [0061.746] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0066.815] CloseHandle (hObject=0x484) returned 1 [0066.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.816] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id_1622540890_.your_last_chance")) returned 1 [0070.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0070.282] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~1.YOU")) returned 0x5b9730 [0071.840] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0073.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0074.116] GetProcessHeap () returned 0x580000 [0074.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1921) returned 0x6d0e508 [0074.116] GetProcessHeap () returned 0x580000 [0074.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1921) returned 0x6f04bb8 [0074.117] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.117] ReadFile (in: hFile=0x410, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1900, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x3a8ff14*=0x1900, lpOverlapped=0x0) returned 1 [0074.140] GetProcessHeap () returned 0x580000 [0074.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0074.140] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x410, lpBuffer=0x6f04bb8*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04bb8*, lpNumberOfBytesWritten=0x3a8ff14*=0x1900, lpOverlapped=0x0) returned 1 [0074.140] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x410, lpBuffer=0x6f064b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f064b7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.140] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.140] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.141] CloseHandle (hObject=0x410) returned 1 [0074.819] GetProcessHeap () returned 0x580000 [0074.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04bb8 | out: hHeap=0x580000) returned 1 [0074.819] GetProcessHeap () returned 0x580000 [0074.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0074.819] GetProcessHeap () returned 0x580000 [0074.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0079.334] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0x63dbf840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x3a8fd28, dwReserved1=0x6d0e508, cFileName="PrjProrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~1.YOU")) returned 0x5b96f0 [0079.334] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.349] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", len=0x3e | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 1 [0079.349] GetProcessHeap () returned 0x580000 [0079.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x3c) returned 0x5f76f0 [0079.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.360] Sleep (dwMilliseconds=0x1) [0081.727] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", len=0x65 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 1 [0081.727] GetProcessHeap () returned 0x580000 [0081.727] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.792] CloseHandle (hObject=0x458) returned 1 [0081.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id_1622540890_.your_last_chance")) returned 1 [0081.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~1.YOU")) returned 0x5b9730 [0081.793] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.793] GetProcessHeap () returned 0x580000 [0081.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1921) returned 0x673cd0 [0081.793] GetProcessHeap () returned 0x580000 [0081.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1921) returned 0x675600 [0081.793] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.793] ReadFile (in: hFile=0x458, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x1900, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x3a8ff14*=0x1900, lpOverlapped=0x0) returned 1 [0081.816] GetProcessHeap () returned 0x580000 [0081.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0081.816] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.816] WriteFile (in: hFile=0x458, lpBuffer=0x675600*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x675600*, lpNumberOfBytesWritten=0x3a8ff14*=0x1900, lpOverlapped=0x0) returned 1 [0081.817] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.817] WriteFile (in: hFile=0x458, lpBuffer=0x676eff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x676eff*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.817] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.817] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.817] CloseHandle (hObject=0x458) returned 1 [0081.817] GetProcessHeap () returned 0x580000 [0081.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x675600 | out: hHeap=0x580000) returned 1 [0081.817] GetProcessHeap () returned 0x580000 [0081.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0081.817] GetProcessHeap () returned 0x580000 [0081.817] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0081.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6860d480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1939, dwReserved0=0x3a8fd28, dwReserved1=0x673cd0, cFileName="PrjProrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~1.YOU")) returned 0x5b9730 [0081.817] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.838] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 1 [0081.838] GetProcessHeap () returned 0x580000 [0081.838] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.838] CloseHandle (hObject=0x488) returned 1 [0081.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.839] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.840] GetProcessHeap () returned 0x580000 [0081.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6f094f0 [0081.840] GetProcessHeap () returned 0x580000 [0081.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6f09c60 [0081.840] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.840] ReadFile (in: hFile=0x488, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x3a8ff14*=0x740, lpOverlapped=0x0) returned 1 [0081.850] GetProcessHeap () returned 0x580000 [0081.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0081.850] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.850] WriteFile (in: hFile=0x488, lpBuffer=0x6f09c60*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09c60*, lpNumberOfBytesWritten=0x3a8ff14*=0x740, lpOverlapped=0x0) returned 1 [0081.850] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.851] WriteFile (in: hFile=0x488, lpBuffer=0x6f0a39f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a39f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.851] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.851] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.851] CloseHandle (hObject=0x488) returned 1 [0081.851] GetProcessHeap () returned 0x580000 [0081.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09c60 | out: hHeap=0x580000) returned 1 [0081.851] GetProcessHeap () returned 0x580000 [0081.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.851] GetProcessHeap () returned 0x580000 [0081.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0081.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68659740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x3a8fd28, dwReserved1=0x6f094f0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.851] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.660] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", len=0x62 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 1 [0082.660] GetProcessHeap () returned 0x580000 [0082.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0082.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0082.661] CloseHandle (hObject=0x498) returned 1 [0082.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0082.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0083.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0083.313] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0083.314] GetProcessHeap () returned 0x580000 [0083.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7981) returned 0x673cd0 [0083.314] GetProcessHeap () returned 0x580000 [0083.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7981) returned 0x6c57108 [0083.315] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.315] ReadFile (in: hFile=0x498, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x7960, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x3a8ff14*=0x7960, lpOverlapped=0x0) returned 1 [0083.762] GetProcessHeap () returned 0x580000 [0083.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.762] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x498, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x3a8ff14*=0x7960, lpOverlapped=0x0) returned 1 [0083.762] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x498, lpBuffer=0x6c5ea67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5ea67*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.762] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.762] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.762] CloseHandle (hObject=0x498) returned 1 [0083.763] GetProcessHeap () returned 0x580000 [0083.763] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0083.763] GetProcessHeap () returned 0x580000 [0083.763] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0083.766] GetProcessHeap () returned 0x580000 [0083.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x698a6060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x580000, dwReserved1=0x6f094e8, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0083.766] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.227] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 1 [0088.227] GetProcessHeap () returned 0x580000 [0088.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0088.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0088.227] CloseHandle (hObject=0x428) returned 1 [0088.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.227] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0088.349] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0088.349] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0088.349] GetProcessHeap () returned 0x580000 [0088.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c61) returned 0x6e16e60 [0088.349] GetProcessHeap () returned 0x580000 [0088.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c61) returned 0x6e1ead0 [0088.350] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.350] ReadFile (in: hFile=0x428, lpBuffer=0x6e16e60, nNumberOfBytesToRead=0x7c40, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e16e60*, lpNumberOfBytesRead=0x3a8ff14*=0x7c40, lpOverlapped=0x0) returned 1 [0090.152] GetProcessHeap () returned 0x580000 [0090.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0090.152] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.153] WriteFile (in: hFile=0x428, lpBuffer=0x6e1ead0*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1ead0*, lpNumberOfBytesWritten=0x3a8ff14*=0x7c40, lpOverlapped=0x0) returned 1 [0090.767] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.767] WriteFile (in: hFile=0x428, lpBuffer=0x6e2670f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2670f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.441] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.441] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.441] CloseHandle (hObject=0x428) returned 1 [0092.597] GetProcessHeap () returned 0x580000 [0092.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1ead0 | out: hHeap=0x580000) returned 1 [0092.597] GetProcessHeap () returned 0x580000 [0092.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e16e60 | out: hHeap=0x580000) returned 1 [0092.597] GetProcessHeap () returned 0x580000 [0092.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0092.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7c81, dwReserved0=0x3a8fd28, dwReserved1=0x6e16e60, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0092.597] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.182] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 1 [0094.182] GetProcessHeap () returned 0x580000 [0094.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x44) returned 0x596cd8 [0094.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0094.183] CloseHandle (hObject=0x450) returned 1 [0094.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0095.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0095.769] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0095.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0095.770] GetProcessHeap () returned 0x580000 [0095.770] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d81) returned 0x6df22b0 [0095.770] GetProcessHeap () returned 0x580000 [0095.770] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d81) returned 0x6ce54a8 [0095.770] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.770] ReadFile (in: hFile=0x450, lpBuffer=0x6df22b0, nNumberOfBytesToRead=0x3d60, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df22b0*, lpNumberOfBytesRead=0x3a8ff14*=0x3d60, lpOverlapped=0x0) returned 1 [0097.184] GetProcessHeap () returned 0x580000 [0097.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0097.184] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.184] WriteFile (in: hFile=0x450, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x3a8ff14*=0x3d60, lpOverlapped=0x0) returned 1 [0097.185] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.185] WriteFile (in: hFile=0x450, lpBuffer=0x6ce9207*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce9207*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.185] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.185] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.185] CloseHandle (hObject=0x450) returned 1 [0097.185] GetProcessHeap () returned 0x580000 [0097.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0097.185] GetProcessHeap () returned 0x580000 [0097.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df22b0 | out: hHeap=0x580000) returned 1 [0097.185] GetProcessHeap () returned 0x580000 [0097.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0097.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71897ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d9d, dwReserved0=0x3a8fd28, dwReserved1=0x6df22b0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.185] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0098.285] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", len=0x47 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 1 [0098.285] GetProcessHeap () returned 0x580000 [0098.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0098.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0099.997] CloseHandle (hObject=0x4a8) returned 1 [0099.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id_1622540890_.your_last_chance")) returned 1 [0099.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEI~1.YOU")) returned 0x5b96f0 [0099.998] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0099.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0099.998] GetProcessHeap () returned 0x580000 [0099.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f0ce0 [0099.998] GetProcessHeap () returned 0x580000 [0099.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f0890 [0099.998] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.998] ReadFile (in: hFile=0x4a8, lpBuffer=0x5f0ce0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f0ce0*, lpNumberOfBytesRead=0x3a8ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0100.001] GetProcessHeap () returned 0x580000 [0100.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0100.001] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.001] WriteFile (in: hFile=0x4a8, lpBuffer=0x5f0890*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f0890*, lpNumberOfBytesWritten=0x3a8ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0100.001] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.001] WriteFile (in: hFile=0x4a8, lpBuffer=0x5f0a6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f0a6f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.001] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.001] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.001] CloseHandle (hObject=0x4a8) returned 1 [0100.002] GetProcessHeap () returned 0x580000 [0100.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f0890 | out: hHeap=0x580000) returned 1 [0100.002] GetProcessHeap () returned 0x580000 [0100.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f0ce0 | out: hHeap=0x580000) returned 1 [0100.002] GetProcessHeap () returned 0x580000 [0100.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x733857c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x3a8fd28, dwReserved1=0x5f0ce0, cFileName="SLATE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEI~1.YOU")) returned 0x5b9630 [0101.572] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.650] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x3a8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 1 [0101.650] GetProcessHeap () returned 0x580000 [0101.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7d8, Size=0x28) returned 0x5dc550 [0101.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0104.599] CloseHandle (hObject=0x390) returned 1 [0104.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0104.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0104.607] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0104.607] GetProcessHeap () returned 0x580000 [0104.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x75e1) returned 0x6ce54a8 [0104.607] GetProcessHeap () returned 0x580000 [0104.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x75e1) returned 0x6c6a0f8 [0104.608] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.608] ReadFile (in: hFile=0x390, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0x75c0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x3a8ff14*=0x75c0, lpOverlapped=0x0) returned 1 [0105.853] GetProcessHeap () returned 0x580000 [0105.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0105.853] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.853] WriteFile (in: hFile=0x390, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0x75c0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x3a8ff14*=0x75c0, lpOverlapped=0x0) returned 1 [0105.853] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.853] WriteFile (in: hFile=0x390, lpBuffer=0x6c716b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c716b7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0105.853] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.854] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0105.854] CloseHandle (hObject=0x390) returned 1 [0105.854] GetProcessHeap () returned 0x580000 [0105.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0105.857] GetProcessHeap () returned 0x580000 [0105.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0105.857] GetProcessHeap () returned 0x580000 [0105.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0105.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76b4fb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75fe, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0105.857] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.844] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Eurosti.TTF", len=0x26 | out: pbstr=0x3a8ff84*="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 1 [0111.844] GetProcessHeap () returned 0x580000 [0111.844] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.864] Sleep (dwMilliseconds=0x1) [0111.912] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", len=0x45 | out: pbstr=0x3a8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 1 [0111.912] GetProcessHeap () returned 0x580000 [0111.912] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0111.912] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.945] Sleep (dwMilliseconds=0x1) [0112.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.046] Sleep (dwMilliseconds=0x1) [0112.161] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", len=0x52 | out: pbstr=0x3a8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 1 [0112.161] GetProcessHeap () returned 0x580000 [0112.161] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f880 [0112.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.187] Sleep (dwMilliseconds=0x1) [0112.340] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", len=0x46 | out: pbstr=0x3a8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 1 [0112.340] GetProcessHeap () returned 0x580000 [0112.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.340] Sleep (dwMilliseconds=0x1) [0112.357] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", len=0x4b | out: pbstr=0x3a8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png") returned 1 [0112.357] GetProcessHeap () returned 0x580000 [0112.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0112.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.382] Sleep (dwMilliseconds=0x1) [0113.339] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", len=0x3f | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 1 [0113.340] GetProcessHeap () returned 0x580000 [0113.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x70) returned 0x6f0ceb8 [0113.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0113.474] CloseHandle (hObject=0x41c) returned 1 [0113.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id_1622540890_.your_last_chance")) returned 1 [0115.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~4.YOU")) returned 0x5b9630 [0115.267] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0115.267] GetProcessHeap () returned 0x580000 [0115.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6d035f8 [0115.267] GetProcessHeap () returned 0x580000 [0115.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6d06ca8 [0115.267] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.268] ReadFile (in: hFile=0x41c, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1300, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x3a8ff14*=0x1300, lpOverlapped=0x0) returned 1 [0115.286] GetProcessHeap () returned 0x580000 [0115.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.286] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.286] WriteFile (in: hFile=0x41c, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x3a8ff14*=0x1300, lpOverlapped=0x0) returned 1 [0115.286] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.286] WriteFile (in: hFile=0x41c, lpBuffer=0x6d07fa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07fa7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.286] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.286] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.286] CloseHandle (hObject=0x41c) returned 1 [0115.286] GetProcessHeap () returned 0x580000 [0115.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0115.286] GetProcessHeap () returned 0x580000 [0115.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0115.286] GetProcessHeap () returned 0x580000 [0115.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c551b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1342, dwReserved0=0x3a8fd28, dwReserved1=0x6d035f8, cFileName="AG00167_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~4.YOU")) returned 0x5b9630 [0117.324] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0117.409] CloseHandle (hObject=0x460) returned 1 [0117.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0064~1.YOU")) returned 0x5b9730 [0118.448] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.449] GetProcessHeap () returned 0x580000 [0118.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6c676b8 [0118.449] GetProcessHeap () returned 0x580000 [0118.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6cda390 [0118.449] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.449] ReadFile (in: hFile=0x460, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x3a8ff14*=0x760, lpOverlapped=0x0) returned 1 [0118.458] GetProcessHeap () returned 0x580000 [0118.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.458] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.458] WriteFile (in: hFile=0x460, lpBuffer=0x6cda390*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesWritten=0x3a8ff14*=0x760, lpOverlapped=0x0) returned 1 [0118.458] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.458] WriteFile (in: hFile=0x460, lpBuffer=0x6cdaaef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdaaef*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.458] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.458] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.458] CloseHandle (hObject=0x460) returned 1 [0118.459] GetProcessHeap () returned 0x580000 [0118.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0118.459] GetProcessHeap () returned 0x580000 [0118.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.459] GetProcessHeap () returned 0x580000 [0118.459] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e385260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x3a8fd28, dwReserved1=0x6c676b8, cFileName="SY00642_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0064~1.YOU")) returned 0x5b96f0 [0120.124] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.150] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", len=0x4c | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 1 [0120.150] GetProcessHeap () returned 0x580000 [0120.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d8) returned 0x6d06ca8 [0120.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0121.427] CloseHandle (hObject=0x4a4) returned 1 [0121.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0211~1.YOU")) returned 0x5b9730 [0121.428] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0121.429] GetProcessHeap () returned 0x580000 [0121.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c65108 [0121.429] GetProcessHeap () returned 0x580000 [0121.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a110 [0121.429] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.429] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x3a8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0121.434] GetProcessHeap () returned 0x580000 [0121.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.434] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.434] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c6a110*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesWritten=0x3a8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0121.434] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.434] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c6a4ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a4ef*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.434] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.434] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.434] CloseHandle (hObject=0x4a4) returned 1 [0121.434] GetProcessHeap () returned 0x580000 [0121.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0121.434] GetProcessHeap () returned 0x580000 [0121.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0121.434] GetProcessHeap () returned 0x580000 [0121.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffef900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x413, dwReserved0=0x3a8fd28, dwReserved1=0x6c65108, cFileName="WB02116_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0211~1.YOU")) returned 0x5b9730 [0121.913] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.561] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", len=0x49 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned 1 [0122.561] GetProcessHeap () returned 0x580000 [0122.561] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1954) returned 0x6f42f08 [0122.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.602] CloseHandle (hObject=0x3fc) returned 1 [0122.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.id_1622540890_.your_last_chance")) returned 1 [0122.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKXM~1.YOU")) returned 0x5b9730 [0122.603] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.603] GetProcessHeap () returned 0x580000 [0122.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0122.604] GetProcessHeap () returned 0x580000 [0122.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6d10048 [0122.604] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.604] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3a8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0122.633] GetProcessHeap () returned 0x580000 [0122.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0122.633] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.633] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x3a8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0122.633] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.634] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d10e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10e67*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.634] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.634] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.634] CloseHandle (hObject=0x3fc) returned 1 [0122.635] GetProcessHeap () returned 0x580000 [0122.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0122.635] GetProcessHeap () returned 0x580000 [0122.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0122.635] GetProcessHeap () returned 0x580000 [0122.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b642e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x3a8fd28, dwReserved1=0x6c29878, cFileName="Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKXM~1.YOU")) returned 0x5b9730 [0124.301] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.319] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", len=0x4a | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned 1 [0124.319] GetProcessHeap () returned 0x580000 [0124.319] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1930) returned 0x6f42f08 [0124.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.320] CloseHandle (hObject=0x484) returned 1 [0124.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.id_1622540890_.your_last_chance")) returned 1 [0124.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELX~1.YOU")) returned 0x5b9730 [0124.321] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.321] GetProcessHeap () returned 0x580000 [0124.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6c29878 [0124.321] GetProcessHeap () returned 0x580000 [0124.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6ce2378 [0124.321] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.321] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe40, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3a8ff14*=0xe40, lpOverlapped=0x0) returned 1 [0124.337] GetProcessHeap () returned 0x580000 [0124.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.338] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.338] WriteFile (in: hFile=0x484, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x3a8ff14*=0xe40, lpOverlapped=0x0) returned 1 [0124.338] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.338] WriteFile (in: hFile=0x484, lpBuffer=0x6ce31b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce31b7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.338] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.338] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.338] CloseHandle (hObject=0x484) returned 1 [0124.338] GetProcessHeap () returned 0x580000 [0124.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.338] GetProcessHeap () returned 0x580000 [0124.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.338] GetProcessHeap () returned 0x580000 [0124.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81b9b8c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe7e, dwReserved0=0x3a8fd28, dwReserved1=0x6c29878, cFileName="Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELX~1.YOU")) returned 0x5b9730 [0124.338] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.353] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", len=0x4e | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned 1 [0124.353] GetProcessHeap () returned 0x580000 [0124.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x191c) returned 0x6f42f08 [0124.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.354] CloseHandle (hObject=0x440) returned 1 [0124.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.id_1622540890_.your_last_chance")) returned 1 [0124.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0124.355] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.355] GetProcessHeap () returned 0x580000 [0124.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0124.355] GetProcessHeap () returned 0x580000 [0124.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6ce2378 [0124.356] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.356] ReadFile (in: hFile=0x440, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3a8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.369] GetProcessHeap () returned 0x580000 [0124.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.369] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.369] WriteFile (in: hFile=0x440, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x3a8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.369] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.369] WriteFile (in: hFile=0x440, lpBuffer=0x6ce3197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3197*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.370] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.370] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.370] CloseHandle (hObject=0x440) returned 1 [0124.370] GetProcessHeap () returned 0x580000 [0124.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.370] GetProcessHeap () returned 0x580000 [0124.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.370] GetProcessHeap () returned 0x580000 [0124.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81be7b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe5d, dwReserved0=0x3a8fd28, dwReserved1=0x6c29878, cFileName="Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0124.370] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.379] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", len=0x4a | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned 1 [0124.379] GetProcessHeap () returned 0x580000 [0124.379] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1914) returned 0x6f42f08 [0124.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.699] CloseHandle (hObject=0x4a0) returned 1 [0124.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.id_1622540890_.your_last_chance")) returned 1 [0124.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METROX~1.YOU")) returned 0x5b9730 [0124.700] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.700] GetProcessHeap () returned 0x580000 [0124.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.700] GetProcessHeap () returned 0x580000 [0124.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.700] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.700] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x3a8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.713] GetProcessHeap () returned 0x580000 [0124.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.713] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.713] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x3a8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.714] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.714] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.714] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.714] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.714] CloseHandle (hObject=0x4a0) returned 1 [0124.714] GetProcessHeap () returned 0x580000 [0124.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.714] GetProcessHeap () returned 0x580000 [0124.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.714] GetProcessHeap () returned 0x580000 [0124.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f2d9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe37, dwReserved0=0x3a8fd28, dwReserved1=0x6f67710, cFileName="Metro.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METROX~1.YOU")) returned 0x5b9730 [0125.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.331] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", len=0x3d | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned 1 [0125.331] GetProcessHeap () returned 0x580000 [0125.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18fc) returned 0x6f42f08 [0125.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0128.611] CloseHandle (hObject=0x450) returned 1 [0128.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02122~1.YOU")) returned 0x5b9730 [0130.355] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0130.355] GetProcessHeap () returned 0x580000 [0130.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x6dd7c30 [0130.355] GetProcessHeap () returned 0x580000 [0130.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x67ec60 [0130.355] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.355] ReadFile (in: hFile=0x450, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x11a0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x3a8ff14*=0x11a0, lpOverlapped=0x0) returned 1 [0130.371] GetProcessHeap () returned 0x580000 [0130.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.371] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.371] WriteFile (in: hFile=0x450, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x3a8ff14*=0x11a0, lpOverlapped=0x0) returned 1 [0130.372] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.372] WriteFile (in: hFile=0x450, lpBuffer=0x67fdff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fdff*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.372] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.372] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.372] CloseHandle (hObject=0x450) returned 1 [0130.372] GetProcessHeap () returned 0x580000 [0130.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0130.372] GetProcessHeap () returned 0x580000 [0130.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0130.372] GetProcessHeap () returned 0x580000 [0130.372] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8552ece0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x3a8fd28, dwReserved1=0x6dd7c30, cFileName="J0212219.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02122~1.YOU")) returned 0x5b9730 [0130.372] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.405] CloseHandle (hObject=0x3e4) returned 1 [0132.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.id_1622540890_.your_last_chance")) returned 1 [0132.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTC~1.YOU")) returned 0x5b9730 [0132.406] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.407] GetProcessHeap () returned 0x580000 [0132.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0132.407] GetProcessHeap () returned 0x580000 [0132.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0132.407] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.407] ReadFile (in: hFile=0x3e4, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3a8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.420] GetProcessHeap () returned 0x580000 [0132.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.420] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.420] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x3a8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.420] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.420] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.420] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.420] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.420] CloseHandle (hObject=0x3e4) returned 1 [0132.421] GetProcessHeap () returned 0x580000 [0132.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0132.421] GetProcessHeap () returned 0x580000 [0132.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0132.421] GetProcessHeap () returned 0x580000 [0132.421] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x868ac100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x3a8fd28, dwReserved1=0x635768, cFileName="GANTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTC~1.YOU")) returned 0x5b96f0 [0134.939] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.939] Sleep (dwMilliseconds=0x1) [0134.998] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD", len=0x3b | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 1 [0134.998] GetProcessHeap () returned 0x580000 [0134.998] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea0) returned 0x6f14048 [0134.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.004] CloseHandle (hObject=0x3b8) returned 1 [0135.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id_1622540890_.your_last_chance")) returned 1 [0135.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQPLIS~1.YOU")) returned 0x5b96f0 [0135.005] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.005] GetProcessHeap () returned 0x580000 [0135.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0135.005] GetProcessHeap () returned 0x580000 [0135.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0135.005] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.005] ReadFile (in: hFile=0x3b8, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3a8ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0135.012] GetProcessHeap () returned 0x580000 [0135.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0135.012] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.012] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3a8ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0135.012] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.012] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.012] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.012] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.013] CloseHandle (hObject=0x3b8) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0135.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8815e540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6c7, dwReserved0=0x3a8fd28, dwReserved1=0x6c79898, cFileName="EQPLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQPLIS~1.YOU")) returned 0x5b96b0 [0135.736] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.752] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x5b | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0135.752] GetProcessHeap () returned 0x580000 [0135.752] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.752] CloseHandle (hObject=0x488) returned 1 [0135.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0135.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0135.757] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.757] GetProcessHeap () returned 0x580000 [0135.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0135.757] GetProcessHeap () returned 0x580000 [0135.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0135.757] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.757] ReadFile (in: hFile=0x488, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x3a8ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.759] GetProcessHeap () returned 0x580000 [0135.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.759] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.759] WriteFile (in: hFile=0x488, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x3a8ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.759] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.759] WriteFile (in: hFile=0x488, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.759] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.759] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.760] CloseHandle (hObject=0x488) returned 1 [0135.760] GetProcessHeap () returned 0x580000 [0135.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0135.760] GetProcessHeap () returned 0x580000 [0135.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0135.760] GetProcessHeap () returned 0x580000 [0135.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88882740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x3a8fd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0135.760] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.767] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", len=0x52 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css") returned 1 [0135.767] GetProcessHeap () returned 0x580000 [0135.767] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.768] CloseHandle (hObject=0x488) returned 1 [0135.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.id_1622540890_.your_last_chance")) returned 1 [0135.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Beige.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BEIGEC~1.YOU")) returned 0x5b96b0 [0135.769] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.769] GetProcessHeap () returned 0x580000 [0135.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x642e20 [0135.769] GetProcessHeap () returned 0x580000 [0135.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef020 [0135.769] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.769] ReadFile (in: hFile=0x488, lpBuffer=0x642e20, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x642e20*, lpNumberOfBytesRead=0x3a8ff14*=0x700, lpOverlapped=0x0) returned 1 [0135.776] GetProcessHeap () returned 0x580000 [0135.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.776] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.776] WriteFile (in: hFile=0x488, lpBuffer=0x6eef020*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesWritten=0x3a8ff14*=0x700, lpOverlapped=0x0) returned 1 [0135.776] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.776] WriteFile (in: hFile=0x488, lpBuffer=0x6eef71f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef71f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.777] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.777] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.777] CloseHandle (hObject=0x488) returned 1 [0135.777] GetProcessHeap () returned 0x580000 [0135.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0135.777] GetProcessHeap () returned 0x580000 [0135.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x642e20 | out: hHeap=0x580000) returned 1 [0135.777] GetProcessHeap () returned 0x580000 [0135.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x888a88a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x743, dwReserved0=0x3a8fd28, dwReserved1=0x642e20, cFileName="Beige.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BEIGEC~1.YOU")) returned 0x5b96b0 [0135.777] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.783] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", len=0x55 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css") returned 1 [0135.783] GetProcessHeap () returned 0x580000 [0135.783] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.783] CloseHandle (hObject=0x488) returned 1 [0135.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance")) returned 1 [0135.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b96b0 [0135.784] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.784] GetProcessHeap () returned 0x580000 [0135.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6dd7c30 [0135.784] GetProcessHeap () returned 0x580000 [0135.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x67ec60 [0135.785] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.785] ReadFile (in: hFile=0x488, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x3a8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0135.797] GetProcessHeap () returned 0x580000 [0135.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.797] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.797] WriteFile (in: hFile=0x488, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x3a8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0135.797] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.797] WriteFile (in: hFile=0x488, lpBuffer=0x67f8ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f8ff*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.797] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.797] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.797] CloseHandle (hObject=0x488) returned 1 [0135.797] GetProcessHeap () returned 0x580000 [0135.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0135.797] GetProcessHeap () returned 0x580000 [0135.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0135.797] GetProcessHeap () returned 0x580000 [0135.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x888cea00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0x3a8fd28, dwReserved1=0x6dd7c30, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b96b0 [0135.797] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.883] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", len=0x43 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned 1 [0136.883] GetProcessHeap () returned 0x580000 [0136.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0136.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.741] CloseHandle (hObject=0x3b4) returned 1 [0139.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.814] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df51200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2df51200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~3.YOU")) returned 0x5b97b0 [0139.814] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.814] GetProcessHeap () returned 0x580000 [0139.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6f04558 [0139.814] GetProcessHeap () returned 0x580000 [0139.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6c79898 [0139.814] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.814] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x3a8ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0139.821] GetProcessHeap () returned 0x580000 [0139.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.821] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.821] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c79898*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesWritten=0x3a8ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0139.821] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.821] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c79e77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79e77*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.821] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.821] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.821] CloseHandle (hObject=0x3b4) returned 1 [0139.821] GetProcessHeap () returned 0x580000 [0139.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0139.821] GetProcessHeap () returned 0x580000 [0139.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0139.821] GetProcessHeap () returned 0x580000 [0139.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df51200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8af30cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x604, dwReserved0=0x3a8fd28, dwReserved1=0x6f04558, cFileName="BD21325_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~3.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.175] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", len=0x5c | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png") returned 1 [0140.175] GetProcessHeap () returned 0x580000 [0140.175] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0140.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.652] CloseHandle (hObject=0x4a0) returned 1 [0140.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.id_1622540890_.your_last_chance")) returned 1 [0140.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="arrow.png.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARROWP~1.YOU")) returned 0x5b9770 [0140.653] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.653] GetProcessHeap () returned 0x580000 [0140.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf4d0 [0140.653] GetProcessHeap () returned 0x580000 [0140.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf5e8 [0140.653] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.653] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dcf4d0, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf4d0*, lpNumberOfBytesRead=0x3a8ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.655] GetProcessHeap () returned 0x580000 [0140.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.655] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.655] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dcf5e8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf5e8*, lpNumberOfBytesWritten=0x3a8ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.655] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.655] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dcf6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf6c7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.655] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.655] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.656] CloseHandle (hObject=0x4a0) returned 1 [0140.656] GetProcessHeap () returned 0x580000 [0140.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0140.656] GetProcessHeap () returned 0x580000 [0140.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0140.656] GetProcessHeap () returned 0x580000 [0140.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b739700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x3a8fd28, dwReserved1=0x6dcf4d0, cFileName="arrow.png.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARROWP~1.YOU")) returned 0x5b9730 [0141.012] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.541] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL", len=0x3c | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 1 [0144.541] GetProcessHeap () returned 0x580000 [0144.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0144.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0144.548] CloseHandle (hObject=0x490) returned 1 [0144.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id_1622540890_.your_last_chance")) returned 1 [0144.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGCHA~1.YOU")) returned 0x5b9730 [0144.549] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0144.550] GetProcessHeap () returned 0x580000 [0144.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdfc1) returned 0x6fa12a8 [0144.550] GetProcessHeap () returned 0x580000 [0144.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdfc1) returned 0x6d21878 [0144.550] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.550] ReadFile (in: hFile=0x490, lpBuffer=0x6fa12a8, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa12a8*, lpNumberOfBytesRead=0x3a8ff14*=0xdfa0, lpOverlapped=0x0) returned 1 [0146.384] GetProcessHeap () returned 0x580000 [0146.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0146.385] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] WriteFile (in: hFile=0x490, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x3a8ff14*=0xdfa0, lpOverlapped=0x0) returned 1 [0146.385] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] WriteFile (in: hFile=0x490, lpBuffer=0x6d2f817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f817*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0146.385] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.385] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0146.385] CloseHandle (hObject=0x490) returned 1 [0146.385] GetProcessHeap () returned 0x580000 [0146.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0146.385] GetProcessHeap () returned 0x580000 [0146.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa12a8 | out: hHeap=0x580000) returned 1 [0146.385] GetProcessHeap () returned 0x580000 [0146.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8edd2fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdfc4, dwReserved0=0x3a8fd28, dwReserved1=0x6fa12a8, cFileName="ORGCHART.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGCHA~1.YOU")) returned 0x5b96f0 [0146.867] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.882] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", len=0x44 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned 1 [0146.882] GetProcessHeap () returned 0x580000 [0146.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0146.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0152.818] CloseHandle (hObject=0x4ac) returned 1 [0152.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR12~1.YOU")) returned 0x5b9730 [0152.819] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0152.821] GetProcessHeap () returned 0x580000 [0152.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46e1) returned 0x7059798 [0152.821] GetProcessHeap () returned 0x580000 [0152.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46e1) returned 0x705de88 [0152.821] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.821] ReadFile (in: hFile=0x4ac, lpBuffer=0x7059798, nNumberOfBytesToRead=0x46c0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7059798*, lpNumberOfBytesRead=0x3a8ff14*=0x46c0, lpOverlapped=0x0) returned 1 [0154.068] GetProcessHeap () returned 0x580000 [0154.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.068] WriteFile (in: hFile=0x4ac, lpBuffer=0x705de88*, nNumberOfBytesToWrite=0x46c0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x705de88*, lpNumberOfBytesWritten=0x3a8ff14*=0x46c0, lpOverlapped=0x0) returned 1 [0154.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.068] WriteFile (in: hFile=0x4ac, lpBuffer=0x7062547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062547*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.068] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.069] CloseHandle (hObject=0x4ac) returned 1 [0154.069] GetProcessHeap () returned 0x580000 [0154.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705de88 | out: hHeap=0x580000) returned 1 [0154.069] GetProcessHeap () returned 0x580000 [0154.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7059798 | out: hHeap=0x580000) returned 1 [0154.069] GetProcessHeap () returned 0x580000 [0154.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9372b580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4703, dwReserved0=0x3a8fd28, dwReserved1=0x7059798, cFileName="PDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR12~1.YOU")) returned 0x5b9630 [0154.069] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.683] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS", len=0x3b | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 1 [0154.683] GetProcessHeap () returned 0x580000 [0154.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0154.753] CloseHandle (hObject=0x490) returned 1 [0154.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0154.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id_1622540890_.your_last_chance")) returned 1 [0154.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0154.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x168406, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~1.YOU")) returned 0x5b9630 [0154.755] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0154.755] GetProcessHeap () returned 0x580000 [0154.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0154.755] GetProcessHeap () returned 0x580000 [0154.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d63f88 [0154.755] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.755] ReadFile (in: hFile=0x490, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.030] GetProcessHeap () returned 0x580000 [0159.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0159.030] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.030] WriteFile (in: hFile=0x490, lpBuffer=0x6d63f88*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d63f88*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.031] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.031] WriteFile (in: hFile=0x490, lpBuffer=0x6d75787*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75787*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0160.339] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.339] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0160.340] CloseHandle (hObject=0x490) returned 1 [0160.340] GetProcessHeap () returned 0x580000 [0160.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d63f88 | out: hHeap=0x580000) returned 1 [0160.340] GetProcessHeap () returned 0x580000 [0160.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0160.340] GetProcessHeap () returned 0x580000 [0160.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0164.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x972f9e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16842a, dwReserved0=0x3a8fd28, dwReserved1=0x6d10048, cFileName="WINPROJ.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~1.YOU")) returned 0x5b9730 [0164.565] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.547] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", len=0x41 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 1 [0166.547] GetProcessHeap () returned 0x580000 [0166.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x224c) returned 0x6f14048 [0166.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0166.605] CloseHandle (hObject=0x464) returned 1 [0166.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id_1622540890_.your_last_chance")) returned 1 [0166.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~2.YOU")) returned 0x5b9730 [0166.606] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0166.606] GetProcessHeap () returned 0x580000 [0166.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0166.606] GetProcessHeap () returned 0x580000 [0166.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0166.606] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.606] ReadFile (in: hFile=0x464, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x3a8ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.645] GetProcessHeap () returned 0x580000 [0166.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0166.645] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.645] WriteFile (in: hFile=0x464, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x3a8ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x464, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.648] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.648] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.648] CloseHandle (hObject=0x464) returned 1 [0166.654] GetProcessHeap () returned 0x580000 [0166.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0166.654] GetProcessHeap () returned 0x580000 [0166.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9af149c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x3a8fd28, dwReserved1=0x5cf780, cFileName="EXITEML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~2.YOU")) returned 0x5b9730 [0169.807] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.862] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", len=0x40 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 1 [0169.862] GetProcessHeap () returned 0x580000 [0169.862] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0169.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0169.862] CloseHandle (hObject=0x490) returned 1 [0169.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.863] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id_1622540890_.your_last_chance")) returned 1 [0169.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PABRSA~1.YOU")) returned 0x5b9730 [0169.863] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0169.864] GetProcessHeap () returned 0x580000 [0169.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ba1) returned 0x6d77938 [0169.864] GetProcessHeap () returned 0x580000 [0169.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ba1) returned 0x7162068 [0169.864] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.864] ReadFile (in: hFile=0x490, lpBuffer=0x6d77938, nNumberOfBytesToRead=0x2b80, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77938*, lpNumberOfBytesRead=0x3a8ff14*=0x2b80, lpOverlapped=0x0) returned 1 [0171.092] GetProcessHeap () returned 0x580000 [0171.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0171.093] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.093] WriteFile (in: hFile=0x490, lpBuffer=0x7162068*, nNumberOfBytesToWrite=0x2b80, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162068*, lpNumberOfBytesWritten=0x3a8ff14*=0x2b80, lpOverlapped=0x0) returned 1 [0171.093] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.093] WriteFile (in: hFile=0x490, lpBuffer=0x7164be7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7164be7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.093] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.093] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.093] CloseHandle (hObject=0x490) returned 1 [0171.093] GetProcessHeap () returned 0x580000 [0171.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162068 | out: hHeap=0x580000) returned 1 [0171.093] GetProcessHeap () returned 0x580000 [0171.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d77938 | out: hHeap=0x580000) returned 1 [0171.093] GetProcessHeap () returned 0x580000 [0171.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d97b1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bac, dwReserved0=0x3a8fd28, dwReserved1=0x6d77938, cFileName="PABR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PABRSA~1.YOU")) returned 0x5b9770 [0173.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.083] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", len=0x42 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 1 [0173.084] GetProcessHeap () returned 0x580000 [0173.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0173.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.117] CloseHandle (hObject=0x3fc) returned 1 [0173.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id_1622540890_.your_last_chance")) returned 1 [0173.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDCNC~1.YOU")) returned 0x5b9770 [0173.118] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.118] GetProcessHeap () returned 0x580000 [0173.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0173.118] GetProcessHeap () returned 0x580000 [0173.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0173.118] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.118] ReadFile (in: hFile=0x3fc, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x3a8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.160] GetProcessHeap () returned 0x580000 [0173.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.160] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.160] WriteFile (in: hFile=0x3fc, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x3a8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.160] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.160] WriteFile (in: hFile=0x3fc, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.160] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.160] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.160] CloseHandle (hObject=0x3fc) returned 1 [0173.160] GetProcessHeap () returned 0x580000 [0173.161] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0173.161] GetProcessHeap () returned 0x580000 [0173.161] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0173.161] GetProcessHeap () returned 0x580000 [0173.161] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed44880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x3a8fd28, dwReserved1=0x65f268, cFileName="SCDCNCLS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDCNC~1.YOU")) returned 0x5b9770 [0173.161] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.284] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", len=0x41 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 1 [0174.284] GetProcessHeap () returned 0x580000 [0174.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0174.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0176.063] CloseHandle (hObject=0x48c) returned 1 [0176.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id_1622540890_.your_last_chance")) returned 1 [0176.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACT3RS~1.YOU")) returned 0x5b9730 [0176.064] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0176.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0176.064] GetProcessHeap () returned 0x580000 [0176.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33a1) returned 0x7047008 [0176.064] GetProcessHeap () returned 0x580000 [0176.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33a1) returned 0x6d2fa18 [0176.064] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.064] ReadFile (in: hFile=0x48c, lpBuffer=0x7047008, nNumberOfBytesToRead=0x3380, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7047008*, lpNumberOfBytesRead=0x3a8ff14*=0x3380, lpOverlapped=0x0) returned 1 [0176.898] GetProcessHeap () returned 0x580000 [0176.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0176.899] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.899] WriteFile (in: hFile=0x48c, lpBuffer=0x6d2fa18*, nNumberOfBytesToWrite=0x3380, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2fa18*, lpNumberOfBytesWritten=0x3a8ff14*=0x3380, lpOverlapped=0x0) returned 1 [0176.899] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.899] WriteFile (in: hFile=0x48c, lpBuffer=0x6d32d97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d32d97*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.899] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.899] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.899] CloseHandle (hObject=0x48c) returned 1 [0176.899] GetProcessHeap () returned 0x580000 [0176.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2fa18 | out: hHeap=0x580000) returned 1 [0176.899] GetProcessHeap () returned 0x580000 [0176.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7047008 | out: hHeap=0x580000) returned 1 [0176.899] GetProcessHeap () returned 0x580000 [0176.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0179.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa10d3120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x33ac, dwReserved0=0x3a8fd28, dwReserved1=0x7047008, cFileName="ACT3R.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACT3RS~1.YOU")) returned 0x5b96f0 [0179.055] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.072] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", len=0x55 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx") returned 1 [0179.072] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0179.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0180.796] CloseHandle (hObject=0x440) returned 1 [0180.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.id_1622540890_.your_last_chance")) returned 1 [0180.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f5, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b96b0 [0180.797] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0180.797] GetProcessHeap () returned 0x580000 [0180.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1bec0 [0180.797] GetProcessHeap () returned 0x580000 [0180.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1e0c8 [0180.797] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.797] ReadFile (in: hFile=0x440, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x3a8ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0180.825] GetProcessHeap () returned 0x580000 [0180.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0180.826] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.826] WriteFile (in: hFile=0x440, lpBuffer=0x6f1e0c8*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e0c8*, lpNumberOfBytesWritten=0x3a8ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0180.826] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.826] WriteFile (in: hFile=0x440, lpBuffer=0x6f201a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f201a7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.826] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.826] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.826] CloseHandle (hObject=0x440) returned 1 [0180.826] GetProcessHeap () returned 0x580000 [0180.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1e0c8 | out: hHeap=0x580000) returned 1 [0180.826] GetProcessHeap () returned 0x580000 [0180.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0180.826] GetProcessHeap () returned 0x580000 [0180.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3650ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2119, dwReserved0=0x3a8fd28, dwReserved1=0x6f1bec0, cFileName="DefaultBlackAndWhite.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b9770 [0182.214] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.568] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", len=0x51 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned 1 [0183.568] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2138) returned 0x6f14048 [0183.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0184.379] CloseHandle (hObject=0x480) returned 1 [0184.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0184.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8472000, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~3.YOU")) returned 0x5b9770 [0184.381] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0184.381] GetProcessHeap () returned 0x580000 [0184.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0184.381] GetProcessHeap () returned 0x580000 [0184.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x7066b08 [0184.381] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.381] ReadFile (in: hFile=0x480, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x3a8ff14*=0x1320, lpOverlapped=0x0) returned 1 [0184.400] GetProcessHeap () returned 0x580000 [0184.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.400] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.400] WriteFile (in: hFile=0x480, lpBuffer=0x7066b08*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesWritten=0x3a8ff14*=0x1320, lpOverlapped=0x0) returned 1 [0184.400] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.400] WriteFile (in: hFile=0x480, lpBuffer=0x7067e27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7067e27*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.400] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.400] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.400] CloseHandle (hObject=0x480) returned 1 [0184.401] GetProcessHeap () returned 0x580000 [0184.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0184.401] GetProcessHeap () returned 0x580000 [0184.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0184.401] GetProcessHeap () returned 0x580000 [0184.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.401] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5862680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x3a8fd28, dwReserved1=0x67ec60, cFileName="NotifierWindowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~3.YOU")) returned 0x5b9770 [0184.401] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.408] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", len=0x6b | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned 1 [0184.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0184.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.375] CloseHandle (hObject=0x484) returned 1 [0185.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0185.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0185.376] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.377] GetProcessHeap () returned 0x580000 [0185.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc79b8 [0185.377] GetProcessHeap () returned 0x580000 [0185.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc7da0 [0185.377] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.377] ReadFile (in: hFile=0x484, lpBuffer=0x6dc79b8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc79b8*, lpNumberOfBytesRead=0x3a8ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0185.381] GetProcessHeap () returned 0x580000 [0185.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.381] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.381] WriteFile (in: hFile=0x484, lpBuffer=0x6dc7da0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7da0*, lpNumberOfBytesWritten=0x3a8ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0185.381] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.382] WriteFile (in: hFile=0x484, lpBuffer=0x6dc813f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc813f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.382] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.382] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.382] CloseHandle (hObject=0x484) returned 1 [0185.382] GetProcessHeap () returned 0x580000 [0185.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7da0 | out: hHeap=0x580000) returned 1 [0185.382] GetProcessHeap () returned 0x580000 [0185.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc79b8 | out: hHeap=0x580000) returned 1 [0185.382] GetProcessHeap () returned 0x580000 [0185.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa61c1d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x3a8fd28, dwReserved1=0x6dc79b8, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0185.535] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.583] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", len=0x4f | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned 1 [0185.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0185.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.899] CloseHandle (hObject=0x478) returned 1 [0186.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CREATE~1.YOU")) returned 0x5b96b0 [0186.900] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.900] GetProcessHeap () returned 0x580000 [0186.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2981) returned 0x70075b8 [0186.900] GetProcessHeap () returned 0x580000 [0186.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2981) returned 0x7009f48 [0186.901] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.901] ReadFile (in: hFile=0x478, lpBuffer=0x70075b8, nNumberOfBytesToRead=0x2960, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70075b8*, lpNumberOfBytesRead=0x3a8ff14*=0x2960, lpOverlapped=0x0) returned 1 [0186.936] GetProcessHeap () returned 0x580000 [0186.936] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf930 [0186.936] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.936] WriteFile (in: hFile=0x478, lpBuffer=0x7009f48*, nNumberOfBytesToWrite=0x2960, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7009f48*, lpNumberOfBytesWritten=0x3a8ff14*=0x2960, lpOverlapped=0x0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x478, lpBuffer=0x700c8a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x700c8a7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.937] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.937] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.937] CloseHandle (hObject=0x478) returned 1 [0187.722] GetProcessHeap () returned 0x580000 [0187.723] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7009f48 | out: hHeap=0x580000) returned 1 [0187.723] GetProcessHeap () returned 0x580000 [0187.723] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70075b8 | out: hHeap=0x580000) returned 1 [0187.723] GetProcessHeap () returned 0x580000 [0187.723] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf930 | out: hHeap=0x580000) returned 1 [0188.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7812b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x298f, dwReserved0=0x3a8fd28, dwReserved1=0x70075b8, cFileName="CreateSpaceImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CREATE~1.YOU")) returned 0x5b9770 [0188.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.066] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", len=0x75 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 1 [0188.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x209c) returned 0x6f14048 [0188.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0188.121] CloseHandle (hObject=0x428) returned 1 [0188.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x750053, dwReserved1=0x700070, cFileName="Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CUSTOM~1.YOU")) returned 0x5b9770 [0188.122] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0188.123] GetProcessHeap () returned 0x580000 [0188.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0188.123] GetProcessHeap () returned 0x580000 [0188.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0188.123] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.123] ReadFile (in: hFile=0x428, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.952] GetProcessHeap () returned 0x580000 [0190.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0190.952] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.952] WriteFile (in: hFile=0x428, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.952] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.952] WriteFile (in: hFile=0x428, lpBuffer=0x6fc4737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4737*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0190.953] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.953] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0190.953] CloseHandle (hObject=0x428) returned 1 [0190.953] GetProcessHeap () returned 0x580000 [0190.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0190.953] GetProcessHeap () returned 0x580000 [0190.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0190.953] GetProcessHeap () returned 0x580000 [0190.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa96de800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20242, dwReserved0=0x3a8fd28, dwReserved1=0x6d21878, cFileName="Customer Support.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CUSTOM~1.YOU")) returned 0x5b9770 [0193.194] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.270] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", len=0x65 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned 1 [0193.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2070) returned 0x6f14048 [0193.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.271] CloseHandle (hObject=0x4a4) returned 1 [0193.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.id_1622540890_.your_last_chance")) returned 1 [0193.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b9770 [0193.272] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.272] GetProcessHeap () returned 0x580000 [0193.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x635768 [0193.273] GetProcessHeap () returned 0x580000 [0193.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x6f668d8 [0193.273] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.273] ReadFile (in: hFile=0x4a4, lpBuffer=0x635768, nNumberOfBytesToRead=0xc60, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3a8ff14*=0xc60, lpOverlapped=0x0) returned 1 [0193.350] GetProcessHeap () returned 0x580000 [0193.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.350] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.350] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x3a8ff14*=0xc60, lpOverlapped=0x0) returned 1 [0193.350] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.350] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f67537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67537*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.350] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.350] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.350] CloseHandle (hObject=0x4a4) returned 1 [0193.350] GetProcessHeap () returned 0x580000 [0193.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0193.350] GetProcessHeap () returned 0x580000 [0193.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0193.351] GetProcessHeap () returned 0x580000 [0193.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaadc7bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xca0, dwReserved0=0x3a8fd28, dwReserved1=0x635768, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b97b0 [0193.351] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.422] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", len=0x63 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned 1 [0193.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0193.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.443] CloseHandle (hObject=0x4a4) returned 1 [0193.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.id_1622540890_.your_last_chance")) returned 1 [0193.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b97b0 [0193.444] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.445] GetProcessHeap () returned 0x580000 [0193.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0193.445] GetProcessHeap () returned 0x580000 [0193.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0193.445] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.445] ReadFile (in: hFile=0x4a4, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x3a8ff14*=0x160, lpOverlapped=0x0) returned 1 [0193.447] GetProcessHeap () returned 0x580000 [0193.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.447] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.447] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x3a8ff14*=0x160, lpOverlapped=0x0) returned 1 [0193.447] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.447] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f4f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.447] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.447] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.447] CloseHandle (hObject=0x4a4) returned 1 [0193.447] GetProcessHeap () returned 0x580000 [0193.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0193.448] GetProcessHeap () returned 0x580000 [0193.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0193.448] GetProcessHeap () returned 0x580000 [0193.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.737] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaeac400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x3a8fd28, dwReserved1=0x65f0b0, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b97f0 [0193.737] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.836] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", len=0x61 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned 1 [0193.836] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0193.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0193.837] CloseHandle (hObject=0x414) returned 1 [0193.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.id_1622540890_.your_last_chance")) returned 1 [0193.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b97f0 [0193.839] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0193.839] GetProcessHeap () returned 0x580000 [0193.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x6e32d50 [0193.839] GetProcessHeap () returned 0x580000 [0193.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x710e848 [0193.840] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.840] ReadFile (in: hFile=0x414, lpBuffer=0x6e32d50, nNumberOfBytesToRead=0x7dc0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesRead=0x3a8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0195.974] GetProcessHeap () returned 0x580000 [0195.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.975] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.975] WriteFile (in: hFile=0x414, lpBuffer=0x710e848*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x710e848*, lpNumberOfBytesWritten=0x3a8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0195.975] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.975] WriteFile (in: hFile=0x414, lpBuffer=0x7116607*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7116607*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.975] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.975] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.975] CloseHandle (hObject=0x414) returned 1 [0195.975] GetProcessHeap () returned 0x580000 [0195.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710e848 | out: hHeap=0x580000) returned 1 [0195.975] GetProcessHeap () returned 0x580000 [0195.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0195.975] GetProcessHeap () returned 0x580000 [0195.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac6c62c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7df7, dwReserved0=0x3a8fd28, dwReserved1=0x6e32d50, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b97f0 [0198.014] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.076] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", len=0x44 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF") returned 1 [0198.076] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0198.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0199.657] CloseHandle (hObject=0x438) returned 1 [0199.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.id_1622540890_.your_last_chance")) returned 1 [0199.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1349, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR46~2.YOU")) returned 0x5b96b0 [0199.658] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0199.658] GetProcessHeap () returned 0x580000 [0199.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1361) returned 0x67ec60 [0199.658] GetProcessHeap () returned 0x580000 [0199.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1361) returned 0x6e0c8f0 [0199.658] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.659] ReadFile (in: hFile=0x438, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1340, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x3a8ff14*=0x1340, lpOverlapped=0x0) returned 1 [0199.676] GetProcessHeap () returned 0x580000 [0199.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0199.676] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.676] WriteFile (in: hFile=0x438, lpBuffer=0x6e0c8f0*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c8f0*, lpNumberOfBytesWritten=0x3a8ff14*=0x1340, lpOverlapped=0x0) returned 1 [0199.676] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.676] WriteFile (in: hFile=0x438, lpBuffer=0x6e0dc2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0dc2f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.676] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.676] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.676] CloseHandle (hObject=0x438) returned 1 [0199.677] GetProcessHeap () returned 0x580000 [0199.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c8f0 | out: hHeap=0x580000) returned 1 [0199.677] GetProcessHeap () returned 0x580000 [0199.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0199.677] GetProcessHeap () returned 0x580000 [0199.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0200.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaea088a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x136d, dwReserved0=0x3a8fd28, dwReserved1=0x67ec60, cFileName="PDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR46~2.YOU")) returned 0x5b9770 [0200.953] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.960] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", len=0x66 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned 1 [0200.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc4) returned 0x6f14048 [0200.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.647] CloseHandle (hObject=0x480) returned 1 [0201.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.id_1622540890_.your_last_chance")) returned 1 [0201.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1313, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b97b0 [0201.648] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.648] GetProcessHeap () returned 0x580000 [0201.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6c9a390 [0201.648] GetProcessHeap () returned 0x580000 [0201.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6c9b798 [0201.648] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.648] ReadFile (in: hFile=0x480, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1300, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x3a8ff14*=0x1300, lpOverlapped=0x0) returned 1 [0201.666] GetProcessHeap () returned 0x580000 [0201.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.666] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.666] WriteFile (in: hFile=0x480, lpBuffer=0x6c9b798*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b798*, lpNumberOfBytesWritten=0x3a8ff14*=0x1300, lpOverlapped=0x0) returned 1 [0201.667] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x480, lpBuffer=0x6c9ca97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9ca97*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.667] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.667] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.667] CloseHandle (hObject=0x480) returned 1 [0201.667] GetProcessHeap () returned 0x580000 [0201.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b798 | out: hHeap=0x580000) returned 1 [0201.667] GetProcessHeap () returned 0x580000 [0201.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0201.667] GetProcessHeap () returned 0x580000 [0201.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd138a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1337, dwReserved0=0x3a8fd28, dwReserved1=0x6c9a390, cFileName="FormsViewFrame.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~2.YOU")) returned 0x5b9770 [0202.458] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.490] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS", len=0x45 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS") returned 1 [0202.491] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee8) returned 0x6f14048 [0202.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0202.535] CloseHandle (hObject=0x49c) returned 1 [0202.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css.id_1622540890_.your_last_chance")) returned 1 [0202.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad35f00, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad35f00, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x205bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC4887~1.YOU")) returned 0x5b9770 [0202.537] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0202.537] GetProcessHeap () returned 0x580000 [0202.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e55db0 [0202.538] GetProcessHeap () returned 0x580000 [0202.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e675e0 [0202.539] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.539] ReadFile (in: hFile=0x49c, lpBuffer=0x6e55db0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55db0*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.897] GetProcessHeap () returned 0x580000 [0208.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.897] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.897] WriteFile (in: hFile=0x49c, lpBuffer=0x6e675e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.898] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.898] WriteFile (in: hFile=0x49c, lpBuffer=0x6e78ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78ddf*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.898] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.898] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.898] CloseHandle (hObject=0x49c) returned 1 [0208.898] GetProcessHeap () returned 0x580000 [0208.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e675e0 | out: hHeap=0x580000) returned 1 [0208.898] GetProcessHeap () returned 0x580000 [0208.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e55db0 | out: hHeap=0x580000) returned 1 [0209.935] GetProcessHeap () returned 0x580000 [0209.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad35f00, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb41f5540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x205e0, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SCHEME37.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC4887~1.YOU")) returned 0x5b97b0 [0210.153] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.476] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS", len=0x45 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS") returned 1 [0210.476] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0210.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0210.617] CloseHandle (hObject=0x41c) returned 1 [0210.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css.id_1622540890_.your_last_chance")) returned 1 [0210.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dc1200, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20dc1200, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e09a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC648F~1.YOU")) returned 0x5b9830 [0210.618] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0210.618] GetProcessHeap () returned 0x580000 [0210.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0210.618] GetProcessHeap () returned 0x580000 [0210.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e44580 [0210.619] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.619] ReadFile (in: hFile=0x41c, lpBuffer=0x6fe77c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.150] GetProcessHeap () returned 0x580000 [0214.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0214.150] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.150] WriteFile (in: hFile=0x41c, lpBuffer=0x6e44580*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.151] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.151] WriteFile (in: hFile=0x41c, lpBuffer=0x6e55d7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55d7f*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.151] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.151] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.151] CloseHandle (hObject=0x41c) returned 1 [0214.151] GetProcessHeap () returned 0x580000 [0214.151] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e44580 | out: hHeap=0x580000) returned 1 [0214.263] GetProcessHeap () returned 0x580000 [0214.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0214.264] GetProcessHeap () returned 0x580000 [0214.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0215.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dc1200, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb74184a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e0be, dwReserved0=0x3a8fd28, dwReserved1=0x6fe77c8, cFileName="SCHEME12.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC648F~1.YOU")) returned 0x5b97b0 [0215.047] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.091] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD", len=0x3c | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 1 [0215.091] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0215.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0215.092] CloseHandle (hObject=0x4ac) returned 1 [0215.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id_1622540890_.your_last_chance")) returned 1 [0215.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~3.YOU")) returned 0x5b97b0 [0215.093] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0215.093] GetProcessHeap () returned 0x580000 [0215.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0215.098] GetProcessHeap () returned 0x580000 [0215.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0215.109] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.109] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x3a8ff14*=0x720, lpOverlapped=0x0) returned 1 [0215.174] GetProcessHeap () returned 0x580000 [0215.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.174] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.175] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x3a8ff14*=0x720, lpOverlapped=0x0) returned 1 [0215.175] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.175] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.175] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.175] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.175] CloseHandle (hObject=0x4ac) returned 1 [0215.175] GetProcessHeap () returned 0x580000 [0215.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0215.175] GetProcessHeap () returned 0x580000 [0215.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0215.175] GetProcessHeap () returned 0x580000 [0215.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb7de9f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x3a8fd28, dwReserved1=0x6c4e820, cFileName="NETWORK1.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~3.YOU")) returned 0x5b97b0 [0215.175] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.248] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", len=0x6d | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned 1 [0217.249] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0217.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.249] CloseHandle (hObject=0x4a4) returned 1 [0217.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.id_1622540890_.your_last_chance")) returned 1 [0217.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2e4800, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x5c9, dwReserved0=0x6d0074, dwReserved1=0x2e006c, cFileName="FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0217.251] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.251] GetProcessHeap () returned 0x580000 [0217.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e1) returned 0x6f04558 [0217.251] GetProcessHeap () returned 0x580000 [0217.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e1) returned 0x6d045f8 [0217.251] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.251] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x3a8ff14*=0x5c0, lpOverlapped=0x0) returned 1 [0217.344] GetProcessHeap () returned 0x580000 [0217.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.344] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.344] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x3a8ff14*=0x5c0, lpOverlapped=0x0) returned 1 [0217.344] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.344] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d04bb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04bb7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.344] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.344] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.345] CloseHandle (hObject=0x4a4) returned 1 [0217.345] GetProcessHeap () returned 0x580000 [0217.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0217.345] GetProcessHeap () returned 0x580000 [0217.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0217.345] GetProcessHeap () returned 0x580000 [0217.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9297e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ed, dwReserved0=0x3a8fd28, dwReserved1=0x6f04558, cFileName="FormsPrintTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0217.345] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.403] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", len=0x66 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned 1 [0217.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0217.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.434] CloseHandle (hObject=0x414) returned 1 [0217.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.id_1622540890_.your_last_chance")) returned 1 [0217.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9770 [0217.435] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.436] GetProcessHeap () returned 0x580000 [0217.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0217.436] GetProcessHeap () returned 0x580000 [0217.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0217.436] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.436] ReadFile (in: hFile=0x414, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x3a8ff14*=0x420, lpOverlapped=0x0) returned 1 [0217.441] GetProcessHeap () returned 0x580000 [0217.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.441] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.441] WriteFile (in: hFile=0x414, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x3a8ff14*=0x420, lpOverlapped=0x0) returned 1 [0217.441] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.441] WriteFile (in: hFile=0x414, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.441] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.441] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.441] CloseHandle (hObject=0x414) returned 1 [0217.441] GetProcessHeap () returned 0x580000 [0217.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0217.441] GetProcessHeap () returned 0x580000 [0217.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0217.442] GetProcessHeap () returned 0x580000 [0217.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb937c6c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x3a8fd28, dwReserved1=0x5d09a0, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9770 [0221.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.078] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned 1 [0221.079] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0221.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.079] CloseHandle (hObject=0x47c) returned 1 [0221.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.id_1622540890_.your_last_chance")) returned 1 [0221.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~2.YOU")) returned 0x5b9770 [0221.080] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.081] GetProcessHeap () returned 0x580000 [0221.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a110 [0221.081] GetProcessHeap () returned 0x580000 [0221.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a558 [0221.081] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.081] ReadFile (in: hFile=0x47c, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x3a8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0221.093] GetProcessHeap () returned 0x580000 [0221.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.093] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.093] WriteFile (in: hFile=0x47c, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x3a8ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0221.093] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.093] WriteFile (in: hFile=0x47c, lpBuffer=0x6c6a937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a937*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.093] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.093] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.093] CloseHandle (hObject=0x47c) returned 1 [0221.093] GetProcessHeap () returned 0x580000 [0221.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0221.093] GetProcessHeap () returned 0x580000 [0221.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0221.093] GetProcessHeap () returned 0x580000 [0221.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb64c880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x3a8fd28, dwReserved1=0x6c6a110, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~2.YOU")) returned 0x5b9770 [0221.094] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.099] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", len=0x65 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned 1 [0221.100] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0221.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.104] CloseHandle (hObject=0x440) returned 1 [0222.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.id_1622540890_.your_last_chance")) returned 1 [0222.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b9730 [0222.105] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0222.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.105] GetProcessHeap () returned 0x580000 [0222.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0222.106] GetProcessHeap () returned 0x580000 [0222.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0222.106] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.106] ReadFile (in: hFile=0x440, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x3a8ff14*=0x340, lpOverlapped=0x0) returned 1 [0222.110] GetProcessHeap () returned 0x580000 [0222.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.110] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.110] WriteFile (in: hFile=0x440, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x3a8ff14*=0x340, lpOverlapped=0x0) returned 1 [0222.110] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.110] WriteFile (in: hFile=0x440, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.110] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.110] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.110] CloseHandle (hObject=0x440) returned 1 [0222.110] GetProcessHeap () returned 0x580000 [0222.110] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0222.110] GetProcessHeap () returned 0x580000 [0222.110] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0222.110] GetProcessHeap () returned 0x580000 [0222.110] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0223.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbff81e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x3a8fd28, dwReserved1=0x6dcfb90, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b96f0 [0223.596] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.648] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", len=0x5e | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned 1 [0223.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0223.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.649] CloseHandle (hObject=0x47c) returned 1 [0223.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.id_1622540890_.your_last_chance")) returned 1 [0223.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~2.YOU")) returned 0x5b9630 [0223.650] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.650] GetProcessHeap () returned 0x580000 [0223.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0223.650] GetProcessHeap () returned 0x580000 [0223.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0223.651] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.652] ReadFile (in: hFile=0x47c, lpBuffer=0x72d6838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0229.568] GetProcessHeap () returned 0x580000 [0229.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0229.569] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.569] WriteFile (in: hFile=0x47c, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0229.569] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.569] WriteFile (in: hFile=0x47c, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0229.570] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.570] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0229.570] CloseHandle (hObject=0x47c) returned 1 [0229.570] GetProcessHeap () returned 0x580000 [0229.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0229.576] GetProcessHeap () returned 0x580000 [0229.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0229.576] GetProcessHeap () returned 0x580000 [0229.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0598560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b899, dwReserved0=0x3a8fd28, dwReserved1=0x72d6838, cFileName="StarterNotificationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~2.YOU")) returned 0x5b9630 [0230.856] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.948] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", len=0x3b | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 1 [0230.948] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0230.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0230.949] CloseHandle (hObject=0x268) returned 1 [0230.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.949] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.id_1622540890_.your_last_chance")) returned 1 [0230.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~1.YOU")) returned 0x5b9630 [0230.950] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0230.950] GetProcessHeap () returned 0x580000 [0230.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x677cd0 [0230.950] GetProcessHeap () returned 0x580000 [0230.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x635768 [0230.950] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.950] ReadFile (in: hFile=0x268, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x3a8ff14*=0xc00, lpOverlapped=0x0) returned 1 [0231.016] GetProcessHeap () returned 0x580000 [0231.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.016] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x268, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x3a8ff14*=0xc00, lpOverlapped=0x0) returned 1 [0231.016] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x268, lpBuffer=0x636367*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636367*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0231.016] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.016] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0231.016] CloseHandle (hObject=0x268) returned 1 [0231.017] GetProcessHeap () returned 0x580000 [0231.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0231.017] GetProcessHeap () returned 0x580000 [0231.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0231.017] GetProcessHeap () returned 0x580000 [0231.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc136e540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x3a8fd28, dwReserved1=0x677cd0, cFileName="mscss7wre_fr.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~1.YOU")) returned 0x5b9630 [0231.017] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.099] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", len=0x3a | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 1 [0231.099] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0231.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0231.100] CloseHandle (hObject=0x3b4) returned 1 [0231.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.id_1622540890_.your_last_chance")) returned 1 [0231.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~4.YOU")) returned 0x5b9630 [0231.101] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0231.101] GetProcessHeap () returned 0x580000 [0231.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0231.101] GetProcessHeap () returned 0x580000 [0231.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0231.101] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.102] ReadFile (in: hFile=0x3b4, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x3a8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0231.112] GetProcessHeap () returned 0x580000 [0231.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.112] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.112] WriteFile (in: hFile=0x3b4, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x3a8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0231.112] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.112] WriteFile (in: hFile=0x3b4, lpBuffer=0x62f717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f717*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0231.112] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.112] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0231.113] CloseHandle (hObject=0x3b4) returned 1 [0231.113] GetProcessHeap () returned 0x580000 [0231.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0231.113] GetProcessHeap () returned 0x580000 [0231.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0231.113] GetProcessHeap () returned 0x580000 [0231.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc1452d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x3a8fd28, dwReserved1=0x6c676b8, cFileName="mscss7cm_es.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~4.YOU")) returned 0x5b9630 [0231.113] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.116] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", len=0x3a | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 1 [0231.117] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0231.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0231.117] CloseHandle (hObject=0x3b4) returned 1 [0231.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.id_1622540890_.your_last_chance")) returned 1 [0231.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS69F1~1.YOU")) returned 0x5b9630 [0231.119] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0231.119] GetProcessHeap () returned 0x580000 [0231.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6ce54c0 [0231.119] GetProcessHeap () returned 0x580000 [0231.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6ce6348 [0231.119] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.119] ReadFile (in: hFile=0x3b4, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x3a8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0233.186] GetProcessHeap () returned 0x580000 [0233.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0233.186] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.186] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ce6348*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6348*, lpNumberOfBytesWritten=0x3a8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0233.186] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.186] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ce7147*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce7147*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.186] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.187] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.187] CloseHandle (hObject=0x3b4) returned 1 [0233.187] GetProcessHeap () returned 0x580000 [0233.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce6348 | out: hHeap=0x580000) returned 1 [0233.187] GetProcessHeap () returned 0x580000 [0233.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0233.187] GetProcessHeap () returned 0x580000 [0233.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0233.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc281c460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe24, dwReserved0=0x3a8fd28, dwReserved1=0x6ce54c0, cFileName="mscss7cm_en.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS69F1~1.YOU")) returned 0x5b9630 [0233.187] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0235.046] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", len=0x36 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 1 [0235.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0235.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0239.570] CloseHandle (hObject=0x268) returned 1 [0239.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.id_1622540890_.your_last_chance")) returned 1 [0239.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MLCFG3~1.YOU")) returned 0x5b96f0 [0239.572] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0239.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mlcfg32.cpl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0239.572] GetProcessHeap () returned 0x580000 [0239.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead008 [0239.573] GetProcessHeap () returned 0x580000 [0239.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0239.573] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.573] ReadFile (in: hFile=0x268, lpBuffer=0x6ead008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead008*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.907] GetProcessHeap () returned 0x580000 [0242.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0242.908] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.908] WriteFile (in: hFile=0x268, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.908] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.908] WriteFile (in: hFile=0x268, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0242.908] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.908] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0242.909] CloseHandle (hObject=0x268) returned 1 [0242.909] GetProcessHeap () returned 0x580000 [0242.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0242.909] GetProcessHeap () returned 0x580000 [0242.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead008 | out: hHeap=0x580000) returned 1 [0242.909] GetProcessHeap () returned 0x580000 [0242.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0242.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc84f1e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x125ac, dwReserved0=0x3a8fd28, dwReserved1=0x6ead008, cFileName="MLCFG32.CPL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MLCFG3~1.YOU")) returned 0x5b9630 [0242.909] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0245.397] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML", len=0x40 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned 1 [0245.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0245.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0248.478] CloseHandle (hObject=0x268) returned 1 [0248.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml.id_1622540890_.your_last_chance")) returned 1 [0248.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG8055~1.YOU")) returned 0x5b96f0 [0248.479] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0248.480] GetProcessHeap () returned 0x580000 [0248.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb541) returned 0x6eb4f78 [0248.480] GetProcessHeap () returned 0x580000 [0248.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb541) returned 0x6f976f8 [0248.480] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.481] ReadFile (in: hFile=0x268, lpBuffer=0x6eb4f78, nNumberOfBytesToRead=0xb520, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb4f78*, lpNumberOfBytesRead=0x3a8ff14*=0xb520, lpOverlapped=0x0) returned 1 [0251.255] GetProcessHeap () returned 0x580000 [0251.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0251.255] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.255] WriteFile (in: hFile=0x268, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0xb520, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x3a8ff14*=0xb520, lpOverlapped=0x0) returned 1 [0251.255] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.256] WriteFile (in: hFile=0x268, lpBuffer=0x6fa2c17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa2c17*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0251.256] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0251.256] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0251.256] CloseHandle (hObject=0x268) returned 1 [0251.256] GetProcessHeap () returned 0x580000 [0251.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0251.256] GetProcessHeap () returned 0x580000 [0251.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb4f78 | out: hHeap=0x580000) returned 1 [0251.256] GetProcessHeap () returned 0x580000 [0251.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd489e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb556, dwReserved0=0x3a8fd28, dwReserved1=0x6eb4f78, cFileName="PGLBL089.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG8055~1.YOU")) returned 0x5b9730 [0254.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.295] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV", len=0x3e | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 1 [0255.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f94) returned 0x72e5948 [0255.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.880] CloseHandle (hObject=0x4a8) returned 1 [0258.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaad500, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aaad500, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBB~2.YOU")) returned 0x5b96f0 [0258.882] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.882] GetProcessHeap () returned 0x580000 [0258.882] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2821) returned 0x706acd8 [0258.882] GetProcessHeap () returned 0x580000 [0258.882] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2821) returned 0x6d748d8 [0258.882] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.882] ReadFile (in: hFile=0x4a8, lpBuffer=0x706acd8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x706acd8*, lpNumberOfBytesRead=0x3a8ff14*=0x2800, lpOverlapped=0x0) returned 1 [0260.960] GetProcessHeap () returned 0x580000 [0260.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.960] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.960] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x3a8ff14*=0x2800, lpOverlapped=0x0) returned 1 [0260.960] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.960] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d770d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d770d7*, lpNumberOfBytesWritten=0x3a8ff14*=0x20, lpOverlapped=0x0) returned 1 [0260.960] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.960] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3a8ff14*=0x4, lpOverlapped=0x0) returned 1 [0260.961] CloseHandle (hObject=0x4a8) returned 1 [0260.961] GetProcessHeap () returned 0x580000 [0260.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0260.961] GetProcessHeap () returned 0x580000 [0260.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706acd8 | out: hHeap=0x580000) returned 1 [0260.961] GetProcessHeap () returned 0x580000 [0260.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fccc | out: lpFindFileData=0x3a8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaad500, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3113540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2824, dwReserved0=0x3a8fd28, dwReserved1=0x706acd8, cFileName="DGWEBBTN.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBB~2.YOU")) returned 0x5b9630 [0260.961] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.736] SysReAllocStringLen (in: pbstr=0x3a8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV", len=0x37 | out: pbstr=0x3a8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV") returned 1 [0262.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2064) returned 0x72e5948 [0262.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0264.707] CloseHandle (hObject=0x44c) returned 1 [0264.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0264.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.id_1622540890_.your_last_chance")) returned 1 [0264.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3a8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0264.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3a8fc74 | out: lpFindFileData=0x3a8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1a900, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMINDER.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMIND~1.YOU")) returned 0x5b96f0 [0264.708] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0264.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\reminder.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0264.709] GetProcessHeap () returned 0x580000 [0264.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74ff6a8 [0264.709] GetProcessHeap () returned 0x580000 [0264.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7510ed8 [0264.710] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.710] ReadFile (in: hFile=0x44c, lpBuffer=0x74ff6a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3a8ff14, lpOverlapped=0x0 | out: lpBuffer=0x74ff6a8*, lpNumberOfBytesRead=0x3a8ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 24 os_tid = 0xa58 [0039.062] Sleep (dwMilliseconds=0x1) [0039.087] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.408] Sleep (dwMilliseconds=0x1) [0039.574] Sleep (dwMilliseconds=0x1) [0039.610] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.288] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.592] Sleep (dwMilliseconds=0x1) [0042.311] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.465] Sleep (dwMilliseconds=0x1) [0042.508] Sleep (dwMilliseconds=0x1) [0042.545] Sleep (dwMilliseconds=0x1) [0042.643] Sleep (dwMilliseconds=0x1) [0042.656] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.828] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.922] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.027] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.416] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.556] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.681] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.821] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.899] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.024] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.586] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.007] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.163] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.319] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.413] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.538] Sleep (dwMilliseconds=0x1) [0046.553] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.756] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.932] Sleep (dwMilliseconds=0x1) [0046.943] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.989] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.036] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.691] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.925] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.972] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.237] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.440] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.596] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.830] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.861] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.017] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.173] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.844] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.156] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.192] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.421] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.478] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.577] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.733] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.846] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.957] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.482] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.669] Sleep (dwMilliseconds=0x1) [0051.698] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.734] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.781] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.859] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.890] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.937] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.015] Sleep (dwMilliseconds=0x1) [0052.030] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.062] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.140] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.171] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.265] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.327] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.405] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.501] Sleep (dwMilliseconds=0x1) [0052.514] Sleep (dwMilliseconds=0x1) [0052.530] Sleep (dwMilliseconds=0x1) [0052.552] Sleep (dwMilliseconds=0x1) [0052.561] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.670] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.717] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.827] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] Sleep (dwMilliseconds=0x1) [0052.889] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.951] Sleep (dwMilliseconds=0x1) [0052.966] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.138] Sleep (dwMilliseconds=0x1) [0053.154] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.185] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.294] Sleep (dwMilliseconds=0x1) [0053.310] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.341] Sleep (dwMilliseconds=0x1) [0053.365] Sleep (dwMilliseconds=0x1) [0053.372] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.418] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.497] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.731] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.809] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.980] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.090] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.479] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.511] Sleep (dwMilliseconds=0x1) [0054.527] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.636] Sleep (dwMilliseconds=0x1) [0054.652] Sleep (dwMilliseconds=0x1) [0054.667] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.714] Sleep (dwMilliseconds=0x1) [0054.730] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.823] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.979] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.025] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.057] Sleep (dwMilliseconds=0x1) [0055.073] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.104] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.150] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.182] Sleep (dwMilliseconds=0x1) [0055.202] Sleep (dwMilliseconds=0x1) [0055.213] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.259] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] Sleep (dwMilliseconds=0x1) [0055.338] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.369] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.415] Sleep (dwMilliseconds=0x1) [0055.433] Sleep (dwMilliseconds=0x1) [0055.447] Sleep (dwMilliseconds=0x1) [0055.462] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.494] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.746] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", len=0x4c | out: pbstr=0x3bcff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 1 [0061.747] GetProcessHeap () returned 0x580000 [0061.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x6c) returned 0x5b5bc8 [0061.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0070.282] CloseHandle (hObject=0x490) returned 1 [0070.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.282] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id_1622540890_.your_last_chance")) returned 1 [0074.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.820] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~2.YOU")) returned 0x5b96f0 [0076.629] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.629] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0076.629] GetProcessHeap () returned 0x580000 [0076.629] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f6a940 [0076.631] GetProcessHeap () returned 0x580000 [0076.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f7c170 [0076.631] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.631] ReadFile (in: hFile=0x498, lpBuffer=0x6f6a940, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a940*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.248] GetProcessHeap () returned 0x580000 [0079.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0079.781] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.781] WriteFile (in: hFile=0x498, lpBuffer=0x6f7c170*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f7c170*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.782] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.782] WriteFile (in: hFile=0x498, lpBuffer=0x6f8d96f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d96f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0079.972] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.972] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0079.972] CloseHandle (hObject=0x498) returned 1 [0079.972] GetProcessHeap () returned 0x580000 [0079.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f7c170 | out: hHeap=0x580000) returned 1 [0079.972] GetProcessHeap () returned 0x580000 [0079.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a940 | out: hHeap=0x580000) returned 1 [0079.972] GetProcessHeap () returned 0x580000 [0079.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0079.972] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0x6747f240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa4c424, dwReserved0=0x3bcfd28, dwReserved1=0x6f6a940, cFileName="PrjProrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRJPRO~2.YOU")) returned 0x5b9730 [0079.973] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.817] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", len=0x64 | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 1 [0080.818] GetProcessHeap () returned 0x580000 [0080.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0080.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0081.995] CloseHandle (hObject=0x478) returned 1 [0081.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id_1622540890_.your_last_chance")) returned 1 [0081.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCTCHM~1.YOU")) returned 0x5b96f0 [0081.996] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0081.997] GetProcessHeap () returned 0x580000 [0081.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11661) returned 0x6c67798 [0081.997] GetProcessHeap () returned 0x580000 [0081.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11661) returned 0x6ce54a8 [0081.997] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.997] ReadFile (in: hFile=0x478, lpBuffer=0x6c67798, nNumberOfBytesToRead=0x11640, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67798*, lpNumberOfBytesRead=0x3bcff14*=0x11640, lpOverlapped=0x0) returned 1 [0083.441] GetProcessHeap () returned 0x580000 [0083.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.441] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.441] WriteFile (in: hFile=0x478, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11640, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x3bcff14*=0x11640, lpOverlapped=0x0) returned 1 [0083.441] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.442] WriteFile (in: hFile=0x478, lpBuffer=0x6cf6ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ae7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0083.442] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.442] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0083.442] CloseHandle (hObject=0x478) returned 1 [0083.442] GetProcessHeap () returned 0x580000 [0083.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0083.443] GetProcessHeap () returned 0x580000 [0083.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c67798 | out: hHeap=0x580000) returned 1 [0083.444] GetProcessHeap () returned 0x580000 [0083.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x69586380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11668, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="OCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCTCHM~1.YOU")) returned 0x5b96f0 [0083.444] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.240] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 1 [0088.240] GetProcessHeap () returned 0x580000 [0088.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0088.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0088.373] CloseHandle (hObject=0x410) returned 1 [0088.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x771a1ecd, dwReserved1=0x3769b7, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.374] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0088.374] GetProcessHeap () returned 0x580000 [0088.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6c79138 [0088.374] GetProcessHeap () returned 0x580000 [0088.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6c796a8 [0088.374] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.374] ReadFile (in: hFile=0x410, lpBuffer=0x6c79138, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79138*, lpNumberOfBytesRead=0x3bcff14*=0x540, lpOverlapped=0x0) returned 1 [0088.380] GetProcessHeap () returned 0x580000 [0088.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.380] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.380] WriteFile (in: hFile=0x410, lpBuffer=0x6c796a8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c796a8*, lpNumberOfBytesWritten=0x3bcff14*=0x540, lpOverlapped=0x0) returned 1 [0088.381] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.381] WriteFile (in: hFile=0x410, lpBuffer=0x6c79be7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79be7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0088.381] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.381] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0088.381] CloseHandle (hObject=0x410) returned 1 [0088.381] GetProcessHeap () returned 0x580000 [0088.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c796a8 | out: hHeap=0x580000) returned 1 [0088.381] GetProcessHeap () returned 0x580000 [0088.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79138 | out: hHeap=0x580000) returned 1 [0088.381] GetProcessHeap () returned 0x580000 [0088.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c4af760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x577, dwReserved0=0x3bcfd28, dwReserved1=0x6c79138, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.381] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.635] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 1 [0091.635] GetProcessHeap () returned 0x580000 [0091.635] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0091.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0091.635] CloseHandle (hObject=0x408) returned 1 [0091.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0091.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.638] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0091.638] GetProcessHeap () returned 0x580000 [0091.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6221) returned 0x673cd0 [0091.638] GetProcessHeap () returned 0x580000 [0091.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6221) returned 0x6f10048 [0091.638] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.638] ReadFile (in: hFile=0x408, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x6200, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x3bcff14*=0x6200, lpOverlapped=0x0) returned 1 [0093.773] GetProcessHeap () returned 0x580000 [0093.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.774] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.774] WriteFile (in: hFile=0x408, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x6200, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x3bcff14*=0x6200, lpOverlapped=0x0) returned 1 [0093.774] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.774] WriteFile (in: hFile=0x408, lpBuffer=0x6f16247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f16247*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0093.774] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.774] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0093.774] CloseHandle (hObject=0x408) returned 1 [0093.775] GetProcessHeap () returned 0x580000 [0093.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0093.775] GetProcessHeap () returned 0x580000 [0093.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0093.775] GetProcessHeap () returned 0x580000 [0093.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f829320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6236, dwReserved0=0x3bcfd28, dwReserved1=0x673cd0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0094.349] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.430] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", len=0x49 | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 1 [0094.430] GetProcessHeap () returned 0x580000 [0094.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0094.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.440] CloseHandle (hObject=0x41c) returned 1 [0094.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0094.441] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.441] GetProcessHeap () returned 0x580000 [0094.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x67b9e0 [0094.441] GetProcessHeap () returned 0x580000 [0094.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6e25480 [0094.441] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.441] ReadFile (in: hFile=0x41c, lpBuffer=0x67b9e0, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x67b9e0*, lpNumberOfBytesRead=0x3bcff14*=0xe00, lpOverlapped=0x0) returned 1 [0094.536] GetProcessHeap () returned 0x580000 [0094.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.536] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.536] WriteFile (in: hFile=0x41c, lpBuffer=0x6e25480*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e25480*, lpNumberOfBytesWritten=0x3bcff14*=0xe00, lpOverlapped=0x0) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.536] WriteFile (in: hFile=0x41c, lpBuffer=0x6e2627f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2627f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0094.536] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.536] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0094.537] CloseHandle (hObject=0x41c) returned 1 [0094.537] GetProcessHeap () returned 0x580000 [0094.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e25480 | out: hHeap=0x580000) returned 1 [0094.537] GetProcessHeap () returned 0x580000 [0094.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67b9e0 | out: hHeap=0x580000) returned 1 [0094.537] GetProcessHeap () returned 0x580000 [0094.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ff73680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3f, dwReserved0=0x3bcfd28, dwReserved1=0x67b9e0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0094.537] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.614] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", len=0x4a | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 1 [0094.615] GetProcessHeap () returned 0x580000 [0094.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x38) returned 0x5b96b0 [0094.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.615] CloseHandle (hObject=0x41c) returned 1 [0094.615] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0094.616] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.616] GetProcessHeap () returned 0x580000 [0094.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x652020 [0094.616] GetProcessHeap () returned 0x580000 [0094.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x67b9e0 [0094.616] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.616] ReadFile (in: hFile=0x41c, lpBuffer=0x652020, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x652020*, lpNumberOfBytesRead=0x3bcff14*=0xa20, lpOverlapped=0x0) returned 1 [0094.627] GetProcessHeap () returned 0x580000 [0094.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.627] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.628] WriteFile (in: hFile=0x41c, lpBuffer=0x67b9e0*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x67b9e0*, lpNumberOfBytesWritten=0x3bcff14*=0xa20, lpOverlapped=0x0) returned 1 [0094.628] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.628] WriteFile (in: hFile=0x41c, lpBuffer=0x67c3ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x67c3ff*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0094.628] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.628] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0094.628] CloseHandle (hObject=0x41c) returned 1 [0094.628] GetProcessHeap () returned 0x580000 [0094.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67b9e0 | out: hHeap=0x580000) returned 1 [0094.628] GetProcessHeap () returned 0x580000 [0094.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x652020 | out: hHeap=0x580000) returned 1 [0094.628] GetProcessHeap () returned 0x580000 [0094.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70031d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa50, dwReserved0=0x3bcfd28, dwReserved1=0x652020, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0094.628] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.630] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", len=0x4d | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 1 [0094.631] GetProcessHeap () returned 0x580000 [0094.631] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f6c0 [0094.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.631] CloseHandle (hObject=0x41c) returned 1 [0094.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id_1622540890_.your_last_chance")) returned 1 [0094.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RICEPA~1.YOU")) returned 0x5b96f0 [0094.632] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.633] GetProcessHeap () returned 0x580000 [0094.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e5b9e0 [0094.633] GetProcessHeap () returned 0x580000 [0094.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e6d210 [0094.634] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.634] ReadFile (in: hFile=0x41c, lpBuffer=0x6e5b9e0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5b9e0*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0100.518] GetProcessHeap () returned 0x580000 [0100.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0100.519] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.519] WriteFile (in: hFile=0x41c, lpBuffer=0x6e6d210*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6d210*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0100.519] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.519] WriteFile (in: hFile=0x41c, lpBuffer=0x6e7ea0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7ea0f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0100.519] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.519] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0100.519] CloseHandle (hObject=0x41c) returned 1 [0100.520] GetProcessHeap () returned 0x580000 [0100.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e6d210 | out: hHeap=0x580000) returned 1 [0100.999] GetProcessHeap () returned 0x580000 [0100.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e5b9e0 | out: hHeap=0x580000) returned 1 [0101.000] GetProcessHeap () returned 0x580000 [0101.000] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0101.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7386e520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12082, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="RICEPAPR.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RICEPA~1.YOU")) returned 0x5b96b0 [0101.841] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.883] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", len=0x4d | out: pbstr=0x3bcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 1 [0106.883] GetProcessHeap () returned 0x580000 [0106.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0106.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0107.201] CloseHandle (hObject=0x424) returned 1 [0107.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id_1622540890_.your_last_chance")) returned 1 [0107.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXTFON~1.YOU")) returned 0x5b9630 [0107.202] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0107.202] GetProcessHeap () returned 0x580000 [0107.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ef2068 [0107.202] GetProcessHeap () returned 0x580000 [0107.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0107.203] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.203] ReadFile (in: hFile=0x424, lpBuffer=0x6ef2068, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2068*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.752] GetProcessHeap () returned 0x580000 [0110.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0110.752] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.752] WriteFile (in: hFile=0x424, lpBuffer=0x6c10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.752] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.753] WriteFile (in: hFile=0x424, lpBuffer=0x6c21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21847*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0111.319] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.319] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0111.319] CloseHandle (hObject=0x424) returned 1 [0111.319] GetProcessHeap () returned 0x580000 [0111.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0111.319] GetProcessHeap () returned 0x580000 [0111.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef2068 | out: hHeap=0x580000) returned 1 [0111.319] GetProcessHeap () returned 0x580000 [0111.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0111.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x79f61ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6aa0a, dwReserved0=0x3bcfd28, dwReserved1=0x6ef2068, cFileName="EXTFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXTFON~1.YOU")) returned 0x5b96f0 [0111.319] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.008] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", len=0x4c | out: pbstr=0x3bcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 1 [0112.008] GetProcessHeap () returned 0x580000 [0112.008] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.008] Sleep (dwMilliseconds=0x1) [0112.133] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", len=0x43 | out: pbstr=0x3bcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned 1 [0112.134] GetProcessHeap () returned 0x580000 [0112.134] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.140] Sleep (dwMilliseconds=0x1) [0112.265] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", len=0x4a | out: pbstr=0x3bcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned 1 [0112.265] GetProcessHeap () returned 0x580000 [0112.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.265] Sleep (dwMilliseconds=0x1) [0112.310] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", len=0x4c | out: pbstr=0x3bcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned 1 [0112.310] GetProcessHeap () returned 0x580000 [0112.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c562c0 [0112.310] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.310] Sleep (dwMilliseconds=0x1) [0113.335] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", len=0x3f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 1 [0113.335] GetProcessHeap () returned 0x580000 [0113.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x88) returned 0x6f0ceb8 [0113.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.477] CloseHandle (hObject=0x3f8) returned 1 [0113.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG015D~1.YOU")) returned 0x5b9630 [0114.336] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.336] GetProcessHeap () returned 0x580000 [0114.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x635768 [0114.336] GetProcessHeap () returned 0x580000 [0114.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x6d10048 [0114.336] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.336] ReadFile (in: hFile=0x3f8, lpBuffer=0x635768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3bcff14*=0xd20, lpOverlapped=0x0) returned 1 [0114.350] GetProcessHeap () returned 0x580000 [0114.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.350] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.350] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x3bcff14*=0xd20, lpOverlapped=0x0) returned 1 [0114.350] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.350] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d10d67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10d67*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0114.350] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.350] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0114.350] CloseHandle (hObject=0x3f8) returned 1 [0114.350] GetProcessHeap () returned 0x580000 [0114.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0114.350] GetProcessHeap () returned 0x580000 [0114.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.350] GetProcessHeap () returned 0x580000 [0114.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bc648c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd56, dwReserved0=0x3bcfd28, dwReserved1=0x635768, cFileName="AG00175_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG015D~1.YOU")) returned 0x5b9630 [0114.351] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0114.367] CloseHandle (hObject=0x424) returned 1 [0114.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.368] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NA0239~1.YOU")) returned 0x5b9630 [0114.368] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0114.368] GetProcessHeap () returned 0x580000 [0114.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6c779a8 [0114.369] GetProcessHeap () returned 0x580000 [0114.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6ef8668 [0114.369] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.369] ReadFile (in: hFile=0x424, lpBuffer=0x6c779a8, nNumberOfBytesToRead=0x1e80, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c779a8*, lpNumberOfBytesRead=0x3bcff14*=0x1e80, lpOverlapped=0x0) returned 1 [0114.397] GetProcessHeap () returned 0x580000 [0114.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.397] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.397] WriteFile (in: hFile=0x424, lpBuffer=0x6ef8668*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef8668*, lpNumberOfBytesWritten=0x3bcff14*=0x1e80, lpOverlapped=0x0) returned 1 [0114.397] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.397] WriteFile (in: hFile=0x424, lpBuffer=0x6efa4e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6efa4e7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0114.397] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.397] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0114.397] CloseHandle (hObject=0x424) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef8668 | out: hHeap=0x580000) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c779a8 | out: hHeap=0x580000) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bcb0b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ebc, dwReserved0=0x3bcfd28, dwReserved1=0x6c779a8, cFileName="NA02398_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NA0239~1.YOU")) returned 0x5b9630 [0117.325] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.468] CloseHandle (hObject=0x4a0) returned 1 [0118.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.469] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id_1622540890_.your_last_chance")) returned 1 [0118.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWEST_~1.YOU")) returned 0x5b9730 [0118.469] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.470] GetProcessHeap () returned 0x580000 [0118.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2141) returned 0x6c61108 [0118.470] GetProcessHeap () returned 0x580000 [0118.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2141) returned 0x6c63258 [0118.470] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.470] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c61108, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesRead=0x3bcff14*=0x2120, lpOverlapped=0x0) returned 1 [0118.508] GetProcessHeap () returned 0x580000 [0118.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.508] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.508] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c63258*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c63258*, lpNumberOfBytesWritten=0x3bcff14*=0x2120, lpOverlapped=0x0) returned 1 [0118.508] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.508] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c65377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65377*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0118.508] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.508] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0118.508] CloseHandle (hObject=0x4a0) returned 1 [0118.508] GetProcessHeap () returned 0x580000 [0118.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c63258 | out: hHeap=0x580000) returned 1 [0118.508] GetProcessHeap () returned 0x580000 [0118.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0118.508] GetProcessHeap () returned 0x580000 [0118.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3f7680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2159, dwReserved0=0x3bcfd28, dwReserved1=0x6c61108, cFileName="SWEST_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWEST_~1.YOU")) returned 0x5b96f0 [0120.124] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.150] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", len=0x4c | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 1 [0120.150] GetProcessHeap () returned 0x580000 [0120.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d0) returned 0x6d06ca8 [0120.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0121.435] CloseHandle (hObject=0x4a4) returned 1 [0121.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0209~1.YOU")) returned 0x5b9730 [0121.436] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0121.436] GetProcessHeap () returned 0x580000 [0121.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x626d30 [0121.436] GetProcessHeap () returned 0x580000 [0121.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6272f8 [0121.436] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.436] ReadFile (in: hFile=0x4a4, lpBuffer=0x626d30, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x3bcff14*=0x580, lpOverlapped=0x0) returned 1 [0121.442] GetProcessHeap () returned 0x580000 [0121.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.442] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.442] WriteFile (in: hFile=0x4a4, lpBuffer=0x6272f8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6272f8*, lpNumberOfBytesWritten=0x3bcff14*=0x580, lpOverlapped=0x0) returned 1 [0121.443] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.443] WriteFile (in: hFile=0x4a4, lpBuffer=0x627877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x627877*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0121.443] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.443] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0121.443] CloseHandle (hObject=0x4a4) returned 1 [0121.443] GetProcessHeap () returned 0x580000 [0121.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6272f8 | out: hHeap=0x580000) returned 1 [0121.443] GetProcessHeap () returned 0x580000 [0121.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0121.443] GetProcessHeap () returned 0x580000 [0121.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffef900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5a5, dwReserved0=0x3bcfd28, dwReserved1=0x626d30, cFileName="WB02097_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0209~1.YOU")) returned 0x5b9730 [0121.913] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.562] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", len=0x4b | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned 1 [0122.562] GetProcessHeap () returned 0x580000 [0122.562] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1950) returned 0x6f42f08 [0122.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0122.566] CloseHandle (hObject=0x460) returned 1 [0122.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.id_1622540890_.your_last_chance")) returned 1 [0122.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x45, dwReserved1=0x0, cFileName="Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0122.567] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0122.568] GetProcessHeap () returned 0x580000 [0122.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0122.568] GetProcessHeap () returned 0x580000 [0122.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6d10048 [0122.568] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.568] ReadFile (in: hFile=0x460, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3bcff14*=0xee0, lpOverlapped=0x0) returned 1 [0122.582] GetProcessHeap () returned 0x580000 [0122.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.583] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.583] WriteFile (in: hFile=0x460, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x3bcff14*=0xee0, lpOverlapped=0x0) returned 1 [0122.583] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.583] WriteFile (in: hFile=0x460, lpBuffer=0x6d10f27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10f27*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0122.583] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.583] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0122.583] CloseHandle (hObject=0x460) returned 1 [0122.583] GetProcessHeap () returned 0x580000 [0122.583] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0122.583] GetProcessHeap () returned 0x580000 [0122.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0122.584] GetProcessHeap () returned 0x580000 [0122.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0122.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80acbd60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf23, dwReserved0=0x3bcfd28, dwReserved1=0x6c29878, cFileName="Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0122.584] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.584] Sleep (dwMilliseconds=0x1) [0122.585] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", len=0x4c | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned 1 [0122.585] GetProcessHeap () returned 0x580000 [0122.585] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x194c) returned 0x6f42f08 [0122.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0122.586] CloseHandle (hObject=0x460) returned 1 [0122.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.id_1622540890_.your_last_chance")) returned 1 [0122.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0122.587] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0122.587] GetProcessHeap () returned 0x580000 [0122.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0122.587] GetProcessHeap () returned 0x580000 [0122.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0122.587] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.587] ReadFile (in: hFile=0x460, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x3bcff14*=0xe00, lpOverlapped=0x0) returned 1 [0122.601] GetProcessHeap () returned 0x580000 [0123.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0123.038] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.038] WriteFile (in: hFile=0x460, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x3bcff14*=0xe00, lpOverlapped=0x0) returned 1 [0123.038] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.038] WriteFile (in: hFile=0x460, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0123.038] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0123.038] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0123.038] CloseHandle (hObject=0x460) returned 1 [0123.693] GetProcessHeap () returned 0x580000 [0123.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0123.693] GetProcessHeap () returned 0x580000 [0123.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0123.693] GetProcessHeap () returned 0x580000 [0123.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80f426a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe37, dwReserved0=0x3bcfd28, dwReserved1=0x6f67710, cFileName="Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0124.825] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.860] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", len=0x4e | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 1 [0124.860] GetProcessHeap () returned 0x580000 [0124.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b4) returned 0x6f42f08 [0124.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0124.860] CloseHandle (hObject=0x488) returned 1 [0124.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id_1622540890_.your_last_chance")) returned 1 [0124.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0124.864] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0124.864] GetProcessHeap () returned 0x580000 [0124.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa161) returned 0x6f976f8 [0124.864] GetProcessHeap () returned 0x580000 [0124.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa161) returned 0x6fa1868 [0124.864] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.864] ReadFile (in: hFile=0x488, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0xa140, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x3bcff14*=0xa140, lpOverlapped=0x0) returned 1 [0126.661] GetProcessHeap () returned 0x580000 [0126.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0126.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.661] WriteFile (in: hFile=0x488, lpBuffer=0x6fa1868*, nNumberOfBytesToWrite=0xa140, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa1868*, lpNumberOfBytesWritten=0x3bcff14*=0xa140, lpOverlapped=0x0) returned 1 [0126.662] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.662] WriteFile (in: hFile=0x488, lpBuffer=0x6fab9a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fab9a7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0126.662] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.662] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0126.662] CloseHandle (hObject=0x488) returned 1 [0126.662] GetProcessHeap () returned 0x580000 [0126.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa1868 | out: hHeap=0x580000) returned 1 [0126.662] GetProcessHeap () returned 0x580000 [0126.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0126.662] GetProcessHeap () returned 0x580000 [0126.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0126.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x831c65a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa173, dwReserved0=0x3bcfd28, dwReserved1=0x6f976f8, cFileName="Thatch.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0126.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.720] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", len=0x3d | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned 1 [0126.720] GetProcessHeap () returned 0x580000 [0126.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d0) returned 0x667250 [0126.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0128.871] CloseHandle (hObject=0x390) returned 1 [0128.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03008~1.YOU")) returned 0x5b96f0 [0129.247] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.247] GetProcessHeap () returned 0x580000 [0129.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6efc558 [0129.247] GetProcessHeap () returned 0x580000 [0129.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6efe908 [0129.248] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.248] ReadFile (in: hFile=0x390, lpBuffer=0x6efc558, nNumberOfBytesToRead=0x2380, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc558*, lpNumberOfBytesRead=0x3bcff14*=0x2380, lpOverlapped=0x0) returned 1 [0129.279] GetProcessHeap () returned 0x580000 [0129.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.279] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.279] WriteFile (in: hFile=0x390, lpBuffer=0x6efe908*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6efe908*, lpNumberOfBytesWritten=0x3bcff14*=0x2380, lpOverlapped=0x0) returned 1 [0129.280] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.280] WriteFile (in: hFile=0x390, lpBuffer=0x6f00c87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f00c87*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0129.280] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.280] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0129.280] CloseHandle (hObject=0x390) returned 1 [0129.280] GetProcessHeap () returned 0x580000 [0129.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efe908 | out: hHeap=0x580000) returned 1 [0129.280] GetProcessHeap () returned 0x580000 [0129.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efc558 | out: hHeap=0x580000) returned 1 [0129.280] GetProcessHeap () returned 0x580000 [0129.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84ac4ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23c0, dwReserved0=0x3bcfd28, dwReserved1=0x6efc558, cFileName="J0300840.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03008~1.YOU")) returned 0x5b9630 [0129.577] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.604] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn", len=0x4a | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn") returned 1 [0129.604] GetProcessHeap () returned 0x580000 [0129.604] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0129.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.604] CloseHandle (hObject=0x458) returned 1 [0129.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.id_1622540890_.your_last_chance")) returned 1 [0129.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COLLEC~1.YOU")) returned 0x5b9730 [0129.637] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0129.637] GetProcessHeap () returned 0x580000 [0129.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3701) returned 0x6d91de8 [0129.637] GetProcessHeap () returned 0x580000 [0129.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3701) returned 0x6d954f8 [0129.637] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.637] ReadFile (in: hFile=0x440, lpBuffer=0x6d91de8, nNumberOfBytesToRead=0x36e0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d91de8*, lpNumberOfBytesRead=0x3bcff14*=0x36e0, lpOverlapped=0x0) returned 1 [0131.110] GetProcessHeap () returned 0x580000 [0131.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0131.110] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.111] WriteFile (in: hFile=0x440, lpBuffer=0x6d954f8*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d954f8*, lpNumberOfBytesWritten=0x3bcff14*=0x36e0, lpOverlapped=0x0) returned 1 [0131.111] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.111] WriteFile (in: hFile=0x440, lpBuffer=0x6d98bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98bd7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0131.111] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.111] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0131.111] CloseHandle (hObject=0x440) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d954f8 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d91de8 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0132.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x85c2cd80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x371f, dwReserved0=0x3bcfd28, dwReserved1=0x6d91de8, cFileName="CollectSignatures_Sign.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COLLEC~1.YOU")) returned 0x5b9730 [0132.642] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0135.083] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", len=0x3c | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 1 [0135.083] GetProcessHeap () returned 0x580000 [0135.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0135.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0135.085] CloseHandle (hObject=0x448) returned 1 [0135.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id_1622540890_.your_last_chance")) returned 1 [0138.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOORSC~1.YOU")) returned 0x5b9770 [0138.711] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0138.711] GetProcessHeap () returned 0x580000 [0138.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0138.711] GetProcessHeap () returned 0x580000 [0138.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0138.711] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.711] ReadFile (in: hFile=0x448, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3bcff14*=0x6a0, lpOverlapped=0x0) returned 1 [0138.718] GetProcessHeap () returned 0x580000 [0138.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0138.718] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.718] WriteFile (in: hFile=0x448, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3bcff14*=0x6a0, lpOverlapped=0x0) returned 1 [0138.718] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.718] WriteFile (in: hFile=0x448, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0138.719] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.719] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0138.719] CloseHandle (hObject=0x448) returned 1 [0138.719] GetProcessHeap () returned 0x580000 [0138.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0138.719] GetProcessHeap () returned 0x580000 [0138.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0138.719] GetProcessHeap () returned 0x580000 [0138.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0140.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a4c6c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6df, dwReserved0=0x3bcfd28, dwReserved1=0x6c79898, cFileName="DOORSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOORSC~1.YOU")) returned 0x5b9770 [0140.122] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.166] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x5f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0140.166] GetProcessHeap () returned 0x580000 [0140.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0140.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.167] CloseHandle (hObject=0x3b4) returned 1 [0140.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0140.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.632] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.632] GetProcessHeap () returned 0x580000 [0140.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0140.632] GetProcessHeap () returned 0x580000 [0140.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0140.632] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.632] ReadFile (in: hFile=0x3b4, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x3bcff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.633] GetProcessHeap () returned 0x580000 [0140.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf2a0 [0140.633] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.633] WriteFile (in: hFile=0x3b4, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x3bcff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.634] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.634] WriteFile (in: hFile=0x3b4, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0140.634] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.634] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0140.634] CloseHandle (hObject=0x3b4) returned 1 [0140.634] GetProcessHeap () returned 0x580000 [0140.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0140.634] GetProcessHeap () returned 0x580000 [0140.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0140.634] GetProcessHeap () returned 0x580000 [0140.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf2a0 | out: hHeap=0x580000) returned 1 [0141.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6ed440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3bcfd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9730 [0141.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.457] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS", len=0x3f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 1 [0144.457] GetProcessHeap () returned 0x580000 [0144.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0144.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0144.457] CloseHandle (hObject=0x488) returned 1 [0144.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.458] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0144.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80e2700, ftLastWriteTime.dwHighDateTime=0x1ca8f17, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUA106~1.YOU")) returned 0x5b9730 [0144.458] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0144.459] GetProcessHeap () returned 0x580000 [0144.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0144.460] GetProcessHeap () returned 0x580000 [0144.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0144.460] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.460] ReadFile (in: hFile=0x488, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.772] GetProcessHeap () returned 0x580000 [0147.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0147.773] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.773] WriteFile (in: hFile=0x488, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.773] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.773] WriteFile (in: hFile=0x488, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0148.623] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.623] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0148.623] CloseHandle (hObject=0x488) returned 1 [0148.623] GetProcessHeap () returned 0x580000 [0148.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0148.623] GetProcessHeap () returned 0x580000 [0148.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0148.623] GetProcessHeap () returned 0x580000 [0148.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0148.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9033f5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3fc, dwReserved0=0x3bcfd28, dwReserved1=0x6fb2f38, cFileName="OUTLOOK.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUA106~1.YOU")) returned 0x5b96f0 [0148.623] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0149.355] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", len=0x44 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned 1 [0149.355] GetProcessHeap () returned 0x580000 [0149.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0149.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0150.557] CloseHandle (hObject=0x470) returned 1 [0150.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.id_1622540890_.your_last_chance")) returned 1 [0150.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1001, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR50~1.YOU")) returned 0x5b96f0 [0150.558] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0150.558] GetProcessHeap () returned 0x580000 [0150.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6dd7c30 [0150.558] GetProcessHeap () returned 0x580000 [0150.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6cba390 [0150.558] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.558] ReadFile (in: hFile=0x470, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x3bcff14*=0x1000, lpOverlapped=0x0) returned 1 [0150.573] GetProcessHeap () returned 0x580000 [0150.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0150.573] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.573] WriteFile (in: hFile=0x470, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x3bcff14*=0x1000, lpOverlapped=0x0) returned 1 [0150.573] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.573] WriteFile (in: hFile=0x470, lpBuffer=0x6cbb38f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbb38f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0150.574] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.574] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0150.574] CloseHandle (hObject=0x470) returned 1 [0150.574] GetProcessHeap () returned 0x580000 [0150.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0150.574] GetProcessHeap () returned 0x580000 [0150.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0150.575] GetProcessHeap () returned 0x580000 [0150.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0150.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x915d8180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1025, dwReserved0=0x3bcfd28, dwReserved1=0x6dd7c30, cFileName="PDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR50~1.YOU")) returned 0x5b96f0 [0150.787] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.933] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", len=0x3c | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 1 [0150.935] GetProcessHeap () returned 0x580000 [0150.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2120) returned 0x6f14048 [0150.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.232] CloseHandle (hObject=0x3e4) returned 1 [0152.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id_1622540890_.your_last_chance")) returned 1 [0152.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.234] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIGRA~1.YOU")) returned 0x5b9730 [0152.234] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.234] GetProcessHeap () returned 0x580000 [0152.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9781) returned 0x6de0f50 [0152.234] GetProcessHeap () returned 0x580000 [0152.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9781) returned 0x703c008 [0152.235] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.235] ReadFile (in: hFile=0x3e4, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x9760, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x3bcff14*=0x9760, lpOverlapped=0x0) returned 1 [0155.153] GetProcessHeap () returned 0x580000 [0155.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.153] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.153] WriteFile (in: hFile=0x3e4, lpBuffer=0x703c008*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x703c008*, lpNumberOfBytesWritten=0x3bcff14*=0x9760, lpOverlapped=0x0) returned 1 [0155.153] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.153] WriteFile (in: hFile=0x3e4, lpBuffer=0x7045767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7045767*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0155.154] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.154] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0155.154] CloseHandle (hObject=0x3e4) returned 1 [0155.154] GetProcessHeap () returned 0x580000 [0155.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703c008 | out: hHeap=0x580000) returned 1 [0155.154] GetProcessHeap () returned 0x580000 [0155.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0155.155] GetProcessHeap () returned 0x580000 [0155.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.749] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9416f460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9794, dwReserved0=0x3bcfd28, dwReserved1=0x6de0f50, cFileName="SMIGRATE.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIGRA~1.YOU")) returned 0x5b9630 [0155.749] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.808] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", len=0x46 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned 1 [0155.809] GetProcessHeap () returned 0x580000 [0155.809] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0155.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0155.855] CloseHandle (hObject=0x4ac) returned 1 [0155.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl.id_1622540890_.your_last_chance")) returned 1 [0155.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TITLEX~1.YOU")) returned 0x5b9630 [0155.856] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0155.856] GetProcessHeap () returned 0x580000 [0155.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c41) returned 0x6f58108 [0155.856] GetProcessHeap () returned 0x580000 [0155.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c41) returned 0x70623b8 [0155.857] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.857] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f58108, nNumberOfBytesToRead=0x8c20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x3bcff14*=0x8c20, lpOverlapped=0x0) returned 1 [0158.067] GetProcessHeap () returned 0x580000 [0158.067] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0158.067] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.067] WriteFile (in: hFile=0x4ac, lpBuffer=0x70623b8*, nNumberOfBytesToWrite=0x8c20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x70623b8*, lpNumberOfBytesWritten=0x3bcff14*=0x8c20, lpOverlapped=0x0) returned 1 [0158.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.068] WriteFile (in: hFile=0x4ac, lpBuffer=0x706afd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x706afd7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0158.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.068] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0158.068] CloseHandle (hObject=0x4ac) returned 1 [0158.068] GetProcessHeap () returned 0x580000 [0158.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70623b8 | out: hHeap=0x580000) returned 1 [0158.069] GetProcessHeap () returned 0x580000 [0158.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0158.069] GetProcessHeap () returned 0x580000 [0158.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0159.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d41580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8c62, dwReserved0=0x3bcfd28, dwReserved1=0x6f58108, cFileName="TITLE.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TITLEX~1.YOU")) returned 0x5b9630 [0159.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.262] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", len=0x50 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 1 [0159.262] GetProcessHeap () returned 0x580000 [0159.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0159.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0159.312] CloseHandle (hObject=0x41c) returned 1 [0159.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISO690~1.YOU")) returned 0x5b9630 [0159.314] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0159.314] GetProcessHeap () returned 0x580000 [0159.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70d6588 [0159.314] GetProcessHeap () returned 0x580000 [0159.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70e7db8 [0159.315] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.315] ReadFile (in: hFile=0x41c, lpBuffer=0x70d6588, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x70d6588*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.913] GetProcessHeap () returned 0x580000 [0164.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0164.913] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.913] WriteFile (in: hFile=0x41c, lpBuffer=0x70e7db8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x70e7db8*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.914] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] WriteFile (in: hFile=0x41c, lpBuffer=0x70f95b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x70f95b7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0164.914] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.914] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0164.914] CloseHandle (hObject=0x41c) returned 1 [0164.914] GetProcessHeap () returned 0x580000 [0164.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70e7db8 | out: hHeap=0x580000) returned 1 [0164.914] GetProcessHeap () returned 0x580000 [0164.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70d6588 | out: hHeap=0x580000) returned 1 [0164.914] GetProcessHeap () returned 0x580000 [0164.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0166.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e91120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ee93, dwReserved0=0x3bcfd28, dwReserved1=0x70d6588, cFileName="ISO690Nmerical.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISO690~1.YOU")) returned 0x5b9730 [0166.577] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.630] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", len=0x3f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 1 [0166.631] GetProcessHeap () returned 0x580000 [0166.631] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0166.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.256] CloseHandle (hObject=0x454) returned 1 [0169.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id_1622540890_.your_last_chance")) returned 1 [0169.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTSI~1.YOU")) returned 0x5b96b0 [0169.257] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.258] GetProcessHeap () returned 0x580000 [0169.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0169.258] GetProcessHeap () returned 0x580000 [0169.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0169.258] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.258] ReadFile (in: hFile=0x454, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x3bcff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.269] GetProcessHeap () returned 0x580000 [0169.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.269] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.269] WriteFile (in: hFile=0x454, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x3bcff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.269] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.270] WriteFile (in: hFile=0x454, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0169.270] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.270] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0169.270] CloseHandle (hObject=0x454) returned 1 [0169.270] GetProcessHeap () returned 0x580000 [0169.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0169.270] GetProcessHeap () returned 0x580000 [0169.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0169.270] GetProcessHeap () returned 0x580000 [0169.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c8130c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x3bcfd28, dwReserved1=0x65f268, cFileName="APPTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTSI~1.YOU")) returned 0x5b9730 [0169.270] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.279] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", len=0x42 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 1 [0169.279] GetProcessHeap () returned 0x580000 [0169.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0169.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.279] CloseHandle (hObject=0x454) returned 1 [0169.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id_1622540890_.your_last_chance")) returned 1 [0169.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~1.YOU")) returned 0x5b9730 [0169.371] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.371] GetProcessHeap () returned 0x580000 [0169.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de0f68 [0169.372] GetProcessHeap () returned 0x580000 [0169.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de1370 [0169.372] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.372] ReadFile (in: hFile=0x454, lpBuffer=0x6de0f68, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f68*, lpNumberOfBytesRead=0x3bcff14*=0x3c0, lpOverlapped=0x0) returned 1 [0169.398] GetProcessHeap () returned 0x580000 [0169.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.398] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.398] WriteFile (in: hFile=0x454, lpBuffer=0x6de1370*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6de1370*, lpNumberOfBytesWritten=0x3bcff14*=0x3c0, lpOverlapped=0x0) returned 1 [0169.398] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.398] WriteFile (in: hFile=0x454, lpBuffer=0x6de172f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6de172f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0169.398] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.398] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0169.398] CloseHandle (hObject=0x454) returned 1 [0169.398] GetProcessHeap () returned 0x580000 [0169.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de1370 | out: hHeap=0x580000) returned 1 [0169.398] GetProcessHeap () returned 0x580000 [0169.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f68 | out: hHeap=0x580000) returned 1 [0169.398] GetProcessHeap () returned 0x580000 [0169.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c943bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x3bcfd28, dwReserved1=0x6de0f68, cFileName="ACTIVITY.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~1.YOU")) returned 0x5b9730 [0169.398] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.536] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", len=0x3c | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 1 [0169.536] GetProcessHeap () returned 0x580000 [0169.536] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0169.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0169.611] CloseHandle (hObject=0x440) returned 1 [0169.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id_1622540890_.your_last_chance")) returned 1 [0169.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLADDF~1.YOU")) returned 0x5b9730 [0169.652] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0169.652] GetProcessHeap () returned 0x580000 [0169.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x712d838 [0169.652] GetProcessHeap () returned 0x580000 [0169.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x713f068 [0169.652] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.652] ReadFile (in: hFile=0x440, lpBuffer=0x712d838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x712d838*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.164] GetProcessHeap () returned 0x580000 [0174.164] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.164] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.164] WriteFile (in: hFile=0x440, lpBuffer=0x713f068*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x713f068*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.165] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.165] WriteFile (in: hFile=0x440, lpBuffer=0x7150867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7150867*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0174.165] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.165] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0174.165] CloseHandle (hObject=0x440) returned 1 [0174.165] GetProcessHeap () returned 0x580000 [0174.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x713f068 | out: hHeap=0x580000) returned 1 [0174.165] GetProcessHeap () returned 0x580000 [0174.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x712d838 | out: hHeap=0x580000) returned 1 [0174.168] GetProcessHeap () returned 0x580000 [0174.168] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f6ca080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x207c4, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="OLADD.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLADDF~1.YOU")) returned 0x5b96f0 [0176.797] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.841] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", len=0x39 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS") returned 1 [0176.841] GetProcessHeap () returned 0x580000 [0176.841] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x212c) returned 0x6f14048 [0176.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.634] CloseHandle (hObject=0x43c) returned 1 [0179.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.id_1622540890_.your_last_chance")) returned 1 [0179.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STEELC~1.YOU")) returned 0x5b96f0 [0179.635] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\steel.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.635] GetProcessHeap () returned 0x580000 [0179.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.635] GetProcessHeap () returned 0x580000 [0179.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.636] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.636] ReadFile (in: hFile=0x43c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3bcff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.648] GetProcessHeap () returned 0x580000 [0179.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.648] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.648] WriteFile (in: hFile=0x43c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x3bcff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.648] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.649] WriteFile (in: hFile=0x43c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0179.649] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.649] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0179.649] CloseHandle (hObject=0x43c) returned 1 [0179.649] GetProcessHeap () returned 0x580000 [0179.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.649] GetProcessHeap () returned 0x580000 [0179.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.649] GetProcessHeap () returned 0x580000 [0179.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa2b02320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x3bcfd28, dwReserved1=0x635768, cFileName="STEEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STEELC~1.YOU")) returned 0x5b9770 [0181.349] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.358] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", len=0x67 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned 1 [0181.358] GetProcessHeap () returned 0x580000 [0181.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0181.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0183.130] CloseHandle (hObject=0x440) returned 1 [0183.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.130] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5eab000, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALA908~1.YOU")) returned 0x5b9770 [0183.131] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0183.131] GetProcessHeap () returned 0x580000 [0183.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46e1) returned 0x715c008 [0183.132] GetProcessHeap () returned 0x580000 [0183.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46e1) returned 0x71606f8 [0183.132] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.132] ReadFile (in: hFile=0x440, lpBuffer=0x715c008, nNumberOfBytesToRead=0x46c0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x3bcff14*=0x46c0, lpOverlapped=0x0) returned 1 [0184.248] GetProcessHeap () returned 0x580000 [0184.248] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.248] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x440, lpBuffer=0x71606f8*, nNumberOfBytesToWrite=0x46c0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x71606f8*, lpNumberOfBytesWritten=0x3bcff14*=0x46c0, lpOverlapped=0x0) returned 1 [0184.248] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x440, lpBuffer=0x7164db7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7164db7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0184.248] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.248] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0184.249] CloseHandle (hObject=0x440) returned 1 [0184.249] GetProcessHeap () returned 0x580000 [0184.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71606f8 | out: hHeap=0x580000) returned 1 [0184.249] GetProcessHeap () returned 0x580000 [0184.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0184.249] GetProcessHeap () returned 0x580000 [0184.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0184.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa56e58c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4702, dwReserved0=0x3bcfd28, dwReserved1=0x715c008, cFileName="AlertImage_FileOff.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALA908~1.YOU")) returned 0x5b9770 [0184.249] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.249] Sleep (dwMilliseconds=0x1) [0184.707] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", len=0x57 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned 1 [0184.707] GetProcessHeap () returned 0x580000 [0184.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2128) returned 0x6f14048 [0184.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0185.191] CloseHandle (hObject=0x46c) returned 1 [0185.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f262800, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NO1958~1.YOU")) returned 0x5b9770 [0185.196] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0185.197] GetProcessHeap () returned 0x580000 [0185.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e023e8 [0185.197] GetProcessHeap () returned 0x580000 [0185.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e026f0 [0185.197] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.197] ReadFile (in: hFile=0x46c, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x3bcff14*=0x2c0, lpOverlapped=0x0) returned 1 [0185.200] GetProcessHeap () returned 0x580000 [0185.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0185.200] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.200] WriteFile (in: hFile=0x46c, lpBuffer=0x6e026f0*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e026f0*, lpNumberOfBytesWritten=0x3bcff14*=0x2c0, lpOverlapped=0x0) returned 1 [0185.200] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.201] WriteFile (in: hFile=0x46c, lpBuffer=0x6e029af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e029af*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0185.201] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.201] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0185.201] CloseHandle (hObject=0x46c) returned 1 [0185.201] GetProcessHeap () returned 0x580000 [0185.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e026f0 | out: hHeap=0x580000) returned 1 [0185.201] GetProcessHeap () returned 0x580000 [0185.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0185.201] GetProcessHeap () returned 0x580000 [0185.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0185.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5ff8ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x3bcfd28, dwReserved1=0x6e023e8, cFileName="NotifierDisableDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NO1958~1.YOU")) returned 0x5b9770 [0185.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.582] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", len=0x55 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned 1 [0185.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.017] CloseHandle (hObject=0x3b4) returned 1 [0187.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0187.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATAVI~2.YOU")) returned 0x5b96b0 [0187.018] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0187.018] GetProcessHeap () returned 0x580000 [0187.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6cda390 [0187.018] GetProcessHeap () returned 0x580000 [0187.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6cdaad8 [0187.018] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.018] ReadFile (in: hFile=0x3b4, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x3bcff14*=0x700, lpOverlapped=0x0) returned 1 [0187.025] GetProcessHeap () returned 0x580000 [0187.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.026] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.026] WriteFile (in: hFile=0x3b4, lpBuffer=0x6cdaad8*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdaad8*, lpNumberOfBytesWritten=0x3bcff14*=0x700, lpOverlapped=0x0) returned 1 [0187.026] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.026] WriteFile (in: hFile=0x3b4, lpBuffer=0x6cdb1d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb1d7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0187.026] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.026] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0187.026] CloseHandle (hObject=0x3b4) returned 1 [0187.026] GetProcessHeap () returned 0x580000 [0187.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdaad8 | out: hHeap=0x580000) returned 1 [0187.026] GetProcessHeap () returned 0x580000 [0187.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0187.026] GetProcessHeap () returned 0x580000 [0187.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0187.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7160d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x3bcfd28, dwReserved1=0x6cda390, cFileName="DataViewIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATAVI~2.YOU")) returned 0x5b96b0 [0187.027] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.029] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", len=0x6e | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned 1 [0187.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0187.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0187.877] CloseHandle (hObject=0x428) returned 1 [0187.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x6a002e, dwReserved1=0x670070, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b96b0 [0187.878] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0187.878] GetProcessHeap () returned 0x580000 [0187.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6efb008 [0187.878] GetProcessHeap () returned 0x580000 [0187.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14a1) returned 0x6f19958 [0187.878] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.878] ReadFile (in: hFile=0x428, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x3bcff14*=0x1480, lpOverlapped=0x0) returned 1 [0187.897] GetProcessHeap () returned 0x580000 [0187.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.897] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.897] WriteFile (in: hFile=0x428, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x3bcff14*=0x1480, lpOverlapped=0x0) returned 1 [0187.897] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.897] WriteFile (in: hFile=0x428, lpBuffer=0x6f1add7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1add7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0187.897] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.897] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0187.897] CloseHandle (hObject=0x428) returned 1 [0187.897] GetProcessHeap () returned 0x580000 [0187.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0187.897] GetProcessHeap () returned 0x580000 [0187.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0187.897] GetProcessHeap () returned 0x580000 [0187.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa79b5a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14bd, dwReserved0=0x3bcfd28, dwReserved1=0x6efb008, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9770 [0191.030] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.042] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", len=0x45 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned 1 [0191.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0191.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0191.043] CloseHandle (hObject=0x3b4) returned 1 [0191.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAFC2~1.YOU")) returned 0x5b9770 [0191.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0191.045] GetProcessHeap () returned 0x580000 [0191.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a81) returned 0x6d10048 [0191.045] GetProcessHeap () returned 0x580000 [0191.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a81) returned 0x6d19ad8 [0191.045] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.046] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x9a60, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x3bcff14*=0x9a60, lpOverlapped=0x0) returned 1 [0194.117] GetProcessHeap () returned 0x580000 [0194.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0194.117] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.117] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d19ad8*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d19ad8*, lpNumberOfBytesWritten=0x3bcff14*=0x9a60, lpOverlapped=0x0) returned 1 [0194.118] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d23537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d23537*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0194.119] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.119] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0194.119] CloseHandle (hObject=0x3b4) returned 1 [0194.119] GetProcessHeap () returned 0x580000 [0194.119] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d19ad8 | out: hHeap=0x580000) returned 1 [0194.120] GetProcessHeap () returned 0x580000 [0194.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0194.120] GetProcessHeap () returned 0x580000 [0194.120] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0194.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab511f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9a84, dwReserved0=0x3bcfd28, dwReserved1=0x6d10048, cFileName="ZPDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAFC2~1.YOU")) returned 0x5b97b0 [0194.121] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.610] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", len=0x76 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned 1 [0196.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0196.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.611] CloseHandle (hObject=0x488) returned 1 [0196.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0196.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5c0065, dwReserved1=0x610074, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.612] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.612] GetProcessHeap () returned 0x580000 [0196.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0196.612] GetProcessHeap () returned 0x580000 [0196.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0196.612] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.612] ReadFile (in: hFile=0x488, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x3bcff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.614] GetProcessHeap () returned 0x580000 [0196.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.614] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.614] WriteFile (in: hFile=0x488, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x3bcff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.614] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.614] WriteFile (in: hFile=0x488, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0196.614] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.614] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0196.614] CloseHandle (hObject=0x488) returned 1 [0196.615] GetProcessHeap () returned 0x580000 [0196.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0196.615] GetProcessHeap () returned 0x580000 [0196.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0196.615] GetProcessHeap () returned 0x580000 [0196.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccdfb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3bcfd28, dwReserved1=0x5ae2f0, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.615] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.629] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", len=0x7a | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0196.629] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0196.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.630] CloseHandle (hObject=0x4ac) returned 1 [0196.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0196.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x5c0065, dwReserved1=0x610062, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97b0 [0196.631] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.631] GetProcessHeap () returned 0x580000 [0196.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.631] GetProcessHeap () returned 0x580000 [0196.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.631] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.631] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x3bcff14*=0x140, lpOverlapped=0x0) returned 1 [0196.633] GetProcessHeap () returned 0x580000 [0196.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.633] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.633] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x3bcff14*=0x140, lpOverlapped=0x0) returned 1 [0196.633] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.634] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0196.634] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.634] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0196.634] CloseHandle (hObject=0x4ac) returned 1 [0196.634] GetProcessHeap () returned 0x580000 [0196.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.634] GetProcessHeap () returned 0x580000 [0196.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.634] GetProcessHeap () returned 0x580000 [0196.634] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd05c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x3bcfd28, dwReserved1=0x6dec6f8, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97b0 [0196.634] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.663] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", len=0x5a | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned 1 [0196.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff4) returned 0x6f14048 [0196.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.664] CloseHandle (hObject=0x480) returned 1 [0196.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.id_1622540890_.your_last_chance")) returned 1 [0196.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b97b0 [0196.678] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.678] GetProcessHeap () returned 0x580000 [0196.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e023e8 [0196.678] GetProcessHeap () returned 0x580000 [0196.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e02670 [0196.678] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.678] ReadFile (in: hFile=0x480, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x3bcff14*=0x240, lpOverlapped=0x0) returned 1 [0196.796] GetProcessHeap () returned 0x580000 [0196.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0196.796] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.796] WriteFile (in: hFile=0x480, lpBuffer=0x6e02670*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02670*, lpNumberOfBytesWritten=0x3bcff14*=0x240, lpOverlapped=0x0) returned 1 [0196.796] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.796] WriteFile (in: hFile=0x480, lpBuffer=0x6e028af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e028af*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0196.796] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.797] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0196.797] CloseHandle (hObject=0x480) returned 1 [0196.797] GetProcessHeap () returned 0x580000 [0196.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02670 | out: hHeap=0x580000) returned 1 [0196.797] GetProcessHeap () returned 0x580000 [0196.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0196.797] GetProcessHeap () returned 0x580000 [0196.797] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0196.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacea8ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x3bcfd28, dwReserved1=0x6e023e8, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b97b0 [0196.797] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.841] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", len=0x45 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned 1 [0196.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc8) returned 0x6f14048 [0196.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0196.842] CloseHandle (hObject=0x3a8) returned 1 [0196.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPEB72~1.YOU")) returned 0x5b97b0 [0196.843] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0196.843] GetProcessHeap () returned 0x580000 [0196.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x7067550 [0196.844] GetProcessHeap () returned 0x580000 [0196.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x706a540 [0196.844] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.844] ReadFile (in: hFile=0x3a8, lpBuffer=0x7067550, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7067550*, lpNumberOfBytesRead=0x3bcff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0197.415] GetProcessHeap () returned 0x580000 [0197.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0197.416] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.416] WriteFile (in: hFile=0x3a8, lpBuffer=0x706a540*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x706a540*, lpNumberOfBytesWritten=0x3bcff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0197.416] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.416] WriteFile (in: hFile=0x3a8, lpBuffer=0x706d4ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x706d4ff*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0197.416] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.416] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0197.416] CloseHandle (hObject=0x3a8) returned 1 [0197.767] GetProcessHeap () returned 0x580000 [0197.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706a540 | out: hHeap=0x580000) returned 1 [0197.767] GetProcessHeap () returned 0x580000 [0197.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7067550 | out: hHeap=0x580000) returned 1 [0197.767] GetProcessHeap () returned 0x580000 [0197.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0199.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad476140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fe5, dwReserved0=0x3bcfd28, dwReserved1=0x7067550, cFileName="ZPDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPEB72~1.YOU")) returned 0x5b96b0 [0199.649] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.953] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned 1 [0200.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff4) returned 0x6f14048 [0200.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0200.978] CloseHandle (hObject=0x4ac) returned 1 [0200.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.978] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.id_1622540890_.your_last_chance")) returned 1 [0200.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~2.YOU")) returned 0x5b9770 [0200.979] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0200.979] GetProcessHeap () returned 0x580000 [0200.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a110 [0200.979] GetProcessHeap () returned 0x580000 [0200.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6c6a558 [0200.979] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.979] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x3bcff14*=0x3e0, lpOverlapped=0x0) returned 1 [0200.997] GetProcessHeap () returned 0x580000 [0200.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0200.997] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.998] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x3bcff14*=0x3e0, lpOverlapped=0x0) returned 1 [0200.998] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.998] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6a937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a937*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0200.998] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.998] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0200.998] CloseHandle (hObject=0x4ac) returned 1 [0201.200] GetProcessHeap () returned 0x580000 [0201.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0201.201] GetProcessHeap () returned 0x580000 [0201.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0201.201] GetProcessHeap () returned 0x580000 [0201.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0201.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf6add80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x3bcfd28, dwReserved1=0x6c6a110, cFileName="rtf_choosecolor.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~2.YOU")) returned 0x5b9770 [0201.873] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.067] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", len=0x5b | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 1 [0203.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0203.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0203.123] CloseHandle (hObject=0x46c) returned 1 [0203.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id_1622540890_.your_last_chance")) returned 1 [0206.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0206.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b97b0 [0206.547] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0206.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0206.547] GetProcessHeap () returned 0x580000 [0206.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5b8df0 [0206.547] GetProcessHeap () returned 0x580000 [0206.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0206.547] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.547] ReadFile (in: hFile=0x46c, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x3bcff14*=0x120, lpOverlapped=0x0) returned 1 [0206.549] GetProcessHeap () returned 0x580000 [0206.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0206.549] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.549] WriteFile (in: hFile=0x46c, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x3bcff14*=0x120, lpOverlapped=0x0) returned 1 [0206.549] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.549] WriteFile (in: hFile=0x46c, lpBuffer=0x65f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x65f1cf*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0206.549] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.549] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0206.549] CloseHandle (hObject=0x46c) returned 1 [0206.549] GetProcessHeap () returned 0x580000 [0206.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0206.549] GetProcessHeap () returned 0x580000 [0206.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0206.550] GetProcessHeap () returned 0x580000 [0206.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0209.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ba4700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x3bcfd28, dwReserved1=0x5b8df0, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b97f0 [0209.786] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.824] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0209.824] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0209.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.032] CloseHandle (hObject=0x448) returned 1 [0210.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0210.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e0046, dwReserved1=0x490047, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.053] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.054] GetProcessHeap () returned 0x580000 [0210.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0210.054] GetProcessHeap () returned 0x580000 [0210.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0210.054] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.054] ReadFile (in: hFile=0x448, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x3bcff14*=0x1c0, lpOverlapped=0x0) returned 1 [0210.056] GetProcessHeap () returned 0x580000 [0210.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.056] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.056] WriteFile (in: hFile=0x448, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x3bcff14*=0x1c0, lpOverlapped=0x0) returned 1 [0210.057] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.057] WriteFile (in: hFile=0x448, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0210.057] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.057] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0210.057] CloseHandle (hObject=0x448) returned 1 [0210.057] GetProcessHeap () returned 0x580000 [0210.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0210.057] GetProcessHeap () returned 0x580000 [0210.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0210.057] GetProcessHeap () returned 0x580000 [0210.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4d1dc60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x3bcfd28, dwReserved1=0x6f3ef20, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.538] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.558] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", len=0x6a | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned 1 [0214.558] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0214.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.610] CloseHandle (hObject=0x438) returned 1 [0214.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.id_1622540890_.your_last_chance")) returned 1 [0214.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x706, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b97b0 [0214.611] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.611] GetProcessHeap () returned 0x580000 [0214.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6cda390 [0214.611] GetProcessHeap () returned 0x580000 [0214.611] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6cdaad8 [0214.611] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.611] ReadFile (in: hFile=0x438, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x3bcff14*=0x700, lpOverlapped=0x0) returned 1 [0214.643] GetProcessHeap () returned 0x580000 [0214.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.643] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.643] WriteFile (in: hFile=0x438, lpBuffer=0x6cdaad8*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdaad8*, lpNumberOfBytesWritten=0x3bcff14*=0x700, lpOverlapped=0x0) returned 1 [0214.643] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.643] WriteFile (in: hFile=0x438, lpBuffer=0x6cdb1d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb1d7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0214.643] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.643] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0214.643] CloseHandle (hObject=0x438) returned 1 [0214.643] GetProcessHeap () returned 0x580000 [0214.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdaad8 | out: hHeap=0x580000) returned 1 [0214.643] GetProcessHeap () returned 0x580000 [0214.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0214.643] GetProcessHeap () returned 0x580000 [0214.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78db0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x72a, dwReserved0=0x3bcfd28, dwReserved1=0x6cda390, cFileName="Premium.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREMIU~1.YOU")) returned 0x5b97b0 [0214.644] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.699] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS", len=0x45 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS") returned 1 [0214.700] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0214.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.700] CloseHandle (hObject=0x448) returned 1 [0214.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css.id_1622540890_.your_last_chance")) returned 1 [0214.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d1f300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26d1f300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ff56, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCA1D6~1.YOU")) returned 0x5b97b0 [0214.709] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0214.735] GetProcessHeap () returned 0x580000 [0214.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0214.735] GetProcessHeap () returned 0x580000 [0214.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0214.736] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.736] ReadFile (in: hFile=0x44c, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.001] GetProcessHeap () returned 0x580000 [0220.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0220.001] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.001] WriteFile (in: hFile=0x44c, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.001] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.001] WriteFile (in: hFile=0x44c, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0220.001] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.001] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0220.002] CloseHandle (hObject=0x44c) returned 1 [0220.002] GetProcessHeap () returned 0x580000 [0220.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0220.002] GetProcessHeap () returned 0x580000 [0220.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0220.002] GetProcessHeap () returned 0x580000 [0220.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d1f300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe2840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ff7a, dwReserved0=0x3bcfd28, dwReserved1=0x6f976f8, cFileName="SCHEME07.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCA1D6~1.YOU")) returned 0x5b9730 [0221.452] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.488] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", len=0x4d | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 1 [0221.488] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f44) returned 0x6dee6e0 [0221.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.489] CloseHandle (hObject=0x458) returned 1 [0221.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id_1622540890_.your_last_chance")) returned 1 [0221.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACES~1.YOU")) returned 0x5b9730 [0221.490] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.491] GetProcessHeap () returned 0x580000 [0221.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38178 [0221.491] GetProcessHeap () returned 0x580000 [0221.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38d00 [0221.491] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.491] ReadFile (in: hFile=0x458, lpBuffer=0x6d38178, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38178*, lpNumberOfBytesRead=0x3bcff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.624] GetProcessHeap () returned 0x580000 [0221.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.624] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.624] WriteFile (in: hFile=0x458, lpBuffer=0x6d38d00*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38d00*, lpNumberOfBytesWritten=0x3bcff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.624] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.624] WriteFile (in: hFile=0x458, lpBuffer=0x6d3981f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3981f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0221.624] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.624] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0221.624] CloseHandle (hObject=0x458) returned 1 [0221.624] GetProcessHeap () returned 0x580000 [0221.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38d00 | out: hHeap=0x580000) returned 1 [0221.624] GetProcessHeap () returned 0x580000 [0221.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38178 | out: hHeap=0x580000) returned 1 [0221.624] GetProcessHeap () returned 0x580000 [0221.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbb5b740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x3bcfd28, dwReserved1=0x6d38178, cFileName="SpaceSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACES~1.YOU")) returned 0x5b9730 [0221.624] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.650] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", len=0x4a | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 1 [0221.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f24) returned 0x6dee6e0 [0221.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.664] CloseHandle (hObject=0x47c) returned 1 [0221.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id_1622540890_.your_last_chance")) returned 1 [0221.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~1.YOU")) returned 0x5b9730 [0221.665] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.665] GetProcessHeap () returned 0x580000 [0221.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0221.665] GetProcessHeap () returned 0x580000 [0221.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6f668d8 [0221.665] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.665] ReadFile (in: hFile=0x47c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3bcff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.696] GetProcessHeap () returned 0x580000 [0221.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.696] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.696] WriteFile (in: hFile=0x47c, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x3bcff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.696] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.696] WriteFile (in: hFile=0x47c, lpBuffer=0x6f67637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67637*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0221.696] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.696] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0221.696] CloseHandle (hObject=0x47c) returned 1 [0221.696] GetProcessHeap () returned 0x580000 [0221.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0221.696] GetProcessHeap () returned 0x580000 [0221.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0221.696] GetProcessHeap () returned 0x580000 [0221.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbc19e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x3bcfd28, dwReserved1=0x635768, cFileName="OnLineBusy.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~1.YOU")) returned 0x5b9730 [0221.697] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.752] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", len=0x4f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 1 [0221.752] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0221.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.753] CloseHandle (hObject=0x3fc) returned 1 [0221.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.753] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id_1622540890_.your_last_chance")) returned 1 [0221.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~3.YOU")) returned 0x5b9730 [0221.754] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.754] GetProcessHeap () returned 0x580000 [0221.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35358 [0221.754] GetProcessHeap () returned 0x580000 [0221.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35ee0 [0221.754] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.754] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d35358, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35358*, lpNumberOfBytesRead=0x3bcff14*=0xb20, lpOverlapped=0x0) returned 1 [0222.189] GetProcessHeap () returned 0x580000 [0222.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0222.189] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.189] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d35ee0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35ee0*, lpNumberOfBytesWritten=0x3bcff14*=0xb20, lpOverlapped=0x0) returned 1 [0222.189] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.189] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d369ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d369ff*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0222.189] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.189] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0222.189] CloseHandle (hObject=0x3fc) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35ee0 | out: hHeap=0x580000) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35358 | out: hHeap=0x580000) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0225.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0b68c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x3bcfd28, dwReserved1=0x6d35358, cFileName="messageboxalert.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~3.YOU")) returned 0x5b9630 [0225.412] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.431] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", len=0x34 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 1 [0225.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0225.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.432] CloseHandle (hObject=0x42c) returned 1 [0225.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.id_1622540890_.your_last_chance")) returned 1 [0225.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXDB2P~1.YOU")) returned 0x5b9630 [0225.433] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0225.434] GetProcessHeap () returned 0x580000 [0225.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7189e48 [0225.434] GetProcessHeap () returned 0x580000 [0225.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x719b678 [0225.434] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.434] ReadFile (in: hFile=0x42c, lpBuffer=0x7189e48, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e48*, lpNumberOfBytesRead=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.896] GetProcessHeap () returned 0x580000 [0233.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0233.897] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.897] WriteFile (in: hFile=0x42c, lpBuffer=0x719b678*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x719b678*, lpNumberOfBytesWritten=0x3bcff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.897] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.897] WriteFile (in: hFile=0x42c, lpBuffer=0x71ace77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x71ace77*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0233.898] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.898] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0233.898] CloseHandle (hObject=0x42c) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x719b678 | out: hHeap=0x580000) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7189e48 | out: hHeap=0x580000) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0239.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2ef43a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x341ac, dwReserved0=0x3bcfd28, dwReserved1=0x7189e48, cFileName="IXDB2.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXDB2P~1.YOU")) returned 0x5b9730 [0239.576] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.596] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", len=0x33 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned 1 [0239.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0239.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0239.597] CloseHandle (hObject=0x480) returned 1 [0239.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.id_1622540890_.your_last_chance")) returned 1 [0239.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPHT~1.YOU")) returned 0x5b9630 [0239.598] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0239.598] GetProcessHeap () returned 0x580000 [0239.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d21) returned 0x6d748d8 [0239.599] GetProcessHeap () returned 0x580000 [0239.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d21) returned 0x7111f48 [0239.599] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.599] ReadFile (in: hFile=0x480, lpBuffer=0x6d748d8, nNumberOfBytesToRead=0x3d00, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesRead=0x3bcff14*=0x3d00, lpOverlapped=0x0) returned 1 [0239.972] GetProcessHeap () returned 0x580000 [0239.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0239.972] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.972] WriteFile (in: hFile=0x480, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x3d00, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x3bcff14*=0x3d00, lpOverlapped=0x0) returned 1 [0239.972] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.972] WriteFile (in: hFile=0x480, lpBuffer=0x7115c47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7115c47*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0239.972] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.972] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0239.972] CloseHandle (hObject=0x480) returned 1 [0240.242] GetProcessHeap () returned 0x580000 [0240.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0240.242] GetProcessHeap () returned 0x580000 [0240.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0240.242] GetProcessHeap () returned 0x580000 [0240.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc68d3a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d29, dwReserved0=0x3bcfd28, dwReserved1=0x6d748d8, cFileName="OSPP.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPHT~1.YOU")) returned 0x5b9730 [0241.329] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.436] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML", len=0x3f | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned 1 [0241.437] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0241.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0241.568] CloseHandle (hObject=0x48c) returned 1 [0241.568] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml.id_1622540890_.your_last_chance")) returned 1 [0244.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b6fc00, ftCreationTime.dwHighDateTime=0x1c9fa26, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7b6fc00, ftLastWriteTime.dwHighDateTime=0x1c9fa26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~3.YOU")) returned 0x5b96f0 [0244.571] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0244.609] GetProcessHeap () returned 0x580000 [0244.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c10060 [0244.609] GetProcessHeap () returned 0x580000 [0244.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c10ae8 [0244.609] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.609] ReadFile (in: hFile=0x264, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x3bcff14*=0xa40, lpOverlapped=0x0) returned 1 [0244.625] GetProcessHeap () returned 0x580000 [0244.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0244.625] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.625] WriteFile (in: hFile=0x264, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x3bcff14*=0xa40, lpOverlapped=0x0) returned 1 [0244.625] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.625] WriteFile (in: hFile=0x264, lpBuffer=0x6c11527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11527*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0244.626] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.626] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0244.626] CloseHandle (hObject=0x264) returned 1 [0244.626] GetProcessHeap () returned 0x580000 [0244.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0244.626] GetProcessHeap () returned 0x580000 [0244.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0244.626] GetProcessHeap () returned 0x580000 [0244.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b6fc00, ftCreationTime.dwHighDateTime=0x1c9fa26, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc954f5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa80, dwReserved0=0x3bcfd28, dwReserved1=0x6c10060, cFileName="PGMN107.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~3.YOU")) returned 0x5b9730 [0249.275] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.388] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC", len=0x3e | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 1 [0249.389] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0249.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0249.389] CloseHandle (hObject=0x478) returned 1 [0249.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.id_1622540890_.your_last_chance")) returned 1 [0252.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0252.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51ad3ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS4BOX~1.YOU")) returned 0x5b96f0 [0252.925] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0252.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0252.955] GetProcessHeap () returned 0x580000 [0252.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10060 [0252.955] GetProcessHeap () returned 0x580000 [0252.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10ae8 [0252.955] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.955] ReadFile (in: hFile=0x47c, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x3bcff14*=0xa20, lpOverlapped=0x0) returned 1 [0252.965] GetProcessHeap () returned 0x580000 [0252.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.965] WriteFile (in: hFile=0x47c, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x3bcff14*=0xa20, lpOverlapped=0x0) returned 1 [0252.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.965] WriteFile (in: hFile=0x47c, lpBuffer=0x6c11507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11507*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0252.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.965] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0252.965] CloseHandle (hObject=0x47c) returned 1 [0252.965] GetProcessHeap () returned 0x580000 [0252.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0252.965] GetProcessHeap () returned 0x580000 [0252.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0252.966] GetProcessHeap () returned 0x580000 [0252.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51ad3ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce4c13e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa4a, dwReserved0=0x3bcfd28, dwReserved1=0x6c10060, cFileName="BS4BOXES.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS4BOX~1.YOU")) returned 0x5b9730 [0254.426] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.365] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML", len=0x3e | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML") returned 1 [0255.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f4c) returned 0x72e5948 [0255.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.509] CloseHandle (hObject=0x488) returned 1 [0258.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml.id_1622540890_.your_last_chance")) returned 1 [0258.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc98600, ftCreationTime.dwHighDateTime=0x1c94493, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fc98600, ftLastWriteTime.dwHighDateTime=0x1c94493, nFileSizeHigh=0x0, nFileSizeLow=0x11c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGNAVB~2.YOU")) returned 0x5b96f0 [0258.511] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0258.511] GetProcessHeap () returned 0x580000 [0258.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x65d9d0 [0258.511] GetProcessHeap () returned 0x580000 [0258.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x67ec60 [0258.511] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.511] ReadFile (in: hFile=0x488, lpBuffer=0x65d9d0, nNumberOfBytesToRead=0x11c0, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x65d9d0*, lpNumberOfBytesRead=0x3bcff14*=0x11c0, lpOverlapped=0x0) returned 1 [0258.528] GetProcessHeap () returned 0x580000 [0258.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.528] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.528] WriteFile (in: hFile=0x488, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x3bcff14*=0x11c0, lpOverlapped=0x0) returned 1 [0258.528] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.528] WriteFile (in: hFile=0x488, lpBuffer=0x67fe1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x67fe1f*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0258.528] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.528] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0258.528] CloseHandle (hObject=0x488) returned 1 [0258.528] GetProcessHeap () returned 0x580000 [0258.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0258.529] GetProcessHeap () returned 0x580000 [0258.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x580000) returned 1 [0258.529] GetProcessHeap () returned 0x580000 [0258.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfccc | out: lpFindFileData=0x3bcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc98600, ftCreationTime.dwHighDateTime=0x1c94493, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd19ddec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11e6, dwReserved0=0x3bcfd28, dwReserved1=0x65d9d0, cFileName="DGNAVBAR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGNAVB~2.YOU")) returned 0x5b9630 [0259.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.235] SysReAllocStringLen (in: pbstr=0x3bcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC", len=0x41 | out: pbstr=0x3bcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC") returned 1 [0259.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a0) returned 0x72e5948 [0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0259.354] CloseHandle (hObject=0x264) returned 1 [0259.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc.id_1622540890_.your_last_chance")) returned 1 [0259.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3bcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3bcfc74 | out: lpFindFileData=0x3bcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc912da00, ftCreationTime.dwHighDateTime=0x1c98d91, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc912da00, ftLastWriteTime.dwHighDateTime=0x1c98d91, nFileSizeHigh=0x0, nFileSizeLow=0x6f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STORYV~2.YOU")) returned 0x5b9630 [0259.355] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0259.356] GetProcessHeap () returned 0x580000 [0259.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6f81) returned 0x7043708 [0259.356] GetProcessHeap () returned 0x580000 [0259.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6f81) returned 0x6ec2488 [0259.356] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.356] ReadFile (in: hFile=0x264, lpBuffer=0x7043708, nNumberOfBytesToRead=0x6f60, lpNumberOfBytesRead=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x7043708*, lpNumberOfBytesRead=0x3bcff14*=0x6f60, lpOverlapped=0x0) returned 1 [0263.157] GetProcessHeap () returned 0x580000 [0263.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0263.158] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.158] WriteFile (in: hFile=0x264, lpBuffer=0x6ec2488*, nNumberOfBytesToWrite=0x6f60, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec2488*, lpNumberOfBytesWritten=0x3bcff14*=0x6f60, lpOverlapped=0x0) returned 1 [0264.702] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.702] WriteFile (in: hFile=0x264, lpBuffer=0x6ec93e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec93e7*, lpNumberOfBytesWritten=0x3bcff14*=0x20, lpOverlapped=0x0) returned 1 [0264.702] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.702] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3bcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3bcff14*=0x4, lpOverlapped=0x0) returned 1 [0264.702] CloseHandle (hObject=0x264) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec2488 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7043708 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 Thread: id = 25 os_tid = 0xa5c [0039.063] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.408] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.921] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.288] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.592] Sleep (dwMilliseconds=0x1) [0042.311] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.508] Sleep (dwMilliseconds=0x1) [0042.545] Sleep (dwMilliseconds=0x1) [0042.643] Sleep (dwMilliseconds=0x1) [0042.656] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.828] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.465] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.559] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.792] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.904] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.364] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.759] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.790] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.837] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.993] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.180] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.494] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.680] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.790] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.898] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.929] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.976] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.085] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.397] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.631] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.709] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.787] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.865] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.198] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.301] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.395] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.598] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.196] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.705] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.752] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.908] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.298] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.501] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.595] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.922] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.000] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.624] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.702] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.749] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.780] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.889] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.045] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.201] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.248] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.357] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.513] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.607] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.656] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.734] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.781] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.859] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.890] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.937] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.015] Sleep (dwMilliseconds=0x1) [0052.031] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.062] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.140] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.171] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.265] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.295] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.327] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.405] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.482] Sleep (dwMilliseconds=0x1) [0052.501] Sleep (dwMilliseconds=0x1) [0052.514] Sleep (dwMilliseconds=0x1) [0052.530] Sleep (dwMilliseconds=0x1) [0052.552] Sleep (dwMilliseconds=0x1) [0052.561] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.638] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.670] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.717] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.827] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] Sleep (dwMilliseconds=0x1) [0052.889] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.951] Sleep (dwMilliseconds=0x1) [0052.967] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.075] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.138] Sleep (dwMilliseconds=0x1) [0053.154] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.185] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.262] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.294] Sleep (dwMilliseconds=0x1) [0053.310] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.341] Sleep (dwMilliseconds=0x1) [0053.366] Sleep (dwMilliseconds=0x1) [0053.372] Sleep (dwMilliseconds=0x1) [0053.387] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.419] Sleep (dwMilliseconds=0x1) [0053.434] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.497] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.731] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.809] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.981] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.011] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.058] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.091] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.136] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.167] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.214] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.370] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.480] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.511] Sleep (dwMilliseconds=0x1) [0054.527] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.636] Sleep (dwMilliseconds=0x1) [0054.652] Sleep (dwMilliseconds=0x1) [0054.667] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.714] Sleep (dwMilliseconds=0x1) [0054.730] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.823] Sleep (dwMilliseconds=0x1) [0054.838] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] Sleep (dwMilliseconds=0x1) [0054.885] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.947] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.979] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.026] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.057] Sleep (dwMilliseconds=0x1) [0055.073] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.104] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.151] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.182] Sleep (dwMilliseconds=0x1) [0055.202] Sleep (dwMilliseconds=0x1) [0055.213] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.260] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] Sleep (dwMilliseconds=0x1) [0055.338] Sleep (dwMilliseconds=0x1) [0055.353] Sleep (dwMilliseconds=0x1) [0055.369] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.416] Sleep (dwMilliseconds=0x1) [0055.433] Sleep (dwMilliseconds=0x1) [0055.447] Sleep (dwMilliseconds=0x1) [0055.463] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.494] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.595] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.747] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x3d0ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0061.747] GetProcessHeap () returned 0x580000 [0061.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x68) returned 0x5b5bc8 [0061.747] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0070.282] CloseHandle (hObject=0x48c) returned 1 [0070.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.283] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance")) returned 1 [0076.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0076.677] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0076.677] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0076.678] GetProcessHeap () returned 0x580000 [0076.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f8d9a0 [0076.678] GetProcessHeap () returned 0x580000 [0076.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f9f1d0 [0076.678] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.678] ReadFile (in: hFile=0x48c, lpBuffer=0x6f8d9a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d9a0*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.275] GetProcessHeap () returned 0x580000 [0079.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0079.275] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.275] WriteFile (in: hFile=0x48c, lpBuffer=0x6f9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f1d0*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.276] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.276] WriteFile (in: hFile=0x48c, lpBuffer=0x6fb09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb09cf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.783] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.783] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.783] CloseHandle (hObject=0x48c) returned 1 [0079.783] GetProcessHeap () returned 0x580000 [0079.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9f1d0 | out: hHeap=0x580000) returned 1 [0079.784] GetProcessHeap () returned 0x580000 [0079.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f8d9a0 | out: hHeap=0x580000) returned 1 [0079.784] GetProcessHeap () returned 0x580000 [0079.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0079.784] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0x672b61c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaec5e, dwReserved0=0x3d0fd28, dwReserved1=0x6f8d9a0, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0079.784] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.819] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", len=0x69 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 1 [0080.819] GetProcessHeap () returned 0x580000 [0080.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0080.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.678] CloseHandle (hObject=0x444) returned 1 [0081.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id_1622540890_.your_last_chance")) returned 1 [0081.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b96f0 [0081.896] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.897] GetProcessHeap () returned 0x580000 [0081.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0081.897] GetProcessHeap () returned 0x580000 [0081.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0081.897] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.897] ReadFile (in: hFile=0x458, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0083.425] GetProcessHeap () returned 0x580000 [0083.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0083.425] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.425] WriteFile (in: hFile=0x458, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0083.426] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.426] WriteFile (in: hFile=0x458, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.645] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.645] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.645] CloseHandle (hObject=0x458) returned 1 [0083.645] GetProcessHeap () returned 0x580000 [0083.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0083.648] GetProcessHeap () returned 0x580000 [0083.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0083.649] GetProcessHeap () returned 0x580000 [0083.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0083.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69775560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91999, dwReserved0=0x580000, dwReserved1=0x6f094e8, cFileName="BRANDING.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRANDI~1.YOU")) returned 0x5b9730 [0083.650] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0088.229] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", len=0x4d | out: pbstr=0x3d0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 1 [0088.229] GetProcessHeap () returned 0x580000 [0088.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0088.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.351] CloseHandle (hObject=0x450) returned 1 [0088.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id_1622540890_.your_last_chance")) returned 1 [0088.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOLDST~2.YOU")) returned 0x5b96f0 [0088.352] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.352] GetProcessHeap () returned 0x580000 [0088.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb01) returned 0x6e26740 [0088.353] GetProcessHeap () returned 0x580000 [0088.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb01) returned 0x6d9f1d0 [0088.354] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.354] ReadFile (in: hFile=0x450, lpBuffer=0x6e26740, nNumberOfBytesToRead=0xeae0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e26740*, lpNumberOfBytesRead=0x3d0ff14*=0xeae0, lpOverlapped=0x0) returned 1 [0091.456] GetProcessHeap () returned 0x580000 [0091.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0091.456] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.456] WriteFile (in: hFile=0x450, lpBuffer=0x6d9f1d0*, nNumberOfBytesToWrite=0xeae0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesWritten=0x3d0ff14*=0xeae0, lpOverlapped=0x0) returned 1 [0091.458] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.458] WriteFile (in: hFile=0x450, lpBuffer=0x6dadcaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dadcaf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.458] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.458] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.458] CloseHandle (hObject=0x450) returned 1 [0091.458] GetProcessHeap () returned 0x580000 [0091.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0091.458] GetProcessHeap () returned 0x580000 [0091.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e26740 | out: hHeap=0x580000) returned 1 [0091.458] GetProcessHeap () returned 0x580000 [0091.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0091.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e1fe640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeb1e, dwReserved0=0x3d0fd28, dwReserved1=0x6e26740, cFileName="BOLDSTRI.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOLDST~2.YOU")) returned 0x5b96b0 [0091.625] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.669] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x3d0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 1 [0091.669] GetProcessHeap () returned 0x580000 [0091.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0091.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0091.670] CloseHandle (hObject=0x480) returned 1 [0091.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0092.774] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0092.774] GetProcessHeap () returned 0x580000 [0092.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7ea1) returned 0x6d93cd0 [0092.775] GetProcessHeap () returned 0x580000 [0092.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7ea1) returned 0x6c57108 [0092.775] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.775] ReadFile (in: hFile=0x480, lpBuffer=0x6d93cd0, nNumberOfBytesToRead=0x7e80, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d93cd0*, lpNumberOfBytesRead=0x3d0ff14*=0x7e80, lpOverlapped=0x0) returned 1 [0096.779] GetProcessHeap () returned 0x580000 [0096.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0096.779] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.780] WriteFile (in: hFile=0x480, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0x7e80, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x3d0ff14*=0x7e80, lpOverlapped=0x0) returned 1 [0096.780] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.780] WriteFile (in: hFile=0x480, lpBuffer=0x6c5ef87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5ef87*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0096.780] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.780] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0096.780] CloseHandle (hObject=0x480) returned 1 [0096.780] GetProcessHeap () returned 0x580000 [0096.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0096.780] GetProcessHeap () returned 0x580000 [0096.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d93cd0 | out: hHeap=0x580000) returned 1 [0096.780] GetProcessHeap () returned 0x580000 [0096.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0096.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x714b9b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7eb7, dwReserved0=0x3d0fd28, dwReserved1=0x6d93cd0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0096.781] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0097.971] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x3d0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 1 [0097.972] GetProcessHeap () returned 0x580000 [0097.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0097.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0101.003] CloseHandle (hObject=0x478) returned 1 [0101.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0102.026] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0102.026] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0102.026] GetProcessHeap () returned 0x580000 [0102.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6d04600 [0102.026] GetProcessHeap () returned 0x580000 [0102.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6f0c4f8 [0102.026] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.026] ReadFile (in: hFile=0x478, lpBuffer=0x6d04600, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04600*, lpNumberOfBytesRead=0x3d0ff14*=0x520, lpOverlapped=0x0) returned 1 [0102.039] GetProcessHeap () returned 0x580000 [0102.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.039] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.039] WriteFile (in: hFile=0x478, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x3d0ff14*=0x520, lpOverlapped=0x0) returned 1 [0102.039] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.039] WriteFile (in: hFile=0x478, lpBuffer=0x6f0ca17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca17*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.039] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.039] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.039] CloseHandle (hObject=0x478) returned 1 [0102.040] GetProcessHeap () returned 0x580000 [0102.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0102.040] GetProcessHeap () returned 0x580000 [0102.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04600 | out: hHeap=0x580000) returned 1 [0102.040] GetProcessHeap () returned 0x580000 [0102.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x746dca80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x3d0fd28, dwReserved1=0x6d04600, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0102.040] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.322] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", len=0x49 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 1 [0102.327] GetProcessHeap () returned 0x580000 [0102.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0102.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0102.327] CloseHandle (hObject=0x424) returned 1 [0102.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id_1622540890_.your_last_chance")) returned 1 [0102.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1ES~1.YOU")) returned 0x5b9630 [0102.328] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0102.328] GetProcessHeap () returned 0x580000 [0102.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6db0a00 [0102.328] GetProcessHeap () returned 0x580000 [0102.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc2230 [0102.329] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.329] ReadFile (in: hFile=0x424, lpBuffer=0x6db0a00, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db0a00*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.062] GetProcessHeap () returned 0x580000 [0106.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0106.063] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.063] WriteFile (in: hFile=0x424, lpBuffer=0x6dc2230*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc2230*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.063] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.063] WriteFile (in: hFile=0x424, lpBuffer=0x6dd3a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a2f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.350] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.350] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.350] CloseHandle (hObject=0x424) returned 1 [0106.351] GetProcessHeap () returned 0x580000 [0106.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc2230 | out: hHeap=0x580000) returned 1 [0106.353] GetProcessHeap () returned 0x580000 [0106.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db0a00 | out: hHeap=0x580000) returned 1 [0106.354] GetProcessHeap () returned 0x580000 [0106.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0106.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77012760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xff816, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="MSB1ESEN.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1ES~1.YOU")) returned 0x5b96f0 [0106.354] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.160] Sleep (dwMilliseconds=0x1) [0112.125] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", len=0x4d | out: pbstr=0x3d0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 1 [0112.125] GetProcessHeap () returned 0x580000 [0112.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.137] Sleep (dwMilliseconds=0x1) [0112.195] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.209] Sleep (dwMilliseconds=0x1) [0112.341] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", len=0x46 | out: pbstr=0x3d0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 1 [0112.341] GetProcessHeap () returned 0x580000 [0112.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.341] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.341] Sleep (dwMilliseconds=0x1) [0112.360] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", len=0x49 | out: pbstr=0x3d0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png") returned 1 [0112.360] GetProcessHeap () returned 0x580000 [0112.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.384] Sleep (dwMilliseconds=0x1) [0112.479] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", len=0x4e | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 1 [0112.479] GetProcessHeap () returned 0x580000 [0112.479] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.498] CloseHandle (hObject=0x488) returned 1 [0113.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id_1622540890_.your_last_chance")) returned 1 [0113.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SYBASE~1.YOU")) returned 0x5b9630 [0113.499] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.499] GetProcessHeap () returned 0x580000 [0113.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7461) returned 0x6c5d108 [0113.499] GetProcessHeap () returned 0x580000 [0113.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7461) returned 0x626d18 [0113.499] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.499] ReadFile (in: hFile=0x488, lpBuffer=0x6c5d108, nNumberOfBytesToRead=0x7440, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5d108*, lpNumberOfBytesRead=0x3d0ff14*=0x7440, lpOverlapped=0x0) returned 1 [0113.818] GetProcessHeap () returned 0x580000 [0113.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.818] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.818] WriteFile (in: hFile=0x488, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0x7440, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x3d0ff14*=0x7440, lpOverlapped=0x0) returned 1 [0113.818] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.818] WriteFile (in: hFile=0x488, lpBuffer=0x62e157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x62e157*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.819] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.819] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.819] CloseHandle (hObject=0x488) returned 1 [0113.819] GetProcessHeap () returned 0x580000 [0113.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0113.819] GetProcessHeap () returned 0x580000 [0113.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5d108 | out: hHeap=0x580000) returned 1 [0113.819] GetProcessHeap () returned 0x580000 [0113.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b755a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7482, dwReserved0=0x3d0fd28, dwReserved1=0x6c5d108, cFileName="Sybase.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SYBASE~1.YOU")) returned 0x5b9630 [0113.912] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.946] CloseHandle (hObject=0x488) returned 1 [0113.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN0034~1.YOU")) returned 0x5b9630 [0113.947] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.947] GetProcessHeap () returned 0x580000 [0113.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6c676b8 [0113.947] GetProcessHeap () returned 0x580000 [0113.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x677cd0 [0113.947] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.947] ReadFile (in: hFile=0x488, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x3d0ff14*=0x760, lpOverlapped=0x0) returned 1 [0113.955] GetProcessHeap () returned 0x580000 [0113.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.955] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.955] WriteFile (in: hFile=0x488, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x3d0ff14*=0x760, lpOverlapped=0x0) returned 1 [0113.955] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.955] WriteFile (in: hFile=0x488, lpBuffer=0x67842f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67842f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.955] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.955] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.955] CloseHandle (hObject=0x488) returned 1 [0113.955] GetProcessHeap () returned 0x580000 [0113.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0113.956] GetProcessHeap () returned 0x580000 [0113.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0113.956] GetProcessHeap () returned 0x580000 [0113.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b886500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x3d0fd28, dwReserved1=0x6c676b8, cFileName="IN00343_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN0034~1.YOU")) returned 0x5b9630 [0113.956] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0114.115] CloseHandle (hObject=0x454) returned 1 [0114.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.115] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id_1622540890_.your_last_chance")) returned 1 [0114.169] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01018~1.YOU")) returned 0x5b9730 [0114.170] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0114.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0114.170] GetProcessHeap () returned 0x580000 [0114.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f81) returned 0x6cf6cd8 [0114.170] GetProcessHeap () returned 0x580000 [0114.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f81) returned 0x6f2d6d8 [0114.170] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.170] ReadFile (in: hFile=0x454, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0x7f60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x3d0ff14*=0x7f60, lpOverlapped=0x0) returned 1 [0116.905] GetProcessHeap () returned 0x580000 [0116.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.905] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.905] WriteFile (in: hFile=0x454, lpBuffer=0x6f2d6d8*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2d6d8*, lpNumberOfBytesWritten=0x3d0ff14*=0x7f60, lpOverlapped=0x0) returned 1 [0116.905] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.905] WriteFile (in: hFile=0x454, lpBuffer=0x6f35637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f35637*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.905] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.905] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.905] CloseHandle (hObject=0x454) returned 1 [0116.906] GetProcessHeap () returned 0x580000 [0116.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2d6d8 | out: hHeap=0x580000) returned 1 [0116.906] GetProcessHeap () returned 0x580000 [0116.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0116.906] GetProcessHeap () returned 0x580000 [0116.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d4a48e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7f8c, dwReserved0=0x3d0fd28, dwReserved1=0x6cf6cd8, cFileName="J0101867.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01018~1.YOU")) returned 0x5b9630 [0117.996] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.565] CloseHandle (hObject=0x4a0) returned 1 [0118.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0261~1.YOU")) returned 0x5b9730 [0118.566] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.566] GetProcessHeap () returned 0x580000 [0118.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6001) returned 0x6f10048 [0118.567] GetProcessHeap () returned 0x580000 [0118.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6001) returned 0x6c4a808 [0118.567] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.567] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x5fe0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x3d0ff14*=0x5fe0, lpOverlapped=0x0) returned 1 [0119.551] GetProcessHeap () returned 0x580000 [0119.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.552] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.552] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c4a808*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesWritten=0x3d0ff14*=0x5fe0, lpOverlapped=0x0) returned 1 [0119.552] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.552] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c507e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c507e7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.552] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.552] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.552] CloseHandle (hObject=0x4a0) returned 1 [0119.782] GetProcessHeap () returned 0x580000 [0119.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0119.783] GetProcessHeap () returned 0x580000 [0119.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0119.783] GetProcessHeap () returned 0x580000 [0119.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7edef2a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6010, dwReserved0=0x3d0fd28, dwReserved1=0x6f10048, cFileName="SO02617_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0261~1.YOU")) returned 0x5b96f0 [0120.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.158] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", len=0x4c | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 1 [0120.158] GetProcessHeap () returned 0x580000 [0120.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1780) returned 0x6d06ca8 [0120.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.746] CloseHandle (hObject=0x48c) returned 1 [0120.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.id_1622540890_.your_last_chance")) returned 1 [0120.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J06999~1.YOU")) returned 0x5b9630 [0120.747] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.747] GetProcessHeap () returned 0x580000 [0120.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0120.747] GetProcessHeap () returned 0x580000 [0120.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6f19958 [0120.747] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.747] ReadFile (in: hFile=0x48c, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x3d0ff14*=0x1320, lpOverlapped=0x0) returned 1 [0120.765] GetProcessHeap () returned 0x580000 [0120.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.765] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.765] WriteFile (in: hFile=0x48c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x3d0ff14*=0x1320, lpOverlapped=0x0) returned 1 [0120.765] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.765] WriteFile (in: hFile=0x48c, lpBuffer=0x6f1ac77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ac77*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.765] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.766] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.766] CloseHandle (hObject=0x48c) returned 1 [0120.766] GetProcessHeap () returned 0x580000 [0120.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0120.766] GetProcessHeap () returned 0x580000 [0120.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0120.766] GetProcessHeap () returned 0x580000 [0120.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f989de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1347, dwReserved0=0x3d0fd28, dwReserved1=0x67ec60, cFileName="J0143749.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J06999~1.YOU")) returned 0x5b9630 [0120.766] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.776] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", len=0x51 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned 1 [0120.776] GetProcessHeap () returned 0x580000 [0120.776] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1844) returned 0x6e00ac0 [0120.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0122.225] CloseHandle (hObject=0x4a4) returned 1 [0122.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.id_1622540890_.your_last_chance")) returned 1 [0122.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0122.226] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0122.226] GetProcessHeap () returned 0x580000 [0122.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.226] GetProcessHeap () returned 0x580000 [0122.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.226] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.226] ReadFile (in: hFile=0x4a4, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x3d0ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.231] GetProcessHeap () returned 0x580000 [0122.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.231] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.231] WriteFile (in: hFile=0x4a4, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x3d0ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.231] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.232] WriteFile (in: hFile=0x4a4, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.232] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.232] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.232] CloseHandle (hObject=0x4a4) returned 1 [0122.232] GetProcessHeap () returned 0x580000 [0122.232] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.232] GetProcessHeap () returned 0x580000 [0122.232] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.232] GetProcessHeap () returned 0x580000 [0122.232] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80785f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ea, dwReserved0=0x3d0fd28, dwReserved1=0x678958, cFileName="Perspective.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0124.421] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.085] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", len=0x4e | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 1 [0125.085] GetProcessHeap () returned 0x580000 [0125.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1888) returned 0x6f42f08 [0125.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0126.845] CloseHandle (hObject=0x45c) returned 1 [0126.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0126.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id_1622540890_.your_last_chance")) returned 1 [0126.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0126.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Module.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0126.846] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0126.846] GetProcessHeap () returned 0x580000 [0126.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa961) returned 0x6d70678 [0126.846] GetProcessHeap () returned 0x580000 [0126.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa961) returned 0x6d15418 [0126.846] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.846] ReadFile (in: hFile=0x45c, lpBuffer=0x6d70678, nNumberOfBytesToRead=0xa940, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d70678*, lpNumberOfBytesRead=0x3d0ff14*=0xa940, lpOverlapped=0x0) returned 1 [0128.046] GetProcessHeap () returned 0x580000 [0128.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0128.047] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.047] WriteFile (in: hFile=0x45c, lpBuffer=0x6d15418*, nNumberOfBytesToWrite=0xa940, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d15418*, lpNumberOfBytesWritten=0x3d0ff14*=0xa940, lpOverlapped=0x0) returned 1 [0128.158] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.158] WriteFile (in: hFile=0x45c, lpBuffer=0x6d1fd57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1fd57*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.158] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.158] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.158] CloseHandle (hObject=0x45c) returned 1 [0128.158] GetProcessHeap () returned 0x580000 [0128.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d15418 | out: hHeap=0x580000) returned 1 [0128.159] GetProcessHeap () returned 0x580000 [0128.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d70678 | out: hHeap=0x580000) returned 1 [0128.159] GetProcessHeap () returned 0x580000 [0128.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0128.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8400e9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa981, dwReserved0=0x3d0fd28, dwReserved1=0x6d70678, cFileName="Module.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0128.160] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.203] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", len=0x3d | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned 1 [0128.203] GetProcessHeap () returned 0x580000 [0128.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19ac) returned 0x667250 [0128.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0129.285] CloseHandle (hObject=0x488) returned 1 [0129.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02938~1.YOU")) returned 0x5b9730 [0130.963] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0130.963] GetProcessHeap () returned 0x580000 [0130.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6c79898 [0130.963] GetProcessHeap () returned 0x580000 [0130.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6d00cd8 [0130.963] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.963] ReadFile (in: hFile=0x488, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3d0ff14*=0x800, lpOverlapped=0x0) returned 1 [0130.971] GetProcessHeap () returned 0x580000 [0130.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.972] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.972] WriteFile (in: hFile=0x488, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3d0ff14*=0x800, lpOverlapped=0x0) returned 1 [0130.972] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.972] WriteFile (in: hFile=0x488, lpBuffer=0x6d014d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014d7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.972] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.972] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.972] CloseHandle (hObject=0x488) returned 1 [0130.972] GetProcessHeap () returned 0x580000 [0130.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0130.972] GetProcessHeap () returned 0x580000 [0130.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0130.972] GetProcessHeap () returned 0x580000 [0130.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ad6120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x836, dwReserved0=0x3d0fd28, dwReserved1=0x6c79898, cFileName="J0293844.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02938~1.YOU")) returned 0x5b9730 [0130.972] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.647] CloseHandle (hObject=0x428) returned 1 [0132.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0132.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~2.YOU")) returned 0x5b9730 [0132.648] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.648] GetProcessHeap () returned 0x580000 [0132.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0132.648] GetProcessHeap () returned 0x580000 [0132.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0132.648] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.648] ReadFile (in: hFile=0x428, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.649] GetProcessHeap () returned 0x580000 [0132.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.650] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.650] WriteFile (in: hFile=0x428, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.650] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.650] WriteFile (in: hFile=0x428, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.650] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.650] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.650] CloseHandle (hObject=0x428) returned 1 [0132.650] GetProcessHeap () returned 0x580000 [0132.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0132.650] GetProcessHeap () returned 0x580000 [0132.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0132.650] GetProcessHeap () returned 0x580000 [0132.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86ae75a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3d0fd28, dwReserved1=0x61b540, cFileName="EXCEL_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~2.YOU")) returned 0x5b96f0 [0135.128] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.128] Sleep (dwMilliseconds=0x1) [0135.143] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", len=0x3a | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 1 [0135.143] GetProcessHeap () returned 0x580000 [0135.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0135.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0135.144] CloseHandle (hObject=0x438) returned 1 [0135.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id_1622540890_.your_last_chance")) returned 1 [0135.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBENGR~1.YOU")) returned 0x5b96f0 [0135.146] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0135.146] GetProcessHeap () returned 0x580000 [0135.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcfa1) returned 0x6d8e818 [0135.146] GetProcessHeap () returned 0x580000 [0135.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcfa1) returned 0x6f58108 [0135.146] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.146] ReadFile (in: hFile=0x438, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xcf80, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x3d0ff14*=0xcf80, lpOverlapped=0x0) returned 1 [0137.994] GetProcessHeap () returned 0x580000 [0137.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0137.994] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.994] WriteFile (in: hFile=0x438, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x3d0ff14*=0xcf80, lpOverlapped=0x0) returned 1 [0138.478] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.478] WriteFile (in: hFile=0x438, lpBuffer=0x6f65087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f65087*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.478] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.478] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.478] CloseHandle (hObject=0x438) returned 1 [0138.578] GetProcessHeap () returned 0x580000 [0138.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0138.579] GetProcessHeap () returned 0x580000 [0138.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0138.580] GetProcessHeap () returned 0x580000 [0138.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0139.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a265680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcfbc, dwReserved0=0x3d0fd28, dwReserved1=0x6d8e818, cFileName="DBENGR.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBENGR~1.YOU")) returned 0x5b9770 [0139.878] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.905] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0139.905] GetProcessHeap () returned 0x580000 [0139.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0139.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.926] CloseHandle (hObject=0x4a0) returned 1 [0139.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0139.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0139.950] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.950] GetProcessHeap () returned 0x580000 [0139.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x608e50 [0139.950] GetProcessHeap () returned 0x580000 [0139.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60b520 [0139.951] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.951] ReadFile (in: hFile=0x4a0, lpBuffer=0x608e50, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x608e50*, lpNumberOfBytesRead=0x3d0ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0139.953] GetProcessHeap () returned 0x580000 [0139.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0139.953] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x60b520*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b520*, lpNumberOfBytesWritten=0x3d0ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0139.953] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x60b6ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b6ff*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.953] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.953] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.954] CloseHandle (hObject=0x4a0) returned 1 [0139.954] GetProcessHeap () returned 0x580000 [0139.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60b520 | out: hHeap=0x580000) returned 1 [0139.954] GetProcessHeap () returned 0x580000 [0139.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x608e50 | out: hHeap=0x580000) returned 1 [0139.954] GetProcessHeap () returned 0x580000 [0139.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0140.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b087920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x3d0fd28, dwReserved1=0x608e50, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.140] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", len=0x56 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css") returned 1 [0140.141] GetProcessHeap () returned 0x580000 [0140.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0140.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.396] CloseHandle (hObject=0x488) returned 1 [0140.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance")) returned 1 [0140.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74e, dwReserved0=0x4c005f, dwReserved1=0x530041, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b9770 [0140.397] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.397] GetProcessHeap () returned 0x580000 [0140.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cda390 [0140.397] GetProcessHeap () returned 0x580000 [0140.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cdab18 [0140.397] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.397] ReadFile (in: hFile=0x488, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x3d0ff14*=0x740, lpOverlapped=0x0) returned 1 [0140.405] GetProcessHeap () returned 0x580000 [0140.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.405] WriteFile (in: hFile=0x488, lpBuffer=0x6cdab18*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab18*, lpNumberOfBytesWritten=0x3d0ff14*=0x740, lpOverlapped=0x0) returned 1 [0140.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.405] WriteFile (in: hFile=0x488, lpBuffer=0x6cdb257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb257*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.405] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.406] CloseHandle (hObject=0x488) returned 1 [0140.406] GetProcessHeap () returned 0x580000 [0140.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab18 | out: hHeap=0x580000) returned 1 [0140.406] GetProcessHeap () returned 0x580000 [0140.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0140.406] GetProcessHeap () returned 0x580000 [0140.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b4d8100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x772, dwReserved0=0x3d0fd28, dwReserved1=0x6cda390, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b9770 [0140.674] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.685] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK", len=0x42 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 1 [0140.685] GetProcessHeap () returned 0x580000 [0140.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0140.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.708] CloseHandle (hObject=0x478) returned 1 [0140.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~2.YOU")) returned 0x5b9730 [0140.710] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.710] GetProcessHeap () returned 0x580000 [0140.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.710] GetProcessHeap () returned 0x580000 [0140.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.710] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.710] ReadFile (in: hFile=0x478, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.711] GetProcessHeap () returned 0x580000 [0140.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0140.711] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.711] WriteFile (in: hFile=0x478, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.711] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.711] WriteFile (in: hFile=0x478, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.711] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.711] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.711] CloseHandle (hObject=0x478) returned 1 [0140.712] GetProcessHeap () returned 0x580000 [0140.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.712] GetProcessHeap () returned 0x580000 [0140.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.712] GetProcessHeap () returned 0x580000 [0140.712] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0141.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b7abb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3d0fd28, dwReserved1=0x61b540, cFileName="INFOPATH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~2.YOU")) returned 0x5b9730 [0141.553] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.556] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS", len=0x3a | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS") returned 1 [0141.556] GetProcessHeap () returned 0x580000 [0141.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0141.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0141.557] CloseHandle (hObject=0x478) returned 1 [0141.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.558] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.id_1622540890_.your_last_chance")) returned 1 [0141.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASTEL~1.YOU")) returned 0x5b9730 [0141.559] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pastel.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0141.559] GetProcessHeap () returned 0x580000 [0141.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0141.559] GetProcessHeap () returned 0x580000 [0141.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0141.559] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.560] ReadFile (in: hFile=0x478, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x3d0ff14*=0xd60, lpOverlapped=0x0) returned 1 [0141.573] GetProcessHeap () returned 0x580000 [0141.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0x478, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x3d0ff14*=0xd60, lpOverlapped=0x0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0x478, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.573] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.573] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.573] CloseHandle (hObject=0x478) returned 1 [0141.573] GetProcessHeap () returned 0x580000 [0141.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0141.574] GetProcessHeap () returned 0x580000 [0141.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0141.574] GetProcessHeap () returned 0x580000 [0141.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8c000820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x3d0fd28, dwReserved1=0x635768, cFileName="PASTEL.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PASTEL~1.YOU")) returned 0x5b9730 [0141.574] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.428] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK", len=0x41 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 1 [0146.428] GetProcessHeap () returned 0x580000 [0146.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0146.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.429] CloseHandle (hObject=0x454) returned 1 [0146.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0146.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~2.YOU")) returned 0x5b9730 [0146.436] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.437] GetProcessHeap () returned 0x580000 [0146.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0146.437] GetProcessHeap () returned 0x580000 [0146.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0146.437] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.437] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0146.438] GetProcessHeap () returned 0x580000 [0146.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0146.438] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.438] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0146.439] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.439] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0146.439] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.439] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0146.439] CloseHandle (hObject=0x454) returned 1 [0146.439] GetProcessHeap () returned 0x580000 [0146.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0146.439] GetProcessHeap () returned 0x580000 [0146.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0146.439] GetProcessHeap () returned 0x580000 [0146.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ee6b520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3d0fd28, dwReserved1=0x61b540, cFileName="ONENOTE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~2.YOU")) returned 0x5b9730 [0146.439] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.453] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", len=0x3c | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT") returned 1 [0146.453] GetProcessHeap () returned 0x580000 [0146.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0146.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0146.455] CloseHandle (hObject=0x4a0) returned 1 [0146.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id_1622540890_.your_last_chance")) returned 1 [0146.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b190700, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHS~1.YOU")) returned 0x5b9730 [0146.456] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0146.456] GetProcessHeap () returned 0x580000 [0146.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0146.456] GetProcessHeap () returned 0x580000 [0146.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702b3c8 [0146.457] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.457] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.108] GetProcessHeap () returned 0x580000 [0150.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0150.109] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.109] WriteFile (in: hFile=0x4a0, lpBuffer=0x702b3c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x702b3c8*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.109] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.109] WriteFile (in: hFile=0x4a0, lpBuffer=0x703cbc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x703cbc7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.118] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.118] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.118] CloseHandle (hObject=0x4a0) returned 1 [0151.764] GetProcessHeap () returned 0x580000 [0151.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702b3c8 | out: hHeap=0x580000) returned 1 [0151.766] GetProcessHeap () returned 0x580000 [0151.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0151.770] GetProcessHeap () returned 0x580000 [0151.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0152.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91b0d1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa03a6b, dwReserved0=0x580000, dwReserved1=0x6f66600, cFileName="PSRCHSRN.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHS~1.YOU")) returned 0x5b9730 [0152.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.054] CloseHandle (hObject=0x478) returned 1 [0152.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0152.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51ca82a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~2.YOU")) returned 0x5b9730 [0152.055] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.056] GetProcessHeap () returned 0x580000 [0152.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b5d0 [0152.056] GetProcessHeap () returned 0x580000 [0152.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b660 [0152.056] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.056] ReadFile (in: hFile=0x478, lpBuffer=0x61b5d0, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b5d0*, lpNumberOfBytesRead=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.057] GetProcessHeap () returned 0x580000 [0152.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.057] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.057] WriteFile (in: hFile=0x478, lpBuffer=0x61b660*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b660*, lpNumberOfBytesWritten=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.057] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.057] WriteFile (in: hFile=0x478, lpBuffer=0x61b6bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b6bf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.057] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.057] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.057] CloseHandle (hObject=0x478) returned 1 [0152.057] GetProcessHeap () returned 0x580000 [0152.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b660 | out: hHeap=0x580000) returned 1 [0152.057] GetProcessHeap () returned 0x580000 [0152.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b5d0 | out: hHeap=0x580000) returned 1 [0152.058] GetProcessHeap () returned 0x580000 [0152.058] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51ca82a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x923fa420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3d0fd28, dwReserved1=0x61b5d0, cFileName="VISIO.SHAPESHEET_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~2.YOU")) returned 0x5b9730 [0152.058] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.097] CloseHandle (hObject=0x478) returned 1 [0152.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0152.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x588a20, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIFEED~1.YOU")) returned 0x5b9730 [0152.099] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.099] GetProcessHeap () returned 0x580000 [0152.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ea1008 [0152.100] GetProcessHeap () returned 0x580000 [0152.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eb2838 [0152.100] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.100] ReadFile (in: hFile=0x478, lpBuffer=0x6ea1008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.692] GetProcessHeap () returned 0x580000 [0157.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0157.692] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] WriteFile (in: hFile=0x478, lpBuffer=0x6eb2838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2838*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.693] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.693] WriteFile (in: hFile=0x478, lpBuffer=0x6ec4037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4037*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.169] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.169] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.169] CloseHandle (hObject=0x478) returned 1 [0158.170] GetProcessHeap () returned 0x580000 [0158.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb2838 | out: hHeap=0x580000) returned 1 [0158.170] GetProcessHeap () returned 0x580000 [0158.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0158.170] GetProcessHeap () returned 0x580000 [0158.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0159.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95e4bf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x588a44, dwReserved0=0x3d0fd28, dwReserved1=0x6ea1008, cFileName="VISIO.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIFEED~1.YOU")) returned 0x5b9630 [0159.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.263] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", len=0x4b | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL") returned 1 [0159.263] GetProcessHeap () returned 0x580000 [0159.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0159.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0159.321] CloseHandle (hObject=0x49c) returned 1 [0159.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x45, dwReserved1=0x0, cFileName="GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GOSTTI~1.YOU")) returned 0x5b9630 [0159.323] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0159.323] GetProcessHeap () returned 0x580000 [0159.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x711c648 [0159.324] GetProcessHeap () returned 0x580000 [0159.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x712de78 [0159.324] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.325] ReadFile (in: hFile=0x49c, lpBuffer=0x711c648, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c648*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.410] GetProcessHeap () returned 0x580000 [0165.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0165.410] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.411] WriteFile (in: hFile=0x49c, lpBuffer=0x712de78*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x712de78*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.411] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.411] WriteFile (in: hFile=0x49c, lpBuffer=0x713f677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x713f677*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.411] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.411] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.411] CloseHandle (hObject=0x49c) returned 1 [0165.411] GetProcessHeap () returned 0x580000 [0165.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x712de78 | out: hHeap=0x580000) returned 1 [0165.412] GetProcessHeap () returned 0x580000 [0165.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c648 | out: hHeap=0x580000) returned 1 [0165.412] GetProcessHeap () returned 0x580000 [0165.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0169.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a353d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b9fa, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="GostTitle.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GOSTTI~1.YOU")) returned 0x5b9730 [0169.271] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.281] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", len=0x42 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 1 [0169.281] GetProcessHeap () returned 0x580000 [0169.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0169.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0169.287] CloseHandle (hObject=0x430) returned 1 [0169.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id_1622540890_.your_last_chance")) returned 1 [0169.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~2.YOU")) returned 0x5b9730 [0169.288] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0169.288] GetProcessHeap () returned 0x580000 [0169.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0169.289] GetProcessHeap () returned 0x580000 [0169.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0169.289] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.289] ReadFile (in: hFile=0x430, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x3d0ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.294] GetProcessHeap () returned 0x580000 [0169.294] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.294] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.294] WriteFile (in: hFile=0x430, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x3d0ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.294] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.294] WriteFile (in: hFile=0x430, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.294] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.294] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.294] CloseHandle (hObject=0x430) returned 1 [0169.294] GetProcessHeap () returned 0x580000 [0169.294] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0169.294] GetProcessHeap () returned 0x580000 [0169.294] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0169.294] GetProcessHeap () returned 0x580000 [0169.294] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.295] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c85f380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x3d0fd28, dwReserved1=0x5cf780, cFileName="ACTIVITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~2.YOU")) returned 0x5b9730 [0169.295] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.307] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", len=0x35 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 1 [0169.307] GetProcessHeap () returned 0x580000 [0169.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0169.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0169.308] CloseHandle (hObject=0x430) returned 1 [0169.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.id_1622540890_.your_last_chance")) returned 1 [0169.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXLIRM~2.YOU")) returned 0x5b9730 [0169.310] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0169.310] GetProcessHeap () returned 0x580000 [0169.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0169.310] GetProcessHeap () returned 0x580000 [0169.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0169.311] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.311] ReadFile (in: hFile=0x430, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.694] GetProcessHeap () returned 0x580000 [0173.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.694] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.695] WriteFile (in: hFile=0x430, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.695] WriteFile (in: hFile=0x430, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.695] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.695] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.128] CloseHandle (hObject=0x430) returned 1 [0174.128] GetProcessHeap () returned 0x580000 [0174.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0174.129] GetProcessHeap () returned 0x580000 [0174.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0174.129] GetProcessHeap () returned 0x580000 [0174.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f67ddc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13750, dwReserved0=0x3d0fd28, dwReserved1=0x6d7cfe8, cFileName="EXLIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXLIRM~2.YOU")) returned 0x5b96f0 [0176.796] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.825] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK", len=0x3f | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 1 [0176.825] GetProcessHeap () returned 0x580000 [0176.825] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x213c) returned 0x6f14048 [0176.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0176.826] CloseHandle (hObject=0x480) returned 1 [0176.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0176.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI42A0~1.YOU")) returned 0x5b96f0 [0176.828] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0176.828] GetProcessHeap () returned 0x580000 [0176.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0176.828] GetProcessHeap () returned 0x580000 [0176.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0176.828] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.828] ReadFile (in: hFile=0x480, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0176.829] GetProcessHeap () returned 0x580000 [0176.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.829] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.829] WriteFile (in: hFile=0x480, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x3d0ff14*=0x60, lpOverlapped=0x0) returned 1 [0176.830] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.830] WriteFile (in: hFile=0x480, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.830] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.830] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.830] CloseHandle (hObject=0x480) returned 1 [0176.830] GetProcessHeap () returned 0x580000 [0176.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0176.830] GetProcessHeap () returned 0x580000 [0176.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0176.830] GetProcessHeap () returned 0x580000 [0176.830] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.830] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa103aba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x3d0fd28, dwReserved1=0x61b540, cFileName="VISIO_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI42A0~1.YOU")) returned 0x5b96f0 [0176.830] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.890] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", len=0x46 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn") returned 1 [0176.890] GetProcessHeap () returned 0x580000 [0176.890] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0176.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.450] CloseHandle (hObject=0x470) returned 1 [0179.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.id_1622540890_.your_last_chance")) returned 1 [0179.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REVIEW~2.YOU")) returned 0x5b96f0 [0179.452] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.452] GetProcessHeap () returned 0x580000 [0179.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39c1) returned 0x6fbecc8 [0179.452] GetProcessHeap () returned 0x580000 [0179.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39c1) returned 0x708aa28 [0179.452] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.452] ReadFile (in: hFile=0x470, lpBuffer=0x6fbecc8, nNumberOfBytesToRead=0x39a0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbecc8*, lpNumberOfBytesRead=0x3d0ff14*=0x39a0, lpOverlapped=0x0) returned 1 [0179.954] GetProcessHeap () returned 0x580000 [0179.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.955] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.955] WriteFile (in: hFile=0x470, lpBuffer=0x708aa28*, nNumberOfBytesToWrite=0x39a0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x708aa28*, lpNumberOfBytesWritten=0x3d0ff14*=0x39a0, lpOverlapped=0x0) returned 1 [0179.955] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.955] WriteFile (in: hFile=0x470, lpBuffer=0x708e3c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x708e3c7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.955] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.955] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.955] CloseHandle (hObject=0x470) returned 1 [0179.955] GetProcessHeap () returned 0x580000 [0179.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708aa28 | out: hHeap=0x580000) returned 1 [0179.955] GetProcessHeap () returned 0x580000 [0179.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbecc8 | out: hHeap=0x580000) returned 1 [0179.955] GetProcessHeap () returned 0x580000 [0179.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0181.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2dfbea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39ce, dwReserved0=0x3d0fd28, dwReserved1=0x6fbecc8, cFileName="ReviewRouting_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REVIEW~2.YOU")) returned 0x5b9770 [0181.350] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.360] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", len=0x6b | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned 1 [0181.360] GetProcessHeap () returned 0x580000 [0181.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0181.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.334] CloseHandle (hObject=0x46c) returned 1 [0182.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.id_1622540890_.your_last_chance")) returned 1 [0182.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x2e0067, dwReserved1=0x640069, cFileName="AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL0D77~1.YOU")) returned 0x5b9770 [0182.336] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.336] GetProcessHeap () returned 0x580000 [0182.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3361) returned 0x6fad418 [0182.336] GetProcessHeap () returned 0x580000 [0182.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3361) returned 0x6dec6e0 [0182.336] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.336] ReadFile (in: hFile=0x46c, lpBuffer=0x6fad418, nNumberOfBytesToRead=0x3340, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad418*, lpNumberOfBytesRead=0x3d0ff14*=0x3340, lpOverlapped=0x0) returned 1 [0182.902] GetProcessHeap () returned 0x580000 [0182.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0182.902] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.903] WriteFile (in: hFile=0x46c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x3340, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x3d0ff14*=0x3340, lpOverlapped=0x0) returned 1 [0182.903] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.903] WriteFile (in: hFile=0x46c, lpBuffer=0x6defa1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6defa1f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.903] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.903] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.903] CloseHandle (hObject=0x46c) returned 1 [0183.027] GetProcessHeap () returned 0x580000 [0183.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0183.027] GetProcessHeap () returned 0x580000 [0183.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fad418 | out: hHeap=0x580000) returned 1 [0183.027] GetProcessHeap () returned 0x580000 [0183.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4a1a280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x337a, dwReserved0=0x3d0fd28, dwReserved1=0x6fad418, cFileName="AlertImage_ContactHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL0D77~1.YOU")) returned 0x5b9770 [0183.805] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.819] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", len=0x72 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned 1 [0183.820] GetProcessHeap () returned 0x580000 [0183.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0183.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0186.171] CloseHandle (hObject=0x43c) returned 1 [0186.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x6e0065, dwReserved1=0x730074, cFileName="Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTACH~1.YOU")) returned 0x5b96b0 [0186.187] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0186.188] GetProcessHeap () returned 0x580000 [0186.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36a1) returned 0x6d1e348 [0186.188] GetProcessHeap () returned 0x580000 [0186.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36a1) returned 0x6d219f8 [0186.188] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.188] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d1e348, nNumberOfBytesToRead=0x3680, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1e348*, lpNumberOfBytesRead=0x3d0ff14*=0x3680, lpOverlapped=0x0) returned 1 [0187.481] GetProcessHeap () returned 0x580000 [0187.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.481] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.481] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d219f8*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d219f8*, lpNumberOfBytesWritten=0x3d0ff14*=0x3680, lpOverlapped=0x0) returned 1 [0187.482] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.482] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d25077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d25077*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.482] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.482] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.482] CloseHandle (hObject=0x4ac) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d219f8 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1e348 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0188.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa75d76c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36b0, dwReserved0=0x3d0fd28, dwReserved1=0x6d1e348, cFileName="Attachments.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTACH~1.YOU")) returned 0x5b9770 [0188.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.078] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", len=0x45 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned 1 [0188.078] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2078) returned 0x6f14048 [0188.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0191.915] CloseHandle (hObject=0x430) returned 1 [0191.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP28B3~1.YOU")) returned 0x5b97b0 [0194.752] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0194.752] GetProcessHeap () returned 0x580000 [0194.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x6dc71d0 [0194.752] GetProcessHeap () returned 0x580000 [0194.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x636988 [0194.752] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.752] ReadFile (in: hFile=0x430, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x3d0ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0194.777] GetProcessHeap () returned 0x580000 [0194.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.777] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.777] WriteFile (in: hFile=0x430, lpBuffer=0x636988*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636988*, lpNumberOfBytesWritten=0x3d0ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0194.777] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.777] WriteFile (in: hFile=0x430, lpBuffer=0x638527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x638527*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.777] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.777] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.777] CloseHandle (hObject=0x430) returned 1 [0194.778] GetProcessHeap () returned 0x580000 [0194.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636988 | out: hHeap=0x580000) returned 1 [0194.778] GetProcessHeap () returned 0x580000 [0194.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0194.778] GetProcessHeap () returned 0x580000 [0194.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabb518e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bc5, dwReserved0=0x3d0fd28, dwReserved1=0x6dc71d0, cFileName="ZPDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP28B3~1.YOU")) returned 0x5b97b0 [0194.778] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.807] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x70 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0194.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0194.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0194.807] CloseHandle (hObject=0x450) returned 1 [0194.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0196.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x4e004f, dwReserved1=0x47002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0196.027] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0196.027] GetProcessHeap () returned 0x580000 [0196.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0196.028] GetProcessHeap () returned 0x580000 [0196.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0196.028] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.028] ReadFile (in: hFile=0x450, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x3d0ff14*=0x400, lpOverlapped=0x0) returned 1 [0196.033] GetProcessHeap () returned 0x580000 [0196.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.033] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.033] WriteFile (in: hFile=0x450, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x3d0ff14*=0x400, lpOverlapped=0x0) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x450, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.034] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.034] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.034] CloseHandle (hObject=0x450) returned 1 [0196.034] GetProcessHeap () returned 0x580000 [0196.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0196.034] GetProcessHeap () returned 0x580000 [0196.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0196.034] GetProcessHeap () returned 0x580000 [0196.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac75e840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x3d0fd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0198.916] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.916] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", len=0x44 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned 1 [0198.916] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0198.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.917] CloseHandle (hObject=0x488) returned 1 [0198.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR45~1.YOU")) returned 0x5b97f0 [0198.919] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.919] GetProcessHeap () returned 0x580000 [0198.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f01) returned 0x6dee6e0 [0198.919] GetProcessHeap () returned 0x580000 [0198.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f01) returned 0x6dc71d0 [0198.919] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.919] ReadFile (in: hFile=0x488, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1ee0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x3d0ff14*=0x1ee0, lpOverlapped=0x0) returned 1 [0198.945] GetProcessHeap () returned 0x580000 [0198.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0198.945] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.945] WriteFile (in: hFile=0x488, lpBuffer=0x6dc71d0*, nNumberOfBytesToWrite=0x1ee0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesWritten=0x3d0ff14*=0x1ee0, lpOverlapped=0x0) returned 1 [0198.946] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.946] WriteFile (in: hFile=0x488, lpBuffer=0x6dc90af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc90af*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.946] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.946] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.946] CloseHandle (hObject=0x488) returned 1 [0198.946] GetProcessHeap () returned 0x580000 [0198.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0198.946] GetProcessHeap () returned 0x580000 [0198.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0198.946] GetProcessHeap () returned 0x580000 [0198.946] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae30a800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f0d, dwReserved0=0x3d0fd28, dwReserved1=0x6dee6e0, cFileName="PDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR45~1.YOU")) returned 0x5b96b0 [0199.655] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.038] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", len=0x6f | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned 1 [0201.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0201.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.860] CloseHandle (hObject=0x450) returned 1 [0201.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0201.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x2e0072, dwReserved1=0x690067, cFileName="header.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0201.986] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0201.986] GetProcessHeap () returned 0x580000 [0201.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x6e063d0 [0201.987] GetProcessHeap () returned 0x580000 [0201.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x715c008 [0201.987] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.987] ReadFile (in: hFile=0x428, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6980, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x3d0ff14*=0x6980, lpOverlapped=0x0) returned 1 [0204.803] GetProcessHeap () returned 0x580000 [0204.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0204.803] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.803] WriteFile (in: hFile=0x428, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x3d0ff14*=0x6980, lpOverlapped=0x0) returned 1 [0204.803] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.803] WriteFile (in: hFile=0x428, lpBuffer=0x7162987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162987*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0204.804] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0204.804] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0204.804] CloseHandle (hObject=0x428) returned 1 [0204.804] GetProcessHeap () returned 0x580000 [0204.804] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0204.804] GetProcessHeap () returned 0x580000 [0204.804] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0204.804] GetProcessHeap () returned 0x580000 [0204.804] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0204.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1afad00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69b7, dwReserved0=0x3d0fd28, dwReserved1=0x6e063d0, cFileName="header.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0204.805] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0209.610] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x76 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0209.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0209.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.626] CloseHandle (hObject=0x3b8) returned 1 [0209.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0209.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5c0077, dwReserved1=0x410054, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.627] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.627] GetProcessHeap () returned 0x580000 [0209.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0209.627] GetProcessHeap () returned 0x580000 [0209.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0209.627] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x3d0ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.629] GetProcessHeap () returned 0x580000 [0209.629] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.629] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x3d0ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.629] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.629] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.629] CloseHandle (hObject=0x3b8) returned 1 [0209.630] GetProcessHeap () returned 0x580000 [0209.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0209.630] GetProcessHeap () returned 0x580000 [0209.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0209.630] GetProcessHeap () returned 0x580000 [0209.630] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0209.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48f35e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3d0fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.630] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.673] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x70 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0209.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0209.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.674] CloseHandle (hObject=0x484) returned 1 [0209.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.674] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0209.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x4e004f, dwReserved1=0x47002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.675] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.675] GetProcessHeap () returned 0x580000 [0209.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0209.675] GetProcessHeap () returned 0x580000 [0209.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0209.676] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.676] ReadFile (in: hFile=0x484, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x3d0ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.677] GetProcessHeap () returned 0x580000 [0209.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0209.677] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.677] WriteFile (in: hFile=0x484, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x3d0ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.677] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.677] WriteFile (in: hFile=0x484, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.677] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.677] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.677] CloseHandle (hObject=0x484) returned 1 [0209.678] GetProcessHeap () returned 0x580000 [0209.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0209.678] GetProcessHeap () returned 0x580000 [0209.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0209.678] GetProcessHeap () returned 0x580000 [0209.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0209.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4965a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3d0fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.678] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.703] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", len=0x6c | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned 1 [0209.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0209.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.704] CloseHandle (hObject=0x3b8) returned 1 [0209.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.id_1622540890_.your_last_chance")) returned 1 [0209.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b97f0 [0209.705] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.705] GetProcessHeap () returned 0x580000 [0209.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6f668d8 [0209.705] GetProcessHeap () returned 0x580000 [0209.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6c29878 [0209.705] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.705] ReadFile (in: hFile=0x3b8, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x3d0ff14*=0xde0, lpOverlapped=0x0) returned 1 [0209.755] GetProcessHeap () returned 0x580000 [0209.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0209.755] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.755] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x3d0ff14*=0xde0, lpOverlapped=0x0) returned 1 [0209.755] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.755] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c2a657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a657*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.755] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.756] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.756] CloseHandle (hObject=0x3b8) returned 1 [0209.756] GetProcessHeap () returned 0x580000 [0209.756] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0209.756] GetProcessHeap () returned 0x580000 [0209.756] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0209.756] GetProcessHeap () returned 0x580000 [0209.756] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0209.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a240e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x3d0fd28, dwReserved1=0x6f668d8, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b97f0 [0209.756] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.795] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", len=0x66 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned 1 [0209.795] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0209.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.796] CloseHandle (hObject=0x428) returned 1 [0209.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.id_1622540890_.your_last_chance")) returned 1 [0209.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b97f0 [0209.797] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.797] GetProcessHeap () returned 0x580000 [0209.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6f42f08 [0209.798] GetProcessHeap () returned 0x580000 [0209.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6f15f48 [0209.798] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.798] ReadFile (in: hFile=0x428, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1920, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x3d0ff14*=0x1920, lpOverlapped=0x0) returned 1 [0209.980] GetProcessHeap () returned 0x580000 [0209.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.980] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] WriteFile (in: hFile=0x428, lpBuffer=0x6f15f48*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15f48*, lpNumberOfBytesWritten=0x3d0ff14*=0x1920, lpOverlapped=0x0) returned 1 [0209.980] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] WriteFile (in: hFile=0x428, lpBuffer=0x6f17867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f17867*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.980] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.980] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.980] CloseHandle (hObject=0x428) returned 1 [0209.980] GetProcessHeap () returned 0x580000 [0209.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f15f48 | out: hHeap=0x580000) returned 1 [0209.980] GetProcessHeap () returned 0x580000 [0209.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0209.980] GetProcessHeap () returned 0x580000 [0209.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0214.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c5f580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x3d0fd28, dwReserved1=0x6f42f08, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b97b0 [0214.535] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.553] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", len=0x6b | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned 1 [0214.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0214.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0214.587] CloseHandle (hObject=0x45c) returned 1 [0214.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.id_1622540890_.your_last_chance")) returned 1 [0214.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b97f0 [0214.589] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0214.589] GetProcessHeap () returned 0x580000 [0214.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x6f19958 [0214.589] GetProcessHeap () returned 0x580000 [0214.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x6efb008 [0214.589] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.589] ReadFile (in: hFile=0x45c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x11c0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x3d0ff14*=0x11c0, lpOverlapped=0x0) returned 1 [0214.628] GetProcessHeap () returned 0x580000 [0214.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.628] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.628] WriteFile (in: hFile=0x45c, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x3d0ff14*=0x11c0, lpOverlapped=0x0) returned 1 [0214.628] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.628] WriteFile (in: hFile=0x45c, lpBuffer=0x6efc1c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc1c7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.628] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.628] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.628] CloseHandle (hObject=0x45c) returned 1 [0214.629] GetProcessHeap () returned 0x580000 [0214.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0214.629] GetProcessHeap () returned 0x580000 [0214.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0214.629] GetProcessHeap () returned 0x580000 [0214.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78b4f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11ee, dwReserved0=0x3d0fd28, dwReserved1=0x6f19958, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b97b0 [0214.629] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.645] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0214.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0214.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.692] CloseHandle (hObject=0x448) returned 1 [0214.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0214.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x460046, dwReserved1=0x47002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.693] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.693] GetProcessHeap () returned 0x580000 [0214.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x6094c8 [0214.693] GetProcessHeap () returned 0x580000 [0214.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x608c28 [0214.693] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.693] ReadFile (in: hFile=0x448, lpBuffer=0x6094c8, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6094c8*, lpNumberOfBytesRead=0x3d0ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0214.696] GetProcessHeap () returned 0x580000 [0214.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.696] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.696] WriteFile (in: hFile=0x448, lpBuffer=0x608c28*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x608c28*, lpNumberOfBytesWritten=0x3d0ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0214.696] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.696] WriteFile (in: hFile=0x448, lpBuffer=0x608e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x608e07*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.696] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.696] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.696] CloseHandle (hObject=0x448) returned 1 [0214.696] GetProcessHeap () returned 0x580000 [0214.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x608c28 | out: hHeap=0x580000) returned 1 [0214.697] GetProcessHeap () returned 0x580000 [0214.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6094c8 | out: hHeap=0x580000) returned 1 [0214.697] GetProcessHeap () returned 0x580000 [0214.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb794d4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x3d0fd28, dwReserved1=0x6094c8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.697] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.767] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS", len=0x45 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS") returned 1 [0214.768] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0214.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.768] CloseHandle (hObject=0x438) returned 1 [0214.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css.id_1622540890_.your_last_chance")) returned 1 [0214.769] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b96a700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b96a700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fbbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC8094~1.YOU")) returned 0x5b97b0 [0214.769] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.769] GetProcessHeap () returned 0x580000 [0214.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0214.770] GetProcessHeap () returned 0x580000 [0214.770] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0214.770] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.771] ReadFile (in: hFile=0x438, lpBuffer=0x7007128, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.158] GetProcessHeap () returned 0x580000 [0220.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0220.159] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.159] WriteFile (in: hFile=0x438, lpBuffer=0x7018958*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.159] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.159] WriteFile (in: hFile=0x438, lpBuffer=0x702a157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a157*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.159] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.159] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.159] CloseHandle (hObject=0x438) returned 1 [0220.159] GetProcessHeap () returned 0x580000 [0220.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0220.666] GetProcessHeap () returned 0x580000 [0220.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0220.666] GetProcessHeap () returned 0x580000 [0220.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b96a700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad5f600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe2, dwReserved0=0x3d0fd28, dwReserved1=0x7007128, cFileName="SCHEME02.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC8094~1.YOU")) returned 0x5b9730 [0221.651] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.680] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", len=0x47 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 1 [0221.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f1c) returned 0x6dee6e0 [0221.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.681] CloseHandle (hObject=0x460) returned 1 [0221.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id_1622540890_.your_last_chance")) returned 1 [0221.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFLIN~1.YOU")) returned 0x5b9730 [0221.682] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.682] GetProcessHeap () returned 0x580000 [0221.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x65d9d0 [0221.682] GetProcessHeap () returned 0x580000 [0221.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x67ec60 [0221.683] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.683] ReadFile (in: hFile=0x460, lpBuffer=0x65d9d0, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65d9d0*, lpNumberOfBytesRead=0x3d0ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.747] GetProcessHeap () returned 0x580000 [0221.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.747] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.747] WriteFile (in: hFile=0x460, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x3d0ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.747] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.748] WriteFile (in: hFile=0x460, lpBuffer=0x67f9bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f9bf*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.748] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.748] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.748] CloseHandle (hObject=0x460) returned 1 [0221.748] GetProcessHeap () returned 0x580000 [0221.748] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0221.748] GetProcessHeap () returned 0x580000 [0221.748] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x580000) returned 1 [0221.748] GetProcessHeap () returned 0x580000 [0221.748] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbc8c240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x3d0fd28, dwReserved1=0x65d9d0, cFileName="OFFLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFLIN~1.YOU")) returned 0x5b9730 [0221.748] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.804] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", len=0x48 | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 1 [0221.804] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0221.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.804] CloseHandle (hObject=0x460) returned 1 [0221.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id_1622540890_.your_last_chance")) returned 1 [0221.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INCOMI~1.YOU")) returned 0x5b9730 [0221.806] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.806] GetProcessHeap () returned 0x580000 [0221.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0221.806] GetProcessHeap () returned 0x580000 [0221.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0221.806] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.806] ReadFile (in: hFile=0x460, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3d0ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.824] GetProcessHeap () returned 0x580000 [0221.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.824] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.824] WriteFile (in: hFile=0x460, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3d0ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.824] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.824] WriteFile (in: hFile=0x460, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.824] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.824] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.824] CloseHandle (hObject=0x460) returned 1 [0222.238] GetProcessHeap () returned 0x580000 [0222.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0222.238] GetProcessHeap () returned 0x580000 [0222.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0222.238] GetProcessHeap () returned 0x580000 [0222.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0223.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbd4a920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6da, dwReserved0=0x3d0fd28, dwReserved1=0x6c79898, cFileName="INCOMING.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INCOMI~1.YOU")) returned 0x5b9630 [0223.643] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.722] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", len=0x5d | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned 1 [0223.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0223.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0223.736] CloseHandle (hObject=0x48c) returned 1 [0223.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.id_1622540890_.your_last_chance")) returned 1 [0223.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~3.YOU")) returned 0x5b96f0 [0223.738] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0223.738] GetProcessHeap () returned 0x580000 [0223.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0223.738] GetProcessHeap () returned 0x580000 [0223.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0223.738] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.738] ReadFile (in: hFile=0x48c, lpBuffer=0x70904c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.315] GetProcessHeap () returned 0x580000 [0228.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0228.315] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.315] WriteFile (in: hFile=0x48c, lpBuffer=0x70a1cf8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.315] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.316] WriteFile (in: hFile=0x48c, lpBuffer=0x70b34f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b34f7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0228.316] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.316] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0228.316] CloseHandle (hObject=0x48c) returned 1 [0228.316] GetProcessHeap () returned 0x580000 [0228.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0228.316] GetProcessHeap () returned 0x580000 [0228.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0228.316] GetProcessHeap () returned 0x580000 [0228.316] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf9b1760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17e51, dwReserved0=0x3d0fd28, dwReserved1=0x70904c8, cFileName="StarterApplicationDescriptors.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STARTE~3.YOU")) returned 0x5b9630 [0230.593] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.960] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", len=0x3b | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 1 [0230.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0230.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0230.961] CloseHandle (hObject=0x3f4) returned 1 [0230.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.id_1622540890_.your_last_chance")) returned 1 [0230.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~3.YOU")) returned 0x5b9630 [0230.962] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0230.962] GetProcessHeap () returned 0x580000 [0230.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7618058 [0230.963] GetProcessHeap () returned 0x580000 [0230.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7629888 [0230.964] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.964] ReadFile (in: hFile=0x3f4, lpBuffer=0x7618058, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7618058*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.116] GetProcessHeap () returned 0x580000 [0238.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0238.116] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.116] WriteFile (in: hFile=0x3f4, lpBuffer=0x7629888*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7629888*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.279] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.279] WriteFile (in: hFile=0x3f4, lpBuffer=0x763b087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x763b087*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.279] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.279] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.279] CloseHandle (hObject=0x3f4) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7629888 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7618058 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0240.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc6247e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19424, dwReserved0=0x3d0fd28, dwReserved1=0x7618058, cFileName="mscss7wre_en.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~3.YOU")) returned 0x5b9730 [0240.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.655] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML", len=0x4e | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned 1 [0240.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0240.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.705] CloseHandle (hObject=0x428) returned 1 [0240.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml.id_1622540890_.your_last_chance")) returned 1 [0240.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YADD62~1.YOU")) returned 0x5b9730 [0240.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.706] GetProcessHeap () returned 0x580000 [0240.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09c70 [0240.706] GetProcessHeap () returned 0x580000 [0240.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09fd8 [0240.706] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.706] ReadFile (in: hFile=0x428, lpBuffer=0x6d09c70, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09c70*, lpNumberOfBytesRead=0x3d0ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.761] GetProcessHeap () returned 0x580000 [0240.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.761] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.761] WriteFile (in: hFile=0x428, lpBuffer=0x6d09fd8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09fd8*, lpNumberOfBytesWritten=0x3d0ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.761] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.761] WriteFile (in: hFile=0x428, lpBuffer=0x6d0a2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a2f7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.761] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.761] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.761] CloseHandle (hObject=0x428) returned 1 [0240.762] GetProcessHeap () returned 0x580000 [0240.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09fd8 | out: hHeap=0x580000) returned 1 [0240.762] GetProcessHeap () returned 0x580000 [0240.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09c70 | out: hHeap=0x580000) returned 1 [0240.762] GetProcessHeap () returned 0x580000 [0240.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc706a0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x3d0fd28, dwReserved1=0x6d09c70, cFileName="YAHOO.CO.UK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YADD62~1.YOU")) returned 0x5b9730 [0240.762] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.807] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", len=0x4c | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned 1 [0240.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0240.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.895] CloseHandle (hObject=0x264) returned 1 [0240.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.897] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x450043, dwReserved1=0x0, cFileName="FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLASHN~1.YOU")) returned 0x5b9730 [0240.897] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.897] GetProcessHeap () returned 0x580000 [0240.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0240.897] GetProcessHeap () returned 0x580000 [0240.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0240.897] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.897] ReadFile (in: hFile=0x264, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x3d0ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.907] GetProcessHeap () returned 0x580000 [0240.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.907] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.907] WriteFile (in: hFile=0x264, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x3d0ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.907] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.907] WriteFile (in: hFile=0x264, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.907] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.907] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.908] CloseHandle (hObject=0x264) returned 1 [0240.908] GetProcessHeap () returned 0x580000 [0240.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0240.908] GetProcessHeap () returned 0x580000 [0240.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0240.908] GetProcessHeap () returned 0x580000 [0240.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc71c0d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x3d0fd28, dwReserved1=0x6d0a340, cFileName="FLASH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLASHN~1.YOU")) returned 0x5b9630 [0241.850] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.867] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML", len=0x3f | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned 1 [0241.868] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0241.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0245.342] CloseHandle (hObject=0x45c) returned 1 [0245.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.343] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml.id_1622540890_.your_last_chance")) returned 1 [0245.343] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc63d500, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc63d500, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x2936, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~1.YOU")) returned 0x5b96f0 [0245.344] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0245.344] GetProcessHeap () returned 0x580000 [0245.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2941) returned 0x7111f48 [0245.344] GetProcessHeap () returned 0x580000 [0245.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2941) returned 0x6e32d50 [0245.344] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.344] ReadFile (in: hFile=0x45c, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x2920, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x3d0ff14*=0x2920, lpOverlapped=0x0) returned 1 [0245.381] GetProcessHeap () returned 0x580000 [0245.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0245.382] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.382] WriteFile (in: hFile=0x45c, lpBuffer=0x6e32d50*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesWritten=0x3d0ff14*=0x2920, lpOverlapped=0x0) returned 1 [0245.382] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.382] WriteFile (in: hFile=0x45c, lpBuffer=0x6e3566f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3566f*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0245.382] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.382] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0245.382] CloseHandle (hObject=0x45c) returned 1 [0245.382] GetProcessHeap () returned 0x580000 [0245.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0245.382] GetProcessHeap () returned 0x580000 [0245.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0245.382] GetProcessHeap () returned 0x580000 [0245.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc63d500, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9c737a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x295a, dwReserved0=0x3d0fd28, dwReserved1=0x7111f48, cFileName="PGMN020.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~1.YOU")) returned 0x5b9730 [0249.276] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.391] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV", len=0x3e | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 1 [0249.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0249.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0252.980] CloseHandle (hObject=0x47c) returned 1 [0252.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0252.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.id_1622540890_.your_last_chance")) returned 1 [0252.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0252.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfe5500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfe5500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xa7190, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BROCHU~1.YOU")) returned 0x5b96f0 [0252.981] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0252.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0252.981] GetProcessHeap () returned 0x580000 [0252.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead008 [0252.982] GetProcessHeap () returned 0x580000 [0252.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0252.982] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.982] ReadFile (in: hFile=0x47c, lpBuffer=0x6ead008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead008*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.350] GetProcessHeap () returned 0x580000 [0257.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0257.350] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.351] WriteFile (in: hFile=0x47c, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.351] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.351] WriteFile (in: hFile=0x47c, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x3d0ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.870] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.870] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3d0ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.870] CloseHandle (hObject=0x47c) returned 1 [0258.304] GetProcessHeap () returned 0x580000 [0258.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0258.305] GetProcessHeap () returned 0x580000 [0258.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead008 | out: hHeap=0x580000) returned 1 [0258.311] GetProcessHeap () returned 0x580000 [0258.311] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0259.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fccc | out: lpFindFileData=0x3d0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfe5500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd139e500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa71b4, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="BROCHURE.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BROCHU~1.YOU")) returned 0x5b9630 [0259.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.233] SysReAllocStringLen (in: pbstr=0x3d0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC", len=0x3e | out: pbstr=0x3d0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC") returned 1 [0259.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c0) returned 0x72e5948 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0259.383] CloseHandle (hObject=0x450) returned 1 [0259.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3d0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3d0fc74 | out: lpFindFileData=0x3d0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x12a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBHED98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBHED~1.YOU")) returned 0x5b9630 [0259.384] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0259.385] GetProcessHeap () returned 0x580000 [0259.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71acea8 [0259.385] GetProcessHeap () returned 0x580000 [0259.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71be6d8 [0259.386] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.386] ReadFile (in: hFile=0x450, lpBuffer=0x71acea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3d0ff14, lpOverlapped=0x0 | out: lpBuffer=0x71acea8*, lpNumberOfBytesRead=0x3d0ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 26 os_tid = 0xa60 [0039.063] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.408] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.815] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.288] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.592] Sleep (dwMilliseconds=0x1) [0042.312] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.508] Sleep (dwMilliseconds=0x1) [0042.545] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.656] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.828] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.135] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.434] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.591] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.870] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.017] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.447] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.603] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.071] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.149] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.227] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.306] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.336] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.383] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.461] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.539] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.132] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.241] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.529] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.600] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.834] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.912] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.114] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.816] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.128] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.284] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.518] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.674] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.064] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.220] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.267] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.766] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.078] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.125] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.281] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.312] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.390] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.437] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.671] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.560] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.703] Sleep (dwMilliseconds=0x1) [0051.718] Sleep (dwMilliseconds=0x1) [0051.734] Sleep (dwMilliseconds=0x1) [0051.750] Sleep (dwMilliseconds=0x1) [0051.765] Sleep (dwMilliseconds=0x1) [0051.781] Sleep (dwMilliseconds=0x1) [0051.796] Sleep (dwMilliseconds=0x1) [0051.812] Sleep (dwMilliseconds=0x1) [0051.828] Sleep (dwMilliseconds=0x1) [0051.843] Sleep (dwMilliseconds=0x1) [0051.859] Sleep (dwMilliseconds=0x1) [0051.874] Sleep (dwMilliseconds=0x1) [0051.890] Sleep (dwMilliseconds=0x1) [0051.906] Sleep (dwMilliseconds=0x1) [0051.921] Sleep (dwMilliseconds=0x1) [0051.937] Sleep (dwMilliseconds=0x1) [0051.952] Sleep (dwMilliseconds=0x1) [0051.968] Sleep (dwMilliseconds=0x1) [0051.983] Sleep (dwMilliseconds=0x1) [0051.999] Sleep (dwMilliseconds=0x1) [0052.015] Sleep (dwMilliseconds=0x1) [0052.031] Sleep (dwMilliseconds=0x1) [0052.046] Sleep (dwMilliseconds=0x1) [0052.062] Sleep (dwMilliseconds=0x1) [0052.077] Sleep (dwMilliseconds=0x1) [0052.094] Sleep (dwMilliseconds=0x1) [0052.108] Sleep (dwMilliseconds=0x1) [0052.124] Sleep (dwMilliseconds=0x1) [0052.140] Sleep (dwMilliseconds=0x1) [0052.155] Sleep (dwMilliseconds=0x1) [0052.171] Sleep (dwMilliseconds=0x1) [0052.192] Sleep (dwMilliseconds=0x1) [0052.202] Sleep (dwMilliseconds=0x1) [0052.218] Sleep (dwMilliseconds=0x1) [0052.233] Sleep (dwMilliseconds=0x1) [0052.249] Sleep (dwMilliseconds=0x1) [0052.265] Sleep (dwMilliseconds=0x1) [0052.280] Sleep (dwMilliseconds=0x1) [0052.296] Sleep (dwMilliseconds=0x1) [0052.311] Sleep (dwMilliseconds=0x1) [0052.327] Sleep (dwMilliseconds=0x1) [0052.342] Sleep (dwMilliseconds=0x1) [0052.358] Sleep (dwMilliseconds=0x1) [0052.374] Sleep (dwMilliseconds=0x1) [0052.389] Sleep (dwMilliseconds=0x1) [0052.405] Sleep (dwMilliseconds=0x1) [0052.420] Sleep (dwMilliseconds=0x1) [0052.436] Sleep (dwMilliseconds=0x1) [0052.451] Sleep (dwMilliseconds=0x1) [0052.467] Sleep (dwMilliseconds=0x1) [0052.483] Sleep (dwMilliseconds=0x1) [0052.501] Sleep (dwMilliseconds=0x1) [0052.514] Sleep (dwMilliseconds=0x1) [0052.530] Sleep (dwMilliseconds=0x1) [0052.552] Sleep (dwMilliseconds=0x1) [0052.561] Sleep (dwMilliseconds=0x1) [0052.576] Sleep (dwMilliseconds=0x1) [0052.592] Sleep (dwMilliseconds=0x1) [0052.608] Sleep (dwMilliseconds=0x1) [0052.623] Sleep (dwMilliseconds=0x1) [0052.639] Sleep (dwMilliseconds=0x1) [0052.654] Sleep (dwMilliseconds=0x1) [0052.670] Sleep (dwMilliseconds=0x1) [0052.686] Sleep (dwMilliseconds=0x1) [0052.701] Sleep (dwMilliseconds=0x1) [0052.717] Sleep (dwMilliseconds=0x1) [0052.732] Sleep (dwMilliseconds=0x1) [0052.748] Sleep (dwMilliseconds=0x1) [0052.763] Sleep (dwMilliseconds=0x1) [0052.779] Sleep (dwMilliseconds=0x1) [0052.795] Sleep (dwMilliseconds=0x1) [0052.810] Sleep (dwMilliseconds=0x1) [0052.827] Sleep (dwMilliseconds=0x1) [0052.842] Sleep (dwMilliseconds=0x1) [0052.857] Sleep (dwMilliseconds=0x1) [0052.873] Sleep (dwMilliseconds=0x1) [0052.889] Sleep (dwMilliseconds=0x1) [0052.904] Sleep (dwMilliseconds=0x1) [0052.919] Sleep (dwMilliseconds=0x1) [0052.935] Sleep (dwMilliseconds=0x1) [0052.951] Sleep (dwMilliseconds=0x1) [0052.967] Sleep (dwMilliseconds=0x1) [0052.982] Sleep (dwMilliseconds=0x1) [0052.998] Sleep (dwMilliseconds=0x1) [0053.013] Sleep (dwMilliseconds=0x1) [0053.029] Sleep (dwMilliseconds=0x1) [0053.044] Sleep (dwMilliseconds=0x1) [0053.060] Sleep (dwMilliseconds=0x1) [0053.076] Sleep (dwMilliseconds=0x1) [0053.091] Sleep (dwMilliseconds=0x1) [0053.115] Sleep (dwMilliseconds=0x1) [0053.122] Sleep (dwMilliseconds=0x1) [0053.138] Sleep (dwMilliseconds=0x1) [0053.154] Sleep (dwMilliseconds=0x1) [0053.169] Sleep (dwMilliseconds=0x1) [0053.185] Sleep (dwMilliseconds=0x1) [0053.204] Sleep (dwMilliseconds=0x1) [0053.217] Sleep (dwMilliseconds=0x1) [0053.231] Sleep (dwMilliseconds=0x1) [0053.247] Sleep (dwMilliseconds=0x1) [0053.263] Sleep (dwMilliseconds=0x1) [0053.278] Sleep (dwMilliseconds=0x1) [0053.294] Sleep (dwMilliseconds=0x1) [0053.310] Sleep (dwMilliseconds=0x1) [0053.325] Sleep (dwMilliseconds=0x1) [0053.341] Sleep (dwMilliseconds=0x1) [0053.366] Sleep (dwMilliseconds=0x1) [0053.372] Sleep (dwMilliseconds=0x1) [0053.388] Sleep (dwMilliseconds=0x1) [0053.403] Sleep (dwMilliseconds=0x1) [0053.419] Sleep (dwMilliseconds=0x1) [0053.435] Sleep (dwMilliseconds=0x1) [0053.450] Sleep (dwMilliseconds=0x1) [0053.466] Sleep (dwMilliseconds=0x1) [0053.481] Sleep (dwMilliseconds=0x1) [0053.497] Sleep (dwMilliseconds=0x1) [0053.512] Sleep (dwMilliseconds=0x1) [0053.528] Sleep (dwMilliseconds=0x1) [0053.544] Sleep (dwMilliseconds=0x1) [0053.559] Sleep (dwMilliseconds=0x1) [0053.575] Sleep (dwMilliseconds=0x1) [0053.591] Sleep (dwMilliseconds=0x1) [0053.606] Sleep (dwMilliseconds=0x1) [0053.622] Sleep (dwMilliseconds=0x1) [0053.637] Sleep (dwMilliseconds=0x1) [0053.653] Sleep (dwMilliseconds=0x1) [0053.668] Sleep (dwMilliseconds=0x1) [0053.684] Sleep (dwMilliseconds=0x1) [0053.700] Sleep (dwMilliseconds=0x1) [0053.715] Sleep (dwMilliseconds=0x1) [0053.731] Sleep (dwMilliseconds=0x1) [0053.746] Sleep (dwMilliseconds=0x1) [0053.762] Sleep (dwMilliseconds=0x1) [0053.778] Sleep (dwMilliseconds=0x1) [0053.793] Sleep (dwMilliseconds=0x1) [0053.809] Sleep (dwMilliseconds=0x1) [0053.824] Sleep (dwMilliseconds=0x1) [0053.840] Sleep (dwMilliseconds=0x1) [0053.856] Sleep (dwMilliseconds=0x1) [0053.871] Sleep (dwMilliseconds=0x1) [0053.887] Sleep (dwMilliseconds=0x1) [0053.902] Sleep (dwMilliseconds=0x1) [0053.918] Sleep (dwMilliseconds=0x1) [0053.935] Sleep (dwMilliseconds=0x1) [0053.949] Sleep (dwMilliseconds=0x1) [0053.965] Sleep (dwMilliseconds=0x1) [0053.981] Sleep (dwMilliseconds=0x1) [0053.996] Sleep (dwMilliseconds=0x1) [0054.012] Sleep (dwMilliseconds=0x1) [0054.027] Sleep (dwMilliseconds=0x1) [0054.043] Sleep (dwMilliseconds=0x1) [0054.059] Sleep (dwMilliseconds=0x1) [0054.074] Sleep (dwMilliseconds=0x1) [0054.091] Sleep (dwMilliseconds=0x1) [0054.105] Sleep (dwMilliseconds=0x1) [0054.121] Sleep (dwMilliseconds=0x1) [0054.137] Sleep (dwMilliseconds=0x1) [0054.152] Sleep (dwMilliseconds=0x1) [0054.168] Sleep (dwMilliseconds=0x1) [0054.183] Sleep (dwMilliseconds=0x1) [0054.203] Sleep (dwMilliseconds=0x1) [0054.215] Sleep (dwMilliseconds=0x1) [0054.230] Sleep (dwMilliseconds=0x1) [0054.246] Sleep (dwMilliseconds=0x1) [0054.261] Sleep (dwMilliseconds=0x1) [0054.277] Sleep (dwMilliseconds=0x1) [0054.292] Sleep (dwMilliseconds=0x1) [0054.308] Sleep (dwMilliseconds=0x1) [0054.325] Sleep (dwMilliseconds=0x1) [0054.340] Sleep (dwMilliseconds=0x1) [0054.355] Sleep (dwMilliseconds=0x1) [0054.371] Sleep (dwMilliseconds=0x1) [0054.386] Sleep (dwMilliseconds=0x1) [0054.402] Sleep (dwMilliseconds=0x1) [0054.417] Sleep (dwMilliseconds=0x1) [0054.433] Sleep (dwMilliseconds=0x1) [0054.448] Sleep (dwMilliseconds=0x1) [0054.464] Sleep (dwMilliseconds=0x1) [0054.480] Sleep (dwMilliseconds=0x1) [0054.495] Sleep (dwMilliseconds=0x1) [0054.511] Sleep (dwMilliseconds=0x1) [0054.527] Sleep (dwMilliseconds=0x1) [0054.542] Sleep (dwMilliseconds=0x1) [0054.565] Sleep (dwMilliseconds=0x1) [0054.573] Sleep (dwMilliseconds=0x1) [0054.589] Sleep (dwMilliseconds=0x1) [0054.604] Sleep (dwMilliseconds=0x1) [0054.620] Sleep (dwMilliseconds=0x1) [0054.636] Sleep (dwMilliseconds=0x1) [0054.652] Sleep (dwMilliseconds=0x1) [0054.667] Sleep (dwMilliseconds=0x1) [0054.682] Sleep (dwMilliseconds=0x1) [0054.698] Sleep (dwMilliseconds=0x1) [0054.714] Sleep (dwMilliseconds=0x1) [0054.730] Sleep (dwMilliseconds=0x1) [0054.745] Sleep (dwMilliseconds=0x1) [0054.760] Sleep (dwMilliseconds=0x1) [0054.776] Sleep (dwMilliseconds=0x1) [0054.791] Sleep (dwMilliseconds=0x1) [0054.807] Sleep (dwMilliseconds=0x1) [0054.823] Sleep (dwMilliseconds=0x1) [0054.839] Sleep (dwMilliseconds=0x1) [0054.854] Sleep (dwMilliseconds=0x1) [0054.870] Sleep (dwMilliseconds=0x1) [0054.886] Sleep (dwMilliseconds=0x1) [0054.901] Sleep (dwMilliseconds=0x1) [0054.916] Sleep (dwMilliseconds=0x1) [0054.932] Sleep (dwMilliseconds=0x1) [0054.948] Sleep (dwMilliseconds=0x1) [0054.963] Sleep (dwMilliseconds=0x1) [0054.979] Sleep (dwMilliseconds=0x1) [0054.994] Sleep (dwMilliseconds=0x1) [0055.010] Sleep (dwMilliseconds=0x1) [0055.026] Sleep (dwMilliseconds=0x1) [0055.042] Sleep (dwMilliseconds=0x1) [0055.057] Sleep (dwMilliseconds=0x1) [0055.073] Sleep (dwMilliseconds=0x1) [0055.088] Sleep (dwMilliseconds=0x1) [0055.104] Sleep (dwMilliseconds=0x1) [0055.119] Sleep (dwMilliseconds=0x1) [0055.135] Sleep (dwMilliseconds=0x1) [0055.151] Sleep (dwMilliseconds=0x1) [0055.166] Sleep (dwMilliseconds=0x1) [0055.182] Sleep (dwMilliseconds=0x1) [0055.202] Sleep (dwMilliseconds=0x1) [0055.213] Sleep (dwMilliseconds=0x1) [0055.228] Sleep (dwMilliseconds=0x1) [0055.244] Sleep (dwMilliseconds=0x1) [0055.260] Sleep (dwMilliseconds=0x1) [0055.275] Sleep (dwMilliseconds=0x1) [0055.291] Sleep (dwMilliseconds=0x1) [0055.306] Sleep (dwMilliseconds=0x1) [0055.322] Sleep (dwMilliseconds=0x1) [0055.338] Sleep (dwMilliseconds=0x1) [0055.354] Sleep (dwMilliseconds=0x1) [0055.369] Sleep (dwMilliseconds=0x1) [0055.384] Sleep (dwMilliseconds=0x1) [0055.400] Sleep (dwMilliseconds=0x1) [0055.416] Sleep (dwMilliseconds=0x1) [0055.433] Sleep (dwMilliseconds=0x1) [0055.447] Sleep (dwMilliseconds=0x1) [0055.463] Sleep (dwMilliseconds=0x1) [0055.478] Sleep (dwMilliseconds=0x1) [0055.494] Sleep (dwMilliseconds=0x1) [0055.544] Sleep (dwMilliseconds=0x1) [0055.596] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.748] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x3e4ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0061.748] GetProcessHeap () returned 0x580000 [0061.748] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x64) returned 0x5b5bc8 [0061.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0065.693] CloseHandle (hObject=0x460) returned 1 [0065.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0065.693] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance")) returned 1 [0066.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.424] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x45, dwReserved1=0x0, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96b0 [0066.424] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0066.424] GetProcessHeap () returned 0x580000 [0066.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f8d9a0 [0066.425] GetProcessHeap () returned 0x580000 [0066.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f9f1d0 [0066.425] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.425] ReadFile (in: hFile=0x460, lpBuffer=0x6f8d9a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d9a0*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0072.323] GetProcessHeap () returned 0x580000 [0072.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0072.323] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.323] WriteFile (in: hFile=0x460, lpBuffer=0x6f9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f1d0*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0072.997] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.997] WriteFile (in: hFile=0x460, lpBuffer=0x6fb09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb09cf*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.916] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.916] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.916] CloseHandle (hObject=0x460) returned 1 [0074.818] GetProcessHeap () returned 0x580000 [0074.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9f1d0 | out: hHeap=0x580000) returned 1 [0074.818] GetProcessHeap () returned 0x580000 [0074.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f8d9a0 | out: hHeap=0x580000) returned 1 [0074.818] GetProcessHeap () returned 0x580000 [0074.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0079.333] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x228df80, dwReserved0=0x3e4fd28, dwReserved1=0x6f8d9a0, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96f0 [0079.334] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.348] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", len=0x3f | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 1 [0079.348] GetProcessHeap () returned 0x580000 [0079.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x40) returned 0x5f76f0 [0079.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.360] Sleep (dwMilliseconds=0x1) [0081.726] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", len=0x61 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 1 [0081.726] GetProcessHeap () returned 0x580000 [0081.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.789] CloseHandle (hObject=0x48c) returned 1 [0081.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.790] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0081.819] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.820] GetProcessHeap () returned 0x580000 [0081.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x673cd0 [0081.820] GetProcessHeap () returned 0x580000 [0081.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x677e20 [0081.820] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.820] ReadFile (in: hFile=0x48c, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x4120, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x3e4ff14*=0x4120, lpOverlapped=0x0) returned 1 [0082.123] GetProcessHeap () returned 0x580000 [0082.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0082.123] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.123] WriteFile (in: hFile=0x48c, lpBuffer=0x677e20*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x677e20*, lpNumberOfBytesWritten=0x3e4ff14*=0x4120, lpOverlapped=0x0) returned 1 [0082.124] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.124] WriteFile (in: hFile=0x48c, lpBuffer=0x67bf3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67bf3f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0082.131] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.131] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0082.131] CloseHandle (hObject=0x48c) returned 1 [0082.133] GetProcessHeap () returned 0x580000 [0082.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677e20 | out: hHeap=0x580000) returned 1 [0082.133] GetProcessHeap () returned 0x580000 [0082.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0082.133] GetProcessHeap () returned 0x580000 [0082.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0082.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68907000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x414f, dwReserved0=0x3e4fd28, dwReserved1=0x673cd0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0082.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.661] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", len=0x67 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 1 [0082.661] GetProcessHeap () returned 0x580000 [0082.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0082.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0083.362] CloseHandle (hObject=0x48c) returned 1 [0083.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id_1622540890_.your_last_chance")) returned 1 [0083.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~1.YOU")) returned 0x5b96f0 [0083.363] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0083.363] GetProcessHeap () returned 0x580000 [0083.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x67b660 [0083.363] GetProcessHeap () returned 0x580000 [0083.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x6c5ea98 [0083.363] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.363] ReadFile (in: hFile=0x48c, lpBuffer=0x67b660, nNumberOfBytesToRead=0x41c0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67b660*, lpNumberOfBytesRead=0x3e4ff14*=0x41c0, lpOverlapped=0x0) returned 1 [0083.643] GetProcessHeap () returned 0x580000 [0083.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.643] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.643] WriteFile (in: hFile=0x48c, lpBuffer=0x6c5ea98*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5ea98*, lpNumberOfBytesWritten=0x3e4ff14*=0x41c0, lpOverlapped=0x0) returned 1 [0083.643] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.643] WriteFile (in: hFile=0x48c, lpBuffer=0x6c62c57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62c57*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.643] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.643] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.643] CloseHandle (hObject=0x48c) returned 1 [0083.644] GetProcessHeap () returned 0x580000 [0083.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5ea98 | out: hHeap=0x580000) returned 1 [0083.644] GetProcessHeap () returned 0x580000 [0083.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67b660 | out: hHeap=0x580000) returned 1 [0083.644] GetProcessHeap () returned 0x580000 [0083.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69775560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x41f8, dwReserved0=0x3e4fd28, dwReserved1=0x67b660, cFileName="ProPlusrWW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~1.YOU")) returned 0x5b9730 [0083.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0088.228] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", len=0x4d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 1 [0088.228] GetProcessHeap () returned 0x580000 [0088.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0088.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0088.245] CloseHandle (hObject=0x44c) returned 1 [0088.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id_1622540890_.your_last_chance")) returned 1 [0088.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOLDST~1.YOU")) returned 0x5b96f0 [0088.356] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0088.357] GetProcessHeap () returned 0x580000 [0088.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c4f8 [0088.357] GetProcessHeap () returned 0x580000 [0088.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c768 [0088.357] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.357] ReadFile (in: hFile=0x44c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0088.455] GetProcessHeap () returned 0x580000 [0088.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.455] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.455] WriteFile (in: hFile=0x44c, lpBuffer=0x6f0c768*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c768*, lpNumberOfBytesWritten=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0088.455] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.455] WriteFile (in: hFile=0x44c, lpBuffer=0x6f0c9a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c9a7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.455] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.456] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.456] CloseHandle (hObject=0x44c) returned 1 [0088.456] GetProcessHeap () returned 0x580000 [0088.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c768 | out: hHeap=0x580000) returned 1 [0088.456] GetProcessHeap () returned 0x580000 [0088.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0088.456] GetProcessHeap () returned 0x580000 [0088.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c56de40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x3e4fd28, dwReserved1=0x6f0c4f8, cFileName="BOLDSTRI.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOLDST~1.YOU")) returned 0x5b96b0 [0088.456] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.671] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", len=0x4b | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 1 [0091.671] GetProcessHeap () returned 0x580000 [0091.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0091.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0091.776] CloseHandle (hObject=0x48c) returned 1 [0091.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id_1622540890_.your_last_chance")) returned 1 [0091.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x45, dwReserved1=0x0, cFileName="ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECLIPS~1.YOU")) returned 0x5b96b0 [0091.825] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0091.826] GetProcessHeap () returned 0x580000 [0091.826] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6d08220 [0091.826] GetProcessHeap () returned 0x580000 [0091.826] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67fc68 [0091.826] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.826] ReadFile (in: hFile=0x48c, lpBuffer=0x6d08220, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08220*, lpNumberOfBytesRead=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0091.839] GetProcessHeap () returned 0x580000 [0091.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.839] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.839] WriteFile (in: hFile=0x48c, lpBuffer=0x67fc68*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesWritten=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0091.839] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.839] WriteFile (in: hFile=0x48c, lpBuffer=0x67fea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fea7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.839] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.839] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.840] CloseHandle (hObject=0x48c) returned 1 [0091.840] GetProcessHeap () returned 0x580000 [0091.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0091.840] GetProcessHeap () returned 0x580000 [0091.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08220 | out: hHeap=0x580000) returned 1 [0091.840] GetProcessHeap () returned 0x580000 [0091.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e5b68a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x3e4fd28, dwReserved1=0x6d08220, cFileName="ECLIPSE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECLIPS~1.YOU")) returned 0x5b96f0 [0092.411] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.522] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", len=0x4d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 1 [0092.522] GetProcessHeap () returned 0x580000 [0092.522] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0092.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.587] CloseHandle (hObject=0x3f8) returned 1 [0092.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id_1622540890_.your_last_chance")) returned 1 [0092.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPEDI~1.YOU")) returned 0x5b96f0 [0092.589] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.589] GetProcessHeap () returned 0x580000 [0092.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67fc68 [0092.589] GetProcessHeap () returned 0x580000 [0092.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f1bea8 [0092.589] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.589] ReadFile (in: hFile=0x3f8, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0092.592] GetProcessHeap () returned 0x580000 [0092.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.593] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f1bea8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesWritten=0x3e4ff14*=0x240, lpOverlapped=0x0) returned 1 [0092.593] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f1c0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c0e7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.593] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.593] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.593] CloseHandle (hObject=0x3f8) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0092.593] GetProcessHeap () returned 0x580000 [0092.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ecdaaa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x3e4fd28, dwReserved1=0x67fc68, cFileName="EXPEDITN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPEDI~1.YOU")) returned 0x5b96f0 [0092.594] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.602] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", len=0x4d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 1 [0092.602] GetProcessHeap () returned 0x580000 [0092.602] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0092.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0092.603] CloseHandle (hObject=0x424) returned 1 [0092.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id_1622540890_.your_last_chance")) returned 1 [0092.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EVRGRE~2.YOU")) returned 0x5b96f0 [0092.604] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0092.604] GetProcessHeap () returned 0x580000 [0092.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c7a378 [0092.605] GetProcessHeap () returned 0x580000 [0092.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c8bba8 [0092.605] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.605] ReadFile (in: hFile=0x424, lpBuffer=0x6c7a378, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a378*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0098.872] GetProcessHeap () returned 0x580000 [0098.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.873] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.873] WriteFile (in: hFile=0x424, lpBuffer=0x6c8bba8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c8bba8*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0098.873] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.873] WriteFile (in: hFile=0x424, lpBuffer=0x6c9d3a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3a7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.691] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.691] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.691] CloseHandle (hObject=0x424) returned 1 [0099.692] GetProcessHeap () returned 0x580000 [0099.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c8bba8 | out: hHeap=0x580000) returned 1 [0099.692] GetProcessHeap () returned 0x580000 [0099.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a378 | out: hHeap=0x580000) returned 1 [0099.693] GetProcessHeap () returned 0x580000 [0099.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0099.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7308bc40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12e12, dwReserved0=0x3e4fd28, dwReserved1=0x6c7a378, cFileName="EVRGREEN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EVRGRE~2.YOU")) returned 0x5b9730 [0099.693] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0104.044] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", len=0x49 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 1 [0104.044] GetProcessHeap () returned 0x580000 [0104.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92e8 | out: hHeap=0x580000) returned 1 [0104.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.068] CloseHandle (hObject=0x39c) returned 1 [0104.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.069] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id_1622540890_.your_last_chance")) returned 1 [0104.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1FR~1.YOU")) returned 0x5b96f0 [0104.787] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0104.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.787] GetProcessHeap () returned 0x580000 [0104.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0104.787] GetProcessHeap () returned 0x580000 [0104.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ceca98 [0104.787] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.787] ReadFile (in: hFile=0x39c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.896] GetProcessHeap () returned 0x580000 [0106.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0106.896] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.896] WriteFile (in: hFile=0x39c, lpBuffer=0x6ceca98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ceca98*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.897] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.897] WriteFile (in: hFile=0x39c, lpBuffer=0x6cfe297*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfe297*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.994] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.995] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.995] CloseHandle (hObject=0x39c) returned 1 [0106.995] GetProcessHeap () returned 0x580000 [0106.995] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ceca98 | out: hHeap=0x580000) returned 1 [0106.997] GetProcessHeap () returned 0x580000 [0106.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0106.998] GetProcessHeap () returned 0x580000 [0106.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0106.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7762bfc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcd2d0, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="MSB1FREN.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1FR~1.YOU")) returned 0x5b9630 [0106.998] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.079] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.079] GetProcessHeap () returned 0x580000 [0112.079] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.079] Sleep (dwMilliseconds=0x1) [0112.122] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", len=0x4a | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.122] GetProcessHeap () returned 0x580000 [0112.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c563f8, Size=0x5c) returned 0x6c561f0 [0112.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.122] Sleep (dwMilliseconds=0x1) [0112.264] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", len=0x62 | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.264] GetProcessHeap () returned 0x580000 [0112.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.264] Sleep (dwMilliseconds=0x1) [0112.277] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", len=0x45 | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned 1 [0112.277] GetProcessHeap () returned 0x580000 [0112.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.277] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.277] Sleep (dwMilliseconds=0x1) [0112.303] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", len=0x4d | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 1 [0112.303] GetProcessHeap () returned 0x580000 [0112.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x84) returned 0x61b4b0 [0112.303] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.325] Sleep (dwMilliseconds=0x1) [0112.392] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x3e4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.392] GetProcessHeap () returned 0x580000 [0112.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.392] Sleep (dwMilliseconds=0x1) [0113.322] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", len=0x3f | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 1 [0113.323] GetProcessHeap () returned 0x580000 [0113.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xcc) returned 0x6f0ceb8 [0113.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0113.487] CloseHandle (hObject=0x46c) returned 1 [0113.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0121~2.YOU")) returned 0x5b9630 [0114.809] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0114.810] GetProcessHeap () returned 0x580000 [0114.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x677cd0 [0114.810] GetProcessHeap () returned 0x580000 [0114.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x635768 [0114.810] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.810] ReadFile (in: hFile=0x46c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x3e4ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0114.821] GetProcessHeap () returned 0x580000 [0114.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.821] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.821] WriteFile (in: hFile=0x46c, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x3e4ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0114.821] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.821] WriteFile (in: hFile=0x46c, lpBuffer=0x636327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x636327*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.822] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.822] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.822] CloseHandle (hObject=0x46c) returned 1 [0114.822] GetProcessHeap () returned 0x580000 [0114.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.822] GetProcessHeap () returned 0x580000 [0114.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0114.822] GetProcessHeap () returned 0x580000 [0114.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c0db200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x3e4fd28, dwReserved1=0x677cd0, cFileName="AN01218_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0121~2.YOU")) returned 0x5b9630 [0115.831] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.870] CloseHandle (hObject=0x4a0) returned 1 [0115.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0017~1.YOU")) returned 0x5b9630 [0115.871] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.871] GetProcessHeap () returned 0x580000 [0115.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8f21) returned 0x6f35668 [0115.871] GetProcessHeap () returned 0x580000 [0115.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8f21) returned 0x6eef008 [0115.871] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.872] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f35668, nNumberOfBytesToRead=0x8f00, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f35668*, lpNumberOfBytesRead=0x3e4ff14*=0x8f00, lpOverlapped=0x0) returned 1 [0118.098] GetProcessHeap () returned 0x580000 [0118.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0118.098] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.098] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eef008*, nNumberOfBytesToWrite=0x8f00, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesWritten=0x3e4ff14*=0x8f00, lpOverlapped=0x0) returned 1 [0118.098] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.098] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ef7f07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7f07*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.099] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.099] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.099] CloseHandle (hObject=0x4a0) returned 1 [0118.327] GetProcessHeap () returned 0x580000 [0118.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0118.328] GetProcessHeap () returned 0x580000 [0118.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f35668 | out: hHeap=0x580000) returned 1 [0118.331] GetProcessHeap () returned 0x580000 [0118.331] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0120.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e0192c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8f32, dwReserved0=0x580000, dwReserved1=0x6d00360, cFileName="SO00177_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0017~1.YOU")) returned 0x5b96f0 [0120.123] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.148] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", len=0x4c | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 1 [0120.148] GetProcessHeap () returned 0x580000 [0120.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ec) returned 0x6d06ca8 [0120.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.257] CloseHandle (hObject=0x4a0) returned 1 [0120.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.257] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.258] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0221~1.YOU")) returned 0x5b9630 [0120.258] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.258] GetProcessHeap () returned 0x580000 [0120.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6f19958 [0120.258] GetProcessHeap () returned 0x580000 [0120.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6c7a390 [0120.258] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.259] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1360, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x3e4ff14*=0x1360, lpOverlapped=0x0) returned 1 [0120.327] GetProcessHeap () returned 0x580000 [0120.327] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.327] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.327] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c7a390*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a390*, lpNumberOfBytesWritten=0x3e4ff14*=0x1360, lpOverlapped=0x0) returned 1 [0120.327] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.327] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c7b6ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7b6ef*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.327] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.327] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.327] CloseHandle (hObject=0x4a0) returned 1 [0120.327] GetProcessHeap () returned 0x580000 [0120.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a390 | out: hHeap=0x580000) returned 1 [0120.327] GetProcessHeap () returned 0x580000 [0120.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0120.327] GetProcessHeap () returned 0x580000 [0120.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f55f760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x138f, dwReserved0=0x3e4fd28, dwReserved1=0x6f19958, cFileName="WB02214_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0221~1.YOU")) returned 0x5b9630 [0120.328] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.390] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", len=0x42 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 1 [0120.390] GetProcessHeap () returned 0x580000 [0120.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d0) returned 0x6d06ca8 [0120.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0120.391] CloseHandle (hObject=0x440) returned 1 [0120.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.id_1622540890_.your_last_chance")) returned 1 [0120.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9630 [0120.392] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0120.393] GetProcessHeap () returned 0x580000 [0120.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0120.393] GetProcessHeap () returned 0x580000 [0120.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc0a00 [0120.394] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.394] ReadFile (in: hFile=0x440, lpBuffer=0x6daf1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0122.064] GetProcessHeap () returned 0x580000 [0122.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.065] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.065] WriteFile (in: hFile=0x440, lpBuffer=0x6dc0a00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0122.065] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.065] WriteFile (in: hFile=0x440, lpBuffer=0x6dd21ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd21ff*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.065] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.065] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.065] CloseHandle (hObject=0x440) returned 1 [0122.065] GetProcessHeap () returned 0x580000 [0122.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0122.066] GetProcessHeap () returned 0x580000 [0122.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0122.066] GetProcessHeap () returned 0x580000 [0122.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x805e3000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x124c4, dwReserved0=0x3e4fd28, dwReserved1=0x6daf1d0, cFileName="Solstice.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0124.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.353] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", len=0x4d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned 1 [0124.353] GetProcessHeap () returned 0x580000 [0124.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1920) returned 0x6f42f08 [0124.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.370] CloseHandle (hObject=0x484) returned 1 [0124.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.id_1622540890_.your_last_chance")) returned 1 [0124.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0124.371] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.371] GetProcessHeap () returned 0x580000 [0124.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.371] GetProcessHeap () returned 0x580000 [0124.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.372] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.372] ReadFile (in: hFile=0x484, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x3e4ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.393] GetProcessHeap () returned 0x580000 [0124.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.393] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.393] WriteFile (in: hFile=0x484, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x3e4ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.393] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.393] WriteFile (in: hFile=0x484, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.393] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.393] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.393] CloseHandle (hObject=0x484) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81c0dce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x3e4fd28, dwReserved1=0x6f67710, cFileName="Office 2.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0125.316] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.341] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", len=0x3d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned 1 [0125.341] GetProcessHeap () returned 0x580000 [0125.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0125.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0128.876] CloseHandle (hObject=0x468) returned 1 [0128.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02406~1.YOU")) returned 0x5b9730 [0130.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0130.012] GetProcessHeap () returned 0x580000 [0130.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6f19958 [0130.012] GetProcessHeap () returned 0x580000 [0130.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6d035f8 [0130.012] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.012] ReadFile (in: hFile=0x468, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x13c0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x3e4ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0130.032] GetProcessHeap () returned 0x580000 [0130.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.032] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.032] WriteFile (in: hFile=0x468, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x3e4ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0130.032] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.032] WriteFile (in: hFile=0x468, lpBuffer=0x6d049b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d049b7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.033] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.033] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.033] CloseHandle (hObject=0x468) returned 1 [0130.033] GetProcessHeap () returned 0x580000 [0130.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0130.033] GetProcessHeap () returned 0x580000 [0130.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0130.033] GetProcessHeap () returned 0x580000 [0130.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0130.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x851e8ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13fa, dwReserved0=0x3e4fd28, dwReserved1=0x6f19958, cFileName="J0240695.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02406~1.YOU")) returned 0x5b9730 [0130.033] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0130.272] CloseHandle (hObject=0x418) returned 1 [0130.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0130.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id_1622540890_.your_last_chance")) returned 1 [0131.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0131.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPHH~1.YOU")) returned 0x5b9730 [0132.591] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.591] GetProcessHeap () returned 0x580000 [0132.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0132.591] GetProcessHeap () returned 0x580000 [0132.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0132.592] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.592] ReadFile (in: hFile=0x470, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.060] GetProcessHeap () returned 0x580000 [0137.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0137.060] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.060] WriteFile (in: hFile=0x470, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.472] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.472] WriteFile (in: hFile=0x470, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.540] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.540] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.540] CloseHandle (hObject=0x470) returned 1 [0138.607] GetProcessHeap () returned 0x580000 [0138.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0138.607] GetProcessHeap () returned 0x580000 [0138.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0138.607] GetProcessHeap () returned 0x580000 [0138.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x94f4a, dwReserved0=0x3e4fd28, dwReserved1=0x6fb2f38, cFileName="GRAPH.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPHH~1.YOU")) returned 0x5b9770 [0139.879] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.908] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", len=0x53 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css") returned 1 [0139.908] GetProcessHeap () returned 0x580000 [0139.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0139.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.054] CloseHandle (hObject=0x3b4) returned 1 [0140.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.id_1622540890_.your_last_chance")) returned 1 [0140.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b9770 [0140.055] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.055] GetProcessHeap () returned 0x580000 [0140.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef020 [0140.055] GetProcessHeap () returned 0x580000 [0140.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef768 [0140.055] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.055] ReadFile (in: hFile=0x3b4, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x3e4ff14*=0x700, lpOverlapped=0x0) returned 1 [0140.062] GetProcessHeap () returned 0x580000 [0140.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.062] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.062] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eef768*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef768*, lpNumberOfBytesWritten=0x3e4ff14*=0x700, lpOverlapped=0x0) returned 1 [0140.062] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.063] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eefe67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefe67*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.063] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.063] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.063] CloseHandle (hObject=0x3b4) returned 1 [0140.063] GetProcessHeap () returned 0x580000 [0140.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef768 | out: hHeap=0x580000) returned 1 [0140.063] GetProcessHeap () returned 0x580000 [0140.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0140.063] GetProcessHeap () returned 0x580000 [0140.063] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b1922c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x742, dwReserved0=0x3e4fd28, dwReserved1=0x6eef020, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b9770 [0140.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.449] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", len=0x43 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned 1 [0140.449] GetProcessHeap () returned 0x580000 [0140.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dcc) returned 0x6f14048 [0140.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.561] CloseHandle (hObject=0x428) returned 1 [0140.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1515~2.YOU")) returned 0x5b9770 [0140.562] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.562] GetProcessHeap () returned 0x580000 [0140.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0140.563] GetProcessHeap () returned 0x580000 [0140.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0140.563] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.563] ReadFile (in: hFile=0x428, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x3e4ff14*=0x100, lpOverlapped=0x0) returned 1 [0140.564] GetProcessHeap () returned 0x580000 [0140.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.564] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.564] WriteFile (in: hFile=0x428, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x3e4ff14*=0x100, lpOverlapped=0x0) returned 1 [0140.565] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.565] WriteFile (in: hFile=0x428, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.565] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.565] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.565] CloseHandle (hObject=0x428) returned 1 [0140.565] GetProcessHeap () returned 0x580000 [0140.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0140.565] GetProcessHeap () returned 0x580000 [0140.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0140.565] GetProcessHeap () returned 0x580000 [0140.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b654ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x3e4fd28, dwReserved1=0x6f0a9f0, cFileName="BD15155_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1515~2.YOU")) returned 0x5b9730 [0140.972] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.009] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta", len=0x42 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 1 [0141.009] GetProcessHeap () returned 0x580000 [0141.009] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0141.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0144.067] CloseHandle (hObject=0x3e4) returned 1 [0144.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id_1622540890_.your_last_chance")) returned 1 [0144.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISSUET~1.YOU")) returned 0x5b96f0 [0144.069] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0144.069] GetProcessHeap () returned 0x580000 [0144.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0144.070] GetProcessHeap () returned 0x580000 [0144.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0144.070] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.070] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.758] GetProcessHeap () returned 0x580000 [0147.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0147.758] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.758] WriteFile (in: hFile=0x3e4, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.759] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x3e4, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0147.759] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.759] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0147.759] CloseHandle (hObject=0x3e4) returned 1 [0147.759] GetProcessHeap () returned 0x580000 [0147.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0147.759] GetProcessHeap () returned 0x580000 [0147.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0147.759] GetProcessHeap () returned 0x580000 [0147.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0147.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8faea8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3cee3, dwReserved0=0x3e4fd28, dwReserved1=0x6d7cfe8, cFileName="Issue Tracking.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ISSUET~1.YOU")) returned 0x5b96f0 [0147.759] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.373] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS", len=0x45 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS") returned 1 [0148.374] GetProcessHeap () returned 0x580000 [0148.374] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0148.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0148.375] CloseHandle (hObject=0x4a4) returned 1 [0148.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.376] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css.id_1622540890_.your_last_chance")) returned 1 [0148.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7869600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7869600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f984, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5019~1.YOU")) returned 0x5b96f0 [0148.376] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0148.377] GetProcessHeap () returned 0x580000 [0148.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ea1008 [0148.377] GetProcessHeap () returned 0x580000 [0148.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eb2838 [0148.377] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.377] ReadFile (in: hFile=0x4a4, lpBuffer=0x6ea1008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.701] GetProcessHeap () returned 0x580000 [0151.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0151.702] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.702] WriteFile (in: hFile=0x4a4, lpBuffer=0x6eb2838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2838*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.702] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.702] WriteFile (in: hFile=0x4a4, lpBuffer=0x6ec4037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4037*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.703] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.703] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.703] CloseHandle (hObject=0x4a4) returned 1 [0151.703] GetProcessHeap () returned 0x580000 [0151.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb2838 | out: hHeap=0x580000) returned 1 [0151.703] GetProcessHeap () returned 0x580000 [0151.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0151.703] GetProcessHeap () returned 0x580000 [0151.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0151.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7869600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9208e480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f9a8, dwReserved0=0x3e4fd28, dwReserved1=0x6ea1008, cFileName="SCHEME48.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5019~1.YOU")) returned 0x5b9730 [0151.704] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.052] CloseHandle (hObject=0x3e4) returned 1 [0152.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.052] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0152.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~1.YOU")) returned 0x5b9730 [0152.053] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.053] GetProcessHeap () returned 0x580000 [0152.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0152.053] GetProcessHeap () returned 0x580000 [0152.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0152.053] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.053] ReadFile (in: hFile=0x3e4, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x3e4ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.231] GetProcessHeap () returned 0x580000 [0152.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.231] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.231] WriteFile (in: hFile=0x3e4, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x3e4ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.231] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.231] WriteFile (in: hFile=0x3e4, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.231] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.231] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.231] CloseHandle (hObject=0x3e4) returned 1 [0152.231] GetProcessHeap () returned 0x580000 [0152.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0152.231] GetProcessHeap () returned 0x580000 [0152.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0152.231] GetProcessHeap () returned 0x580000 [0152.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9259d340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x3e4fd28, dwReserved1=0x61b540, cFileName="VISIO.SHAPESHEET_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~1.YOU")) returned 0x5b9730 [0153.527] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0155.245] CloseHandle (hObject=0x3a8) returned 1 [0155.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id_1622540890_.your_last_chance")) returned 1 [0155.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17253500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17253500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINSCH~1.YOU")) returned 0x5b9730 [0155.284] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0155.284] GetProcessHeap () returned 0x580000 [0155.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6d08520 [0155.284] GetProcessHeap () returned 0x580000 [0155.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6d08b68 [0155.284] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.284] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x3e4ff14*=0x600, lpOverlapped=0x0) returned 1 [0155.337] GetProcessHeap () returned 0x580000 [0155.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.337] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.337] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d08b68*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08b68*, lpNumberOfBytesWritten=0x3e4ff14*=0x600, lpOverlapped=0x0) returned 1 [0155.337] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.337] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d09167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09167*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.337] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.337] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.337] CloseHandle (hObject=0x3a8) returned 1 [0155.337] GetProcessHeap () returned 0x580000 [0155.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08b68 | out: hHeap=0x580000) returned 1 [0155.337] GetProcessHeap () returned 0x580000 [0155.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0155.337] GetProcessHeap () returned 0x580000 [0155.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17253500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x943384e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x3e4fd28, dwReserved1=0x6d08520, cFileName="WINSCHD.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINSCH~1.YOU")) returned 0x5b9630 [0155.972] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.986] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", len=0x3d | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 1 [0155.986] GetProcessHeap () returned 0x580000 [0155.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0155.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0158.809] CloseHandle (hObject=0x480) returned 1 [0158.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.809] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id_1622540890_.your_last_chance")) returned 1 [0164.572] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0164.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART4~1.YOU")) returned 0x5b9730 [0164.572] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0164.573] GetProcessHeap () returned 0x580000 [0164.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3921) returned 0x6fbbac8 [0164.573] GetProcessHeap () returned 0x580000 [0164.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3921) returned 0x6d75668 [0164.573] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.573] ReadFile (in: hFile=0x480, lpBuffer=0x6fbbac8, nNumberOfBytesToRead=0x3900, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbbac8*, lpNumberOfBytesRead=0x3e4ff14*=0x3900, lpOverlapped=0x0) returned 1 [0165.343] GetProcessHeap () returned 0x580000 [0165.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0165.343] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.343] WriteFile (in: hFile=0x480, lpBuffer=0x6d75668*, nNumberOfBytesToWrite=0x3900, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75668*, lpNumberOfBytesWritten=0x3e4ff14*=0x3900, lpOverlapped=0x0) returned 1 [0165.343] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.343] WriteFile (in: hFile=0x480, lpBuffer=0x6d78f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d78f67*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.343] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.343] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.343] CloseHandle (hObject=0x480) returned 1 [0165.926] GetProcessHeap () returned 0x580000 [0165.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d75668 | out: hHeap=0x580000) returned 1 [0165.970] GetProcessHeap () returned 0x580000 [0165.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbbac8 | out: hHeap=0x580000) returned 1 [0165.970] GetProcessHeap () returned 0x580000 [0165.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0169.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a295640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x3e4fd28, dwReserved1=0x6fbbac8, cFileName="MSART4.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART4~1.YOU")) returned 0x5b9730 [0169.682] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.767] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", len=0x3f | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 1 [0169.767] GetProcessHeap () returned 0x580000 [0169.767] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0169.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0169.807] CloseHandle (hObject=0x48c) returned 1 [0169.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id_1622540890_.your_last_chance")) returned 1 [0169.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMW~1.YOU")) returned 0x5b9730 [0169.811] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0169.811] GetProcessHeap () returned 0x580000 [0169.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79c1) returned 0x6f5f2b8 [0169.811] GetProcessHeap () returned 0x580000 [0169.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79c1) returned 0x700dc38 [0169.811] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.811] ReadFile (in: hFile=0x48c, lpBuffer=0x6f5f2b8, nNumberOfBytesToRead=0x79a0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5f2b8*, lpNumberOfBytesRead=0x3e4ff14*=0x79a0, lpOverlapped=0x0) returned 1 [0171.695] GetProcessHeap () returned 0x580000 [0171.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0171.696] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.696] WriteFile (in: hFile=0x48c, lpBuffer=0x700dc38*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x700dc38*, lpNumberOfBytesWritten=0x3e4ff14*=0x79a0, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.696] WriteFile (in: hFile=0x48c, lpBuffer=0x70155d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x70155d7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.696] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.696] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.696] CloseHandle (hObject=0x48c) returned 1 [0171.696] GetProcessHeap () returned 0x580000 [0171.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x700dc38 | out: hHeap=0x580000) returned 1 [0171.696] GetProcessHeap () returned 0x580000 [0171.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f5f2b8 | out: hHeap=0x580000) returned 1 [0171.696] GetProcessHeap () returned 0x580000 [0171.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0173.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9df48740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79c4, dwReserved0=0x3e4fd28, dwReserved1=0x6f5f2b8, cFileName="DELIMWIN.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMW~1.YOU")) returned 0x5b9770 [0173.361] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.391] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", len=0x43 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 1 [0173.391] GetProcessHeap () returned 0x580000 [0173.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0173.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.416] CloseHandle (hObject=0x3fc) returned 1 [0173.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id_1622540890_.your_last_chance")) returned 1 [0173.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLMAIL~1.YOU")) returned 0x5b9770 [0173.417] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.417] GetProcessHeap () returned 0x580000 [0173.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x7162068 [0173.417] GetProcessHeap () returned 0x580000 [0173.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6dec6e0 [0173.417] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.417] ReadFile (in: hFile=0x3fc, lpBuffer=0x7162068, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162068*, lpNumberOfBytesRead=0x3e4ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0173.452] GetProcessHeap () returned 0x580000 [0173.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.452] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.452] WriteFile (in: hFile=0x3fc, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x3e4ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0173.452] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.452] WriteFile (in: hFile=0x3fc, lpBuffer=0x6deee7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6deee7f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.452] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.452] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.452] CloseHandle (hObject=0x3fc) returned 1 [0173.452] GetProcessHeap () returned 0x580000 [0173.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0173.452] GetProcessHeap () returned 0x580000 [0173.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162068 | out: hHeap=0x580000) returned 1 [0173.452] GetProcessHeap () returned 0x580000 [0173.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eff2140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x3e4fd28, dwReserved1=0x7162068, cFileName="OLMAILR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLMAIL~1.YOU")) returned 0x5b96f0 [0175.922] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.168] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", len=0x48 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx") returned 1 [0179.168] GetProcessHeap () returned 0x580000 [0179.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0179.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.008] CloseHandle (hObject=0x440) returned 1 [0181.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.id_1622540890_.your_last_chance")) returned 1 [0181.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95af5900, ftLastWriteTime.dwHighDateTime=0x1c7e846, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLASSI~1.YOU")) returned 0x5b96b0 [0181.010] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.010] GetProcessHeap () returned 0x580000 [0181.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6dcb1d0 [0181.010] GetProcessHeap () returned 0x580000 [0181.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6dec6e0 [0181.010] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.010] ReadFile (in: hFile=0x440, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x2380, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x3e4ff14*=0x2380, lpOverlapped=0x0) returned 1 [0181.040] GetProcessHeap () returned 0x580000 [0181.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.040] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.041] WriteFile (in: hFile=0x440, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x3e4ff14*=0x2380, lpOverlapped=0x0) returned 1 [0181.041] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.041] WriteFile (in: hFile=0x440, lpBuffer=0x6deea5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6deea5f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.041] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.041] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.041] CloseHandle (hObject=0x440) returned 1 [0181.041] GetProcessHeap () returned 0x580000 [0181.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0181.041] GetProcessHeap () returned 0x580000 [0181.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0181.041] GetProcessHeap () returned 0x580000 [0181.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3865ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23ab, dwReserved0=0x3e4fd28, dwReserved1=0x6dcb1d0, cFileName="Classic.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLASSI~1.YOU")) returned 0x5b9770 [0182.214] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.570] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", len=0x4e | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned 1 [0183.570] GetProcessHeap () returned 0x580000 [0183.570] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2134) returned 0x6f14048 [0183.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.623] CloseHandle (hObject=0x490) returned 1 [0183.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89e0bd00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~2.YOU")) returned 0x5b9770 [0183.624] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.624] GetProcessHeap () returned 0x580000 [0183.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de0f68 [0183.624] GetProcessHeap () returned 0x580000 [0183.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de1370 [0183.624] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.624] ReadFile (in: hFile=0x490, lpBuffer=0x6de0f68, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f68*, lpNumberOfBytesRead=0x3e4ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0183.658] GetProcessHeap () returned 0x580000 [0183.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.658] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.658] WriteFile (in: hFile=0x490, lpBuffer=0x6de1370*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de1370*, lpNumberOfBytesWritten=0x3e4ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0183.658] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.658] WriteFile (in: hFile=0x490, lpBuffer=0x6de172f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de172f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.658] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.658] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.659] CloseHandle (hObject=0x490) returned 1 [0183.659] GetProcessHeap () returned 0x580000 [0183.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de1370 | out: hHeap=0x580000) returned 1 [0183.659] GetProcessHeap () returned 0x580000 [0183.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f68 | out: hHeap=0x580000) returned 1 [0183.659] GetProcessHeap () returned 0x580000 [0183.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa513e480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x3e4fd28, dwReserved1=0x6de0f68, cFileName="NotifierUpArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~2.YOU")) returned 0x5b9770 [0183.659] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.679] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", len=0x6a | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned 1 [0183.679] GetProcessHeap () returned 0x580000 [0183.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0183.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.686] CloseHandle (hObject=0x488) returned 1 [0183.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.id_1622540890_.your_last_chance")) returned 1 [0183.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0183.687] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.688] GetProcessHeap () returned 0x580000 [0183.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c1) returned 0x6c79898 [0183.688] GetProcessHeap () returned 0x580000 [0183.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c1) returned 0x6d00cd8 [0183.688] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.688] ReadFile (in: hFile=0x488, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x7a0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3e4ff14*=0x7a0, lpOverlapped=0x0) returned 1 [0183.695] GetProcessHeap () returned 0x580000 [0183.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.695] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] WriteFile (in: hFile=0x488, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3e4ff14*=0x7a0, lpOverlapped=0x0) returned 1 [0183.696] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] WriteFile (in: hFile=0x488, lpBuffer=0x6d01477*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01477*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.696] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.696] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.696] CloseHandle (hObject=0x488) returned 1 [0183.696] GetProcessHeap () returned 0x580000 [0183.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0183.696] GetProcessHeap () returned 0x580000 [0183.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0183.696] GetProcessHeap () returned 0x580000 [0183.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa51b08a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7cb, dwReserved0=0x3e4fd28, dwReserved1=0x6c79898, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0183.696] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.706] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", len=0x6f | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned 1 [0183.706] GetProcessHeap () returned 0x580000 [0183.706] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0183.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.708] CloseHandle (hObject=0x484) returned 1 [0183.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42fa, dwReserved0=0x2e0057, dwReserved1=0x50004a, cFileName="TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTVI~1.YOU")) returned 0x5b9770 [0183.709] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.710] GetProcessHeap () returned 0x580000 [0183.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4301) returned 0x6fbda68 [0183.710] GetProcessHeap () returned 0x580000 [0183.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4301) returned 0x6fa2228 [0183.710] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.710] ReadFile (in: hFile=0x484, lpBuffer=0x6fbda68, nNumberOfBytesToRead=0x42e0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbda68*, lpNumberOfBytesRead=0x3e4ff14*=0x42e0, lpOverlapped=0x0) returned 1 [0184.793] GetProcessHeap () returned 0x580000 [0184.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x705f940 [0184.793] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.793] WriteFile (in: hFile=0x484, lpBuffer=0x6fa2228*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa2228*, lpNumberOfBytesWritten=0x3e4ff14*=0x42e0, lpOverlapped=0x0) returned 1 [0184.793] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.793] WriteFile (in: hFile=0x484, lpBuffer=0x6fa6507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6507*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.793] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.793] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.794] CloseHandle (hObject=0x484) returned 1 [0185.003] GetProcessHeap () returned 0x580000 [0185.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa2228 | out: hHeap=0x580000) returned 1 [0185.003] GetProcessHeap () returned 0x580000 [0185.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbda68 | out: hHeap=0x580000) returned 1 [0185.003] GetProcessHeap () returned 0x580000 [0185.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f940 | out: hHeap=0x580000) returned 1 [0185.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5c1a8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x431e, dwReserved0=0x3e4fd28, dwReserved1=0x6fbda68, cFileName="TEXTVIEW.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTVI~1.YOU")) returned 0x5b9770 [0185.532] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.580] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", len=0x54 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned 1 [0185.580] GetProcessHeap () returned 0x580000 [0185.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0185.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0187.147] CloseHandle (hObject=0x39c) returned 1 [0187.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.147] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x675aa300, ftLastWriteTime.dwHighDateTime=0x1c9f921, nFileSizeHigh=0x0, nFileSizeLow=0xceed, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGIND~1.YOU")) returned 0x5b96b0 [0187.150] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0187.150] GetProcessHeap () returned 0x580000 [0187.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf01) returned 0x70192d8 [0187.151] GetProcessHeap () returned 0x580000 [0187.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf01) returned 0x70261e8 [0187.151] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.151] ReadFile (in: hFile=0x39c, lpBuffer=0x70192d8, nNumberOfBytesToRead=0xcee0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x70192d8*, lpNumberOfBytesRead=0x3e4ff14*=0xcee0, lpOverlapped=0x0) returned 1 [0189.613] GetProcessHeap () returned 0x580000 [0189.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0189.613] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.613] WriteFile (in: hFile=0x39c, lpBuffer=0x70261e8*, nNumberOfBytesToWrite=0xcee0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x70261e8*, lpNumberOfBytesWritten=0x3e4ff14*=0xcee0, lpOverlapped=0x0) returned 1 [0189.615] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.616] WriteFile (in: hFile=0x39c, lpBuffer=0x70330c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x70330c7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0189.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.616] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0189.616] CloseHandle (hObject=0x39c) returned 1 [0189.616] GetProcessHeap () returned 0x580000 [0189.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70261e8 | out: hHeap=0x580000) returned 1 [0189.616] GetProcessHeap () returned 0x580000 [0189.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70192d8 | out: hHeap=0x580000) returned 1 [0189.616] GetProcessHeap () returned 0x580000 [0189.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8a131c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcf11, dwReserved0=0x3e4fd28, dwReserved1=0x70192d8, cFileName="LoginDialogBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGIND~1.YOU")) returned 0x5b9770 [0193.126] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.186] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", len=0x5a | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned 1 [0193.187] GetProcessHeap () returned 0x580000 [0193.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2064) returned 0x6f14048 [0193.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0193.203] CloseHandle (hObject=0x494) returned 1 [0193.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js.id_1622540890_.your_last_chance")) returned 1 [0193.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1388d, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b9770 [0193.217] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0193.217] GetProcessHeap () returned 0x580000 [0193.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0193.217] GetProcessHeap () returned 0x580000 [0193.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0193.217] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.217] ReadFile (in: hFile=0x494, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0197.258] GetProcessHeap () returned 0x580000 [0197.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0197.259] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x494, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0197.259] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x494, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.259] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.259] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.259] CloseHandle (hObject=0x494) returned 1 [0197.260] GetProcessHeap () returned 0x580000 [0197.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0197.260] GetProcessHeap () returned 0x580000 [0197.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0197.260] GetProcessHeap () returned 0x580000 [0197.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0199.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad2f9380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x138b1, dwReserved0=0x3e4fd28, dwReserved1=0x707ec98, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b97b0 [0199.246] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.353] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", len=0x66 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned 1 [0199.353] GetProcessHeap () returned 0x580000 [0199.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0199.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0199.448] CloseHandle (hObject=0x4a0) returned 1 [0199.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.id_1622540890_.your_last_chance")) returned 1 [0199.984] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x736, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b96b0 [0199.984] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0199.984] GetProcessHeap () returned 0x580000 [0199.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0199.985] GetProcessHeap () returned 0x580000 [0199.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0199.985] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.985] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x3e4ff14*=0x720, lpOverlapped=0x0) returned 1 [0199.992] GetProcessHeap () returned 0x580000 [0199.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0199.992] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.992] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x3e4ff14*=0x720, lpOverlapped=0x0) returned 1 [0199.992] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.992] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.993] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.993] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.993] CloseHandle (hObject=0x4a0) returned 1 [0199.993] GetProcessHeap () returned 0x580000 [0199.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0199.993] GetProcessHeap () returned 0x580000 [0199.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0199.993] GetProcessHeap () returned 0x580000 [0199.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed28580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75a, dwReserved0=0x3e4fd28, dwReserved1=0x6c4e820, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b9770 [0201.394] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.098] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", len=0x5c | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned 1 [0203.098] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0203.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0206.593] CloseHandle (hObject=0x428) returned 1 [0206.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0206.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.id_1622540890_.your_last_chance")) returned 1 [0209.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b9830 [0209.143] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.143] GetProcessHeap () returned 0x580000 [0209.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0209.143] GetProcessHeap () returned 0x580000 [0209.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0209.143] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.143] ReadFile (in: hFile=0x428, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x3e4ff14*=0x360, lpOverlapped=0x0) returned 1 [0209.148] GetProcessHeap () returned 0x580000 [0209.148] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.148] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.148] WriteFile (in: hFile=0x428, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x3e4ff14*=0x360, lpOverlapped=0x0) returned 1 [0209.148] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.148] WriteFile (in: hFile=0x428, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.148] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.148] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.148] CloseHandle (hObject=0x428) returned 1 [0209.148] GetProcessHeap () returned 0x580000 [0209.148] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0209.149] GetProcessHeap () returned 0x580000 [0209.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0209.149] GetProcessHeap () returned 0x580000 [0209.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0210.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4456b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x3e4fd28, dwReserved1=0x6eef020, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b97b0 [0210.088] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.123] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", len=0x67 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned 1 [0210.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0210.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.419] CloseHandle (hObject=0x46c) returned 1 [0215.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.id_1622540890_.your_last_chance")) returned 1 [0215.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b97b0 [0215.422] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.423] GetProcessHeap () returned 0x580000 [0215.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e78e10 [0215.423] GetProcessHeap () returned 0x580000 [0215.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8a640 [0215.424] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.424] ReadFile (in: hFile=0x46c, lpBuffer=0x6e78e10, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78e10*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.836] GetProcessHeap () returned 0x580000 [0220.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0220.837] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.837] WriteFile (in: hFile=0x46c, lpBuffer=0x6e8a640*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a640*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.837] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.837] WriteFile (in: hFile=0x46c, lpBuffer=0x6e9be3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be3f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.837] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.837] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.837] CloseHandle (hObject=0x46c) returned 1 [0220.930] GetProcessHeap () returned 0x580000 [0220.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8a640 | out: hHeap=0x580000) returned 1 [0220.931] GetProcessHeap () returned 0x580000 [0220.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e78e10 | out: hHeap=0x580000) returned 1 [0220.934] GetProcessHeap () returned 0x580000 [0220.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0221.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb3eb280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167e1, dwReserved0=0x3e4fd28, dwReserved1=0x580000, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b9730 [0221.879] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.901] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", len=0x65 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned 1 [0221.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0221.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0221.948] CloseHandle (hObject=0x48c) returned 1 [0221.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABOFF~1.YOU")) returned 0x5b9730 [0221.949] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0221.949] GetProcessHeap () returned 0x580000 [0221.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6cf6cf0 [0221.950] GetProcessHeap () returned 0x580000 [0221.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6cf76f8 [0221.950] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.950] ReadFile (in: hFile=0x48c, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x3e4ff14*=0x9a0, lpOverlapped=0x0) returned 1 [0222.048] GetProcessHeap () returned 0x580000 [0222.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0222.048] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.048] WriteFile (in: hFile=0x48c, lpBuffer=0x6cf76f8*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf76f8*, lpNumberOfBytesWritten=0x3e4ff14*=0x9a0, lpOverlapped=0x0) returned 1 [0222.049] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.049] WriteFile (in: hFile=0x48c, lpBuffer=0x6cf8097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf8097*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.049] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.049] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.049] CloseHandle (hObject=0x48c) returned 1 [0222.350] GetProcessHeap () returned 0x580000 [0222.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf76f8 | out: hHeap=0x580000) returned 1 [0222.350] GetProcessHeap () returned 0x580000 [0222.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0222.350] GetProcessHeap () returned 0x580000 [0222.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0223.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbf5fc60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x3e4fd28, dwReserved1=0x6cf6cf0, cFileName="TABOFF.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABOFF~1.YOU")) returned 0x5b9730 [0223.655] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.722] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", len=0x49 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned 1 [0223.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0223.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0223.731] CloseHandle (hObject=0x48c) returned 1 [0223.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.731] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.id_1622540890_.your_last_chance")) returned 1 [0223.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSEN~1.YOU")) returned 0x5b96f0 [0223.732] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0223.732] GetProcessHeap () returned 0x580000 [0223.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dece50 [0223.732] GetProcessHeap () returned 0x580000 [0223.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6decfc8 [0223.732] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.732] ReadFile (in: hFile=0x48c, lpBuffer=0x6dece50, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dece50*, lpNumberOfBytesRead=0x3e4ff14*=0x140, lpOverlapped=0x0) returned 1 [0223.735] GetProcessHeap () returned 0x580000 [0223.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0223.735] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.735] WriteFile (in: hFile=0x48c, lpBuffer=0x6decfc8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6decfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x140, lpOverlapped=0x0) returned 1 [0223.735] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.735] WriteFile (in: hFile=0x48c, lpBuffer=0x6ded107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ded107*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.735] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.735] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.735] CloseHandle (hObject=0x48c) returned 1 [0223.735] GetProcessHeap () returned 0x580000 [0223.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6decfc8 | out: hHeap=0x580000) returned 1 [0223.735] GetProcessHeap () returned 0x580000 [0223.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dece50 | out: hHeap=0x580000) returned 1 [0223.735] GetProcessHeap () returned 0x580000 [0223.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0223.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcf710e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x3e4fd28, dwReserved1=0x6dece50, cFileName="Messenger.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSEN~1.YOU")) returned 0x5b96f0 [0223.736] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.751] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned 1 [0223.751] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0223.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0224.425] CloseHandle (hObject=0x45c) returned 1 [0224.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0224.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0224.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0224.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x4d0073, dwReserved1=0x730061, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9630 [0224.427] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0224.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0224.427] GetProcessHeap () returned 0x580000 [0224.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0224.427] GetProcessHeap () returned 0x580000 [0224.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0224.427] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.427] ReadFile (in: hFile=0x45c, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x3e4ff14*=0x620, lpOverlapped=0x0) returned 1 [0224.434] GetProcessHeap () returned 0x580000 [0224.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0224.434] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.434] WriteFile (in: hFile=0x45c, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x3e4ff14*=0x620, lpOverlapped=0x0) returned 1 [0224.434] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.434] WriteFile (in: hFile=0x45c, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0224.434] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.435] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0224.435] CloseHandle (hObject=0x45c) returned 1 [0224.436] GetProcessHeap () returned 0x580000 [0224.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0224.436] GetProcessHeap () returned 0x580000 [0224.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0224.436] GetProcessHeap () returned 0x580000 [0224.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd622ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x3e4fd28, dwReserved1=0x626d30, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9630 [0226.311] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.421] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", len=0x51 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css") returned 1 [0226.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d94) returned 0x6dee6e0 [0226.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0226.422] CloseHandle (hObject=0x430) returned 1 [0226.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.id_1622540890_.your_last_chance")) returned 1 [0226.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b9630 [0226.424] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0226.424] GetProcessHeap () returned 0x580000 [0226.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd8f68 [0226.424] GetProcessHeap () returned 0x580000 [0226.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd96f0 [0226.424] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.424] ReadFile (in: hFile=0x430, lpBuffer=0x6dd8f68, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesRead=0x3e4ff14*=0x720, lpOverlapped=0x0) returned 1 [0226.487] GetProcessHeap () returned 0x580000 [0226.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0226.487] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.487] WriteFile (in: hFile=0x430, lpBuffer=0x6dd96f0*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd96f0*, lpNumberOfBytesWritten=0x3e4ff14*=0x720, lpOverlapped=0x0) returned 1 [0226.488] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.488] WriteFile (in: hFile=0x430, lpBuffer=0x6dd9e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e0f*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.488] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.488] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.488] CloseHandle (hObject=0x430) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd96f0 | out: hHeap=0x580000) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe849680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x3e4fd28, dwReserved1=0x6dd8f68, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b9630 [0230.351] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.369] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", len=0x34 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned 1 [0230.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0230.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.413] CloseHandle (hObject=0x4a8) returned 1 [0230.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.id_1622540890_.your_last_chance")) returned 1 [0230.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCRHCD~1.YOU")) returned 0x5b9630 [0230.415] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ocrhc.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0230.415] GetProcessHeap () returned 0x580000 [0230.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd021) returned 0x709a4f8 [0230.415] GetProcessHeap () returned 0x580000 [0230.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd021) returned 0x7489c08 [0230.415] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.415] ReadFile (in: hFile=0x4a8, lpBuffer=0x709a4f8, nNumberOfBytesToRead=0xd000, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x709a4f8*, lpNumberOfBytesRead=0x3e4ff14*=0xd000, lpOverlapped=0x0) returned 1 [0236.898] GetProcessHeap () returned 0x580000 [0236.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0236.899] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.899] WriteFile (in: hFile=0x4a8, lpBuffer=0x7489c08*, nNumberOfBytesToWrite=0xd000, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7489c08*, lpNumberOfBytesWritten=0x3e4ff14*=0xd000, lpOverlapped=0x0) returned 1 [0239.105] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.106] WriteFile (in: hFile=0x4a8, lpBuffer=0x7496c07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7496c07*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.156] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.156] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.156] CloseHandle (hObject=0x4a8) returned 1 [0239.404] GetProcessHeap () returned 0x580000 [0239.404] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7489c08 | out: hHeap=0x580000) returned 1 [0239.405] GetProcessHeap () returned 0x580000 [0239.405] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709a4f8 | out: hHeap=0x580000) returned 1 [0239.406] GetProcessHeap () returned 0x580000 [0239.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0240.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6117300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd030, dwReserved0=0x3e4fd28, dwReserved1=0x709a4f8, cFileName="OCRHC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCRHCD~1.YOU")) returned 0x5b9730 [0240.646] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.657] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML", len=0x4e | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned 1 [0240.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0240.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.720] CloseHandle (hObject=0x3f4) returned 1 [0240.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml.id_1622540890_.your_last_chance")) returned 1 [0240.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA695B~1.YOU")) returned 0x5b9730 [0240.721] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.721] GetProcessHeap () returned 0x580000 [0240.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c62590 [0240.721] GetProcessHeap () returned 0x580000 [0240.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c628f8 [0240.721] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.721] ReadFile (in: hFile=0x3f4, lpBuffer=0x6c62590, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62590*, lpNumberOfBytesRead=0x3e4ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.779] GetProcessHeap () returned 0x580000 [0240.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.780] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.780] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c628f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c628f8*, lpNumberOfBytesWritten=0x3e4ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.780] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.780] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c62c17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62c17*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.780] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.780] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.780] CloseHandle (hObject=0x3f4) returned 1 [0240.780] GetProcessHeap () returned 0x580000 [0240.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c628f8 | out: hHeap=0x580000) returned 1 [0240.780] GetProcessHeap () returned 0x580000 [0240.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c62590 | out: hHeap=0x580000) returned 1 [0240.780] GetProcessHeap () returned 0x580000 [0240.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7090200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x3e4fd28, dwReserved1=0x6c62590, cFileName="YAHOO.CO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA695B~1.YOU")) returned 0x5b9730 [0240.780] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.809] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd", len=0x4a | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 1 [0240.809] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0240.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.930] CloseHandle (hObject=0x470) returned 1 [0241.930] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.930] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.id_1622540890_.your_last_chance")) returned 1 [0241.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~4.YOU")) returned 0x5b9630 [0241.931] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.931] GetProcessHeap () returned 0x580000 [0241.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6dd7c48 [0241.931] GetProcessHeap () returned 0x580000 [0241.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6dd7cb8 [0241.931] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.931] ReadFile (in: hFile=0x470, lpBuffer=0x6dd7c48, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c48*, lpNumberOfBytesRead=0x3e4ff14*=0x40, lpOverlapped=0x0) returned 1 [0241.932] GetProcessHeap () returned 0x580000 [0241.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.932] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.932] WriteFile (in: hFile=0x470, lpBuffer=0x6dd7cb8*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7cb8*, lpNumberOfBytesWritten=0x3e4ff14*=0x40, lpOverlapped=0x0) returned 1 [0241.932] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.932] WriteFile (in: hFile=0x470, lpBuffer=0x6dd7cf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7cf7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.933] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.933] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.933] CloseHandle (hObject=0x470) returned 1 [0241.933] GetProcessHeap () returned 0x580000 [0241.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7cb8 | out: hHeap=0x580000) returned 1 [0241.933] GetProcessHeap () returned 0x580000 [0241.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c48 | out: hHeap=0x580000) returned 1 [0241.933] GetProcessHeap () returned 0x580000 [0241.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7b927c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75, dwReserved0=0x3e4fd28, dwReserved1=0x6dd7c48, cFileName="SendtoOneNoteFilter.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~4.YOU")) returned 0x5b9630 [0241.933] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.705] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML", len=0x40 | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned 1 [0242.705] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0245.391] CloseHandle (hObject=0x4a4) returned 1 [0245.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml.id_1622540890_.your_last_chance")) returned 1 [0248.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39db9100, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x19ede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~3.YOU")) returned 0x5b96f0 [0248.743] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0248.743] GetProcessHeap () returned 0x580000 [0248.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0248.743] GetProcessHeap () returned 0x580000 [0248.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0248.743] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.743] ReadFile (in: hFile=0x4a4, lpBuffer=0x72d6838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.601] GetProcessHeap () returned 0x580000 [0252.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.601] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.601] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x3e4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.601] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.601] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.602] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.602] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.602] CloseHandle (hObject=0x4a4) returned 1 [0252.602] GetProcessHeap () returned 0x580000 [0252.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0252.602] GetProcessHeap () returned 0x580000 [0252.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0252.603] GetProcessHeap () returned 0x580000 [0252.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fccc | out: lpFindFileData=0x3e4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce155440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19f02, dwReserved0=0x3e4fd28, dwReserved1=0x72d6838, cFileName="PGLBL096.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~3.YOU")) returned 0x5b9730 [0254.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.361] SysReAllocStringLen (in: pbstr=0x3e4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV", len=0x3e | out: pbstr=0x3e4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 1 [0255.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f70) returned 0x72e5948 [0255.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0258.817] CloseHandle (hObject=0x480) returned 1 [0258.817] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.818] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3e4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3e4fc74 | out: lpFindFileData=0x3e4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6bca00, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b6bca00, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xae41, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSIDE~2.YOU")) returned 0x5b96f0 [0258.818] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0258.818] GetProcessHeap () returned 0x580000 [0258.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae61) returned 0x72c5008 [0258.819] GetProcessHeap () returned 0x580000 [0258.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae61) returned 0x72cfe78 [0258.819] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.819] ReadFile (in: hFile=0x480, lpBuffer=0x72c5008, nNumberOfBytesToRead=0xae40, lpNumberOfBytesRead=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesRead=0x3e4ff14*=0xae40, lpOverlapped=0x0) returned 1 [0264.105] GetProcessHeap () returned 0x580000 [0264.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0264.105] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.105] WriteFile (in: hFile=0x480, lpBuffer=0x72cfe78*, nNumberOfBytesToWrite=0xae40, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72cfe78*, lpNumberOfBytesWritten=0x3e4ff14*=0xae40, lpOverlapped=0x0) returned 1 [0264.106] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.106] WriteFile (in: hFile=0x480, lpBuffer=0x72dacb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72dacb7*, lpNumberOfBytesWritten=0x3e4ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.106] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.106] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3e4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3e4ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.106] CloseHandle (hObject=0x480) returned 1 [0265.875] GetProcessHeap () returned 0x580000 [0265.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72cfe78 | out: hHeap=0x580000) returned 1 [0265.875] GetProcessHeap () returned 0x580000 [0265.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0265.875] GetProcessHeap () returned 0x580000 [0265.875] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 Thread: id = 27 os_tid = 0xa64 [0039.063] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.408] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.344] Sleep (dwMilliseconds=0x1) [0040.370] Sleep (dwMilliseconds=0x1) [0040.389] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.312] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.656] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.828] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.201] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.325] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.528] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.839] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.917] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.980] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.042] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.401] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.572] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.868] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.915] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.652] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.054] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.101] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.288] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.444] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.678] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.725] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.161] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.239] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.426] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.941] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.050] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.206] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.362] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.877] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.986] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.158] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.657] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.813] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.969] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.234] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.014] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.404] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.761] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.808] Sleep (dwMilliseconds=0x1) [0051.824] Sleep (dwMilliseconds=0x1) [0051.839] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.870] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.902] Sleep (dwMilliseconds=0x1) [0051.917] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.948] Sleep (dwMilliseconds=0x1) [0051.964] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.995] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.042] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.073] Sleep (dwMilliseconds=0x1) [0052.090] Sleep (dwMilliseconds=0x1) [0052.104] Sleep (dwMilliseconds=0x1) [0052.120] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.229] Sleep (dwMilliseconds=0x1) [0052.245] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.276] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.307] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.354] Sleep (dwMilliseconds=0x1) [0052.370] Sleep (dwMilliseconds=0x1) [0052.385] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.416] Sleep (dwMilliseconds=0x1) [0052.432] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.494] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.588] Sleep (dwMilliseconds=0x1) [0052.604] Sleep (dwMilliseconds=0x1) [0052.619] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.697] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.728] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.775] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.838] Sleep (dwMilliseconds=0x1) [0052.853] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.900] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.931] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.978] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.056] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.087] Sleep (dwMilliseconds=0x1) [0053.111] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.165] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.213] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.243] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.321] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.368] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.399] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.446] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.477] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.524] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.587] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.633] Sleep (dwMilliseconds=0x1) [0053.649] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.680] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.711] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.758] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.789] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.836] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.914] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.945] Sleep (dwMilliseconds=0x1) [0053.961] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.992] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.070] Sleep (dwMilliseconds=0x1) [0054.086] Sleep (dwMilliseconds=0x1) [0054.101] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.148] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.179] Sleep (dwMilliseconds=0x1) [0054.199] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.226] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.257] Sleep (dwMilliseconds=0x1) [0054.273] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.304] Sleep (dwMilliseconds=0x1) [0054.321] Sleep (dwMilliseconds=0x1) [0054.336] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.382] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.460] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.491] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.538] Sleep (dwMilliseconds=0x1) [0054.561] Sleep (dwMilliseconds=0x1) [0054.569] Sleep (dwMilliseconds=0x1) [0054.585] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.616] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.694] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.741] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.772] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.850] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.881] Sleep (dwMilliseconds=0x1) [0054.897] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.928] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.006] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.038] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.084] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.115] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.162] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.240] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.271] Sleep (dwMilliseconds=0x1) [0055.287] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.318] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.349] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.396] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.474] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.533] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Boot\\BOOTSTAT.DAT", len=0x14 | out: pbstr=0x3f8ff84*="C:\\Boot\\BOOTSTAT.DAT") returned 1 [0055.533] GetProcessHeap () returned 0x580000 [0055.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615280, Size=0x1c) returned 0x615230 [0055.534] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0055.545] CloseHandle (hObject=0x3fc) returned 1 [0055.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.545] MoveFileW (lpExistingFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), lpNewFileName="C:\\Boot\\BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bootstat.dat.id_1622540890_.your_last_chance")) returned 1 [0055.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.546] FindFirstFileW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOOTST~1.YOU")) returned 0x5b95f0 [0055.546] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.546] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bootstat.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0055.546] GetProcessHeap () returned 0x580000 [0055.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10021) returned 0x621c08 [0055.547] GetProcessHeap () returned 0x580000 [0055.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10021) returned 0x631c38 [0055.547] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.548] ReadFile (in: hFile=0x3fc, lpBuffer=0x621c08, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x621c08*, lpNumberOfBytesRead=0x3f8ff14*=0x10000, lpOverlapped=0x0) returned 1 [0055.832] GetProcessHeap () returned 0x580000 [0055.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0055.832] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.832] WriteFile (in: hFile=0x3fc, lpBuffer=0x631c38*, nNumberOfBytesToWrite=0x10000, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x631c38*, lpNumberOfBytesWritten=0x3f8ff14*=0x10000, lpOverlapped=0x0) returned 1 [0055.841] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.841] WriteFile (in: hFile=0x3fc, lpBuffer=0x641c37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x641c37*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0055.841] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.842] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0055.842] CloseHandle (hObject=0x3fc) returned 1 [0055.843] GetProcessHeap () returned 0x580000 [0055.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x631c38 | out: hHeap=0x580000) returned 1 [0055.843] GetProcessHeap () returned 0x580000 [0055.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x621c08 | out: hHeap=0x580000) returned 1 [0055.843] GetProcessHeap () returned 0x580000 [0055.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0055.843] FindFirstFileW (in: lpFileName="C:\\Boot\\BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x59151ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10024, dwReserved0=0x3f8fd28, dwReserved1=0x621c08, cFileName="BOOTSTAT.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BOOTST~1.YOU")) returned 0x5b95f0 [0055.843] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.880] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0055.880] GetProcessHeap () returned 0x580000 [0055.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x24) returned 0x5dc550 [0055.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0055.880] CloseHandle (hObject=0x3f4) returned 1 [0055.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.880] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0055.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.881] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0055.881] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.881] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0055.881] GetProcessHeap () returned 0x580000 [0055.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x622c10 [0055.881] GetProcessHeap () returned 0x580000 [0055.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x623380 [0055.881] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.881] ReadFile (in: hFile=0x3f4, lpBuffer=0x622c10, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x622c10*, lpNumberOfBytesRead=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0055.889] GetProcessHeap () returned 0x580000 [0055.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0055.889] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.889] WriteFile (in: hFile=0x3f4, lpBuffer=0x623380*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x623380*, lpNumberOfBytesWritten=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0055.889] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.889] WriteFile (in: hFile=0x3f4, lpBuffer=0x623abf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x623abf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0055.890] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.890] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0055.890] CloseHandle (hObject=0x3f4) returned 1 [0055.890] GetProcessHeap () returned 0x580000 [0055.891] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x623380 | out: hHeap=0x580000) returned 1 [0055.891] GetProcessHeap () returned 0x580000 [0055.891] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x622c10 | out: hHeap=0x580000) returned 1 [0055.891] GetProcessHeap () returned 0x580000 [0055.891] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0055.891] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x591c42c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x782, dwReserved0=0x3f8fd28, dwReserved1=0x622c10, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0055.891] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.067] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0056.067] GetProcessHeap () returned 0x580000 [0056.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0056.067] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0056.068] CloseHandle (hObject=0x414) returned 1 [0056.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.068] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0056.069] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.069] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0056.069] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.069] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0056.069] GetProcessHeap () returned 0x580000 [0056.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6c57328 [0056.069] GetProcessHeap () returned 0x580000 [0056.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6c57998 [0056.069] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.069] ReadFile (in: hFile=0x414, lpBuffer=0x6c57328, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57328*, lpNumberOfBytesRead=0x3f8ff14*=0x640, lpOverlapped=0x0) returned 1 [0056.076] GetProcessHeap () returned 0x580000 [0056.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0056.076] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.076] WriteFile (in: hFile=0x414, lpBuffer=0x6c57998*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57998*, lpNumberOfBytesWritten=0x3f8ff14*=0x640, lpOverlapped=0x0) returned 1 [0056.076] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.077] WriteFile (in: hFile=0x414, lpBuffer=0x6c57fd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57fd7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0056.077] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.077] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0056.077] CloseHandle (hObject=0x414) returned 1 [0056.077] GetProcessHeap () returned 0x580000 [0056.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57998 | out: hHeap=0x580000) returned 1 [0056.078] GetProcessHeap () returned 0x580000 [0056.078] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57328 | out: hHeap=0x580000) returned 1 [0056.078] GetProcessHeap () returned 0x580000 [0056.078] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0056.078] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5938d340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x3f8fd28, dwReserved1=0x6c57328, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0056.078] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.083] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", len=0x4f | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 1 [0056.083] GetProcessHeap () returned 0x580000 [0056.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0056.083] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0056.083] CloseHandle (hObject=0x410) returned 1 [0056.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.083] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id_1622540890_.your_last_chance")) returned 1 [0056.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.084] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~1.YOU")) returned 0x5b9630 [0056.084] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.084] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0056.084] GetProcessHeap () returned 0x580000 [0056.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0056.084] GetProcessHeap () returned 0x580000 [0056.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c7a388 [0056.084] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.084] ReadFile (in: hFile=0x410, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x3f8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0056.092] GetProcessHeap () returned 0x580000 [0056.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0056.092] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.092] WriteFile (in: hFile=0x410, lpBuffer=0x6c7a388*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a388*, lpNumberOfBytesWritten=0x3f8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0056.092] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.092] WriteFile (in: hFile=0x410, lpBuffer=0x6c7a927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a927*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0056.092] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.092] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0056.092] CloseHandle (hObject=0x410) returned 1 [0056.093] GetProcessHeap () returned 0x580000 [0056.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a388 | out: hHeap=0x580000) returned 1 [0056.093] GetProcessHeap () returned 0x580000 [0056.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0056.093] GetProcessHeap () returned 0x580000 [0056.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0056.093] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x593b34a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0x3f8fd28, dwReserved1=0x5f3908, cFileName="PublisherMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~1.YOU")) returned 0x5b9630 [0056.093] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.680] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0056.680] GetProcessHeap () returned 0x580000 [0056.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0056.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0057.722] CloseHandle (hObject=0x428) returned 1 [0057.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.722] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0057.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.723] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0057.723] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0057.723] GetProcessHeap () returned 0x580000 [0057.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6c56108 [0057.723] GetProcessHeap () returned 0x580000 [0057.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6d330a8 [0057.723] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.723] ReadFile (in: hFile=0x428, lpBuffer=0x6c56108, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesRead=0x3f8ff14*=0x1060, lpOverlapped=0x0) returned 1 [0057.740] GetProcessHeap () returned 0x580000 [0057.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0057.740] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x428, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x1060, lpOverlapped=0x0) returned 1 [0057.740] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x428, lpBuffer=0x6d34107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d34107*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0057.740] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.740] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0057.740] CloseHandle (hObject=0x428) returned 1 [0057.741] GetProcessHeap () returned 0x580000 [0057.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0057.741] GetProcessHeap () returned 0x580000 [0057.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0057.741] GetProcessHeap () returned 0x580000 [0057.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0057.741] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5a378660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1093, dwReserved0=0x3f8fd28, dwReserved1=0x6c56108, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0057.741] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.142] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", len=0x51 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 1 [0058.142] GetProcessHeap () returned 0x580000 [0058.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0058.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0058.143] CloseHandle (hObject=0x438) returned 1 [0058.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.143] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0058.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.173] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96b0 [0058.173] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0058.173] GetProcessHeap () returned 0x580000 [0058.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x5f3908 [0058.173] GetProcessHeap () returned 0x580000 [0058.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6d57110 [0058.174] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.174] ReadFile (in: hFile=0x438, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x3f8ff14*=0x540, lpOverlapped=0x0) returned 1 [0058.180] GetProcessHeap () returned 0x580000 [0058.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0058.180] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x438, lpBuffer=0x6d57110*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d57110*, lpNumberOfBytesWritten=0x3f8ff14*=0x540, lpOverlapped=0x0) returned 1 [0058.180] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x438, lpBuffer=0x6d5764f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d5764f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0058.180] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.180] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0058.180] CloseHandle (hObject=0x438) returned 1 [0058.181] GetProcessHeap () returned 0x580000 [0058.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d57110 | out: hHeap=0x580000) returned 1 [0058.181] GetProcessHeap () returned 0x580000 [0058.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0058.181] GetProcessHeap () returned 0x580000 [0058.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0058.181] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x5a7a2ce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x3f8fd28, dwReserved1=0x5f3908, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96b0 [0058.181] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.196] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", len=0x51 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 1 [0058.196] GetProcessHeap () returned 0x580000 [0058.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x615348 [0058.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0058.196] CloseHandle (hObject=0x430) returned 1 [0058.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.196] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0058.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.198] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9670 [0058.198] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0058.198] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0058.198] GetProcessHeap () returned 0x580000 [0058.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0058.199] GetProcessHeap () returned 0x580000 [0058.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6d330a8 [0058.199] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.199] ReadFile (in: hFile=0x430, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x3f8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0058.689] GetProcessHeap () returned 0x580000 [0058.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0058.689] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.689] WriteFile (in: hFile=0x430, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0059.086] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.086] WriteFile (in: hFile=0x430, lpBuffer=0x6d33647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33647*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.086] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.086] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.086] CloseHandle (hObject=0x430) returned 1 [0059.999] GetProcessHeap () returned 0x580000 [0059.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0059.999] GetProcessHeap () returned 0x580000 [0059.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0059.999] GetProcessHeap () returned 0x580000 [0059.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0059.999] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b043ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d6, dwReserved0=0x3f8fd28, dwReserved1=0x5f3908, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9630 [0060.364] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.873] SysReAllocStringLen (pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", len=0x4a) [0060.873] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", len=0x4a | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 1 [0060.873] GetProcessHeap () returned 0x580000 [0060.873] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x30) returned 0x61f768 [0060.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0060.874] CloseHandle (hObject=0x430) returned 1 [0060.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.874] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id_1622540890_.your_last_chance")) returned 1 [0060.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.874] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHELLU~1.YOU")) returned 0x5b9630 [0060.875] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0060.875] GetProcessHeap () returned 0x580000 [0060.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6d330a8 [0060.875] GetProcessHeap () returned 0x580000 [0060.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6c56108 [0060.875] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.875] ReadFile (in: hFile=0x430, lpBuffer=0x6d330a8, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesRead=0x3f8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0060.889] GetProcessHeap () returned 0x580000 [0060.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0060.889] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.889] WriteFile (in: hFile=0x430, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x3f8ff14*=0xe00, lpOverlapped=0x0) returned 1 [0060.889] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.889] WriteFile (in: hFile=0x430, lpBuffer=0x6c56f07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56f07*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0060.889] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.890] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0060.890] CloseHandle (hObject=0x430) returned 1 [0060.890] GetProcessHeap () returned 0x580000 [0060.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0060.890] GetProcessHeap () returned 0x580000 [0060.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0060.890] GetProcessHeap () returned 0x580000 [0060.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0060.891] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0x5c185c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe24, dwReserved0=0x3f8fd28, dwReserved1=0x6d330a8, cFileName="ShellUI.MST.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHELLU~1.YOU")) returned 0x5b9630 [0060.891] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.903] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", len=0x48 | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 1 [0060.903] GetProcessHeap () returned 0x580000 [0060.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f730, Size=0x28) returned 0x5dc340 [0060.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0060.904] CloseHandle (hObject=0x45c) returned 1 [0060.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.904] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id_1622540890_.your_last_chance")) returned 1 [0060.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.904] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPC~1.YOU")) returned 0x5b9630 [0060.905] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0060.905] GetProcessHeap () returned 0x580000 [0060.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10681) returned 0x6eae600 [0060.905] GetProcessHeap () returned 0x580000 [0060.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10681) returned 0x6ebec90 [0060.906] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.906] ReadFile (in: hFile=0x45c, lpBuffer=0x6eae600, nNumberOfBytesToRead=0x10660, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eae600*, lpNumberOfBytesRead=0x3f8ff14*=0x10660, lpOverlapped=0x0) returned 1 [0066.560] GetProcessHeap () returned 0x580000 [0066.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0066.561] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.561] WriteFile (in: hFile=0x45c, lpBuffer=0x6ebec90*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebec90*, lpNumberOfBytesWritten=0x3f8ff14*=0x10660, lpOverlapped=0x0) returned 1 [0067.550] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.550] WriteFile (in: hFile=0x45c, lpBuffer=0x6ecf2ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf2ef*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.550] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.551] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.551] CloseHandle (hObject=0x45c) returned 1 [0067.552] GetProcessHeap () returned 0x580000 [0067.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebec90 | out: hHeap=0x580000) returned 1 [0067.558] GetProcessHeap () returned 0x580000 [0067.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eae600 | out: hHeap=0x580000) returned 1 [0067.559] GetProcessHeap () returned 0x580000 [0067.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0067.559] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0x60027f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1069a, dwReserved0=0x3f8fd34, dwReserved1=0x7718ba87, cFileName="setup.chm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPC~1.YOU")) returned 0x5b9630 [0067.559] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.639] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", len=0x4c | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 1 [0068.639] GetProcessHeap () returned 0x580000 [0068.639] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x18) returned 0x5e9710 [0068.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.640] CloseHandle (hObject=0x458) returned 1 [0068.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.641] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id_1622540890_.your_last_chance")) returned 1 [0068.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.641] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x450043, dwReserved1=0x0, cFileName="OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~3.YOU")) returned 0x5b96b0 [0068.641] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.641] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.641] GetProcessHeap () returned 0x580000 [0068.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x15c1) returned 0x6d0c508 [0068.641] GetProcessHeap () returned 0x580000 [0068.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x15c1) returned 0x6d0dad8 [0068.641] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.642] ReadFile (in: hFile=0x458, lpBuffer=0x6d0c508, nNumberOfBytesToRead=0x15a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0c508*, lpNumberOfBytesRead=0x3f8ff14*=0x15a0, lpOverlapped=0x0) returned 1 [0068.742] GetProcessHeap () returned 0x580000 [0068.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0068.743] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.743] WriteFile (in: hFile=0x458, lpBuffer=0x6d0dad8*, nNumberOfBytesToWrite=0x15a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0dad8*, lpNumberOfBytesWritten=0x3f8ff14*=0x15a0, lpOverlapped=0x0) returned 1 [0068.743] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.743] WriteFile (in: hFile=0x458, lpBuffer=0x6d0f077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f077*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0068.743] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.743] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0068.743] CloseHandle (hObject=0x458) returned 1 [0068.744] GetProcessHeap () returned 0x580000 [0068.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0dad8 | out: hHeap=0x580000) returned 1 [0068.744] GetProcessHeap () returned 0x580000 [0068.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0c508 | out: hHeap=0x580000) returned 1 [0068.744] GetProcessHeap () returned 0x580000 [0068.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0068.744] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x60b76780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x15d9, dwReserved0=0x3f8fd28, dwReserved1=0x6d0c508, cFileName="OfficeMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~3.YOU")) returned 0x5b96b0 [0068.744] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.828] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", len=0x5a | out: pbstr=0x3f8ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 1 [0068.828] GetProcessHeap () returned 0x580000 [0068.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0xc) returned 0x5e9710 [0068.828] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.828] CloseHandle (hObject=0x458) returned 1 [0068.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.829] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id_1622540890_.your_last_chance")) returned 1 [0068.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.829] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x2000002, cFileName="Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b96b0 [0068.829] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.829] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.830] GetProcessHeap () returned 0x580000 [0068.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6d0e508 [0068.830] GetProcessHeap () returned 0x580000 [0068.830] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6d0ec78 [0068.830] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.830] ReadFile (in: hFile=0x458, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0068.839] GetProcessHeap () returned 0x580000 [0068.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0068.839] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x458, lpBuffer=0x6d0ec78*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ec78*, lpNumberOfBytesWritten=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0068.839] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x458, lpBuffer=0x6d0f3b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f3b7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0068.839] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.839] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0068.839] CloseHandle (hObject=0x458) returned 1 [0069.702] GetProcessHeap () returned 0x580000 [0069.702] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0ec78 | out: hHeap=0x580000) returned 1 [0069.702] GetProcessHeap () returned 0x580000 [0069.702] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0069.702] GetProcessHeap () returned 0x580000 [0069.702] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0069.702] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0x60c5afc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x765, dwReserved0=0x3f8fd28, dwReserved1=0x6d0e508, cFileName="Microsoft.VC90.CRT.manifest.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9770 [0072.134] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0073.120] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", len=0x43 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 1 [0073.121] GetProcessHeap () returned 0x580000 [0073.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x14) returned 0x5b5d08 [0073.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0074.027] CloseHandle (hObject=0x458) returned 1 [0074.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id_1622540890_.your_last_chance")) returned 1 [0074.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EPSIMP~1.YOU")) returned 0x5b96b0 [0074.028] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0074.028] GetProcessHeap () returned 0x580000 [0074.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0074.029] GetProcessHeap () returned 0x580000 [0074.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0074.029] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.029] ReadFile (in: hFile=0x458, lpBuffer=0x6d9f1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.947] GetProcessHeap () returned 0x580000 [0077.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0077.948] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.948] WriteFile (in: hFile=0x458, lpBuffer=0x6c10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.948] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.949] WriteFile (in: hFile=0x458, lpBuffer=0x6c21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21847*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0078.461] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.461] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0078.461] CloseHandle (hObject=0x458) returned 1 [0079.033] GetProcessHeap () returned 0x580000 [0079.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0079.033] GetProcessHeap () returned 0x580000 [0079.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0079.035] GetProcessHeap () returned 0x580000 [0079.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0079.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66610ce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xadfb4, dwReserved0=0x3f8fd28, dwReserved1=0x6d9f1d0, cFileName="EPSIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EPSIMP~1.YOU")) returned 0x5b96f0 [0079.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.962] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", len=0x47 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 1 [0085.962] GetProcessHeap () returned 0x580000 [0085.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xa0) returned 0x614a48 [0085.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.963] Sleep (dwMilliseconds=0x1) [0085.979] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", len=0x45 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 1 [0085.979] GetProcessHeap () returned 0x580000 [0085.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x30) returned 0x614a48 [0085.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.426] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", len=0x45 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 1 [0086.426] GetProcessHeap () returned 0x580000 [0086.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0087.985] CloseHandle (hObject=0x474) returned 1 [0087.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0087.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id_1622540890_.your_last_chance")) returned 1 [0087.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AXISEL~1.YOU")) returned 0x5b96b0 [0087.986] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0087.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0087.986] GetProcessHeap () returned 0x580000 [0087.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f2c538 [0087.986] GetProcessHeap () returned 0x580000 [0087.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c296a8 [0087.986] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.986] ReadFile (in: hFile=0x474, lpBuffer=0x6f2c538, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2c538*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0091.470] GetProcessHeap () returned 0x580000 [0091.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0091.471] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.471] WriteFile (in: hFile=0x474, lpBuffer=0x6c296a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c296a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0091.471] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.472] WriteFile (in: hFile=0x474, lpBuffer=0x6c3aea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3aea7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.472] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.472] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.472] CloseHandle (hObject=0x474) returned 1 [0091.472] GetProcessHeap () returned 0x580000 [0091.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c296a8 | out: hHeap=0x580000) returned 1 [0091.480] GetProcessHeap () returned 0x580000 [0091.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2c538 | out: hHeap=0x580000) returned 1 [0091.480] GetProcessHeap () returned 0x580000 [0091.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0091.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e2247a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x189e2, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="AXIS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AXISEL~1.YOU")) returned 0x5b96b0 [0091.627] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.185] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", len=0x4b | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 1 [0092.185] GetProcessHeap () returned 0x580000 [0092.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1aec0, Size=0x68) returned 0x6f09508 [0092.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.186] CloseHandle (hObject=0x448) returned 1 [0092.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.187] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.187] GetProcessHeap () returned 0x580000 [0092.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6c79b98 [0092.187] GetProcessHeap () returned 0x580000 [0092.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f0c4f8 [0092.187] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.187] ReadFile (in: hFile=0x448, lpBuffer=0x6c79b98, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79b98*, lpNumberOfBytesRead=0x3f8ff14*=0x540, lpOverlapped=0x0) returned 1 [0092.194] GetProcessHeap () returned 0x580000 [0092.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.194] WriteFile (in: hFile=0x448, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x3f8ff14*=0x540, lpOverlapped=0x0) returned 1 [0092.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.194] WriteFile (in: hFile=0x448, lpBuffer=0x6f0ca37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca37*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.194] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.194] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.194] CloseHandle (hObject=0x448) returned 1 [0092.194] GetProcessHeap () returned 0x580000 [0092.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0092.194] GetProcessHeap () returned 0x580000 [0092.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79b98 | out: hHeap=0x580000) returned 1 [0092.195] GetProcessHeap () returned 0x580000 [0092.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e8fc6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x3f8fd28, dwReserved1=0x6c79b98, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.207] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.212] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", len=0x4b | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 1 [0092.212] GetProcessHeap () returned 0x580000 [0092.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c56120 [0092.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0092.281] CloseHandle (hObject=0x410) returned 1 [0092.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id_1622540890_.your_last_chance")) returned 1 [0092.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x45, dwReserved1=0x0, cFileName="NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~2.YOU")) returned 0x5b96b0 [0092.282] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0092.282] GetProcessHeap () returned 0x580000 [0092.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc661) returned 0x6d21878 [0092.282] GetProcessHeap () returned 0x580000 [0092.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc661) returned 0x6c10048 [0092.283] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.283] ReadFile (in: hFile=0x410, lpBuffer=0x6d21878, nNumberOfBytesToRead=0xc640, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x3f8ff14*=0xc640, lpOverlapped=0x0) returned 1 [0097.598] GetProcessHeap () returned 0x580000 [0097.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.598] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.599] WriteFile (in: hFile=0x410, lpBuffer=0x6c10048*, nNumberOfBytesToWrite=0xc640, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesWritten=0x3f8ff14*=0xc640, lpOverlapped=0x0) returned 1 [0097.599] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.599] WriteFile (in: hFile=0x410, lpBuffer=0x6c1c687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c1c687*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.599] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.599] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.599] CloseHandle (hObject=0x410) returned 1 [0097.599] GetProcessHeap () returned 0x580000 [0097.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0097.599] GetProcessHeap () returned 0x580000 [0097.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0097.600] GetProcessHeap () returned 0x580000 [0097.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c9c400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc66d, dwReserved0=0x3f8fd28, dwReserved1=0x6d21878, cFileName="NETWORK.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~2.YOU")) returned 0x5b96f0 [0097.600] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.713] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", len=0x47 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 1 [0101.713] GetProcessHeap () returned 0x580000 [0101.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0101.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0101.765] CloseHandle (hObject=0x47c) returned 1 [0101.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id_1622540890_.your_last_chance")) returned 1 [0106.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0106.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERE~1.YOU")) returned 0x5b9630 [0106.627] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0106.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0106.627] GetProcessHeap () returned 0x580000 [0106.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101e1) returned 0x636970 [0106.628] GetProcessHeap () returned 0x580000 [0106.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101e1) returned 0x646b60 [0106.628] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.628] ReadFile (in: hFile=0x47c, lpBuffer=0x636970, nNumberOfBytesToRead=0x101c0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x3f8ff14*=0x101c0, lpOverlapped=0x0) returned 1 [0108.422] GetProcessHeap () returned 0x580000 [0108.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0108.423] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.423] WriteFile (in: hFile=0x47c, lpBuffer=0x646b60*, nNumberOfBytesToWrite=0x101c0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x646b60*, lpNumberOfBytesWritten=0x3f8ff14*=0x101c0, lpOverlapped=0x0) returned 1 [0108.423] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.423] WriteFile (in: hFile=0x47c, lpBuffer=0x656d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x656d1f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0108.423] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0108.423] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0108.423] CloseHandle (hObject=0x47c) returned 1 [0108.423] GetProcessHeap () returned 0x580000 [0108.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x646b60 | out: hHeap=0x580000) returned 1 [0108.423] GetProcessHeap () returned 0x580000 [0108.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0108.423] GetProcessHeap () returned 0x580000 [0108.424] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0108.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x783dbe40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x101f0, dwReserved0=0x3f8fd28, dwReserved1=0x636970, cFileName="WATER.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERE~1.YOU")) returned 0x5b9730 [0108.424] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.008] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", len=0x48 | out: pbstr=0x3f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 1 [0112.009] GetProcessHeap () returned 0x580000 [0112.009] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.011] Sleep (dwMilliseconds=0x1) [0112.047] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", len=0x40 | out: pbstr=0x3f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 1 [0112.047] GetProcessHeap () returned 0x580000 [0112.048] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.048] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.067] Sleep (dwMilliseconds=0x1) [0112.191] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.206] Sleep (dwMilliseconds=0x1) [0112.316] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", len=0x3f | out: pbstr=0x3f8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned 1 [0112.316] GetProcessHeap () returned 0x580000 [0112.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.316] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.328] Sleep (dwMilliseconds=0x1) [0113.331] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", len=0x3f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 1 [0113.331] GetProcessHeap () returned 0x580000 [0113.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x9c) returned 0x6f0ceb8 [0113.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0113.480] CloseHandle (hObject=0x4a8) returned 1 [0113.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0085~1.YOU")) returned 0x5b9630 [0114.469] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0114.470] GetProcessHeap () returned 0x580000 [0114.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x6efa518 [0114.470] GetProcessHeap () returned 0x580000 [0114.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x6eff5a8 [0114.470] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.470] ReadFile (in: hFile=0x4a8, lpBuffer=0x6efa518, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efa518*, lpNumberOfBytesRead=0x3f8ff14*=0x5060, lpOverlapped=0x0) returned 1 [0116.641] GetProcessHeap () returned 0x580000 [0116.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x6eff5a8*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eff5a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x5060, lpOverlapped=0x0) returned 1 [0116.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f04607*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04607*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.460] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.460] CloseHandle (hObject=0x4a8) returned 1 [0117.922] GetProcessHeap () returned 0x580000 [0117.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eff5a8 | out: hHeap=0x580000) returned 1 [0117.922] GetProcessHeap () returned 0x580000 [0117.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efa518 | out: hHeap=0x580000) returned 1 [0117.922] GetProcessHeap () returned 0x580000 [0117.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0120.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d9ffa60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5086, dwReserved0=0x3f8fd28, dwReserved1=0x6efa518, cFileName="AN00853_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0085~1.YOU")) returned 0x5b96f0 [0120.013] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.027] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", len=0x3d | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF") returned 1 [0120.028] GetProcessHeap () returned 0x580000 [0120.028] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a8) returned 0x6d06ca8 [0120.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.986] CloseHandle (hObject=0x470) returned 1 [0121.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.id_1622540890_.your_last_chance")) returned 1 [0121.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHIRL1~1.YOU")) returned 0x5b9730 [0121.987] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.987] GetProcessHeap () returned 0x580000 [0121.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0121.987] GetProcessHeap () returned 0x580000 [0121.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0121.987] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.987] ReadFile (in: hFile=0x470, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x3f8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0121.997] GetProcessHeap () returned 0x580000 [0121.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.998] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.998] WriteFile (in: hFile=0x470, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x3f8ff14*=0xa00, lpOverlapped=0x0) returned 1 [0121.998] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.998] WriteFile (in: hFile=0x470, lpBuffer=0x62f717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f717*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.998] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.998] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.998] CloseHandle (hObject=0x470) returned 1 [0121.998] GetProcessHeap () returned 0x580000 [0121.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0121.998] GetProcessHeap () returned 0x580000 [0121.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0121.998] GetProcessHeap () returned 0x580000 [0121.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8054aa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x3f8fd28, dwReserved1=0x6c676b8, cFileName="WHIRL1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHIRL1~1.YOU")) returned 0x5b9730 [0122.635] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.635] Sleep (dwMilliseconds=0x1) [0124.521] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", len=0x4e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned 1 [0124.521] GetProcessHeap () returned 0x580000 [0124.521] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f8) returned 0x6f42f08 [0124.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.537] CloseHandle (hObject=0x4a0) returned 1 [0124.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.id_1622540890_.your_last_chance")) returned 1 [0124.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Executive.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXECUT~1.YOU")) returned 0x5b9730 [0124.538] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.539] GetProcessHeap () returned 0x580000 [0124.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0124.539] GetProcessHeap () returned 0x580000 [0124.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6ce2378 [0124.539] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.539] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3f8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.554] GetProcessHeap () returned 0x580000 [0124.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.554] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.554] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x3f8ff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.554] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.555] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce3197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3197*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.555] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.555] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.555] CloseHandle (hObject=0x4a0) returned 1 [0124.559] GetProcessHeap () returned 0x580000 [0124.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.559] GetProcessHeap () returned 0x580000 [0124.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.559] GetProcessHeap () returned 0x580000 [0124.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81db0c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x3f8fd28, dwReserved1=0x6c29878, cFileName="Executive.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXECUT~1.YOU")) returned 0x5b9730 [0124.585] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.693] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", len=0x4e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned 1 [0124.693] GetProcessHeap () returned 0x580000 [0124.693] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d4) returned 0x6f42f08 [0124.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.719] CloseHandle (hObject=0x4a0) returned 1 [0124.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.id_1622540890_.your_last_chance")) returned 1 [0124.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLACKT~1.YOU")) returned 0x5b9730 [0124.720] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.720] GetProcessHeap () returned 0x580000 [0124.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0124.720] GetProcessHeap () returned 0x580000 [0124.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0124.720] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.720] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x3f8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.761] GetProcessHeap () returned 0x580000 [0124.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.761] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.761] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x3f8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.761] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.761] WriteFile (in: hFile=0x4a0, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.761] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.761] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.761] CloseHandle (hObject=0x4a0) returned 1 [0124.764] GetProcessHeap () returned 0x580000 [0124.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.764] GetProcessHeap () returned 0x580000 [0124.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.764] GetProcessHeap () returned 0x580000 [0124.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f9fde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1f, dwReserved0=0x3f8fd28, dwReserved1=0x6c29878, cFileName="Black Tie.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLACKT~1.YOU")) returned 0x5b9730 [0125.345] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.359] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", len=0x3d | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned 1 [0125.359] GetProcessHeap () returned 0x580000 [0125.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19bc) returned 0x6f42f08 [0125.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0128.875] CloseHandle (hObject=0x464) returned 1 [0128.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02977~2.YOU")) returned 0x5b9730 [0129.971] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0129.971] GetProcessHeap () returned 0x580000 [0129.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa7e1) returned 0x6fa4468 [0129.971] GetProcessHeap () returned 0x580000 [0129.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa7e1) returned 0x6d10048 [0129.972] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.972] ReadFile (in: hFile=0x464, lpBuffer=0x6fa4468, nNumberOfBytesToRead=0xa7c0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa4468*, lpNumberOfBytesRead=0x3f8ff14*=0xa7c0, lpOverlapped=0x0) returned 1 [0133.155] GetProcessHeap () returned 0x580000 [0133.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0133.155] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.155] WriteFile (in: hFile=0x464, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xa7c0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x3f8ff14*=0xa7c0, lpOverlapped=0x0) returned 1 [0133.156] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.156] WriteFile (in: hFile=0x464, lpBuffer=0x6d1a807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1a807*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0133.156] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.156] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0133.156] CloseHandle (hObject=0x464) returned 1 [0134.146] GetProcessHeap () returned 0x580000 [0134.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0134.146] GetProcessHeap () returned 0x580000 [0134.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa4468 | out: hHeap=0x580000) returned 1 [0134.146] GetProcessHeap () returned 0x580000 [0134.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0135.617] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x86faa1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa7e6, dwReserved0=0x3f8fd28, dwReserved1=0x6fa4468, cFileName="J0297707.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02977~2.YOU")) returned 0x5b96b0 [0135.617] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.696] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", len=0x4b | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned 1 [0135.714] GetProcessHeap () returned 0x580000 [0135.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0135.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.714] CloseHandle (hObject=0x48c) returned 1 [0135.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.id_1622540890_.your_last_chance")) returned 1 [0135.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x45, dwReserved1=0x0, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b96b0 [0135.715] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.716] GetProcessHeap () returned 0x580000 [0135.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x6e50a00 [0135.716] GetProcessHeap () returned 0x580000 [0135.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x7066ea8 [0135.716] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.716] ReadFile (in: hFile=0x48c, lpBuffer=0x6e50a00, nNumberOfBytesToRead=0x7dc0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e50a00*, lpNumberOfBytesRead=0x3f8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0137.602] GetProcessHeap () returned 0x580000 [0137.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0137.602] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.602] WriteFile (in: hFile=0x48c, lpBuffer=0x7066ea8*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066ea8*, lpNumberOfBytesWritten=0x3f8ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0138.494] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.494] WriteFile (in: hFile=0x48c, lpBuffer=0x706ec67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ec67*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.494] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.494] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.494] CloseHandle (hObject=0x48c) returned 1 [0138.494] GetProcessHeap () returned 0x580000 [0138.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066ea8 | out: hHeap=0x580000) returned 1 [0138.495] GetProcessHeap () returned 0x580000 [0138.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e50a00 | out: hHeap=0x580000) returned 1 [0138.495] GetProcessHeap () returned 0x580000 [0138.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0138.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7df7, dwReserved0=0x3f8fd28, dwReserved1=0x6e50a00, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b96b0 [0138.495] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.666] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", len=0x56 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css") returned 1 [0138.666] GetProcessHeap () returned 0x580000 [0138.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0138.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.689] CloseHandle (hObject=0x3a8) returned 1 [0138.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance")) returned 1 [0138.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x4c005f, dwReserved1=0x530041, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b9770 [0138.690] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.690] GetProcessHeap () returned 0x580000 [0138.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x6e063d0 [0138.690] GetProcessHeap () returned 0x580000 [0138.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0138.690] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.690] ReadFile (in: hFile=0x3a8, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x3f8ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0138.709] GetProcessHeap () returned 0x580000 [0138.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0138.709] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.709] WriteFile (in: hFile=0x3a8, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x3f8ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0138.709] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.709] WriteFile (in: hFile=0x3a8, lpBuffer=0x6788af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6788af*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.709] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.709] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.709] CloseHandle (hObject=0x3a8) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0138.710] GetProcessHeap () returned 0x580000 [0138.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0140.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a4a0b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc0e, dwReserved0=0x3f8fd28, dwReserved1=0x6e063d0, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b9770 [0140.122] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.165] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", len=0x50 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css") returned 1 [0140.165] GetProcessHeap () returned 0x580000 [0140.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0140.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.585] CloseHandle (hObject=0x428) returned 1 [0140.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.id_1622540890_.your_last_chance")) returned 1 [0140.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b9770 [0140.586] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.587] GetProcessHeap () returned 0x580000 [0140.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10060 [0140.587] GetProcessHeap () returned 0x580000 [0140.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10ae8 [0140.587] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.587] ReadFile (in: hFile=0x428, lpBuffer=0x6c10060, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x3f8ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0140.597] GetProcessHeap () returned 0x580000 [0140.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.597] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.597] WriteFile (in: hFile=0x428, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x3f8ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0140.597] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.597] WriteFile (in: hFile=0x428, lpBuffer=0x6c114c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c114c7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.597] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.597] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.597] CloseHandle (hObject=0x428) returned 1 [0140.597] GetProcessHeap () returned 0x580000 [0140.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0140.597] GetProcessHeap () returned 0x580000 [0140.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0140.597] GetProcessHeap () returned 0x580000 [0140.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0141.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6a1180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa22, dwReserved0=0x3f8fd28, dwReserved1=0x6c10060, cFileName="Sts.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSCSS~1.YOU")) returned 0x5b9730 [0141.010] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.489] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", len=0x3c | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT") returned 1 [0146.489] GetProcessHeap () returned 0x580000 [0146.489] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0146.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.489] CloseHandle (hObject=0x3b4) returned 1 [0146.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.id_1622540890_.your_last_chance")) returned 1 [0146.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHL~1.YOU")) returned 0x5b9730 [0146.491] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0146.491] GetProcessHeap () returned 0x580000 [0146.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcd81) returned 0x6d8e818 [0146.491] GetProcessHeap () returned 0x580000 [0146.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcd81) returned 0x6dbf1d0 [0146.491] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.491] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xcd60, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x3f8ff14*=0xcd60, lpOverlapped=0x0) returned 1 [0149.546] GetProcessHeap () returned 0x580000 [0149.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0149.546] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.546] WriteFile (in: hFile=0x3b4, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0xcd60, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x3f8ff14*=0xcd60, lpOverlapped=0x0) returned 1 [0149.546] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.546] WriteFile (in: hFile=0x3b4, lpBuffer=0x6dcbf2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcbf2f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0149.546] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.546] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0149.547] CloseHandle (hObject=0x3b4) returned 1 [0149.547] GetProcessHeap () returned 0x580000 [0149.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0149.547] GetProcessHeap () returned 0x580000 [0149.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0149.548] GetProcessHeap () returned 0x580000 [0149.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0149.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c066c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcd88, dwReserved0=0x3f8fd28, dwReserved1=0x6d8e818, cFileName="PSRCHLTS.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHL~1.YOU")) returned 0x5b96f0 [0149.548] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.591] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", len=0x44 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned 1 [0150.591] GetProcessHeap () returned 0x580000 [0150.591] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0150.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0150.591] CloseHandle (hObject=0x470) returned 1 [0150.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR49~1.YOU")) returned 0x5b96f0 [0150.592] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0150.593] GetProcessHeap () returned 0x580000 [0150.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32c1) returned 0x6599d0 [0150.593] GetProcessHeap () returned 0x580000 [0150.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32c1) returned 0x6d97948 [0150.594] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.594] ReadFile (in: hFile=0x470, lpBuffer=0x6599d0, nNumberOfBytesToRead=0x32a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesRead=0x3f8ff14*=0x32a0, lpOverlapped=0x0) returned 1 [0151.279] GetProcessHeap () returned 0x580000 [0151.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0151.279] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x470, lpBuffer=0x6d97948*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d97948*, lpNumberOfBytesWritten=0x3f8ff14*=0x32a0, lpOverlapped=0x0) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x470, lpBuffer=0x6d9abe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9abe7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.279] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.279] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.279] CloseHandle (hObject=0x470) returned 1 [0151.925] GetProcessHeap () returned 0x580000 [0151.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d97948 | out: hHeap=0x580000) returned 1 [0151.926] GetProcessHeap () returned 0x580000 [0151.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0151.926] GetProcessHeap () returned 0x580000 [0151.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0152.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c89f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32da, dwReserved0=0x3f8fd28, dwReserved1=0x6599d0, cFileName="PDIR49F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR49~1.YOU")) returned 0x5b9730 [0152.050] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0152.066] CloseHandle (hObject=0x428) returned 1 [0152.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id_1622540890_.your_last_chance")) returned 1 [0152.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e34500, ftCreationTime.dwHighDateTime=0x1ca90f4, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4e34500, ftLastWriteTime.dwHighDateTime=0x1ca90f4, nFileSizeHigh=0x0, nFileSizeLow=0xd6cc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI7D8B~1.YOU")) returned 0x5b9730 [0152.068] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0152.068] GetProcessHeap () returned 0x580000 [0152.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0152.069] GetProcessHeap () returned 0x580000 [0152.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0152.069] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.069] ReadFile (in: hFile=0x428, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.178] GetProcessHeap () returned 0x580000 [0157.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0157.179] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.179] WriteFile (in: hFile=0x428, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.179] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.179] WriteFile (in: hFile=0x428, lpBuffer=0x6e17bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17bcf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0157.769] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.769] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0157.769] CloseHandle (hObject=0x428) returned 1 [0157.769] GetProcessHeap () returned 0x580000 [0157.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0157.769] GetProcessHeap () returned 0x580000 [0157.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0157.777] GetProcessHeap () returned 0x580000 [0157.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0157.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e34500, ftCreationTime.dwHighDateTime=0x1ca90f4, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95a6db60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd6cea, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="VISIO.SHAPESHEET.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI7D8B~1.YOU")) returned 0x5b9630 [0157.777] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.264] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", len=0x49 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL") returned 1 [0159.264] GetProcessHeap () returned 0x580000 [0159.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0159.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.267] CloseHandle (hObject=0x390) returned 1 [0159.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.267] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHICAG~1.YOU")) returned 0x5b9630 [0159.268] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.268] GetProcessHeap () returned 0x580000 [0159.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8bda0 [0159.269] GetProcessHeap () returned 0x580000 [0159.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0159.269] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.269] ReadFile (in: hFile=0x390, lpBuffer=0x6e8bda0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8bda0*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.849] GetProcessHeap () returned 0x580000 [0164.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0164.850] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.850] WriteFile (in: hFile=0x390, lpBuffer=0x70a1cf8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.850] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.850] WriteFile (in: hFile=0x390, lpBuffer=0x70b34f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b34f7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.380] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.380] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.380] CloseHandle (hObject=0x390) returned 1 [0165.380] GetProcessHeap () returned 0x580000 [0165.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0165.381] GetProcessHeap () returned 0x580000 [0165.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8bda0 | out: hHeap=0x580000) returned 1 [0165.385] GetProcessHeap () returned 0x580000 [0165.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0169.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a307a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x52850, dwReserved0=0x3f8fd28, dwReserved1=0x580000, cFileName="CHICAGO.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHICAG~1.YOU")) returned 0x5b9730 [0169.259] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.270] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", len=0x3e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 1 [0169.271] GetProcessHeap () returned 0x580000 [0169.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0169.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.272] CloseHandle (hObject=0x454) returned 1 [0169.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id_1622540890_.your_last_chance")) returned 1 [0169.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTCF~1.YOU")) returned 0x5b9730 [0169.273] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.273] GetProcessHeap () returned 0x580000 [0169.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0169.273] GetProcessHeap () returned 0x580000 [0169.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x707ec98 [0169.273] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.273] ReadFile (in: hFile=0x454, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x3f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0169.277] GetProcessHeap () returned 0x580000 [0169.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.277] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.277] WriteFile (in: hFile=0x454, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x3f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0169.278] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.278] WriteFile (in: hFile=0x454, lpBuffer=0x707ef97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ef97*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.278] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.278] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.278] CloseHandle (hObject=0x454) returned 1 [0169.278] GetProcessHeap () returned 0x580000 [0169.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0169.278] GetProcessHeap () returned 0x580000 [0169.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0169.278] GetProcessHeap () returned 0x580000 [0169.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c839220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x339, dwReserved0=0x3f8fd28, dwReserved1=0x6df6780, cFileName="APPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTCF~1.YOU")) returned 0x5b9730 [0169.279] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.373] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", len=0x35 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 1 [0169.373] GetProcessHeap () returned 0x580000 [0169.373] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0169.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0169.373] CloseHandle (hObject=0x4a8) returned 1 [0169.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.374] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id_1622540890_.your_last_chance")) returned 1 [0169.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERXIMP~1.YOU")) returned 0x5b9730 [0169.375] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0169.375] GetProcessHeap () returned 0x580000 [0169.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0169.375] GetProcessHeap () returned 0x580000 [0169.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0169.376] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.376] ReadFile (in: hFile=0x4a8, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.739] GetProcessHeap () returned 0x580000 [0173.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.739] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.739] WriteFile (in: hFile=0x4a8, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.739] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.739] WriteFile (in: hFile=0x4a8, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.740] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.740] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.740] CloseHandle (hObject=0x4a8) returned 1 [0173.740] GetProcessHeap () returned 0x580000 [0173.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0173.740] GetProcessHeap () returned 0x580000 [0173.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0173.740] GetProcessHeap () returned 0x580000 [0173.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0176.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f2c5b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fc4, dwReserved0=0x3f8fd28, dwReserved1=0x636970, cFileName="ERXIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERXIMP~1.YOU")) returned 0x5b96f0 [0176.710] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.752] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", len=0x48 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned 1 [0176.752] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0176.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0177.578] CloseHandle (hObject=0x440) returned 1 [0177.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.id_1622540890_.your_last_chance")) returned 1 [0177.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIBEWA~1.YOU")) returned 0x5b96f0 [0177.579] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0177.579] GetProcessHeap () returned 0x580000 [0177.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea81) returned 0x6d21878 [0177.580] GetProcessHeap () returned 0x580000 [0177.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea81) returned 0x6f976f8 [0177.581] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.581] ReadFile (in: hFile=0x440, lpBuffer=0x6d21878, nNumberOfBytesToRead=0xea60, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x3f8ff14*=0xea60, lpOverlapped=0x0) returned 1 [0179.003] GetProcessHeap () returned 0x580000 [0179.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.003] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.003] WriteFile (in: hFile=0x440, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0xea60, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x3f8ff14*=0xea60, lpOverlapped=0x0) returned 1 [0179.003] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.003] WriteFile (in: hFile=0x440, lpBuffer=0x6fa6157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6157*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.003] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.003] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.004] CloseHandle (hObject=0x440) returned 1 [0179.004] GetProcessHeap () returned 0x580000 [0179.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0179.009] GetProcessHeap () returned 0x580000 [0179.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0179.009] GetProcessHeap () returned 0x580000 [0179.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa24e8ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xea96, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="VIBE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIBEWA~1.YOU")) returned 0x5b96b0 [0180.108] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.183] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", len=0x69 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned 1 [0180.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0180.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.184] CloseHandle (hObject=0x448) returned 1 [0180.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b96b0 [0180.185] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.185] GetProcessHeap () returned 0x580000 [0180.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3441) returned 0x6d763c8 [0180.185] GetProcessHeap () returned 0x580000 [0180.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3441) returned 0x6f62698 [0180.185] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.185] ReadFile (in: hFile=0x448, lpBuffer=0x6d763c8, nNumberOfBytesToRead=0x3420, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d763c8*, lpNumberOfBytesRead=0x3f8ff14*=0x3420, lpOverlapped=0x0) returned 1 [0181.254] GetProcessHeap () returned 0x580000 [0181.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.254] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x448, lpBuffer=0x6f62698*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62698*, lpNumberOfBytesWritten=0x3f8ff14*=0x3420, lpOverlapped=0x0) returned 1 [0181.254] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x448, lpBuffer=0x6f65ab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f65ab7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.254] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.254] CloseHandle (hObject=0x448) returned 1 [0181.254] GetProcessHeap () returned 0x580000 [0181.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f62698 | out: hHeap=0x580000) returned 1 [0181.254] GetProcessHeap () returned 0x580000 [0181.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d763c8 | out: hHeap=0x580000) returned 1 [0181.254] GetProcessHeap () returned 0x580000 [0181.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a550c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3448, dwReserved0=0x3f8fd28, dwReserved1=0x6d763c8, cFileName="CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b9770 [0182.674] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.690] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", len=0x50 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned 1 [0182.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0182.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.747] CloseHandle (hObject=0x488) returned 1 [0182.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.id_1622540890_.your_last_chance")) returned 1 [0182.748] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~2.YOU")) returned 0x5b9770 [0182.748] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.748] GetProcessHeap () returned 0x580000 [0182.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1981) returned 0x6f42f08 [0182.748] GetProcessHeap () returned 0x580000 [0182.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1981) returned 0x667250 [0182.748] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.748] ReadFile (in: hFile=0x488, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x3f8ff14*=0x1960, lpOverlapped=0x0) returned 1 [0182.777] GetProcessHeap () returned 0x580000 [0182.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.777] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.777] WriteFile (in: hFile=0x488, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x3f8ff14*=0x1960, lpOverlapped=0x0) returned 1 [0182.777] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.777] WriteFile (in: hFile=0x488, lpBuffer=0x668baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x668baf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.777] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.777] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.778] CloseHandle (hObject=0x488) returned 1 [0182.778] GetProcessHeap () returned 0x580000 [0182.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0182.778] GetProcessHeap () returned 0x580000 [0182.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0182.778] GetProcessHeap () returned 0x580000 [0182.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa48e9780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1987, dwReserved0=0x3f8fd28, dwReserved1=0x6f42f08, cFileName="Shared24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~2.YOU")) returned 0x5b9770 [0183.803] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.817] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", len=0x6b | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned 1 [0183.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0183.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.414] CloseHandle (hObject=0x454) returned 1 [0186.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x2e0047, dwReserved1=0x640069, cFileName="DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATEJP~1.YOU")) returned 0x5b96b0 [0186.415] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0186.415] GetProcessHeap () returned 0x580000 [0186.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x42c1) returned 0x6fd2b58 [0186.416] GetProcessHeap () returned 0x580000 [0186.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x42c1) returned 0x6fd6e28 [0186.416] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.416] ReadFile (in: hFile=0x454, lpBuffer=0x6fd2b58, nNumberOfBytesToRead=0x42a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd2b58*, lpNumberOfBytesRead=0x3f8ff14*=0x42a0, lpOverlapped=0x0) returned 1 [0187.598] GetProcessHeap () returned 0x580000 [0187.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0187.598] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x454, lpBuffer=0x6fd6e28*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd6e28*, lpNumberOfBytesWritten=0x3f8ff14*=0x42a0, lpOverlapped=0x0) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x454, lpBuffer=0x6fdb0c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdb0c7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.598] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.598] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.598] CloseHandle (hObject=0x454) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd6e28 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd2b58 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0188.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa76e2060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x42d3, dwReserved0=0x3f8fd28, dwReserved1=0x6fd2b58, cFileName="DATE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATEJP~1.YOU")) returned 0x5b9770 [0188.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.080] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", len=0x45 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned 1 [0188.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0188.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0191.912] CloseHandle (hObject=0x448) returned 1 [0191.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x141c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPCEE8~1.YOU")) returned 0x5b97b0 [0194.599] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0194.600] GetProcessHeap () returned 0x580000 [0194.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6c3a820 [0194.600] GetProcessHeap () returned 0x580000 [0194.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6c3bd28 [0194.600] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.600] ReadFile (in: hFile=0x448, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x3f8ff14*=0x1400, lpOverlapped=0x0) returned 1 [0194.618] GetProcessHeap () returned 0x580000 [0194.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.618] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.618] WriteFile (in: hFile=0x448, lpBuffer=0x6c3bd28*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3bd28*, lpNumberOfBytesWritten=0x3f8ff14*=0x1400, lpOverlapped=0x0) returned 1 [0194.619] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.619] WriteFile (in: hFile=0x448, lpBuffer=0x6c3d127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3d127*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.619] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.619] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.619] CloseHandle (hObject=0x448) returned 1 [0194.619] GetProcessHeap () returned 0x580000 [0194.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3bd28 | out: hHeap=0x580000) returned 1 [0194.619] GetProcessHeap () returned 0x580000 [0194.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0194.619] GetProcessHeap () returned 0x580000 [0194.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab9d4b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1440, dwReserved0=0x3f8fd28, dwReserved1=0x6c3a820, cFileName="ZPDIR46F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPCEE8~1.YOU")) returned 0x5b97b0 [0194.619] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.657] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", len=0x69 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned 1 [0194.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0194.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.425] CloseHandle (hObject=0x480) returned 1 [0196.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.id_1622540890_.your_last_chance")) returned 1 [0196.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b97f0 [0196.426] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0196.426] GetProcessHeap () returned 0x580000 [0196.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6cf6cf0 [0196.426] GetProcessHeap () returned 0x580000 [0196.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6cf76f8 [0196.426] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.426] ReadFile (in: hFile=0x480, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x3f8ff14*=0x960, lpOverlapped=0x0) returned 1 [0196.435] GetProcessHeap () returned 0x580000 [0196.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.435] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.435] WriteFile (in: hFile=0x480, lpBuffer=0x6cf76f8*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf76f8*, lpNumberOfBytesWritten=0x3f8ff14*=0x960, lpOverlapped=0x0) returned 1 [0196.435] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.435] WriteFile (in: hFile=0x480, lpBuffer=0x6cf8057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf8057*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.436] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.436] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.436] CloseHandle (hObject=0x480) returned 1 [0196.436] GetProcessHeap () returned 0x580000 [0196.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf76f8 | out: hHeap=0x580000) returned 1 [0196.436] GetProcessHeap () returned 0x580000 [0196.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0196.436] GetProcessHeap () returned 0x580000 [0196.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacb3cc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x99b, dwReserved0=0x3f8fd28, dwReserved1=0x6cf6cf0, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b97f0 [0199.126] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.138] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", len=0x44 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned 1 [0199.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0199.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0199.256] CloseHandle (hObject=0x440) returned 1 [0199.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.256] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.257] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR41~1.YOU")) returned 0x5b97b0 [0199.257] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0199.257] GetProcessHeap () returned 0x580000 [0199.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d61) returned 0x6d2a9e8 [0199.257] GetProcessHeap () returned 0x580000 [0199.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d61) returned 0x710e6a8 [0199.257] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.257] ReadFile (in: hFile=0x440, lpBuffer=0x6d2a9e8, nNumberOfBytesToRead=0x7d40, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2a9e8*, lpNumberOfBytesRead=0x3f8ff14*=0x7d40, lpOverlapped=0x0) returned 1 [0200.348] GetProcessHeap () returned 0x580000 [0200.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0200.348] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.348] WriteFile (in: hFile=0x440, lpBuffer=0x710e6a8*, nNumberOfBytesToWrite=0x7d40, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x710e6a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x7d40, lpOverlapped=0x0) returned 1 [0200.348] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.348] WriteFile (in: hFile=0x440, lpBuffer=0x71163e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71163e7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.348] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.349] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.349] CloseHandle (hObject=0x440) returned 1 [0200.349] GetProcessHeap () returned 0x580000 [0200.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710e6a8 | out: hHeap=0x580000) returned 1 [0200.349] GetProcessHeap () returned 0x580000 [0200.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2a9e8 | out: hHeap=0x580000) returned 1 [0200.349] GetProcessHeap () returned 0x580000 [0200.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0201.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf06e3c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7d7f, dwReserved0=0x3f8fd28, dwReserved1=0x6d2a9e8, cFileName="PDIR41F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR41~1.YOU")) returned 0x5b9770 [0201.395] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.397] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x75 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0201.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0201.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.405] CloseHandle (hObject=0x3e4) returned 1 [0201.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x54005c, dwReserved1=0x420041, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.440] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.440] GetProcessHeap () returned 0x580000 [0201.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0201.440] GetProcessHeap () returned 0x580000 [0201.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0201.440] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.440] ReadFile (in: hFile=0x3e4, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x3f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.442] GetProcessHeap () returned 0x580000 [0201.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.442] WriteFile (in: hFile=0x3e4, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x3f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.442] WriteFile (in: hFile=0x3e4, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.442] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.442] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.442] CloseHandle (hObject=0x3e4) returned 1 [0201.442] GetProcessHeap () returned 0x580000 [0201.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0201.442] GetProcessHeap () returned 0x580000 [0201.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0201.442] GetProcessHeap () returned 0x580000 [0201.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafad8400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x3f8fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.043] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.065] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x6e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0202.065] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0202.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.066] CloseHandle (hObject=0x4ac) returned 1 [0202.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0202.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x47002e, dwReserved1=0x460049, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.068] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.068] GetProcessHeap () returned 0x580000 [0202.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5b258 [0202.068] GetProcessHeap () returned 0x580000 [0202.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5b390 [0202.068] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.068] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c5b258, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b258*, lpNumberOfBytesRead=0x3f8ff14*=0x100, lpOverlapped=0x0) returned 1 [0202.069] GetProcessHeap () returned 0x580000 [0202.070] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.070] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c5b390*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b390*, lpNumberOfBytesWritten=0x3f8ff14*=0x100, lpOverlapped=0x0) returned 1 [0202.070] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c5b48f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b48f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0202.070] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.070] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0202.070] CloseHandle (hObject=0x4ac) returned 1 [0202.070] GetProcessHeap () returned 0x580000 [0202.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5b390 | out: hHeap=0x580000) returned 1 [0202.070] GetProcessHeap () returned 0x580000 [0202.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5b258 | out: hHeap=0x580000) returned 1 [0202.070] GetProcessHeap () returned 0x580000 [0202.070] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.070] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb00f1c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x3f8fd28, dwReserved1=0x6c5b258, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.070] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.161] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", len=0x69 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned 1 [0203.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0203.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0203.717] CloseHandle (hObject=0x430) returned 1 [0203.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.id_1622540890_.your_last_chance")) returned 1 [0205.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0205.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b97b0 [0205.284] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0205.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0205.284] GetProcessHeap () returned 0x580000 [0205.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0205.284] GetProcessHeap () returned 0x580000 [0205.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0205.284] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.284] ReadFile (in: hFile=0x430, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x3f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0205.288] GetProcessHeap () returned 0x580000 [0205.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0205.288] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.288] WriteFile (in: hFile=0x430, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x3f8ff14*=0x300, lpOverlapped=0x0) returned 1 [0205.288] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.288] WriteFile (in: hFile=0x430, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0205.288] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.288] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0205.288] CloseHandle (hObject=0x430) returned 1 [0205.288] GetProcessHeap () returned 0x580000 [0205.288] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0205.288] GetProcessHeap () returned 0x580000 [0205.288] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0205.288] GetProcessHeap () returned 0x580000 [0205.289] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0209.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f977a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x3f8fd28, dwReserved1=0x6df6780, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b97f0 [0209.580] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.586] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", len=0x6f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned 1 [0209.587] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0209.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.587] CloseHandle (hObject=0x484) returned 1 [0209.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance")) returned 1 [0209.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0x2e0077, dwReserved1=0x730063, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b97f0 [0209.588] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.588] GetProcessHeap () returned 0x580000 [0209.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6f67710 [0209.588] GetProcessHeap () returned 0x580000 [0209.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6f68818 [0209.589] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.589] ReadFile (in: hFile=0x484, lpBuffer=0x6f67710, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x3f8ff14*=0x1060, lpOverlapped=0x0) returned 1 [0209.604] GetProcessHeap () returned 0x580000 [0209.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.604] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.604] WriteFile (in: hFile=0x484, lpBuffer=0x6f68818*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68818*, lpNumberOfBytesWritten=0x3f8ff14*=0x1060, lpOverlapped=0x0) returned 1 [0209.604] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.604] WriteFile (in: hFile=0x484, lpBuffer=0x6f69877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69877*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.604] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.604] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.604] CloseHandle (hObject=0x484) returned 1 [0209.604] GetProcessHeap () returned 0x580000 [0209.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68818 | out: hHeap=0x580000) returned 1 [0209.604] GetProcessHeap () returned 0x580000 [0209.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0209.604] GetProcessHeap () returned 0x580000 [0209.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0209.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48cd480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1098, dwReserved0=0x3f8fd28, dwReserved1=0x6f67710, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b97f0 [0209.604] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.618] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0209.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0209.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.620] CloseHandle (hObject=0x3b8) returned 1 [0209.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0209.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5c0077, dwReserved1=0x410054, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.623] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.623] GetProcessHeap () returned 0x580000 [0209.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0209.623] GetProcessHeap () returned 0x580000 [0209.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0209.623] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.623] ReadFile (in: hFile=0x3b8, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x3f8ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.625] GetProcessHeap () returned 0x580000 [0209.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x3f8ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.625] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.625] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.625] CloseHandle (hObject=0x3b8) returned 1 [0209.625] GetProcessHeap () returned 0x580000 [0209.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0209.625] GetProcessHeap () returned 0x580000 [0209.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0209.625] GetProcessHeap () returned 0x580000 [0209.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0209.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48f35e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x3f8fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.626] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.633] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", len=0x6f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned 1 [0209.633] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0209.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0209.634] CloseHandle (hObject=0x47c) returned 1 [0209.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.634] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance")) returned 1 [0209.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f1, dwReserved0=0x2e0065, dwReserved1=0x730063, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b97f0 [0209.635] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0209.635] GetProcessHeap () returned 0x580000 [0209.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1101) returned 0x6f19958 [0209.635] GetProcessHeap () returned 0x580000 [0209.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1101) returned 0x7461878 [0209.635] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.635] ReadFile (in: hFile=0x47c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x3f8ff14*=0x10e0, lpOverlapped=0x0) returned 1 [0209.964] GetProcessHeap () returned 0x580000 [0209.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0209.964] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.965] WriteFile (in: hFile=0x47c, lpBuffer=0x7461878*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461878*, lpNumberOfBytesWritten=0x3f8ff14*=0x10e0, lpOverlapped=0x0) returned 1 [0209.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.965] WriteFile (in: hFile=0x47c, lpBuffer=0x7462957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7462957*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.965] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.965] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.965] CloseHandle (hObject=0x47c) returned 1 [0210.033] GetProcessHeap () returned 0x580000 [0210.033] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7461878 | out: hHeap=0x580000) returned 1 [0210.034] GetProcessHeap () returned 0x580000 [0210.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0210.034] GetProcessHeap () returned 0x580000 [0210.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c39420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1115, dwReserved0=0x3f8fd28, dwReserved1=0x6f19958, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b97b0 [0214.537] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.556] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", len=0x6c | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned 1 [0214.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0214.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.607] CloseHandle (hObject=0x448) returned 1 [0214.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance")) returned 1 [0214.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b97b0 [0214.608] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.608] GetProcessHeap () returned 0x580000 [0214.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4e820 [0214.608] GetProcessHeap () returned 0x580000 [0214.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4efa8 [0214.608] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.608] ReadFile (in: hFile=0x448, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0214.635] GetProcessHeap () returned 0x580000 [0214.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.635] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.636] WriteFile (in: hFile=0x448, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x3f8ff14*=0x740, lpOverlapped=0x0) returned 1 [0214.636] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.636] WriteFile (in: hFile=0x448, lpBuffer=0x6c4f6e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6e7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.636] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.636] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.636] CloseHandle (hObject=0x448) returned 1 [0214.636] GetProcessHeap () returned 0x580000 [0214.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0214.636] GetProcessHeap () returned 0x580000 [0214.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0214.636] GetProcessHeap () returned 0x580000 [0214.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78b4f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x76e, dwReserved0=0x3f8fd28, dwReserved1=0x6c4e820, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b97b0 [0214.637] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.646] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", len=0x6f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0214.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0214.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.649] CloseHandle (hObject=0x448) returned 1 [0214.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0214.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x2e0052, dwReserved1=0x490047, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0214.650] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.650] GetProcessHeap () returned 0x580000 [0214.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6c79898 [0214.650] GetProcessHeap () returned 0x580000 [0214.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6d00cd8 [0214.650] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.650] ReadFile (in: hFile=0x448, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x3f8ff14*=0x860, lpOverlapped=0x0) returned 1 [0214.690] GetProcessHeap () returned 0x580000 [0214.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.690] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.691] WriteFile (in: hFile=0x448, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x3f8ff14*=0x860, lpOverlapped=0x0) returned 1 [0214.691] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.691] WriteFile (in: hFile=0x448, lpBuffer=0x6d01537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01537*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.691] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.691] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.691] CloseHandle (hObject=0x448) returned 1 [0214.691] GetProcessHeap () returned 0x580000 [0214.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0214.691] GetProcessHeap () returned 0x580000 [0214.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0214.691] GetProcessHeap () returned 0x580000 [0214.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb794d4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x3f8fd28, dwReserved1=0x6c79898, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0214.691] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.703] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS", len=0x45 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS") returned 1 [0214.704] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0214.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.705] CloseHandle (hObject=0x448) returned 1 [0214.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css.id_1622540890_.your_last_chance")) returned 1 [0214.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCE365~1.YOU")) returned 0x5b97b0 [0214.706] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.706] GetProcessHeap () returned 0x580000 [0214.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0214.707] GetProcessHeap () returned 0x580000 [0214.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0214.707] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.707] ReadFile (in: hFile=0x448, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0219.960] GetProcessHeap () returned 0x580000 [0219.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0219.961] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.961] WriteFile (in: hFile=0x448, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0219.961] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.961] WriteFile (in: hFile=0x448, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0219.961] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.962] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0219.962] CloseHandle (hObject=0x448) returned 1 [0219.962] GetProcessHeap () returned 0x580000 [0219.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0219.962] GetProcessHeap () returned 0x580000 [0219.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0219.962] GetProcessHeap () returned 0x580000 [0219.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbab96580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2fe, dwReserved0=0x3f8fd28, dwReserved1=0x6d630a8, cFileName="SCHEME06.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCE365~1.YOU")) returned 0x5b9730 [0221.451] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.485] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", len=0x4a | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 1 [0221.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f48) returned 0x6dee6e0 [0221.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.486] CloseHandle (hObject=0x47c) returned 1 [0221.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id_1622540890_.your_last_chance")) returned 1 [0221.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~3.YOU")) returned 0x5b9730 [0221.487] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.487] GetProcessHeap () returned 0x580000 [0221.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d36a68 [0221.487] GetProcessHeap () returned 0x580000 [0221.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d375f0 [0221.487] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.487] ReadFile (in: hFile=0x47c, lpBuffer=0x6d36a68, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d36a68*, lpNumberOfBytesRead=0x3f8ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.609] GetProcessHeap () returned 0x580000 [0221.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.609] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.609] WriteFile (in: hFile=0x47c, lpBuffer=0x6d375f0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d375f0*, lpNumberOfBytesWritten=0x3f8ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.610] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.610] WriteFile (in: hFile=0x47c, lpBuffer=0x6d3810f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3810f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.610] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.610] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.610] CloseHandle (hObject=0x47c) returned 1 [0221.610] GetProcessHeap () returned 0x580000 [0221.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d375f0 | out: hHeap=0x580000) returned 1 [0221.610] GetProcessHeap () returned 0x580000 [0221.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d36a68 | out: hHeap=0x580000) returned 1 [0221.610] GetProcessHeap () returned 0x580000 [0221.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbb355e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x3f8fd28, dwReserved1=0x6d36a68, cFileName="StatusAway.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~3.YOU")) returned 0x5b9730 [0221.610] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.639] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", len=0x49 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 1 [0221.639] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f2c) returned 0x6dee6e0 [0221.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.667] CloseHandle (hObject=0x458) returned 1 [0221.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id_1622540890_.your_last_chance")) returned 1 [0221.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTDOM~1.YOU")) returned 0x5b9730 [0221.668] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.668] GetProcessHeap () returned 0x580000 [0221.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0221.668] GetProcessHeap () returned 0x580000 [0221.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5d57a0 [0221.668] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.668] ReadFile (in: hFile=0x458, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x3f8ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.670] GetProcessHeap () returned 0x580000 [0221.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.670] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.670] WriteFile (in: hFile=0x458, lpBuffer=0x5d57a0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d57a0*, lpNumberOfBytesWritten=0x3f8ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.670] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.670] WriteFile (in: hFile=0x458, lpBuffer=0x5d58bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d58bf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.671] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.671] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.671] CloseHandle (hObject=0x458) returned 1 [0221.671] GetProcessHeap () returned 0x580000 [0221.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d57a0 | out: hHeap=0x580000) returned 1 [0221.671] GetProcessHeap () returned 0x580000 [0221.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0221.671] GetProcessHeap () returned 0x580000 [0221.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbbcdb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x3f8fd28, dwReserved1=0x65f0b0, cFileName="OutDomain.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTDOM~1.YOU")) returned 0x5b9730 [0221.671] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.712] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", len=0x4e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 1 [0221.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0221.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.713] CloseHandle (hObject=0x47c) returned 1 [0221.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id_1622540890_.your_last_chance")) returned 1 [0221.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b9730 [0221.715] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.715] GetProcessHeap () returned 0x580000 [0221.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38178 [0221.715] GetProcessHeap () returned 0x580000 [0221.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d38d00 [0221.715] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.715] ReadFile (in: hFile=0x47c, lpBuffer=0x6d38178, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38178*, lpNumberOfBytesRead=0x3f8ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.776] GetProcessHeap () returned 0x580000 [0221.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.776] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.776] WriteFile (in: hFile=0x47c, lpBuffer=0x6d38d00*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d38d00*, lpNumberOfBytesWritten=0x3f8ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.776] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.776] WriteFile (in: hFile=0x47c, lpBuffer=0x6d3981f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3981f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.776] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.777] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.777] CloseHandle (hObject=0x47c) returned 1 [0221.777] GetProcessHeap () returned 0x580000 [0221.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38d00 | out: hHeap=0x580000) returned 1 [0221.777] GetProcessHeap () returned 0x580000 [0221.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d38178 | out: hHeap=0x580000) returned 1 [0221.777] GetProcessHeap () returned 0x580000 [0221.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbcd8500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x3f8fd28, dwReserved1=0x6d38178, cFileName="messageboxinfo.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b9730 [0221.777] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.603] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", len=0x35 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 1 [0223.604] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0223.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0223.605] CloseHandle (hObject=0x410) returned 1 [0223.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id_1622540890_.your_last_chance")) returned 1 [0223.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IMDIMP~1.YOU")) returned 0x5b9630 [0223.606] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0223.606] GetProcessHeap () returned 0x580000 [0223.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x73e1) returned 0x7066858 [0223.606] GetProcessHeap () returned 0x580000 [0223.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x73e1) returned 0x7301a38 [0223.606] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.607] ReadFile (in: hFile=0x410, lpBuffer=0x7066858, nNumberOfBytesToRead=0x73c0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066858*, lpNumberOfBytesRead=0x3f8ff14*=0x73c0, lpOverlapped=0x0) returned 1 [0224.456] GetProcessHeap () returned 0x580000 [0224.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0224.456] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.456] WriteFile (in: hFile=0x410, lpBuffer=0x7301a38*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesWritten=0x3f8ff14*=0x73c0, lpOverlapped=0x0) returned 1 [0224.456] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.456] WriteFile (in: hFile=0x410, lpBuffer=0x7308df7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7308df7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0224.456] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0224.456] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0224.456] CloseHandle (hObject=0x410) returned 1 [0224.456] GetProcessHeap () returned 0x580000 [0224.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0224.457] GetProcessHeap () returned 0x580000 [0224.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066858 | out: hHeap=0x580000) returned 1 [0224.457] GetProcessHeap () returned 0x580000 [0224.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbd66f180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x73ec, dwReserved0=0x3f8fd28, dwReserved1=0x7066858, cFileName="IMDIMP.ADD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IMDIMP~1.YOU")) returned 0x5b9630 [0226.315] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.356] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", len=0x57 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css") returned 1 [0226.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d9c) returned 0x6dee6e0 [0226.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.358] CloseHandle (hObject=0x484) returned 1 [0226.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance")) returned 1 [0226.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b9630 [0226.359] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.359] GetProcessHeap () returned 0x580000 [0226.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd9e78 [0226.359] GetProcessHeap () returned 0x580000 [0226.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dda600 [0226.360] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.360] ReadFile (in: hFile=0x484, lpBuffer=0x6dd9e78, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e78*, lpNumberOfBytesRead=0x3f8ff14*=0x720, lpOverlapped=0x0) returned 1 [0226.367] GetProcessHeap () returned 0x580000 [0226.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.367] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.367] WriteFile (in: hFile=0x484, lpBuffer=0x6dda600*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dda600*, lpNumberOfBytesWritten=0x3f8ff14*=0x720, lpOverlapped=0x0) returned 1 [0226.368] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.368] WriteFile (in: hFile=0x484, lpBuffer=0x6ddad1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ddad1f*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.368] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.368] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.368] CloseHandle (hObject=0x484) returned 1 [0226.368] GetProcessHeap () returned 0x580000 [0226.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dda600 | out: hHeap=0x580000) returned 1 [0226.368] GetProcessHeap () returned 0x580000 [0226.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd9e78 | out: hHeap=0x580000) returned 1 [0226.368] GetProcessHeap () returned 0x580000 [0226.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe718b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x3f8fd28, dwReserved1=0x6dd9e78, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b9730 [0230.194] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0233.189] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", len=0x37 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned 1 [0233.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0233.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0233.191] CloseHandle (hObject=0x3b4) returned 1 [0233.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0233.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.id_1622540890_.your_last_chance")) returned 1 [0233.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0233.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMML2M~1.YOU")) returned 0x5b9630 [0233.194] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0233.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\omml2mml.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0233.194] GetProcessHeap () returned 0x580000 [0233.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x765e118 [0233.195] GetProcessHeap () returned 0x580000 [0233.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x766f948 [0233.195] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.195] ReadFile (in: hFile=0x3b4, lpBuffer=0x765e118, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x765e118*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.553] GetProcessHeap () returned 0x580000 [0238.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf3b8 [0238.554] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.554] WriteFile (in: hFile=0x3b4, lpBuffer=0x766f948*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x766f948*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.338] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.338] WriteFile (in: hFile=0x3b4, lpBuffer=0x7681147*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7681147*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.338] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.338] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.338] CloseHandle (hObject=0x3b4) returned 1 [0239.385] GetProcessHeap () returned 0x580000 [0239.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x766f948 | out: hHeap=0x580000) returned 1 [0239.385] GetProcessHeap () returned 0x580000 [0239.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x765e118 | out: hHeap=0x580000) returned 1 [0239.390] GetProcessHeap () returned 0x580000 [0239.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf3b8 | out: hHeap=0x580000) returned 1 [0240.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x172e0, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="OMML2MML.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMML2M~1.YOU")) returned 0x5b9730 [0240.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.654] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML", len=0x4f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned 1 [0240.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0240.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0240.714] CloseHandle (hObject=0x464) returned 1 [0240.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.714] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml.id_1622540890_.your_last_chance")) returned 1 [0240.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA4704~1.YOU")) returned 0x5b9730 [0240.715] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0240.715] GetProcessHeap () returned 0x580000 [0240.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c617f0 [0240.715] GetProcessHeap () returned 0x580000 [0240.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c61b58 [0240.715] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.715] ReadFile (in: hFile=0x464, lpBuffer=0x6c617f0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c617f0*, lpNumberOfBytesRead=0x3f8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.772] GetProcessHeap () returned 0x580000 [0240.772] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.772] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.772] WriteFile (in: hFile=0x464, lpBuffer=0x6c61b58*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61b58*, lpNumberOfBytesWritten=0x3f8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.772] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.772] WriteFile (in: hFile=0x464, lpBuffer=0x6c61e77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61e77*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.772] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.772] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.773] CloseHandle (hObject=0x464) returned 1 [0240.773] GetProcessHeap () returned 0x580000 [0240.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61b58 | out: hHeap=0x580000) returned 1 [0240.773] GetProcessHeap () returned 0x580000 [0240.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c617f0 | out: hHeap=0x580000) returned 1 [0240.773] GetProcessHeap () returned 0x580000 [0240.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7090200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x3f8fd28, dwReserved1=0x6c617f0, cFileName="YAHOO.COM.CN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA4704~1.YOU")) returned 0x5b9730 [0240.773] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.808] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", len=0x50 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned 1 [0240.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0240.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.852] CloseHandle (hObject=0x470) returned 1 [0241.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.id_1622540890_.your_last_chance")) returned 1 [0241.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIT~1.YOU")) returned 0x5b9630 [0241.853] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.853] GetProcessHeap () returned 0x580000 [0241.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.853] GetProcessHeap () returned 0x580000 [0241.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.853] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.853] ReadFile (in: hFile=0x470, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x3f8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.858] GetProcessHeap () returned 0x580000 [0241.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.858] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.858] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x3f8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.858] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.858] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.858] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.858] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.858] CloseHandle (hObject=0x470) returned 1 [0241.858] GetProcessHeap () returned 0x580000 [0241.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.858] GetProcessHeap () returned 0x580000 [0241.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.858] GetProcessHeap () returned 0x580000 [0241.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7ad40e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x3f8fd28, dwReserved1=0x6d0a340, cFileName="AMERITECH.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIT~1.YOU")) returned 0x5b9630 [0241.859] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.870] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML", len=0x40 | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned 1 [0241.870] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0241.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0245.108] CloseHandle (hObject=0x488) returned 1 [0245.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml.id_1622540890_.your_last_chance")) returned 1 [0245.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643bf200, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x643bf200, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG7F4E~1.YOU")) returned 0x5b96f0 [0245.109] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0245.109] GetProcessHeap () returned 0x580000 [0245.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0245.109] GetProcessHeap () returned 0x580000 [0245.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0245.110] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.110] ReadFile (in: hFile=0x488, lpBuffer=0x70a1cf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.158] GetProcessHeap () returned 0x580000 [0248.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0248.159] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.159] WriteFile (in: hFile=0x488, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.159] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.159] WriteFile (in: hFile=0x488, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.213] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.213] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.213] CloseHandle (hObject=0x488) returned 1 [0248.248] GetProcessHeap () returned 0x580000 [0248.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0248.248] GetProcessHeap () returned 0x580000 [0248.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0248.249] GetProcessHeap () returned 0x580000 [0248.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0253.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643bf200, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb7871e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcdc12, dwReserved0=0x3f8fd28, dwReserved1=0x70a1cf8, cFileName="PGLBL110.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG7F4E~1.YOU")) returned 0x5b9730 [0253.189] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.267] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML", len=0x3d | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned 1 [0253.267] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0253.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0253.268] CloseHandle (hObject=0x4a4) returned 1 [0253.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml.id_1622540890_.your_last_chance")) returned 1 [0253.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cde200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47cde200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x31ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZCAR~1.YOU")) returned 0x5b9730 [0253.270] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0253.270] GetProcessHeap () returned 0x580000 [0253.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31c1) returned 0x6d748d8 [0253.270] GetProcessHeap () returned 0x580000 [0253.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31c1) returned 0x6fa8f28 [0253.270] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.270] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d748d8, nNumberOfBytesToRead=0x31a0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesRead=0x3f8ff14*=0x31a0, lpOverlapped=0x0) returned 1 [0254.143] GetProcessHeap () returned 0x580000 [0254.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0254.143] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.143] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x3f8ff14*=0x31a0, lpOverlapped=0x0) returned 1 [0254.143] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.143] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fac0c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fac0c7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0254.143] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.143] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0254.143] CloseHandle (hObject=0x4a4) returned 1 [0254.146] GetProcessHeap () returned 0x580000 [0254.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0254.146] GetProcessHeap () returned 0x580000 [0254.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0254.146] GetProcessHeap () returned 0x580000 [0254.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cde200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf00fc60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x31de, dwReserved0=0x3f8fd28, dwReserved1=0x6d748d8, cFileName="BIZCARD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZCAR~1.YOU")) returned 0x5b9730 [0255.020] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.063] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML", len=0x3c | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML") returned 1 [0255.063] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc0) returned 0x72e5948 [0255.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0255.150] CloseHandle (hObject=0x4a0) returned 1 [0255.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml.id_1622540890_.your_last_chance")) returned 1 [0255.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8d1000, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8d1000, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGZIPC~1.YOU")) returned 0x5b9730 [0255.152] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0255.152] GetProcessHeap () returned 0x580000 [0255.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0255.152] GetProcessHeap () returned 0x580000 [0255.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0255.152] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.152] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x3f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0255.153] GetProcessHeap () returned 0x580000 [0255.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.153] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] WriteFile (in: hFile=0x4a0, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x3f8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0255.154] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] WriteFile (in: hFile=0x4a0, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.154] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.154] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.154] CloseHandle (hObject=0x4a0) returned 1 [0255.154] GetProcessHeap () returned 0x580000 [0255.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0255.154] GetProcessHeap () returned 0x580000 [0255.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0255.154] GetProcessHeap () returned 0x580000 [0255.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8d1000, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf9bb5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfa, dwReserved0=0x3f8fd28, dwReserved1=0x5ae2f0, cFileName="DGZIPC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGZIPC~1.YOU")) returned 0x5b9730 [0255.155] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.291] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML", len=0x3e | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML") returned 1 [0255.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f9c) returned 0x72e5948 [0255.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0255.292] CloseHandle (hObject=0x39c) returned 1 [0255.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml.id_1622540890_.your_last_chance")) returned 1 [0255.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22eb7700, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22eb7700, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBC~1.YOU")) returned 0x5b9730 [0255.293] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0255.293] GetProcessHeap () returned 0x580000 [0255.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x6dee6e0 [0255.293] GetProcessHeap () returned 0x580000 [0255.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x70bc718 [0255.293] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.293] ReadFile (in: hFile=0x39c, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x3f8ff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0255.351] GetProcessHeap () returned 0x580000 [0255.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.351] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.351] WriteFile (in: hFile=0x39c, lpBuffer=0x70bc718*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bc718*, lpNumberOfBytesWritten=0x3f8ff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0255.351] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.351] WriteFile (in: hFile=0x39c, lpBuffer=0x70be3b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70be3b7*, lpNumberOfBytesWritten=0x3f8ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.351] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.351] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x3f8ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.351] CloseHandle (hObject=0x39c) returned 1 [0256.278] GetProcessHeap () returned 0x580000 [0256.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70bc718 | out: hHeap=0x580000) returned 1 [0256.279] GetProcessHeap () returned 0x580000 [0256.279] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0256.279] GetProcessHeap () returned 0x580000 [0256.279] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0256.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fccc | out: lpFindFileData=0x3f8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22eb7700, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfb84640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cd4, dwReserved0=0x3f8fd28, dwReserved1=0x6dee6e0, cFileName="DGWEBCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBC~1.YOU")) returned 0x5b9730 [0258.082] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0262.221] SysReAllocStringLen (in: pbstr=0x3f8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS", len=0x3f | out: pbstr=0x3f8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS") returned 1 [0262.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0262.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0262.223] CloseHandle (hObject=0x484) returned 1 [0262.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0262.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.id_1622540890_.your_last_chance")) returned 1 [0264.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x3f8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0264.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x3f8fc74 | out: lpFindFileData=0x3f8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLVSA~1.YOU")) returned 0x5b96f0 [0264.610] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0264.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0264.610] GetProcessHeap () returned 0x580000 [0264.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74dc648 [0264.610] GetProcessHeap () returned 0x580000 [0264.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74ede78 [0264.611] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.611] ReadFile (in: hFile=0x484, lpBuffer=0x74dc648, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x3f8ff14, lpOverlapped=0x0 | out: lpBuffer=0x74dc648*, lpNumberOfBytesRead=0x3f8ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 28 os_tid = 0xa68 [0039.064] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.724] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.754] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.053] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.537] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.312] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.810] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.859] Sleep (dwMilliseconds=0x1) [0042.914] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.000] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.113] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.202] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.357] Sleep (dwMilliseconds=0x1) [0043.372] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.403] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.481] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.513] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.544] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.575] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.698] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.886] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.391] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.494] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.541] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.650] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.806] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.884] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.508] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.852] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.945] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.210] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.335] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.366] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.270] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.504] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.551] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.738] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.253] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.409] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.033] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.423] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.579] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.735] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.047] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.221] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.562] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.858] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.968] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.061] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.139] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.192] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.420] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.592] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.761] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.808] Sleep (dwMilliseconds=0x1) [0051.824] Sleep (dwMilliseconds=0x1) [0051.839] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.902] Sleep (dwMilliseconds=0x1) [0051.917] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.964] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.995] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.042] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.073] Sleep (dwMilliseconds=0x1) [0052.090] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.120] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.229] Sleep (dwMilliseconds=0x1) [0052.245] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.276] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.307] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.354] Sleep (dwMilliseconds=0x1) [0052.370] Sleep (dwMilliseconds=0x1) [0052.385] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.432] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.588] Sleep (dwMilliseconds=0x1) [0052.604] Sleep (dwMilliseconds=0x1) [0052.619] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.697] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.775] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.838] Sleep (dwMilliseconds=0x1) [0052.853] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.978] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.056] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.111] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.165] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.213] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.243] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.368] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.446] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.477] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.524] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.587] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.633] Sleep (dwMilliseconds=0x1) [0053.649] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.680] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.758] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.789] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.836] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.914] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.961] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.992] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.070] Sleep (dwMilliseconds=0x1) [0054.086] Sleep (dwMilliseconds=0x1) [0054.101] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.148] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.199] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.226] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.257] Sleep (dwMilliseconds=0x1) [0054.273] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.321] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.382] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.460] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.538] Sleep (dwMilliseconds=0x1) [0054.561] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.585] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.616] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.694] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.741] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.772] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.850] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.881] Sleep (dwMilliseconds=0x1) [0054.897] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.928] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.006] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.038] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.084] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.162] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.240] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.287] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.318] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.349] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.474] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.534] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Boot\\BCD.LOG2", len=0x10 | out: pbstr=0x40cff84*="C:\\Boot\\BCD.LOG2") returned 1 [0055.534] GetProcessHeap () returned 0x580000 [0055.534] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615230, Size=0x18) returned 0x5a58e8 [0055.534] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0055.586] CloseHandle (hObject=0x3f4) returned 1 [0055.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.587] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bcd.log2.id_1622540890_.your_last_chance")) returned 1 [0055.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.587] FindFirstFileW (in: lpFileName="C:\\Boot\\BCD.LOG2.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCDLOG~1.YOU")) returned 0x5b95f0 [0055.587] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef14, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCECE") returned 31 [0055.588] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG2.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bcd.log2.id_1622540890_.your_last_chance"), lpNewFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2")) returned 1 [0055.588] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.696] Sleep (dwMilliseconds=0x1) [0055.838] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Boot\\Fonts\\kor_boot.ttf", len=0x1a | out: pbstr=0x40cff84*="C:\\Boot\\Fonts\\kor_boot.ttf") returned 1 [0055.838] GetProcessHeap () returned 0x580000 [0055.838] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0055.838] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.846] Sleep (dwMilliseconds=0x1) [0061.794] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", len=0x4a | out: pbstr=0x40cff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 1 [0061.794] GetProcessHeap () returned 0x580000 [0061.794] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x54) returned 0x5b5bc8 [0061.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0065.645] CloseHandle (hObject=0x3f8) returned 1 [0065.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0065.645] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id_1622540890_.your_last_chance")) returned 1 [0066.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.395] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRW~1.YOU")) returned 0x5b96b0 [0066.395] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0066.395] GetProcessHeap () returned 0x580000 [0066.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f6a940 [0066.396] GetProcessHeap () returned 0x580000 [0066.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f7c170 [0066.396] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.396] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f6a940, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a940*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0072.300] GetProcessHeap () returned 0x580000 [0072.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0072.300] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.300] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f7c170*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f7c170*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0072.996] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.996] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f8d96f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d96f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0073.916] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.916] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0073.916] CloseHandle (hObject=0x3f8) returned 1 [0074.917] GetProcessHeap () returned 0x580000 [0074.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f7c170 | out: hHeap=0x580000) returned 1 [0074.921] GetProcessHeap () returned 0x580000 [0074.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a940 | out: hHeap=0x580000) returned 1 [0074.922] GetProcessHeap () returned 0x580000 [0074.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0079.335] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbff, dwReserved0=0x40cfd34, dwReserved1=0x7718ba87, cFileName="ProPrWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRW~1.YOU")) returned 0x5b96f0 [0079.335] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.351] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", len=0x3f | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 1 [0079.351] GetProcessHeap () returned 0x580000 [0079.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x30) returned 0x5f76f0 [0079.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.360] Sleep (dwMilliseconds=0x1) [0084.366] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", len=0x49 | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 1 [0084.366] GetProcessHeap () returned 0x580000 [0084.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x1c) returned 0x615398 [0084.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0084.366] CloseHandle (hObject=0x488) returned 1 [0084.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id_1622540890_.your_last_chance")) returned 1 [0084.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BASMLA~1.YOU")) returned 0x5b96b0 [0084.370] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0084.371] GetProcessHeap () returned 0x580000 [0084.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c57108 [0084.371] GetProcessHeap () returned 0x580000 [0084.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c68938 [0084.372] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.372] ReadFile (in: hFile=0x488, lpBuffer=0x6c57108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0085.950] GetProcessHeap () returned 0x580000 [0085.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0085.951] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x488, lpBuffer=0x6c68938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68938*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x488, lpBuffer=0x6c7a137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a137*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0085.951] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.951] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0085.951] CloseHandle (hObject=0x488) returned 1 [0085.952] GetProcessHeap () returned 0x580000 [0085.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c68938 | out: hHeap=0x580000) returned 1 [0085.952] GetProcessHeap () returned 0x580000 [0085.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0085.955] GetProcessHeap () returned 0x580000 [0085.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0085.999] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ad7a0e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x37813, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="BASMLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BASMLA~1.YOU")) returned 0x5b96f0 [0085.999] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.241] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", len=0x4b | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 1 [0088.241] GetProcessHeap () returned 0x580000 [0088.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0088.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0088.463] CloseHandle (hObject=0x470) returned 1 [0088.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id_1622540890_.your_last_chance")) returned 1 [0088.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x45, dwReserved1=0x0, cFileName="CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASCAD~2.YOU")) returned 0x5b96b0 [0088.464] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0088.464] GetProcessHeap () returned 0x580000 [0088.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba61) returned 0x6e35250 [0088.464] GetProcessHeap () returned 0x580000 [0088.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba61) returned 0x6dadce0 [0088.464] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.464] ReadFile (in: hFile=0x470, lpBuffer=0x6e35250, nNumberOfBytesToRead=0xba40, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e35250*, lpNumberOfBytesRead=0x40cff14*=0xba40, lpOverlapped=0x0) returned 1 [0091.269] GetProcessHeap () returned 0x580000 [0091.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0091.269] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.269] WriteFile (in: hFile=0x470, lpBuffer=0x6dadce0*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dadce0*, lpNumberOfBytesWritten=0x40cff14*=0xba40, lpOverlapped=0x0) returned 1 [0091.598] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.598] WriteFile (in: hFile=0x470, lpBuffer=0x6db971f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db971f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0091.598] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.598] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0091.599] CloseHandle (hObject=0x470) returned 1 [0091.599] GetProcessHeap () returned 0x580000 [0091.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dadce0 | out: hHeap=0x580000) returned 1 [0091.599] GetProcessHeap () returned 0x580000 [0091.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e35250 | out: hHeap=0x580000) returned 1 [0091.600] GetProcessHeap () returned 0x580000 [0091.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0091.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3552a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba68, dwReserved0=0x40cfd28, dwReserved1=0x6e35250, cFileName="CASCADE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASCAD~2.YOU")) returned 0x5b96b0 [0091.628] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.468] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", len=0x4c | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 1 [0092.519] GetProcessHeap () returned 0x580000 [0092.519] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0092.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.519] CloseHandle (hObject=0x3f8) returned 1 [0092.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0092.520] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.521] GetProcessHeap () returned 0x580000 [0092.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x667450 [0092.521] GetProcessHeap () returned 0x580000 [0092.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6e15560 [0092.521] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.521] ReadFile (in: hFile=0x3f8, lpBuffer=0x667450, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x667450*, lpNumberOfBytesRead=0x40cff14*=0x1400, lpOverlapped=0x0) returned 1 [0092.544] GetProcessHeap () returned 0x580000 [0092.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.544] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.544] WriteFile (in: hFile=0x3f8, lpBuffer=0x6e15560*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e15560*, lpNumberOfBytesWritten=0x40cff14*=0x1400, lpOverlapped=0x0) returned 1 [0092.544] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.544] WriteFile (in: hFile=0x3f8, lpBuffer=0x6e1695f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1695f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.545] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.545] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.545] CloseHandle (hObject=0x3f8) returned 1 [0092.588] GetProcessHeap () returned 0x580000 [0092.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e15560 | out: hHeap=0x580000) returned 1 [0092.588] GetProcessHeap () returned 0x580000 [0092.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667450 | out: hHeap=0x580000) returned 1 [0092.588] GetProcessHeap () returned 0x580000 [0092.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ec68680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x40cfd28, dwReserved1=0x667450, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0092.593] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.665] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", len=0x48 | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 1 [0092.665] GetProcessHeap () returned 0x580000 [0092.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0092.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0092.665] CloseHandle (hObject=0x45c) returned 1 [0092.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0092.666] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0092.666] GetProcessHeap () returned 0x580000 [0092.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6c79b98 [0092.666] GetProcessHeap () returned 0x580000 [0092.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f0c4f8 [0092.666] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.666] ReadFile (in: hFile=0x45c, lpBuffer=0x6c79b98, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79b98*, lpNumberOfBytesRead=0x40cff14*=0x540, lpOverlapped=0x0) returned 1 [0092.672] GetProcessHeap () returned 0x580000 [0092.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0092.672] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.672] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x40cff14*=0x540, lpOverlapped=0x0) returned 1 [0092.673] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.673] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0ca37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca37*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.673] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.673] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.673] CloseHandle (hObject=0x45c) returned 1 [0092.673] GetProcessHeap () returned 0x580000 [0092.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0092.673] GetProcessHeap () returned 0x580000 [0092.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79b98 | out: hHeap=0x580000) returned 1 [0092.673] GetProcessHeap () returned 0x580000 [0092.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0092.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ed99180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x40cfd28, dwReserved1=0x6c79b98, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0092.673] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.680] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", len=0x45 | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 1 [0092.680] GetProcessHeap () returned 0x580000 [0092.680] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0092.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0092.680] CloseHandle (hObject=0x46c) returned 1 [0092.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id_1622540890_.your_last_chance")) returned 1 [0092.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EDGEEL~1.YOU")) returned 0x5b96f0 [0092.681] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0092.681] GetProcessHeap () returned 0x580000 [0092.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb901) returned 0x6cf5ce8 [0092.682] GetProcessHeap () returned 0x580000 [0092.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb901) returned 0x646710 [0092.682] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.682] ReadFile (in: hFile=0x46c, lpBuffer=0x6cf5ce8, nNumberOfBytesToRead=0xb8e0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf5ce8*, lpNumberOfBytesRead=0x40cff14*=0xb8e0, lpOverlapped=0x0) returned 1 [0097.960] GetProcessHeap () returned 0x580000 [0097.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.960] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x46c, lpBuffer=0x646710*, nNumberOfBytesToWrite=0xb8e0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x646710*, lpNumberOfBytesWritten=0x40cff14*=0xb8e0, lpOverlapped=0x0) returned 1 [0097.961] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x46c, lpBuffer=0x651fef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x651fef*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0097.961] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.961] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0097.961] CloseHandle (hObject=0x46c) returned 1 [0097.961] GetProcessHeap () returned 0x580000 [0097.961] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x646710 | out: hHeap=0x580000) returned 1 [0097.970] GetProcessHeap () returned 0x580000 [0097.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf5ce8 | out: hHeap=0x580000) returned 1 [0097.971] GetProcessHeap () returned 0x580000 [0097.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x720083a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb91c, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="EDGE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EDGEEL~1.YOU")) returned 0x5b96f0 [0097.971] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.401] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", len=0x49 | out: pbstr=0x40cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 1 [0101.401] GetProcessHeap () returned 0x580000 [0101.401] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0101.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0101.415] CloseHandle (hObject=0x408) returned 1 [0101.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id_1622540890_.your_last_chance")) returned 1 [0102.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUDIO~1.YOU")) returned 0x5b9730 [0102.275] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0102.276] GetProcessHeap () returned 0x580000 [0102.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc001) returned 0x6c21878 [0102.276] GetProcessHeap () returned 0x580000 [0102.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc001) returned 0x6c2d888 [0102.276] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.276] ReadFile (in: hFile=0x408, lpBuffer=0x6c21878, nNumberOfBytesToRead=0xbfe0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21878*, lpNumberOfBytesRead=0x40cff14*=0xbfe0, lpOverlapped=0x0) returned 1 [0104.912] GetProcessHeap () returned 0x580000 [0104.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0104.912] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.912] WriteFile (in: hFile=0x408, lpBuffer=0x6c2d888*, nNumberOfBytesToWrite=0xbfe0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2d888*, lpNumberOfBytesWritten=0x40cff14*=0xbfe0, lpOverlapped=0x0) returned 1 [0104.913] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.913] WriteFile (in: hFile=0x408, lpBuffer=0x6c39867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c39867*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0104.913] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.913] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0104.913] CloseHandle (hObject=0x408) returned 1 [0104.913] GetProcessHeap () returned 0x580000 [0104.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2d888 | out: hHeap=0x580000) returned 1 [0104.913] GetProcessHeap () returned 0x580000 [0104.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21878 | out: hHeap=0x580000) returned 1 [0104.913] GetProcessHeap () returned 0x580000 [0104.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0104.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x762628e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc011, dwReserved0=0x40cfd28, dwReserved1=0x6c21878, cFileName="STUDIO.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUDIO~1.YOU")) returned 0x5b96f0 [0104.914] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.160] Sleep (dwMilliseconds=0x1) [0112.126] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", len=0x51 | out: pbstr=0x40cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 1 [0112.126] GetProcessHeap () returned 0x580000 [0112.126] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.126] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.137] Sleep (dwMilliseconds=0x1) [0112.202] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.203] Sleep (dwMilliseconds=0x1) [0112.218] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", len=0x3f | out: pbstr=0x40cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned 1 [0112.218] GetProcessHeap () returned 0x580000 [0112.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b9730 [0112.218] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.218] Sleep (dwMilliseconds=0x1) [0112.234] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", len=0x4e | out: pbstr=0x40cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned 1 [0112.234] GetProcessHeap () returned 0x580000 [0112.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1778 [0112.234] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.250] Sleep (dwMilliseconds=0x1) [0112.391] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x40cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned 1 [0112.391] GetProcessHeap () returned 0x580000 [0112.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.391] Sleep (dwMilliseconds=0x1) [0113.318] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", len=0x3f | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 1 [0113.318] GetProcessHeap () returned 0x580000 [0113.318] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xd8) returned 0x6f0ceb8 [0113.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0113.489] CloseHandle (hObject=0x418) returned 1 [0113.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0212~1.YOU")) returned 0x5b9630 [0114.866] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0114.866] GetProcessHeap () returned 0x580000 [0114.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d81) returned 0x6c2a808 [0114.866] GetProcessHeap () returned 0x580000 [0114.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d81) returned 0x6c2c598 [0114.866] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.866] ReadFile (in: hFile=0x418, lpBuffer=0x6c2a808, nNumberOfBytesToRead=0x1d60, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a808*, lpNumberOfBytesRead=0x40cff14*=0x1d60, lpOverlapped=0x0) returned 1 [0114.892] GetProcessHeap () returned 0x580000 [0114.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.893] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.893] WriteFile (in: hFile=0x418, lpBuffer=0x6c2c598*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2c598*, lpNumberOfBytesWritten=0x40cff14*=0x1d60, lpOverlapped=0x0) returned 1 [0114.893] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.893] WriteFile (in: hFile=0x418, lpBuffer=0x6c2e2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2e2f7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.893] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.893] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.893] CloseHandle (hObject=0x418) returned 1 [0114.893] GetProcessHeap () returned 0x580000 [0114.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2c598 | out: hHeap=0x580000) returned 1 [0114.893] GetProcessHeap () returned 0x580000 [0114.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a808 | out: hHeap=0x580000) returned 1 [0114.893] GetProcessHeap () returned 0x580000 [0114.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c173780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d98, dwReserved0=0x40cfd28, dwReserved1=0x6c2a808, cFileName="AN02122_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0212~1.YOU")) returned 0x5b9630 [0115.876] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0115.944] CloseHandle (hObject=0x41c) returned 1 [0115.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0016~2.YOU")) returned 0x5b9630 [0115.988] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0115.988] GetProcessHeap () returned 0x580000 [0115.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x6d9f1d0 [0115.989] GetProcessHeap () returned 0x580000 [0115.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x6da27a0 [0115.989] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.989] ReadFile (in: hFile=0x41c, lpBuffer=0x6d9f1d0, nNumberOfBytesToRead=0x35a0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesRead=0x40cff14*=0x35a0, lpOverlapped=0x0) returned 1 [0117.089] GetProcessHeap () returned 0x580000 [0117.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.089] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.089] WriteFile (in: hFile=0x41c, lpBuffer=0x6da27a0*, nNumberOfBytesToWrite=0x35a0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6da27a0*, lpNumberOfBytesWritten=0x40cff14*=0x35a0, lpOverlapped=0x0) returned 1 [0117.090] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.090] WriteFile (in: hFile=0x41c, lpBuffer=0x6da5d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6da5d3f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0117.090] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.090] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0117.090] CloseHandle (hObject=0x41c) returned 1 [0117.090] GetProcessHeap () returned 0x580000 [0117.090] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6da27a0 | out: hHeap=0x580000) returned 1 [0117.090] GetProcessHeap () returned 0x580000 [0117.090] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0117.090] GetProcessHeap () returned 0x580000 [0117.090] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d66d960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35d6, dwReserved0=0x40cfd28, dwReserved1=0x6d9f1d0, cFileName="SO00166_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0016~2.YOU")) returned 0x5b9630 [0118.873] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.891] CloseHandle (hObject=0x3fc) returned 1 [0118.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.892] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~3.YOU")) returned 0x5b9630 [0118.892] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.892] GetProcessHeap () returned 0x580000 [0118.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6c676b8 [0118.892] GetProcessHeap () returned 0x580000 [0118.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x681) returned 0x6cf6cf0 [0118.892] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.892] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x660, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x40cff14*=0x660, lpOverlapped=0x0) returned 1 [0118.906] GetProcessHeap () returned 0x580000 [0118.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.906] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.906] WriteFile (in: hFile=0x3fc, lpBuffer=0x6cf6cf0*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesWritten=0x40cff14*=0x660, lpOverlapped=0x0) returned 1 [0118.906] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.906] WriteFile (in: hFile=0x3fc, lpBuffer=0x6cf734f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf734f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0118.906] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.906] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0118.906] CloseHandle (hObject=0x3fc) returned 1 [0118.906] GetProcessHeap () returned 0x580000 [0118.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0118.906] GetProcessHeap () returned 0x580000 [0118.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.906] GetProcessHeap () returned 0x580000 [0118.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0118.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e7d5a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x694, dwReserved0=0x40cfd28, dwReserved1=0x6c676b8, cFileName="SO02431_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~3.YOU")) returned 0x5b9630 [0118.907] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0118.991] CloseHandle (hObject=0x43c) returned 1 [0118.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~4.YOU")) returned 0x5b9630 [0118.992] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0118.993] GetProcessHeap () returned 0x580000 [0118.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c79bc8 [0118.993] GetProcessHeap () returned 0x580000 [0118.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60c7d8 [0118.993] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.993] ReadFile (in: hFile=0x43c, lpBuffer=0x6c79bc8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79bc8*, lpNumberOfBytesRead=0x40cff14*=0x380, lpOverlapped=0x0) returned 1 [0119.026] GetProcessHeap () returned 0x580000 [0119.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.026] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] WriteFile (in: hFile=0x43c, lpBuffer=0x60c7d8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x60c7d8*, lpNumberOfBytesWritten=0x40cff14*=0x380, lpOverlapped=0x0) returned 1 [0119.026] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] WriteFile (in: hFile=0x43c, lpBuffer=0x60cb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x60cb57*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0119.026] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0119.026] CloseHandle (hObject=0x43c) returned 1 [0119.026] GetProcessHeap () returned 0x580000 [0119.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c7d8 | out: hHeap=0x580000) returned 1 [0119.026] GetProcessHeap () returned 0x580000 [0119.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79bc8 | out: hHeap=0x580000) returned 1 [0119.026] GetProcessHeap () returned 0x580000 [0119.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0119.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e8e03e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x40cfd28, dwReserved1=0x6c79bc8, cFileName="SO02265_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~4.YOU")) returned 0x5b9630 [0119.027] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0119.118] CloseHandle (hObject=0x438) returned 1 [0119.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0206~1.YOU")) returned 0x5b9630 [0119.119] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0119.119] GetProcessHeap () returned 0x580000 [0119.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3841) returned 0x6daf1d0 [0119.119] GetProcessHeap () returned 0x580000 [0119.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3841) returned 0x6db2a20 [0119.119] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.119] ReadFile (in: hFile=0x438, lpBuffer=0x6daf1d0, nNumberOfBytesToRead=0x3820, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesRead=0x40cff14*=0x3820, lpOverlapped=0x0) returned 1 [0119.545] GetProcessHeap () returned 0x580000 [0119.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0119.545] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.545] WriteFile (in: hFile=0x438, lpBuffer=0x6db2a20*, nNumberOfBytesToWrite=0x3820, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db2a20*, lpNumberOfBytesWritten=0x40cff14*=0x3820, lpOverlapped=0x0) returned 1 [0119.545] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.545] WriteFile (in: hFile=0x438, lpBuffer=0x6db623f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db623f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0119.545] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.545] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0119.545] CloseHandle (hObject=0x438) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db2a20 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0120.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7edef2a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x384e, dwReserved0=0x40cfd28, dwReserved1=0x6daf1d0, cFileName="SO02067_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0206~1.YOU")) returned 0x5b96f0 [0120.129] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.155] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", len=0x4c | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 1 [0120.155] GetProcessHeap () returned 0x580000 [0120.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a0) returned 0x6d06ca8 [0120.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.570] CloseHandle (hObject=0x460) returned 1 [0120.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.id_1622540890_.your_last_chance")) returned 1 [0120.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0067~1.YOU")) returned 0x5b9630 [0120.571] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.571] GetProcessHeap () returned 0x580000 [0120.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f14048 [0120.571] GetProcessHeap () returned 0x580000 [0120.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6df2780 [0120.572] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.572] ReadFile (in: hFile=0x460, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x40cff14*=0x20e0, lpOverlapped=0x0) returned 1 [0120.602] GetProcessHeap () returned 0x580000 [0120.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.602] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.602] WriteFile (in: hFile=0x460, lpBuffer=0x6df2780*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2780*, lpNumberOfBytesWritten=0x40cff14*=0x20e0, lpOverlapped=0x0) returned 1 [0120.602] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.602] WriteFile (in: hFile=0x460, lpBuffer=0x6df485f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df485f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.602] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.602] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.602] CloseHandle (hObject=0x460) returned 1 [0120.602] GetProcessHeap () returned 0x580000 [0120.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2780 | out: hHeap=0x580000) returned 1 [0120.602] GetProcessHeap () returned 0x580000 [0120.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0120.602] GetProcessHeap () returned 0x580000 [0120.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f7e6ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2112, dwReserved0=0x40cfd28, dwReserved1=0x6f14048, cFileName="WB00673L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0067~1.YOU")) returned 0x5b9630 [0120.603] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0121.702] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", len=0x4c | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 1 [0121.702] GetProcessHeap () returned 0x580000 [0121.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x182c) returned 0x6e00ac0 [0121.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.694] CloseHandle (hObject=0x484) returned 1 [0122.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.id_1622540890_.your_last_chance")) returned 1 [0122.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Module.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0122.695] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.695] GetProcessHeap () returned 0x580000 [0122.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.695] GetProcessHeap () returned 0x580000 [0122.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.695] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.695] ReadFile (in: hFile=0x484, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x40cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.700] GetProcessHeap () returned 0x580000 [0122.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.700] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.700] WriteFile (in: hFile=0x484, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x40cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.700] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.700] WriteFile (in: hFile=0x484, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.700] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.700] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.700] CloseHandle (hObject=0x484) returned 1 [0122.700] GetProcessHeap () returned 0x580000 [0122.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.700] GetProcessHeap () returned 0x580000 [0122.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.700] GetProcessHeap () returned 0x580000 [0122.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bfc860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x40cfd28, dwReserved1=0x678958, cFileName="Module.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0124.693] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.721] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", len=0x4b | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned 1 [0124.721] GetProcessHeap () returned 0x580000 [0124.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18cc) returned 0x6f42f08 [0124.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.787] CloseHandle (hObject=0x460) returned 1 [0124.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.id_1622540890_.your_last_chance")) returned 1 [0124.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x45, dwReserved1=0x0, cFileName="Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASPECT~1.YOU")) returned 0x5b9730 [0124.788] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.788] GetProcessHeap () returned 0x580000 [0124.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.788] GetProcessHeap () returned 0x580000 [0124.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.788] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.788] ReadFile (in: hFile=0x460, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x40cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.802] GetProcessHeap () returned 0x580000 [0124.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.802] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.802] WriteFile (in: hFile=0x460, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x40cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.802] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.802] WriteFile (in: hFile=0x460, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.802] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.802] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.802] CloseHandle (hObject=0x460) returned 1 [0124.802] GetProcessHeap () returned 0x580000 [0124.802] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.802] GetProcessHeap () returned 0x580000 [0124.802] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.802] GetProcessHeap () returned 0x580000 [0124.802] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82012200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x40cfd28, dwReserved1=0x6f69420, cFileName="Aspect.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASPECT~1.YOU")) returned 0x5b9730 [0125.355] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.370] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", len=0x3d | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned 1 [0125.370] GetProcessHeap () returned 0x580000 [0125.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a0c) returned 0x667250 [0125.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0128.874] CloseHandle (hObject=0x410) returned 1 [0128.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.886] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03360~1.YOU")) returned 0x5b9730 [0129.886] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0129.887] GetProcessHeap () returned 0x580000 [0129.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcea1) returned 0x6436e0 [0129.887] GetProcessHeap () returned 0x580000 [0129.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcea1) returned 0x650590 [0129.887] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.887] ReadFile (in: hFile=0x410, lpBuffer=0x6436e0, nNumberOfBytesToRead=0xce80, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6436e0*, lpNumberOfBytesRead=0x40cff14*=0xce80, lpOverlapped=0x0) returned 1 [0133.130] GetProcessHeap () returned 0x580000 [0133.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0133.872] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.872] WriteFile (in: hFile=0x410, lpBuffer=0x650590*, nNumberOfBytesToWrite=0xce80, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x650590*, lpNumberOfBytesWritten=0x40cff14*=0xce80, lpOverlapped=0x0) returned 1 [0133.872] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.872] WriteFile (in: hFile=0x410, lpBuffer=0x65d40f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x65d40f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0133.872] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.872] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0133.872] CloseHandle (hObject=0x410) returned 1 [0136.126] GetProcessHeap () returned 0x580000 [0136.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x650590 | out: hHeap=0x580000) returned 1 [0136.126] GetProcessHeap () returned 0x580000 [0136.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6436e0 | out: hHeap=0x580000) returned 1 [0136.126] GetProcessHeap () returned 0x580000 [0136.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0136.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x876820e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcebe, dwReserved0=0x40cfd28, dwReserved1=0x6436e0, cFileName="J0336075.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03360~1.YOU")) returned 0x5b96b0 [0136.392] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.407] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", len=0x4a | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned 1 [0136.407] GetProcessHeap () returned 0x580000 [0136.407] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0136.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.408] CloseHandle (hObject=0x484) returned 1 [0136.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.id_1622540890_.your_last_chance")) returned 1 [0136.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b96b0 [0136.409] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.409] GetProcessHeap () returned 0x580000 [0136.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6d035f8 [0136.409] GetProcessHeap () returned 0x580000 [0136.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6c6e0f8 [0136.409] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.409] ReadFile (in: hFile=0x484, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x40cff14*=0x1600, lpOverlapped=0x0) returned 1 [0136.436] GetProcessHeap () returned 0x580000 [0136.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.436] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.436] WriteFile (in: hFile=0x484, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x40cff14*=0x1600, lpOverlapped=0x0) returned 1 [0136.436] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.436] WriteFile (in: hFile=0x484, lpBuffer=0x6c6f6f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f6f7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0136.436] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.436] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0136.437] CloseHandle (hObject=0x484) returned 1 [0136.437] GetProcessHeap () returned 0x580000 [0136.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0136.437] GetProcessHeap () returned 0x580000 [0136.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0136.437] GetProcessHeap () returned 0x580000 [0136.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0136.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88ee8260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1641, dwReserved0=0x40cfd28, dwReserved1=0x6d035f8, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b96b0 [0136.437] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.549] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", len=0x43 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned 1 [0136.550] GetProcessHeap () returned 0x580000 [0136.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0136.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.730] CloseHandle (hObject=0x3b4) returned 1 [0139.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.730] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae8400, ftCreationTime.dwHighDateTime=0x1bd4f56, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dae8400, ftLastWriteTime.dwHighDateTime=0x1bd4f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~2.YOU")) returned 0x5b97b0 [0139.731] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.731] GetProcessHeap () returned 0x580000 [0139.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x701) returned 0x6c79898 [0139.731] GetProcessHeap () returned 0x580000 [0139.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x701) returned 0x6d00cd8 [0139.731] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.731] ReadFile (in: hFile=0x3b4, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6e0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x40cff14*=0x6e0, lpOverlapped=0x0) returned 1 [0139.739] GetProcessHeap () returned 0x580000 [0139.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.739] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.739] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x40cff14*=0x6e0, lpOverlapped=0x0) returned 1 [0139.739] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.739] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d013b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d013b7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0139.739] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.739] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0139.739] CloseHandle (hObject=0x3b4) returned 1 [0139.740] GetProcessHeap () returned 0x580000 [0139.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0139.740] GetProcessHeap () returned 0x580000 [0139.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0139.740] GetProcessHeap () returned 0x580000 [0139.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae8400, ftCreationTime.dwHighDateTime=0x1bd4f56, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ae725e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x71d, dwReserved0=0x40cfd28, dwReserved1=0x6c79898, cFileName="BD21326_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~2.YOU")) returned 0x5b9770 [0140.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.171] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", len=0x5f | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned 1 [0140.171] GetProcessHeap () returned 0x580000 [0140.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0140.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.643] CloseHandle (hObject=0x4a0) returned 1 [0140.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.id_1622540890_.your_last_chance")) returned 1 [0140.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="Response.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESPON~1.YOU")) returned 0x5b9770 [0140.644] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.644] GetProcessHeap () returned 0x580000 [0140.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c758b0 [0140.644] GetProcessHeap () returned 0x580000 [0140.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c75f78 [0140.644] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.644] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c758b0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c758b0*, lpNumberOfBytesRead=0x40cff14*=0x680, lpOverlapped=0x0) returned 1 [0140.651] GetProcessHeap () returned 0x580000 [0140.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0140.651] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.651] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c75f78*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75f78*, lpNumberOfBytesWritten=0x40cff14*=0x680, lpOverlapped=0x0) returned 1 [0140.651] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.651] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c765f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c765f7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.651] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.652] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.652] CloseHandle (hObject=0x4a0) returned 1 [0140.652] GetProcessHeap () returned 0x580000 [0140.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75f78 | out: hHeap=0x580000) returned 1 [0140.652] GetProcessHeap () returned 0x580000 [0140.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c758b0 | out: hHeap=0x580000) returned 1 [0140.652] GetProcessHeap () returned 0x580000 [0140.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0141.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b739700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b2, dwReserved0=0x40cfd28, dwReserved1=0x6c758b0, cFileName="Response.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESPON~1.YOU")) returned 0x5b9730 [0141.012] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.535] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL", len=0x3a | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 1 [0144.535] GetProcessHeap () returned 0x580000 [0144.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0144.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0146.018] CloseHandle (hObject=0x170) returned 1 [0146.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id_1622540890_.your_last_chance")) returned 1 [0146.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x105b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGWIZ~1.YOU")) returned 0x5b9730 [0146.019] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0146.019] GetProcessHeap () returned 0x580000 [0146.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x105c1) returned 0x6fe77c8 [0146.020] GetProcessHeap () returned 0x580000 [0146.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x105c1) returned 0x6ff7d98 [0146.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.021] ReadFile (in: hFile=0x170, lpBuffer=0x6fe77c8, nNumberOfBytesToRead=0x105a0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesRead=0x40cff14*=0x105a0, lpOverlapped=0x0) returned 1 [0149.042] GetProcessHeap () returned 0x580000 [0149.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0149.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.042] WriteFile (in: hFile=0x170, lpBuffer=0x6ff7d98*, nNumberOfBytesToWrite=0x105a0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff7d98*, lpNumberOfBytesWritten=0x40cff14*=0x105a0, lpOverlapped=0x0) returned 1 [0149.043] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.043] WriteFile (in: hFile=0x170, lpBuffer=0x7008337*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7008337*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0149.043] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.043] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0149.043] CloseHandle (hObject=0x170) returned 1 [0149.043] GetProcessHeap () returned 0x580000 [0149.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff7d98 | out: hHeap=0x580000) returned 1 [0149.043] GetProcessHeap () returned 0x580000 [0149.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0149.043] GetProcessHeap () returned 0x580000 [0149.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0149.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9071d960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x105d4, dwReserved0=0x40cfd28, dwReserved1=0x6fe77c8, cFileName="ORGWIZ.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGWIZ~1.YOU")) returned 0x5b96f0 [0149.044] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0149.776] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", len=0x43 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned 1 [0149.776] GetProcessHeap () returned 0x580000 [0149.776] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0149.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0150.423] CloseHandle (hObject=0x430) returned 1 [0150.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.id_1622540890_.your_last_chance")) returned 1 [0150.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a01, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR4B~1.YOU")) returned 0x5b96f0 [0150.424] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0150.424] GetProcessHeap () returned 0x580000 [0150.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x705fc58 [0150.425] GetProcessHeap () returned 0x580000 [0150.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x6ec4068 [0150.425] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.425] ReadFile (in: hFile=0x430, lpBuffer=0x705fc58, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x705fc58*, lpNumberOfBytesRead=0x40cff14*=0x2a00, lpOverlapped=0x0) returned 1 [0151.227] GetProcessHeap () returned 0x580000 [0151.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0151.228] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0x430, lpBuffer=0x6ec4068*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesWritten=0x40cff14*=0x2a00, lpOverlapped=0x0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0x430, lpBuffer=0x6ec6a67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec6a67*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0151.228] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.228] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0151.228] CloseHandle (hObject=0x430) returned 1 [0152.353] GetProcessHeap () returned 0x580000 [0152.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0152.354] GetProcessHeap () returned 0x580000 [0152.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705fc58 | out: hHeap=0x580000) returned 1 [0152.354] GetProcessHeap () returned 0x580000 [0152.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c17b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a25, dwReserved0=0x40cfd28, dwReserved1=0x705fc58, cFileName="PDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR4B~1.YOU")) returned 0x5b9730 [0153.551] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.190] CloseHandle (hObject=0x3e4) returned 1 [0155.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.id_1622540890_.your_last_chance")) returned 1 [0155.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLATE_~1.YOU")) returned 0x5b9730 [0155.191] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlate_init.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.192] GetProcessHeap () returned 0x580000 [0155.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x6d21878 [0155.192] GetProcessHeap () returned 0x580000 [0155.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x70086b8 [0155.192] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.192] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x40cff14*=0x2d60, lpOverlapped=0x0) returned 1 [0155.233] GetProcessHeap () returned 0x580000 [0155.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.233] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.233] WriteFile (in: hFile=0x3e4, lpBuffer=0x70086b8*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x70086b8*, lpNumberOfBytesWritten=0x40cff14*=0x2d60, lpOverlapped=0x0) returned 1 [0155.233] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.233] WriteFile (in: hFile=0x3e4, lpBuffer=0x700b417*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x700b417*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0155.233] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.233] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0155.233] CloseHandle (hObject=0x3e4) returned 1 [0155.233] GetProcessHeap () returned 0x580000 [0155.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70086b8 | out: hHeap=0x580000) returned 1 [0155.233] GetProcessHeap () returned 0x580000 [0155.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0155.233] GetProcessHeap () returned 0x580000 [0155.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9422db40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d8f, dwReserved0=0x40cfd28, dwReserved1=0x6d21878, cFileName="Xlate_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLATE_~1.YOU")) returned 0x5b9730 [0155.808] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.853] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", len=0x4a | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL") returned 1 [0155.854] GetProcessHeap () returned 0x580000 [0155.854] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0155.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0155.908] CloseHandle (hObject=0x46c) returned 1 [0155.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl.id_1622540890_.your_last_chance")) returned 1 [0155.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TURABI~1.YOU")) returned 0x5b9630 [0155.909] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0155.909] GetProcessHeap () returned 0x580000 [0155.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e43870 [0155.910] GetProcessHeap () returned 0x580000 [0155.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e550a0 [0155.910] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.910] ReadFile (in: hFile=0x46c, lpBuffer=0x6e43870, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e43870*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0161.531] GetProcessHeap () returned 0x580000 [0161.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0161.531] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.531] WriteFile (in: hFile=0x46c, lpBuffer=0x6e550a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e550a0*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0161.532] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.532] WriteFile (in: hFile=0x46c, lpBuffer=0x6e6689f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6689f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0162.638] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.638] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0162.638] CloseHandle (hObject=0x46c) returned 1 [0162.639] GetProcessHeap () returned 0x580000 [0162.639] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e550a0 | out: hHeap=0x580000) returned 1 [0162.649] GetProcessHeap () returned 0x580000 [0162.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e43870 | out: hHeap=0x580000) returned 1 [0162.650] GetProcessHeap () returned 0x580000 [0162.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0166.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x988d8860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x52a31, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="TURABIAN.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TURABI~1.YOU")) returned 0x5b9730 [0166.173] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.201] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", len=0x3a | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 1 [0166.202] GetProcessHeap () returned 0x580000 [0166.202] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0166.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0166.291] CloseHandle (hObject=0x484) returned 1 [0166.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.292] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id_1622540890_.your_last_chance")) returned 1 [0166.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PABSAM~1.YOU")) returned 0x5b9730 [0166.293] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0166.293] GetProcessHeap () returned 0x580000 [0166.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf981) returned 0x7147b18 [0166.293] GetProcessHeap () returned 0x580000 [0166.293] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf981) returned 0x71574a8 [0166.293] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.293] ReadFile (in: hFile=0x484, lpBuffer=0x7147b18, nNumberOfBytesToRead=0xf960, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7147b18*, lpNumberOfBytesRead=0x40cff14*=0xf960, lpOverlapped=0x0) returned 1 [0169.015] GetProcessHeap () returned 0x580000 [0169.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0169.015] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.015] WriteFile (in: hFile=0x484, lpBuffer=0x71574a8*, nNumberOfBytesToWrite=0xf960, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x71574a8*, lpNumberOfBytesWritten=0x40cff14*=0xf960, lpOverlapped=0x0) returned 1 [0169.016] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.016] WriteFile (in: hFile=0x484, lpBuffer=0x7166e07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7166e07*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0169.016] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.016] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0169.016] CloseHandle (hObject=0x484) returned 1 [0169.016] GetProcessHeap () returned 0x580000 [0169.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71574a8 | out: hHeap=0x580000) returned 1 [0169.016] GetProcessHeap () returned 0x580000 [0169.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7147b18 | out: hHeap=0x580000) returned 1 [0169.016] GetProcessHeap () returned 0x580000 [0169.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c5b1ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf99c, dwReserved0=0x40cfd28, dwReserved1=0x7147b18, cFileName="PAB.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PABSAM~1.YOU")) returned 0x5b96b0 [0170.243] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.247] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", len=0x3e | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 1 [0170.247] GetProcessHeap () returned 0x580000 [0170.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2290) returned 0x6f14048 [0170.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.248] CloseHandle (hObject=0x45c) returned 1 [0170.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id_1622540890_.your_last_chance")) returned 1 [0170.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.273] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKCF~1.YOU")) returned 0x5b96b0 [0170.274] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.274] GetProcessHeap () returned 0x580000 [0170.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0170.274] GetProcessHeap () returned 0x580000 [0170.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0170.274] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.274] ReadFile (in: hFile=0x45c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x40cff14*=0x300, lpOverlapped=0x0) returned 1 [0170.312] GetProcessHeap () returned 0x580000 [0170.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.312] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.312] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x40cff14*=0x300, lpOverlapped=0x0) returned 1 [0170.312] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.313] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.313] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.313] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.313] CloseHandle (hObject=0x45c) returned 1 [0170.313] GetProcessHeap () returned 0x580000 [0170.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0170.313] GetProcessHeap () returned 0x580000 [0170.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0170.313] GetProcessHeap () returned 0x580000 [0170.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d20ace0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x40cfd28, dwReserved1=0x6df6780, cFileName="TASK.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKCF~1.YOU")) returned 0x5b9770 [0173.044] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.082] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", len=0x42 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 1 [0173.082] GetProcessHeap () returned 0x580000 [0173.082] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x222c) returned 0x6f14048 [0173.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.104] CloseHandle (hObject=0x46c) returned 1 [0173.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC6B0C~1.YOU")) returned 0x5b9770 [0173.105] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.105] GetProcessHeap () returned 0x580000 [0173.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0173.105] GetProcessHeap () returned 0x580000 [0173.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0173.106] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.106] ReadFile (in: hFile=0x46c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x40cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.129] GetProcessHeap () returned 0x580000 [0173.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x46c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x40cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x46c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.129] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.130] CloseHandle (hObject=0x46c) returned 1 [0173.130] GetProcessHeap () returned 0x580000 [0173.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0173.130] GetProcessHeap () returned 0x580000 [0173.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0173.130] GetProcessHeap () returned 0x580000 [0173.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ecf85c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x40cfd28, dwReserved1=0x5cf780, cFileName="SCDRESNL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC6B0C~1.YOU")) returned 0x5b9770 [0173.130] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.236] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", len=0x42 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 1 [0174.236] GetProcessHeap () returned 0x580000 [0174.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0174.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0174.237] CloseHandle (hObject=0x460) returned 1 [0174.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id_1622540890_.your_last_chance")) returned 1 [0174.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x35b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLADDR~1.YOU")) returned 0x5b9770 [0174.238] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0174.238] GetProcessHeap () returned 0x580000 [0174.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x7047008 [0174.238] GetProcessHeap () returned 0x580000 [0174.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x6dec6e0 [0174.239] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.239] ReadFile (in: hFile=0x460, lpBuffer=0x7047008, nNumberOfBytesToRead=0x35a0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7047008*, lpNumberOfBytesRead=0x40cff14*=0x35a0, lpOverlapped=0x0) returned 1 [0174.842] GetProcessHeap () returned 0x580000 [0174.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.842] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.842] WriteFile (in: hFile=0x460, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x35a0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x40cff14*=0x35a0, lpOverlapped=0x0) returned 1 [0174.842] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.842] WriteFile (in: hFile=0x460, lpBuffer=0x6defc7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6defc7f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.843] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.843] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.843] CloseHandle (hObject=0x460) returned 1 [0175.360] GetProcessHeap () returned 0x580000 [0175.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0175.360] GetProcessHeap () returned 0x580000 [0175.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7047008 | out: hHeap=0x580000) returned 1 [0175.360] GetProcessHeap () returned 0x580000 [0175.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd2fba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35d4, dwReserved0=0x40cfd28, dwReserved1=0x7047008, cFileName="OLADDR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLADDR~1.YOU")) returned 0x5b96f0 [0176.896] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.055] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", len=0x47 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx") returned 1 [0179.055] GetProcessHeap () returned 0x580000 [0179.055] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0179.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0179.056] CloseHandle (hObject=0x49c) returned 1 [0179.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.056] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.id_1622540890_.your_last_chance")) returned 1 [0179.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b96f0 [0179.058] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0179.058] GetProcessHeap () returned 0x580000 [0179.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5d41) returned 0x6dec6e0 [0179.058] GetProcessHeap () returned 0x580000 [0179.058] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5d41) returned 0x705bbe8 [0179.059] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.059] ReadFile (in: hFile=0x49c, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x5d20, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x40cff14*=0x5d20, lpOverlapped=0x0) returned 1 [0180.794] GetProcessHeap () returned 0x580000 [0180.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.794] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.794] WriteFile (in: hFile=0x49c, lpBuffer=0x705bbe8*, nNumberOfBytesToWrite=0x5d20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x705bbe8*, lpNumberOfBytesWritten=0x40cff14*=0x5d20, lpOverlapped=0x0) returned 1 [0180.794] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.794] WriteFile (in: hFile=0x49c, lpBuffer=0x7061907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7061907*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0180.794] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.794] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0180.794] CloseHandle (hObject=0x49c) returned 1 [0180.794] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705bbe8 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0182.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa36048e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d62, dwReserved0=0x40cfd28, dwReserved1=0x6dec6e0, cFileName="Thatch.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9770 [0182.197] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.213] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", len=0x53 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned 1 [0182.213] GetProcessHeap () returned 0x580000 [0182.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0182.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.944] CloseHandle (hObject=0x430) returned 1 [0182.944] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.944] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEB~2.YOU")) returned 0x5b9770 [0182.945] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.945] GetProcessHeap () returned 0x580000 [0182.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21890 [0182.945] GetProcessHeap () returned 0x580000 [0182.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21e98 [0182.945] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.946] ReadFile (in: hFile=0x430, lpBuffer=0x6c21890, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesRead=0x40cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0182.952] GetProcessHeap () returned 0x580000 [0182.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.952] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.952] WriteFile (in: hFile=0x430, lpBuffer=0x6c21e98*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21e98*, lpNumberOfBytesWritten=0x40cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0182.952] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.952] WriteFile (in: hFile=0x430, lpBuffer=0x6c22437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c22437*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0182.952] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.952] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0182.953] CloseHandle (hObject=0x430) returned 1 [0182.953] GetProcessHeap () returned 0x580000 [0182.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21e98 | out: hHeap=0x580000) returned 1 [0182.953] GetProcessHeap () returned 0x580000 [0182.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0182.953] GetProcessHeap () returned 0x580000 [0182.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4a8c6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x40cfd28, dwReserved1=0x6c21890, cFileName="spacebackupiconsmask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEB~2.YOU")) returned 0x5b9770 [0183.804] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.818] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", len=0x6f | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned 1 [0183.818] GetProcessHeap () returned 0x580000 [0183.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0183.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0186.687] CloseHandle (hObject=0x4a0) returned 1 [0186.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33d6, dwReserved0=0x2e0058, dwReserved1=0x50004a, cFileName="CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHECKB~1.YOU")) returned 0x5b96b0 [0187.791] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0187.791] GetProcessHeap () returned 0x580000 [0187.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33e1) returned 0x6faab98 [0187.792] GetProcessHeap () returned 0x580000 [0187.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x33e1) returned 0x70330f8 [0187.792] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.792] ReadFile (in: hFile=0x4a0, lpBuffer=0x6faab98, nNumberOfBytesToRead=0x33c0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6faab98*, lpNumberOfBytesRead=0x40cff14*=0x33c0, lpOverlapped=0x0) returned 1 [0188.289] GetProcessHeap () returned 0x580000 [0188.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.290] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.290] WriteFile (in: hFile=0x4a0, lpBuffer=0x70330f8*, nNumberOfBytesToWrite=0x33c0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x70330f8*, lpNumberOfBytesWritten=0x40cff14*=0x33c0, lpOverlapped=0x0) returned 1 [0188.290] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.290] WriteFile (in: hFile=0x4a0, lpBuffer=0x70364b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x70364b7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.290] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.290] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0188.290] CloseHandle (hObject=0x4a0) returned 1 [0188.290] GetProcessHeap () returned 0x580000 [0188.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70330f8 | out: hHeap=0x580000) returned 1 [0188.290] GetProcessHeap () returned 0x580000 [0188.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6faab98 | out: hHeap=0x580000) returned 1 [0188.290] GetProcessHeap () returned 0x580000 [0188.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d6dce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x33fa, dwReserved0=0x40cfd28, dwReserved1=0x6faab98, cFileName="CHECKBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHECKB~1.YOU")) returned 0x5b9770 [0191.241] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.280] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", len=0x45 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned 1 [0191.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0191.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0191.352] CloseHandle (hObject=0x39c) returned 1 [0191.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4660, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAEA6~1.YOU")) returned 0x5b9770 [0191.357] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0191.357] GetProcessHeap () returned 0x580000 [0191.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4681) returned 0x6e32d50 [0191.357] GetProcessHeap () returned 0x580000 [0191.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4681) returned 0x6e373e0 [0191.357] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.357] ReadFile (in: hFile=0x39c, lpBuffer=0x6e32d50, nNumberOfBytesToRead=0x4660, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesRead=0x40cff14*=0x4660, lpOverlapped=0x0) returned 1 [0192.340] GetProcessHeap () returned 0x580000 [0192.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0192.340] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.340] WriteFile (in: hFile=0x39c, lpBuffer=0x6e373e0*, nNumberOfBytesToWrite=0x4660, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e373e0*, lpNumberOfBytesWritten=0x40cff14*=0x4660, lpOverlapped=0x0) returned 1 [0192.341] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.341] WriteFile (in: hFile=0x39c, lpBuffer=0x6e3ba3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3ba3f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0192.341] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.341] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0192.341] CloseHandle (hObject=0x39c) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e373e0 | out: hHeap=0x580000) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0193.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa41c260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4684, dwReserved0=0x40cfd28, dwReserved1=0x6e32d50, cFileName="ZPDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAEA6~1.YOU")) returned 0x5b97b0 [0193.420] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.471] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", len=0x62 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned 1 [0193.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0193.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0195.094] CloseHandle (hObject=0x3e4) returned 1 [0195.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.094] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.id_1622540890_.your_last_chance")) returned 1 [0195.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0195.095] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b97b0 [0195.096] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0195.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0195.096] GetProcessHeap () returned 0x580000 [0195.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x7069150 [0195.096] GetProcessHeap () returned 0x580000 [0195.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x71081f8 [0195.096] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.096] ReadFile (in: hFile=0x3e4, lpBuffer=0x7069150, nNumberOfBytesToRead=0x5680, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7069150*, lpNumberOfBytesRead=0x40cff14*=0x5680, lpOverlapped=0x0) returned 1 [0195.897] GetProcessHeap () returned 0x580000 [0195.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.897] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.897] WriteFile (in: hFile=0x3e4, lpBuffer=0x71081f8*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x71081f8*, lpNumberOfBytesWritten=0x40cff14*=0x5680, lpOverlapped=0x0) returned 1 [0195.898] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.898] WriteFile (in: hFile=0x3e4, lpBuffer=0x710d877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x710d877*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0195.898] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.898] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0195.898] CloseHandle (hObject=0x3e4) returned 1 [0195.898] GetProcessHeap () returned 0x580000 [0195.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71081f8 | out: hHeap=0x580000) returned 1 [0195.899] GetProcessHeap () returned 0x580000 [0195.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7069150 | out: hHeap=0x580000) returned 1 [0195.899] GetProcessHeap () returned 0x580000 [0195.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac607be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x56b4, dwReserved0=0x40cfd28, dwReserved1=0x7069150, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b97f0 [0197.938] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.011] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", len=0x43 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned 1 [0198.011] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0198.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0198.064] CloseHandle (hObject=0x3a8) returned 1 [0198.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.id_1622540890_.your_last_chance")) returned 1 [0198.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR5B~1.YOU")) returned 0x5b97f0 [0198.065] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0198.065] GetProcessHeap () returned 0x580000 [0198.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ca1) returned 0x7111f08 [0198.065] GetProcessHeap () returned 0x580000 [0198.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ca1) returned 0x6d10048 [0198.066] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.066] ReadFile (in: hFile=0x3a8, lpBuffer=0x7111f08, nNumberOfBytesToRead=0x4c80, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f08*, lpNumberOfBytesRead=0x40cff14*=0x4c80, lpOverlapped=0x0) returned 1 [0198.598] GetProcessHeap () returned 0x580000 [0198.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0198.598] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.598] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x4c80, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x40cff14*=0x4c80, lpOverlapped=0x0) returned 1 [0198.598] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.598] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d14cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d14cc7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0198.599] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.599] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0198.599] CloseHandle (hObject=0x3a8) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f08 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0199.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadfc49c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4cac, dwReserved0=0x40cfd28, dwReserved1=0x7111f08, cFileName="PDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR5B~1.YOU")) returned 0x5b96b0 [0199.653] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.961] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned 1 [0200.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fbc) returned 0x6f14048 [0200.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.687] CloseHandle (hObject=0x3e4) returned 1 [0201.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance")) returned 1 [0201.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x2e0073, dwReserved1=0x70006a, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b97b0 [0201.688] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.688] GetProcessHeap () returned 0x580000 [0201.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f01) returned 0x6dc71d0 [0201.689] GetProcessHeap () returned 0x580000 [0201.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f01) returned 0x7111f48 [0201.689] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.689] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x2ee0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x40cff14*=0x2ee0, lpOverlapped=0x0) returned 1 [0201.951] GetProcessHeap () returned 0x580000 [0201.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.951] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.951] WriteFile (in: hFile=0x3e4, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x40cff14*=0x2ee0, lpOverlapped=0x0) returned 1 [0201.952] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.952] WriteFile (in: hFile=0x3e4, lpBuffer=0x7114e27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7114e27*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.952] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.952] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.952] CloseHandle (hObject=0x3e4) returned 1 [0201.952] GetProcessHeap () returned 0x580000 [0201.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0201.952] GetProcessHeap () returned 0x580000 [0201.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0201.952] GetProcessHeap () returned 0x580000 [0201.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0203.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaffc1160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f07, dwReserved0=0x40cfd28, dwReserved1=0x6dc71d0, cFileName="FormsViewAttachmentIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b9770 [0203.103] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.124] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned 1 [0203.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0203.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0206.550] CloseHandle (hObject=0x46c) returned 1 [0206.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0206.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0206.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0206.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46a3, dwReserved0=0x6c006d, dwReserved1=0x69002e, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b97b0 [0206.552] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0206.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0206.552] GetProcessHeap () returned 0x580000 [0206.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46c1) returned 0x6d748d8 [0206.552] GetProcessHeap () returned 0x580000 [0206.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x46c1) returned 0x6e063d0 [0206.552] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.552] ReadFile (in: hFile=0x46c, lpBuffer=0x6d748d8, nNumberOfBytesToRead=0x46a0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesRead=0x40cff14*=0x46a0, lpOverlapped=0x0) returned 1 [0207.737] GetProcessHeap () returned 0x580000 [0207.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0207.737] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.738] WriteFile (in: hFile=0x46c, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x46a0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x40cff14*=0x46a0, lpOverlapped=0x0) returned 1 [0207.738] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.738] WriteFile (in: hFile=0x46c, lpBuffer=0x6e0aa6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0aa6f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0207.738] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0207.738] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0207.738] CloseHandle (hObject=0x46c) returned 1 [0209.128] GetProcessHeap () returned 0x580000 [0209.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0209.532] GetProcessHeap () returned 0x580000 [0209.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0209.532] GetProcessHeap () returned 0x580000 [0209.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb36f2f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46c7, dwReserved0=0x40cfd28, dwReserved1=0x6d748d8, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b97b0 [0210.090] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.129] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS", len=0x45 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS") returned 1 [0210.130] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0210.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.131] CloseHandle (hObject=0x448) returned 1 [0210.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css.id_1622540890_.your_last_chance")) returned 1 [0210.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f05000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f05000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF694~1.YOU")) returned 0x5b97b0 [0210.132] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.132] GetProcessHeap () returned 0x580000 [0210.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0210.133] GetProcessHeap () returned 0x580000 [0210.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0210.133] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.133] ReadFile (in: hFile=0x448, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.305] GetProcessHeap () returned 0x580000 [0214.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0214.306] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.306] WriteFile (in: hFile=0x448, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.306] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.306] WriteFile (in: hFile=0x448, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0214.306] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.307] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0214.307] CloseHandle (hObject=0x448) returned 1 [0214.307] GetProcessHeap () returned 0x580000 [0214.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0214.307] GetProcessHeap () returned 0x580000 [0214.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0214.307] GetProcessHeap () returned 0x580000 [0214.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0215.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f05000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7595260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fcee, dwReserved0=0x40cfd28, dwReserved1=0x6d630a8, cFileName="SCHEME22.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF694~1.YOU")) returned 0x5b97b0 [0215.080] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.164] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC", len=0x3e | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 1 [0215.164] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0215.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.165] CloseHandle (hObject=0x3b8) returned 1 [0215.165] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.165] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0215.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~4.YOU")) returned 0x5b97b0 [0215.167] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.167] GetProcessHeap () returned 0x580000 [0215.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0215.167] GetProcessHeap () returned 0x580000 [0215.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0215.167] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.167] ReadFile (in: hFile=0x3b8, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x40cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.195] GetProcessHeap () returned 0x580000 [0215.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.195] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.195] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x40cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.196] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.196] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0215.196] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.196] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0215.196] CloseHandle (hObject=0x3b8) returned 1 [0215.196] GetProcessHeap () returned 0x580000 [0215.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0215.196] GetProcessHeap () returned 0x580000 [0215.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0215.196] GetProcessHeap () returned 0x580000 [0215.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7e100c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x40cfd28, dwReserved1=0x6c61120, cFileName="MSTORE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~4.YOU")) returned 0x5b97b0 [0216.357] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0221.066] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", len=0x64 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned 1 [0221.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0221.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.067] CloseHandle (hObject=0x3e4) returned 1 [0221.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.id_1622540890_.your_last_chance")) returned 1 [0221.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_HY~1.YOU")) returned 0x5b9770 [0221.094] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.094] GetProcessHeap () returned 0x580000 [0221.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf818 [0221.094] GetProcessHeap () returned 0x580000 [0221.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf5e8 [0221.094] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.094] ReadFile (in: hFile=0x47c, lpBuffer=0x6dcf818, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf818*, lpNumberOfBytesRead=0x40cff14*=0xe0, lpOverlapped=0x0) returned 1 [0221.096] GetProcessHeap () returned 0x580000 [0221.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0221.096] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.096] WriteFile (in: hFile=0x47c, lpBuffer=0x6dcf5e8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf5e8*, lpNumberOfBytesWritten=0x40cff14*=0xe0, lpOverlapped=0x0) returned 1 [0221.096] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.096] WriteFile (in: hFile=0x47c, lpBuffer=0x6dcf6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf6c7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.096] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.096] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.096] CloseHandle (hObject=0x47c) returned 1 [0221.096] GetProcessHeap () returned 0x580000 [0221.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.096] GetProcessHeap () returned 0x580000 [0221.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.096] GetProcessHeap () returned 0x580000 [0221.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb64c880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x40cfd28, dwReserved1=0x6dcf818, cFileName="rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_HY~1.YOU")) returned 0x5b9770 [0221.097] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0222.657] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", len=0x8a | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned 1 [0222.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0222.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0222.658] CloseHandle (hObject=0x460) returned 1 [0222.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.id_1622540890_.your_last_chance")) returned 1 [0222.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MINUSG~1.YOU")) returned 0x5b96f0 [0222.659] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0222.659] GetProcessHeap () returned 0x580000 [0222.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0222.659] GetProcessHeap () returned 0x580000 [0222.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0222.659] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.659] ReadFile (in: hFile=0x460, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x40cff14*=0x340, lpOverlapped=0x0) returned 1 [0222.678] GetProcessHeap () returned 0x580000 [0222.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.678] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.678] WriteFile (in: hFile=0x460, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x40cff14*=0x340, lpOverlapped=0x0) returned 1 [0222.678] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.678] WriteFile (in: hFile=0x460, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.678] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.678] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.678] CloseHandle (hObject=0x460) returned 1 [0222.679] GetProcessHeap () returned 0x580000 [0222.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0222.679] GetProcessHeap () returned 0x580000 [0222.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0222.679] GetProcessHeap () returned 0x580000 [0222.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0222.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc5794c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x40cfd28, dwReserved1=0x6dcfb90, cFileName="MINUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MINUSG~1.YOU")) returned 0x5b96f0 [0222.679] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.751] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", len=0x75 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned 1 [0222.751] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0222.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.752] CloseHandle (hObject=0x440) returned 1 [0222.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0222.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa10, dwReserved0=0x6e006f, dwReserved1=0x4d0073, cFileName="ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~4.YOU")) returned 0x5b96f0 [0222.754] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.754] GetProcessHeap () returned 0x580000 [0222.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x6c676b8 [0222.754] GetProcessHeap () returned 0x580000 [0222.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0222.754] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.754] ReadFile (in: hFile=0x440, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x40cff14*=0xa00, lpOverlapped=0x0) returned 1 [0222.777] GetProcessHeap () returned 0x580000 [0222.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.777] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.777] WriteFile (in: hFile=0x440, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x40cff14*=0xa00, lpOverlapped=0x0) returned 1 [0222.777] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.777] WriteFile (in: hFile=0x440, lpBuffer=0x62f717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x62f717*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.777] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.777] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.777] CloseHandle (hObject=0x440) returned 1 [0222.777] GetProcessHeap () returned 0x580000 [0222.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0222.777] GetProcessHeap () returned 0x580000 [0222.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0222.777] GetProcessHeap () returned 0x580000 [0222.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0222.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc65dd00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x40cfd28, dwReserved1=0x6c676b8, cFileName="ProjectStatusIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~4.YOU")) returned 0x5b96f0 [0223.188] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0226.165] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", len=0x40 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 1 [0226.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da8) returned 0x6dee6e0 [0226.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.166] CloseHandle (hObject=0x454) returned 1 [0226.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0226.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~4.YOU")) returned 0x5b9630 [0226.167] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.168] GetProcessHeap () returned 0x580000 [0226.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0226.168] GetProcessHeap () returned 0x580000 [0226.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0226.168] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.168] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x40cff14*=0x60, lpOverlapped=0x0) returned 1 [0226.169] GetProcessHeap () returned 0x580000 [0226.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.169] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.169] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x40cff14*=0x60, lpOverlapped=0x0) returned 1 [0226.169] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.169] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0226.169] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.169] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0226.170] CloseHandle (hObject=0x454) returned 1 [0226.170] GetProcessHeap () returned 0x580000 [0226.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0226.170] GetProcessHeap () returned 0x580000 [0226.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0226.170] GetProcessHeap () returned 0x580000 [0226.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe54fb00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x93, dwReserved0=0x40cfd28, dwReserved1=0x61b540, cFileName="GROOVE_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~4.YOU")) returned 0x5b9630 [0226.170] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.263] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", len=0x37 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 1 [0226.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db8) returned 0x6dee6e0 [0226.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0227.824] CloseHandle (hObject=0x43c) returned 1 [0227.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0227.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.id_1622540890_.your_last_chance")) returned 1 [0227.825] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0227.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGMOD~1.YOU")) returned 0x5b9730 [0227.825] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0227.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\logmodel.mdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0227.825] GetProcessHeap () returned 0x580000 [0227.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb5a1) returned 0x74730a8 [0227.826] GetProcessHeap () returned 0x580000 [0227.826] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb5a1) returned 0x747e658 [0227.826] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.826] ReadFile (in: hFile=0x43c, lpBuffer=0x74730a8, nNumberOfBytesToRead=0xb580, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x74730a8*, lpNumberOfBytesRead=0x40cff14*=0xb580, lpOverlapped=0x0) returned 1 [0233.514] GetProcessHeap () returned 0x580000 [0233.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0233.515] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.515] WriteFile (in: hFile=0x43c, lpBuffer=0x747e658*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x747e658*, lpNumberOfBytesWritten=0x40cff14*=0xb580, lpOverlapped=0x0) returned 1 [0233.515] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.515] WriteFile (in: hFile=0x43c, lpBuffer=0x7489bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7489bd7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0233.515] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.516] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0233.516] CloseHandle (hObject=0x43c) returned 1 [0235.460] GetProcessHeap () returned 0x580000 [0235.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x747e658 | out: hHeap=0x580000) returned 1 [0235.460] GetProcessHeap () returned 0x580000 [0235.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74730a8 | out: hHeap=0x580000) returned 1 [0235.460] GetProcessHeap () returned 0x580000 [0235.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0235.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2b3c140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x40cfd28, dwReserved1=0x74730a8, cFileName="LOGMODEL.MDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGMOD~1.YOU")) returned 0x5b9730 [0239.339] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.326] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", len=0x39 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned 1 [0241.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dcc) returned 0x6dee6e0 [0241.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0241.327] CloseHandle (hObject=0x478) returned 1 [0241.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.id_1622540890_.your_last_chance")) returned 1 [0241.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINDWA~1.YOU")) returned 0x5b9730 [0241.328] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\media\\wind.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0241.328] GetProcessHeap () returned 0x580000 [0241.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ba1) returned 0x72bb898 [0241.328] GetProcessHeap () returned 0x580000 [0241.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ba1) returned 0x6d748d8 [0241.328] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.328] ReadFile (in: hFile=0x478, lpBuffer=0x72bb898, nNumberOfBytesToRead=0x2b80, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x72bb898*, lpNumberOfBytesRead=0x40cff14*=0x2b80, lpOverlapped=0x0) returned 1 [0241.421] GetProcessHeap () returned 0x580000 [0241.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.421] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.422] WriteFile (in: hFile=0x478, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x2b80, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x40cff14*=0x2b80, lpOverlapped=0x0) returned 1 [0241.422] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.422] WriteFile (in: hFile=0x478, lpBuffer=0x6d77457*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77457*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0241.422] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.422] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0241.422] CloseHandle (hObject=0x478) returned 1 [0241.422] GetProcessHeap () returned 0x580000 [0241.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0241.422] GetProcessHeap () returned 0x580000 [0241.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72bb898 | out: hHeap=0x580000) returned 1 [0241.422] GetProcessHeap () returned 0x580000 [0241.422] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc76a9a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba8, dwReserved0=0x40cfd28, dwReserved1=0x72bb898, cFileName="WIND.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINDWA~1.YOU")) returned 0x5b9630 [0241.422] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.346] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML", len=0x40 | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned 1 [0242.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0242.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0245.061] CloseHandle (hObject=0x420) returned 1 [0245.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml.id_1622540890_.your_last_chance")) returned 1 [0245.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45027800, ftLastWriteTime.dwHighDateTime=0x1ca0f15, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGFB6E~1.YOU")) returned 0x5b96f0 [0245.063] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0245.063] GetProcessHeap () returned 0x580000 [0245.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0245.064] GetProcessHeap () returned 0x580000 [0245.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0245.064] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.064] ReadFile (in: hFile=0x420, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.142] GetProcessHeap () returned 0x580000 [0248.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0248.142] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.142] WriteFile (in: hFile=0x420, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.143] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.143] WriteFile (in: hFile=0x420, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0248.143] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.143] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0248.143] CloseHandle (hObject=0x420) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0253.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb6c8b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27b12, dwReserved0=0x40cfd28, dwReserved1=0x707ec98, cFileName="PGLBL103.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGFB6E~1.YOU")) returned 0x5b9730 [0253.663] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.679] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML", len=0x3e | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML") returned 1 [0253.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f98) returned 0x6dee6e0 [0253.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.689] CloseHandle (hObject=0x48c) returned 1 [0253.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml.id_1622540890_.your_last_chance")) returned 1 [0253.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf59600, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cf59600, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x110e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBB~1.YOU")) returned 0x5b9730 [0253.690] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.690] GetProcessHeap () returned 0x580000 [0253.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1121) returned 0x6ce2378 [0253.690] GetProcessHeap () returned 0x580000 [0253.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1121) returned 0x65d9d0 [0253.691] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.691] ReadFile (in: hFile=0x48c, lpBuffer=0x6ce2378, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesRead=0x40cff14*=0x1100, lpOverlapped=0x0) returned 1 [0253.706] GetProcessHeap () returned 0x580000 [0253.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.706] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.706] WriteFile (in: hFile=0x48c, lpBuffer=0x65d9d0*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x65d9d0*, lpNumberOfBytesWritten=0x40cff14*=0x1100, lpOverlapped=0x0) returned 1 [0253.707] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.707] WriteFile (in: hFile=0x48c, lpBuffer=0x65eacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x65eacf*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0253.707] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.707] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0253.707] CloseHandle (hObject=0x48c) returned 1 [0253.707] GetProcessHeap () returned 0x580000 [0253.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x580000) returned 1 [0253.707] GetProcessHeap () returned 0x580000 [0253.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0253.707] GetProcessHeap () returned 0x580000 [0253.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf59600, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcebe55e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1132, dwReserved0=0x40cfd28, dwReserved1=0x6ce2378, cFileName="DGWEBBTN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBB~1.YOU")) returned 0x5b9730 [0254.938] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.951] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC", len=0x3d | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC") returned 1 [0254.951] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd4) returned 0x72e5948 [0254.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0254.952] CloseHandle (hObject=0x4a4) returned 1 [0254.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0254.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc.id_1622540890_.your_last_chance")) returned 1 [0254.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0254.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAIL1~1.YOU")) returned 0x5b9730 [0254.954] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0254.954] GetProcessHeap () returned 0x580000 [0254.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0254.954] GetProcessHeap () returned 0x580000 [0254.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0254.954] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.954] ReadFile (in: hFile=0x4a4, lpBuffer=0x6e21520, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.346] GetProcessHeap () returned 0x580000 [0258.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.346] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e32d50*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesWritten=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.347] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.347] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e4454f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4454f*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0258.433] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.433] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0258.433] CloseHandle (hObject=0x4a4) returned 1 [0258.451] GetProcessHeap () returned 0x580000 [0258.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0258.466] GetProcessHeap () returned 0x580000 [0258.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0258.469] GetProcessHeap () returned 0x580000 [0258.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd18f9680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbc424, dwReserved0=0x40cfd28, dwReserved1=0x580000, cFileName="EMAIL11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAIL1~1.YOU")) returned 0x5b9630 [0259.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.235] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC", len=0x3d | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC") returned 1 [0259.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a4) returned 0x72e5948 [0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0259.358] CloseHandle (hObject=0x3f4) returned 1 [0259.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc.id_1622540890_.your_last_chance")) returned 1 [0259.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRBRS~1.YOU")) returned 0x5b9630 [0259.359] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0259.360] GetProcessHeap () returned 0x580000 [0259.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x7004c60 [0259.360] GetProcessHeap () returned 0x580000 [0259.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x6dcfb90 [0259.360] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.360] ReadFile (in: hFile=0x3f4, lpBuffer=0x7004c60, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7004c60*, lpNumberOfBytesRead=0x40cff14*=0x460, lpOverlapped=0x0) returned 1 [0259.651] GetProcessHeap () returned 0x580000 [0259.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0259.651] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.651] WriteFile (in: hFile=0x3f4, lpBuffer=0x6dcfb90*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesWritten=0x40cff14*=0x460, lpOverlapped=0x0) returned 1 [0259.651] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.652] WriteFile (in: hFile=0x3f4, lpBuffer=0x6dcffef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcffef*, lpNumberOfBytesWritten=0x40cff14*=0x20, lpOverlapped=0x0) returned 1 [0259.652] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.652] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x40cff14*=0x4, lpOverlapped=0x0) returned 1 [0259.652] CloseHandle (hObject=0x3f4) returned 1 [0259.652] GetProcessHeap () returned 0x580000 [0259.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0259.652] GetProcessHeap () returned 0x580000 [0259.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7004c60 | out: hHeap=0x580000) returned 1 [0259.652] GetProcessHeap () returned 0x580000 [0259.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfccc | out: lpFindFileData=0x40cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd24941c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x40cfd28, dwReserved1=0x7004c60, cFileName="STRBRST.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRBRS~1.YOU")) returned 0x5b9630 [0259.652] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.274] SysReAllocStringLen (in: pbstr=0x40cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV", len=0x3f | out: pbstr=0x40cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV") returned 1 [0260.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2070) returned 0x72e5948 [0260.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0260.302] CloseHandle (hObject=0x458) returned 1 [0260.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv.id_1622540890_.your_last_chance")) returned 1 [0260.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x40cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x40cfc74 | out: lpFindFileData=0x40cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb3100, ftCreationTime.dwHighDateTime=0x1c9c70f, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb3100, ftLastWriteTime.dwHighDateTime=0x1c9c70f, nFileSizeHigh=0x0, nFileSizeLow=0x4c4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIDEBA~4.YOU")) returned 0x5b9630 [0260.304] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0260.304] GetProcessHeap () returned 0x580000 [0260.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7258a38 [0260.304] GetProcessHeap () returned 0x580000 [0260.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x726a268 [0260.305] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.305] ReadFile (in: hFile=0x458, lpBuffer=0x7258a38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x40cff14, lpOverlapped=0x0 | out: lpBuffer=0x7258a38*, lpNumberOfBytesRead=0x40cff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 29 os_tid = 0xa6c [0039.064] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.110] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.552] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.313] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.780] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.114] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.194] Sleep (dwMilliseconds=0x1) [0043.204] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.294] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.343] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.419] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.450] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.729] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.762] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.808] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.855] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.964] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0043.999] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.061] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.619] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.697] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.009] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.040] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.165] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.274] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.477] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.867] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.992] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.023] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.257] Sleep (dwMilliseconds=0x1) [0046.275] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.344] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.491] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.569] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.647] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.803] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.881] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.959] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.052] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.083] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.208] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.317] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.473] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.665] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.804] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.896] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.175] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.300] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.534] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.565] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.784] Sleep (dwMilliseconds=0x1) [0048.799] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.955] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.470] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.782] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.938] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.016] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.094] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.203] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.328] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.359] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.515] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.656] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.905] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.217] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.342] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.529] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.643] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.761] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.824] Sleep (dwMilliseconds=0x1) [0051.839] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.902] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.964] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.995] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.042] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.073] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.120] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.229] Sleep (dwMilliseconds=0x1) [0052.245] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.307] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.354] Sleep (dwMilliseconds=0x1) [0052.370] Sleep (dwMilliseconds=0x1) [0052.385] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.604] Sleep (dwMilliseconds=0x1) [0052.619] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.838] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.978] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.056] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.111] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.165] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.368] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.446] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.477] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.524] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.587] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.649] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.680] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.836] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.914] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.961] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.992] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.070] Sleep (dwMilliseconds=0x1) [0054.086] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.148] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.226] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.273] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.321] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.382] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.460] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.538] Sleep (dwMilliseconds=0x1) [0054.561] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.585] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.616] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.694] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.741] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.772] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.850] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.897] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.928] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.006] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.038] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.162] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.240] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.287] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.318] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.474] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.534] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Boot\\BCD.LOG1", len=0x10 | out: pbstr=0x420ff84*="C:\\Boot\\BCD.LOG1") returned 1 [0055.534] GetProcessHeap () returned 0x580000 [0055.534] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0055.535] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0055.584] CloseHandle (hObject=0x3f4) returned 1 [0055.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.585] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bcd.log1.id_1622540890_.your_last_chance")) returned 1 [0055.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.585] FindFirstFileW (in: lpFileName="C:\\Boot\\BCD.LOG1.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCDLOG~1.YOU")) returned 0x5b95f0 [0055.586] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef14, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCECE") returned 31 [0055.586] MoveFileW (lpExistingFileName="C:\\Boot\\BCD.LOG1.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\boot\\bcd.log1.id_1622540890_.your_last_chance"), lpNewFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1")) returned 1 [0055.586] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.696] Sleep (dwMilliseconds=0x1) [0055.837] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Boot\\Fonts\\wgl4_boot.ttf", len=0x1b | out: pbstr=0x420ff84*="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 1 [0055.837] GetProcessHeap () returned 0x580000 [0055.837] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6152a8, Size=0x18) returned 0x5a58e8 [0055.837] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.846] Sleep (dwMilliseconds=0x1) [0061.793] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", len=0x4b | out: pbstr=0x420ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 1 [0061.793] GetProcessHeap () returned 0x580000 [0061.793] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x58) returned 0x5b5bc8 [0061.793] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0066.760] CloseHandle (hObject=0x480) returned 1 [0066.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.760] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id_1622540890_.your_last_chance")) returned 1 [0075.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.023] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x45, dwReserved1=0x0, cFileName="ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRW~2.YOU")) returned 0x5b96f0 [0075.023] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0075.023] GetProcessHeap () returned 0x580000 [0075.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0075.023] GetProcessHeap () returned 0x580000 [0075.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e1db20 [0075.024] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.024] ReadFile (in: hFile=0x480, lpBuffer=0x6481a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.787] GetProcessHeap () returned 0x580000 [0078.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0078.787] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.787] WriteFile (in: hFile=0x480, lpBuffer=0x6e1db20*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1db20*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.788] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.788] WriteFile (in: hFile=0x480, lpBuffer=0x6e2f31f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2f31f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.094] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.098] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.105] CloseHandle (hObject=0x480) returned 1 [0079.109] GetProcessHeap () returned 0x580000 [0079.111] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1db20 | out: hHeap=0x580000) returned 1 [0079.125] GetProcessHeap () returned 0x580000 [0079.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0079.145] GetProcessHeap () returned 0x580000 [0079.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0079.460] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x66c2a540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee55, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="ProPrWW2.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRW~2.YOU")) returned 0x5b96b0 [0079.460] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.964] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", len=0x4c | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 1 [0085.964] GetProcessHeap () returned 0x580000 [0085.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x90) returned 0x614a48 [0085.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.966] Sleep (dwMilliseconds=0x1) [0085.981] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", len=0x44 | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 1 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x24) returned 0x614a48 [0085.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.982] Sleep (dwMilliseconds=0x1) [0086.328] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", len=0x4d | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 1 [0086.328] GetProcessHeap () returned 0x580000 [0086.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0088.687] CloseHandle (hObject=0x170) returned 1 [0088.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id_1622540890_.your_last_chance")) returned 1 [0095.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AFTRNO~1.YOU")) returned 0x5b96f0 [0095.536] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0095.536] GetProcessHeap () returned 0x580000 [0095.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x67c990 [0095.536] GetProcessHeap () returned 0x580000 [0095.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6e26430 [0095.536] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.536] ReadFile (in: hFile=0x170, lpBuffer=0x67c990, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c990*, lpNumberOfBytesRead=0x420ff14*=0x220, lpOverlapped=0x0) returned 1 [0095.539] GetProcessHeap () returned 0x580000 [0095.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0095.539] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.539] WriteFile (in: hFile=0x170, lpBuffer=0x6e26430*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e26430*, lpNumberOfBytesWritten=0x420ff14*=0x220, lpOverlapped=0x0) returned 1 [0095.540] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.540] WriteFile (in: hFile=0x170, lpBuffer=0x6e2664f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2664f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0095.540] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.540] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0095.541] CloseHandle (hObject=0x170) returned 1 [0095.541] GetProcessHeap () returned 0x580000 [0095.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e26430 | out: hHeap=0x580000) returned 1 [0095.541] GetProcessHeap () returned 0x580000 [0095.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c990 | out: hHeap=0x580000) returned 1 [0095.541] GetProcessHeap () returned 0x580000 [0095.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0095.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708f8e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x420fd28, dwReserved1=0x67c990, cFileName="AFTRNOON.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AFTRNO~1.YOU")) returned 0x5b96f0 [0095.541] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.550] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", len=0x4a | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 1 [0095.550] GetProcessHeap () returned 0x580000 [0095.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x28) returned 0x5dc550 [0095.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0095.551] CloseHandle (hObject=0x170) returned 1 [0095.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0095.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0095.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0095.552] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0095.552] GetProcessHeap () returned 0x580000 [0095.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6f0c4f8 [0095.552] GetProcessHeap () returned 0x580000 [0095.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c556f8 [0095.552] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.552] ReadFile (in: hFile=0x170, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x420ff14*=0x680, lpOverlapped=0x0) returned 1 [0095.559] GetProcessHeap () returned 0x580000 [0095.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0095.559] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.559] WriteFile (in: hFile=0x170, lpBuffer=0x6c556f8*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c556f8*, lpNumberOfBytesWritten=0x420ff14*=0x680, lpOverlapped=0x0) returned 1 [0095.560] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.560] WriteFile (in: hFile=0x170, lpBuffer=0x6c55d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55d77*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0095.560] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.560] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0095.560] CloseHandle (hObject=0x170) returned 1 [0095.560] GetProcessHeap () returned 0x580000 [0095.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c556f8 | out: hHeap=0x580000) returned 1 [0095.560] GetProcessHeap () returned 0x580000 [0095.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0095.560] GetProcessHeap () returned 0x580000 [0095.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0095.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7091efe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x420fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0095.560] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.566] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 1 [0095.566] GetProcessHeap () returned 0x580000 [0095.566] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0095.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0095.566] CloseHandle (hObject=0x170) returned 1 [0095.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0095.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0095.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0095.569] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0095.569] GetProcessHeap () returned 0x580000 [0095.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9101) returned 0x6f3aa38 [0095.569] GetProcessHeap () returned 0x580000 [0095.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9101) returned 0x6cd9508 [0095.569] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.569] ReadFile (in: hFile=0x170, lpBuffer=0x6f3aa38, nNumberOfBytesToRead=0x90e0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3aa38*, lpNumberOfBytesRead=0x420ff14*=0x90e0, lpOverlapped=0x0) returned 1 [0099.145] GetProcessHeap () returned 0x580000 [0099.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.145] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.145] WriteFile (in: hFile=0x170, lpBuffer=0x6cd9508*, nNumberOfBytesToWrite=0x90e0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cd9508*, lpNumberOfBytesWritten=0x420ff14*=0x90e0, lpOverlapped=0x0) returned 1 [0099.145] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.145] WriteFile (in: hFile=0x170, lpBuffer=0x6ce25e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce25e7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.145] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.146] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.146] CloseHandle (hObject=0x170) returned 1 [0099.146] GetProcessHeap () returned 0x580000 [0099.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cd9508 | out: hHeap=0x580000) returned 1 [0099.146] GetProcessHeap () returned 0x580000 [0099.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3aa38 | out: hHeap=0x580000) returned 1 [0099.147] GetProcessHeap () returned 0x580000 [0099.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72b56c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x911c, dwReserved0=0x420fd28, dwReserved1=0x6f3aa38, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0099.147] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.351] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x420ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 1 [0101.351] GetProcessHeap () returned 0x580000 [0101.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0101.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0101.365] CloseHandle (hObject=0x43c) returned 1 [0101.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0101.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.366] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0101.366] GetProcessHeap () returned 0x580000 [0101.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c61) returned 0x6f3f838 [0101.367] GetProcessHeap () returned 0x580000 [0101.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c61) returned 0x673cd0 [0101.367] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.367] ReadFile (in: hFile=0x43c, lpBuffer=0x6f3f838, nNumberOfBytesToRead=0x4c40, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f838*, lpNumberOfBytesRead=0x420ff14*=0x4c40, lpOverlapped=0x0) returned 1 [0102.177] GetProcessHeap () returned 0x580000 [0102.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.177] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.177] WriteFile (in: hFile=0x43c, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x4c40, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x420ff14*=0x4c40, lpOverlapped=0x0) returned 1 [0102.177] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.177] WriteFile (in: hFile=0x43c, lpBuffer=0x67890f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x67890f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.178] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.178] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.178] CloseHandle (hObject=0x43c) returned 1 [0102.178] GetProcessHeap () returned 0x580000 [0102.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0102.178] GetProcessHeap () returned 0x580000 [0102.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f838 | out: hHeap=0x580000) returned 1 [0102.178] GetProcessHeap () returned 0x580000 [0102.178] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x748336e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c69, dwReserved0=0x420fd28, dwReserved1=0x6f3f838, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0102.178] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.078] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x420ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.078] GetProcessHeap () returned 0x580000 [0112.078] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.078] Sleep (dwMilliseconds=0x1) [0112.094] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", len=0x61 | out: pbstr=0x420ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.094] GetProcessHeap () returned 0x580000 [0112.094] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.094] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.099] Sleep (dwMilliseconds=0x1) [0112.192] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.207] Sleep (dwMilliseconds=0x1) [0112.317] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", len=0x69 | out: pbstr=0x420ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned 1 [0112.317] GetProcessHeap () returned 0x580000 [0112.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b9630 [0112.317] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.318] Sleep (dwMilliseconds=0x1) [0113.337] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", len=0x3f | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 1 [0113.337] GetProcessHeap () returned 0x580000 [0113.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x7c) returned 0x6f0ceb8 [0113.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0113.476] CloseHandle (hObject=0x4a4) returned 1 [0113.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~2.YOU")) returned 0x5b9730 [0114.148] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0114.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0114.149] GetProcessHeap () returned 0x580000 [0114.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x6f19958 [0114.149] GetProcessHeap () returned 0x580000 [0114.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x6d035f8 [0114.149] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.149] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x420ff14*=0x1380, lpOverlapped=0x0) returned 1 [0114.167] GetProcessHeap () returned 0x580000 [0114.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.168] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.168] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x420ff14*=0x1380, lpOverlapped=0x0) returned 1 [0114.168] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.168] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d04977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04977*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.168] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.168] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.168] CloseHandle (hObject=0x4a4) returned 1 [0114.168] GetProcessHeap () returned 0x580000 [0114.168] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0114.168] GetProcessHeap () returned 0x580000 [0114.168] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0114.168] GetProcessHeap () returned 0x580000 [0114.168] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ba9b840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13bc, dwReserved0=0x420fd28, dwReserved1=0x6f19958, cFileName="AG00171_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~2.YOU")) returned 0x5b9730 [0114.168] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0114.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0114.193] CloseHandle (hObject=0x4a4) returned 1 [0114.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01987~1.YOU")) returned 0x5b9730 [0114.194] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0114.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0114.195] GetProcessHeap () returned 0x580000 [0114.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe181) returned 0x636970 [0114.195] GetProcessHeap () returned 0x580000 [0114.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe181) returned 0x644b00 [0114.196] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.196] ReadFile (in: hFile=0x4a4, lpBuffer=0x636970, nNumberOfBytesToRead=0xe160, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x420ff14*=0xe160, lpOverlapped=0x0) returned 1 [0118.314] GetProcessHeap () returned 0x580000 [0118.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.315] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.315] WriteFile (in: hFile=0x4a4, lpBuffer=0x644b00*, nNumberOfBytesToWrite=0xe160, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x644b00*, lpNumberOfBytesWritten=0x420ff14*=0xe160, lpOverlapped=0x0) returned 1 [0118.315] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.315] WriteFile (in: hFile=0x4a4, lpBuffer=0x652c5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x652c5f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.315] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.315] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.315] CloseHandle (hObject=0x4a4) returned 1 [0118.363] GetProcessHeap () returned 0x580000 [0118.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x644b00 | out: hHeap=0x580000) returned 1 [0118.364] GetProcessHeap () returned 0x580000 [0118.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0118.364] GetProcessHeap () returned 0x580000 [0118.364] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e22e600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe19e, dwReserved0=0x420fd28, dwReserved1=0x636970, cFileName="J0198712.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01987~1.YOU")) returned 0x5b96f0 [0120.123] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.149] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", len=0x4c | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 1 [0120.149] GetProcessHeap () returned 0x580000 [0120.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e4) returned 0x6d06ca8 [0120.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0121.382] CloseHandle (hObject=0x460) returned 1 [0121.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0219~1.YOU")) returned 0x5b9730 [0121.383] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0121.383] GetProcessHeap () returned 0x580000 [0121.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ac1) returned 0x6dd2230 [0121.383] GetProcessHeap () returned 0x580000 [0121.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ac1) returned 0x6584d0 [0121.383] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.383] ReadFile (in: hFile=0x460, lpBuffer=0x6dd2230, nNumberOfBytesToRead=0x4aa0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd2230*, lpNumberOfBytesRead=0x420ff14*=0x4aa0, lpOverlapped=0x0) returned 1 [0121.694] GetProcessHeap () returned 0x580000 [0121.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.694] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.694] WriteFile (in: hFile=0x460, lpBuffer=0x6584d0*, nNumberOfBytesToWrite=0x4aa0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6584d0*, lpNumberOfBytesWritten=0x420ff14*=0x4aa0, lpOverlapped=0x0) returned 1 [0121.694] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.694] WriteFile (in: hFile=0x460, lpBuffer=0x65cf6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x65cf6f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.694] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.695] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.695] CloseHandle (hObject=0x460) returned 1 [0121.913] GetProcessHeap () returned 0x580000 [0121.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6584d0 | out: hHeap=0x580000) returned 1 [0121.913] GetProcessHeap () returned 0x580000 [0121.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd2230 | out: hHeap=0x580000) returned 1 [0121.913] GetProcessHeap () returned 0x580000 [0121.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80250f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4ae0, dwReserved0=0x420fd28, dwReserved1=0x6dd2230, cFileName="WB02198_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0219~1.YOU")) returned 0x5b9630 [0122.253] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0122.311] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", len=0x3f | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned 1 [0122.311] GetProcessHeap () returned 0x580000 [0122.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x196c) returned 0x6f42f08 [0122.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.804] CloseHandle (hObject=0x440) returned 1 [0122.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.804] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.id_1622540890_.your_last_chance")) returned 1 [0122.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVET~1.YOU")) returned 0x5b9730 [0122.805] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.805] GetProcessHeap () returned 0x580000 [0122.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0122.806] GetProcessHeap () returned 0x580000 [0122.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0122.807] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.807] ReadFile (in: hFile=0x440, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.267] GetProcessHeap () returned 0x580000 [0124.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.267] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.268] WriteFile (in: hFile=0x440, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.268] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.268] WriteFile (in: hFile=0x440, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.268] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.268] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.268] CloseHandle (hObject=0x440) returned 1 [0124.268] GetProcessHeap () returned 0x580000 [0124.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0124.268] GetProcessHeap () returned 0x580000 [0124.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0124.268] GetProcessHeap () returned 0x580000 [0124.268] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81add1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12624, dwReserved0=0x420fd28, dwReserved1=0x6d10048, cFileName="Verve.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVET~1.YOU")) returned 0x5b9730 [0124.992] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.082] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", len=0x4d | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 1 [0125.082] GetProcessHeap () returned 0x580000 [0125.082] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x189c) returned 0x6f42f08 [0125.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0125.144] CloseHandle (hObject=0x430) returned 1 [0125.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERE~1.YOU")) returned 0x5b9730 [0125.145] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0125.146] GetProcessHeap () returned 0x580000 [0125.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d2a5b8 [0125.146] GetProcessHeap () returned 0x580000 [0125.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d3bde8 [0125.146] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.146] ReadFile (in: hFile=0x430, lpBuffer=0x6d2a5b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2a5b8*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.731] GetProcessHeap () returned 0x580000 [0127.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0127.731] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.731] WriteFile (in: hFile=0x430, lpBuffer=0x6d3bde8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3bde8*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.731] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.732] WriteFile (in: hFile=0x430, lpBuffer=0x6d4d5e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4d5e7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0127.732] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.732] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0127.732] CloseHandle (hObject=0x430) returned 1 [0127.732] GetProcessHeap () returned 0x580000 [0127.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d3bde8 | out: hHeap=0x580000) returned 1 [0127.732] GetProcessHeap () returned 0x580000 [0127.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2a5b8 | out: hHeap=0x580000) returned 1 [0127.732] GetProcessHeap () returned 0x580000 [0127.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0127.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83be4320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x37dae, dwReserved0=0x420fd28, dwReserved1=0x6d2a5b8, cFileName="Paper.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERE~1.YOU")) returned 0x5b96f0 [0127.732] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.049] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", len=0x3d | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned 1 [0128.049] GetProcessHeap () returned 0x580000 [0128.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19bc) returned 0x667250 [0128.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.285] CloseHandle (hObject=0x41c) returned 1 [0129.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02991~1.YOU")) returned 0x5b9730 [0130.973] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0130.973] GetProcessHeap () returned 0x580000 [0130.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23c1) returned 0x6e56e40 [0130.973] GetProcessHeap () returned 0x580000 [0130.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23c1) returned 0x6e59210 [0130.974] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.974] ReadFile (in: hFile=0x41c, lpBuffer=0x6e56e40, nNumberOfBytesToRead=0x23a0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e56e40*, lpNumberOfBytesRead=0x420ff14*=0x23a0, lpOverlapped=0x0) returned 1 [0131.006] GetProcessHeap () returned 0x580000 [0131.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0131.006] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.006] WriteFile (in: hFile=0x41c, lpBuffer=0x6e59210*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e59210*, lpNumberOfBytesWritten=0x420ff14*=0x23a0, lpOverlapped=0x0) returned 1 [0131.006] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.006] WriteFile (in: hFile=0x41c, lpBuffer=0x6e5b5af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5b5af*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.006] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.006] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.006] CloseHandle (hObject=0x41c) returned 1 [0131.893] GetProcessHeap () returned 0x580000 [0131.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e59210 | out: hHeap=0x580000) returned 1 [0131.893] GetProcessHeap () returned 0x580000 [0131.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e56e40 | out: hHeap=0x580000) returned 1 [0131.893] GetProcessHeap () returned 0x580000 [0131.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0132.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b223e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23da, dwReserved0=0x420fd28, dwReserved1=0x6e56e40, cFileName="J0299171.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02991~1.YOU")) returned 0x5b96f0 [0134.753] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.754] Sleep (dwMilliseconds=0x1) [0135.617] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", len=0x56 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css") returned 1 [0135.617] GetProcessHeap () returned 0x580000 [0135.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0136.882] CloseHandle (hObject=0x3a8) returned 1 [0136.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.id_1622540890_.your_last_chance")) returned 1 [0138.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x4c005f, dwReserved1=0x530041, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b96b0 [0138.456] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0138.456] GetProcessHeap () returned 0x580000 [0138.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x6c29878 [0138.456] GetProcessHeap () returned 0x580000 [0138.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x6dd7c30 [0138.456] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.456] ReadFile (in: hFile=0x390, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x420ff14*=0xb80, lpOverlapped=0x0) returned 1 [0138.467] GetProcessHeap () returned 0x580000 [0138.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0138.468] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.468] WriteFile (in: hFile=0x390, lpBuffer=0x6dd7c30*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesWritten=0x420ff14*=0xb80, lpOverlapped=0x0) returned 1 [0138.468] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.468] WriteFile (in: hFile=0x390, lpBuffer=0x6dd87af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd87af*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.468] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.468] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.468] CloseHandle (hObject=0x390) returned 1 [0138.468] GetProcessHeap () returned 0x580000 [0138.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0138.468] GetProcessHeap () returned 0x580000 [0138.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0138.468] GetProcessHeap () returned 0x580000 [0138.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0138.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a265680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbba, dwReserved0=0x420fd28, dwReserved1=0x6c29878, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b96b0 [0138.468] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.484] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", len=0x43 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned 1 [0138.484] GetProcessHeap () returned 0x580000 [0138.484] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0138.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.575] CloseHandle (hObject=0x4a0) returned 1 [0139.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x364d4d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x364d4d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~1.YOU")) returned 0x5b97b0 [0139.577] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.577] GetProcessHeap () returned 0x580000 [0139.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0139.577] GetProcessHeap () returned 0x580000 [0139.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0139.577] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.577] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x420ff14*=0x140, lpOverlapped=0x0) returned 1 [0139.579] GetProcessHeap () returned 0x580000 [0139.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.579] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.579] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x420ff14*=0x140, lpOverlapped=0x0) returned 1 [0139.579] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.579] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.579] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.579] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.580] CloseHandle (hObject=0x4a0) returned 1 [0139.580] GetProcessHeap () returned 0x580000 [0139.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0139.580] GetProcessHeap () returned 0x580000 [0139.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0139.580] GetProcessHeap () returned 0x580000 [0139.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x364d4d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8acf5820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x420fd28, dwReserved1=0x6f3bec0, cFileName="BD21315_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~1.YOU")) returned 0x5b9770 [0140.123] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.169] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", len=0x5e | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css") returned 1 [0140.169] GetProcessHeap () returned 0x580000 [0140.169] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0140.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.623] CloseHandle (hObject=0x428) returned 1 [0140.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.id_1622540890_.your_last_chance")) returned 1 [0140.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO2FE8~1.YOU")) returned 0x5b9770 [0140.624] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.624] GetProcessHeap () returned 0x580000 [0140.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6dd8f68 [0140.624] GetProcessHeap () returned 0x580000 [0140.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6dd94f0 [0140.624] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.624] ReadFile (in: hFile=0x428, lpBuffer=0x6dd8f68, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesRead=0x420ff14*=0x540, lpOverlapped=0x0) returned 1 [0140.630] GetProcessHeap () returned 0x580000 [0140.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf2a0 [0140.630] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.630] WriteFile (in: hFile=0x428, lpBuffer=0x6dd94f0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd94f0*, lpNumberOfBytesWritten=0x420ff14*=0x540, lpOverlapped=0x0) returned 1 [0140.630] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.631] WriteFile (in: hFile=0x428, lpBuffer=0x6dd9a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9a2f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.631] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.631] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.631] CloseHandle (hObject=0x428) returned 1 [0140.631] GetProcessHeap () returned 0x580000 [0140.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd94f0 | out: hHeap=0x580000) returned 1 [0140.631] GetProcessHeap () returned 0x580000 [0140.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0140.631] GetProcessHeap () returned 0x580000 [0140.631] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf2a0 | out: hHeap=0x580000) returned 1 [0141.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6ed440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x580, dwReserved0=0x420fd28, dwReserved1=0x6dd8f68, cFileName="Solutions_Generic.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO2FE8~1.YOU")) returned 0x5b9730 [0141.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.415] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT", len=0x43 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 1 [0144.415] GetProcessHeap () returned 0x580000 [0144.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0144.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.415] CloseHandle (hObject=0x484) returned 1 [0144.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0144.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU18E8~1.YOU")) returned 0x5b9730 [0144.416] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.417] GetProcessHeap () returned 0x580000 [0144.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0144.417] GetProcessHeap () returned 0x580000 [0144.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0144.417] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.417] ReadFile (in: hFile=0x484, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x420ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.418] GetProcessHeap () returned 0x580000 [0144.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.418] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.418] WriteFile (in: hFile=0x484, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x420ff14*=0xc0, lpOverlapped=0x0) returned 1 [0144.418] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.418] WriteFile (in: hFile=0x484, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.419] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.419] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.419] CloseHandle (hObject=0x484) returned 1 [0144.419] GetProcessHeap () returned 0x580000 [0144.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0144.419] GetProcessHeap () returned 0x580000 [0144.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0144.419] GetProcessHeap () returned 0x580000 [0144.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8db14260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x420fd28, dwReserved1=0x5ad8a0, cFileName="OUTLOOK.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU18E8~1.YOU")) returned 0x5b9730 [0144.419] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.468] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF", len=0x3b | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 1 [0144.469] GetProcessHeap () returned 0x580000 [0144.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0144.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0144.588] CloseHandle (hObject=0x448) returned 1 [0144.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id_1622540890_.your_last_chance")) returned 1 [0144.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fc5400, ftLastWriteTime.dwHighDateTime=0x1ca0f51, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLBA~1.YOU")) returned 0x5b9730 [0144.589] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0144.589] GetProcessHeap () returned 0x580000 [0144.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6ce54c0 [0144.589] GetProcessHeap () returned 0x580000 [0144.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6ce5ec8 [0144.589] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.589] ReadFile (in: hFile=0x448, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x420ff14*=0x960, lpOverlapped=0x0) returned 1 [0144.652] GetProcessHeap () returned 0x580000 [0144.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.652] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.652] WriteFile (in: hFile=0x448, lpBuffer=0x6ce5ec8*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5ec8*, lpNumberOfBytesWritten=0x420ff14*=0x960, lpOverlapped=0x0) returned 1 [0144.652] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.652] WriteFile (in: hFile=0x448, lpBuffer=0x6ce6827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6827*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.652] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.652] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.652] CloseHandle (hObject=0x448) returned 1 [0145.145] GetProcessHeap () returned 0x580000 [0145.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5ec8 | out: hHeap=0x580000) returned 1 [0145.145] GetProcessHeap () returned 0x580000 [0145.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0145.145] GetProcessHeap () returned 0x580000 [0145.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8dd4f700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x420fd28, dwReserved1=0x6ce54c0, cFileName="OUTLBAR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLBA~1.YOU")) returned 0x5b96f0 [0146.866] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.880] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", len=0x44 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned 1 [0146.881] GetProcessHeap () returned 0x580000 [0146.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0146.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0152.623] CloseHandle (hObject=0x484) returned 1 [0152.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x399f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR16~1.YOU")) returned 0x5b9730 [0152.663] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0152.663] GetProcessHeap () returned 0x580000 [0152.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39a1) returned 0x6fa8f28 [0152.663] GetProcessHeap () returned 0x580000 [0152.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x39a1) returned 0x6fac8d8 [0152.663] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.663] ReadFile (in: hFile=0x484, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x3980, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x420ff14*=0x3980, lpOverlapped=0x0) returned 1 [0153.940] GetProcessHeap () returned 0x580000 [0153.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0153.940] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.940] WriteFile (in: hFile=0x484, lpBuffer=0x6fac8d8*, nNumberOfBytesToWrite=0x3980, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fac8d8*, lpNumberOfBytesWritten=0x420ff14*=0x3980, lpOverlapped=0x0) returned 1 [0153.941] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.941] WriteFile (in: hFile=0x484, lpBuffer=0x6fb0257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb0257*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.941] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.941] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.941] CloseHandle (hObject=0x484) returned 1 [0153.941] GetProcessHeap () returned 0x580000 [0153.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fac8d8 | out: hHeap=0x580000) returned 1 [0153.941] GetProcessHeap () returned 0x580000 [0153.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0153.941] GetProcessHeap () returned 0x580000 [0153.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x935d4920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39c3, dwReserved0=0x420fd28, dwReserved1=0x6fa8f28, cFileName="PDIR16F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR16~1.YOU")) returned 0x5b9630 [0153.941] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.678] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", len=0x41 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 1 [0154.678] GetProcessHeap () returned 0x580000 [0154.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0158.182] CloseHandle (hObject=0x460) returned 1 [0158.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id_1622540890_.your_last_chance")) returned 1 [0159.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZDA~1.YOU")) returned 0x5b9630 [0159.183] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0159.184] GetProcessHeap () returned 0x580000 [0159.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe2d48 [0159.184] GetProcessHeap () returned 0x580000 [0159.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ff4578 [0159.184] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.184] ReadFile (in: hFile=0x460, lpBuffer=0x6fe2d48, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe2d48*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.793] GetProcessHeap () returned 0x580000 [0164.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0164.793] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.794] WriteFile (in: hFile=0x460, lpBuffer=0x6ff4578*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff4578*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.794] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.794] WriteFile (in: hFile=0x460, lpBuffer=0x7005d77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7005d77*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0164.795] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.795] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0164.795] CloseHandle (hObject=0x460) returned 1 [0164.795] GetProcessHeap () returned 0x580000 [0164.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff4578 | out: hHeap=0x580000) returned 1 [0164.795] GetProcessHeap () returned 0x580000 [0164.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe2d48 | out: hHeap=0x580000) returned 1 [0164.798] GetProcessHeap () returned 0x580000 [0164.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0166.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d60620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5f6024, dwReserved0=0x420fd28, dwReserved1=0x580000, cFileName="ACWZDAT12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZDA~1.YOU")) returned 0x5b9730 [0166.552] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.618] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", len=0x42 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 1 [0166.618] GetProcessHeap () returned 0x580000 [0166.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0166.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.204] CloseHandle (hObject=0x450) returned 1 [0169.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id_1622540890_.your_last_chance")) returned 1 [0169.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONFLI~1.YOU")) returned 0x5b96b0 [0169.205] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.205] GetProcessHeap () returned 0x580000 [0169.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0169.205] GetProcessHeap () returned 0x580000 [0169.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0169.205] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.205] ReadFile (in: hFile=0x450, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x420ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.218] GetProcessHeap () returned 0x580000 [0169.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.219] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.219] WriteFile (in: hFile=0x450, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x420ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.219] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.219] WriteFile (in: hFile=0x450, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.219] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.219] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.219] CloseHandle (hObject=0x450) returned 1 [0169.219] GetProcessHeap () returned 0x580000 [0169.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0169.219] GetProcessHeap () returned 0x580000 [0169.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0169.219] GetProcessHeap () returned 0x580000 [0169.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7a0ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x420fd28, dwReserved1=0x65f268, cFileName="CONFLICT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONFLI~1.YOU")) returned 0x5b9770 [0172.813] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.861] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", len=0x40 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 1 [0172.861] GetProcessHeap () returned 0x580000 [0172.861] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2268) returned 0x6f14048 [0172.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.898] CloseHandle (hObject=0x48c) returned 1 [0172.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.898] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id_1622540890_.your_last_chance")) returned 1 [0172.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURL~1.YOU")) returned 0x5b9770 [0172.899] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0172.899] GetProcessHeap () returned 0x580000 [0172.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0172.899] GetProcessHeap () returned 0x580000 [0172.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0172.899] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.899] ReadFile (in: hFile=0x48c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x420ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.904] GetProcessHeap () returned 0x580000 [0172.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.904] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.904] WriteFile (in: hFile=0x48c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x420ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.904] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.904] WriteFile (in: hFile=0x48c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.904] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.905] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.905] CloseHandle (hObject=0x48c) returned 1 [0172.905] GetProcessHeap () returned 0x580000 [0172.905] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0172.905] GetProcessHeap () returned 0x580000 [0172.905] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0172.905] GetProcessHeap () returned 0x580000 [0172.905] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eabd120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x420fd28, dwReserved1=0x5cf780, cFileName="SECURL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECURL~1.YOU")) returned 0x5b9770 [0173.188] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.211] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", len=0x40 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 1 [0173.211] GetProcessHeap () returned 0x580000 [0173.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0173.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.237] CloseHandle (hObject=0x46c) returned 1 [0173.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.237] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.237] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~3.YOU")) returned 0x5b9770 [0173.238] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.238] GetProcessHeap () returned 0x580000 [0173.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0173.238] GetProcessHeap () returned 0x580000 [0173.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0173.238] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.238] ReadFile (in: hFile=0x46c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x420ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.242] GetProcessHeap () returned 0x580000 [0173.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.242] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.242] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x420ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.242] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.242] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.242] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.242] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.242] CloseHandle (hObject=0x46c) returned 1 [0173.242] GetProcessHeap () returned 0x580000 [0173.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0173.242] GetProcessHeap () returned 0x580000 [0173.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0173.242] GetProcessHeap () returned 0x580000 [0173.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ee02f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x420fd28, dwReserved1=0x6df6780, cFileName="REPORT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~3.YOU")) returned 0x5b9770 [0173.243] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.552] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", len=0x49 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned 1 [0174.552] GetProcessHeap () returned 0x580000 [0174.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0174.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0175.641] CloseHandle (hObject=0x46c) returned 1 [0175.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.id_1622540890_.your_last_chance")) returned 1 [0175.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUGHW~1.YOU")) returned 0x5b96f0 [0175.642] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0175.643] GetProcessHeap () returned 0x580000 [0175.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6be1) returned 0x712f968 [0175.643] GetProcessHeap () returned 0x580000 [0175.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6be1) returned 0x7136558 [0175.643] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.643] ReadFile (in: hFile=0x46c, lpBuffer=0x712f968, nNumberOfBytesToRead=0x6bc0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x712f968*, lpNumberOfBytesRead=0x420ff14*=0x6bc0, lpOverlapped=0x0) returned 1 [0177.111] GetProcessHeap () returned 0x580000 [0177.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.111] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.111] WriteFile (in: hFile=0x46c, lpBuffer=0x7136558*, nNumberOfBytesToWrite=0x6bc0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7136558*, lpNumberOfBytesWritten=0x420ff14*=0x6bc0, lpOverlapped=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.111] WriteFile (in: hFile=0x46c, lpBuffer=0x713d117*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x713d117*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.111] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.112] CloseHandle (hObject=0x46c) returned 1 [0177.112] GetProcessHeap () returned 0x580000 [0177.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7136558 | out: hHeap=0x580000) returned 1 [0177.112] GetProcessHeap () returned 0x580000 [0177.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x712f968 | out: hHeap=0x580000) returned 1 [0177.112] GetProcessHeap () returned 0x580000 [0177.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0179.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa12e8460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6bf8, dwReserved0=0x420fd28, dwReserved1=0x712f968, cFileName="COUGH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUGHW~1.YOU")) returned 0x5b96f0 [0179.104] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.167] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", len=0x48 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx") returned 1 [0179.168] GetProcessHeap () returned 0x580000 [0179.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0179.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.082] CloseHandle (hObject=0x430) returned 1 [0182.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.id_1622540890_.your_last_chance")) returned 1 [0182.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~2.YOU")) returned 0x5b9770 [0182.084] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.084] GetProcessHeap () returned 0x580000 [0182.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x6dcb1d0 [0182.084] GetProcessHeap () returned 0x580000 [0182.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x656970 [0182.085] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x430, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x23e0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x420ff14*=0x23e0, lpOverlapped=0x0) returned 1 [0182.446] GetProcessHeap () returned 0x580000 [0182.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.446] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] WriteFile (in: hFile=0x430, lpBuffer=0x656970*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesWritten=0x420ff14*=0x23e0, lpOverlapped=0x0) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] WriteFile (in: hFile=0x430, lpBuffer=0x658d4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x658d4f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.447] CloseHandle (hObject=0x430) returned 1 [0182.447] GetProcessHeap () returned 0x580000 [0182.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0182.447] GetProcessHeap () returned 0x580000 [0182.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0182.447] GetProcessHeap () returned 0x580000 [0182.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa45c9aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2404, dwReserved0=0x420fd28, dwReserved1=0x6dcb1d0, cFileName="Default.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~2.YOU")) returned 0x5b9770 [0183.686] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.724] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", len=0x6e | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned 1 [0183.724] GetProcessHeap () returned 0x580000 [0183.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0183.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0183.725] CloseHandle (hObject=0x41c) returned 1 [0183.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a97, dwReserved0=0x4a002e, dwReserved1=0x470050, cFileName="TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTBO~1.YOU")) returned 0x5b9770 [0183.726] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0183.726] GetProcessHeap () returned 0x580000 [0183.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3aa1) returned 0x6e14180 [0183.726] GetProcessHeap () returned 0x580000 [0183.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3aa1) returned 0x6d671f8 [0183.726] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.726] ReadFile (in: hFile=0x41c, lpBuffer=0x6e14180, nNumberOfBytesToRead=0x3a80, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e14180*, lpNumberOfBytesRead=0x420ff14*=0x3a80, lpOverlapped=0x0) returned 1 [0184.482] GetProcessHeap () returned 0x580000 [0184.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0184.482] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.482] WriteFile (in: hFile=0x41c, lpBuffer=0x6d671f8*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d671f8*, lpNumberOfBytesWritten=0x420ff14*=0x3a80, lpOverlapped=0x0) returned 1 [0184.482] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.482] WriteFile (in: hFile=0x41c, lpBuffer=0x6d6ac77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ac77*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.482] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.482] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.482] CloseHandle (hObject=0x41c) returned 1 [0184.876] GetProcessHeap () returned 0x580000 [0184.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d671f8 | out: hHeap=0x580000) returned 1 [0184.876] GetProcessHeap () returned 0x580000 [0184.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e14180 | out: hHeap=0x580000) returned 1 [0184.877] GetProcessHeap () returned 0x580000 [0184.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0184.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5920d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3abb, dwReserved0=0x420fd28, dwReserved1=0x6e14180, cFileName="TEXTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTBO~1.YOU")) returned 0x5b9770 [0185.531] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0186.697] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", len=0x65 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned 1 [0186.697] GetProcessHeap () returned 0x580000 [0186.697] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0186.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.381] CloseHandle (hObject=0x4a0) returned 1 [0188.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0188.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x103f, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9770 [0188.382] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.382] GetProcessHeap () returned 0x580000 [0188.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x658970 [0188.382] GetProcessHeap () returned 0x580000 [0188.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x70a1cf8 [0188.382] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.382] ReadFile (in: hFile=0x4a0, lpBuffer=0x658970, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesRead=0x420ff14*=0x1020, lpOverlapped=0x0) returned 1 [0188.399] GetProcessHeap () returned 0x580000 [0188.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.399] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.399] WriteFile (in: hFile=0x4a0, lpBuffer=0x70a1cf8*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesWritten=0x420ff14*=0x1020, lpOverlapped=0x0) returned 1 [0188.399] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.399] WriteFile (in: hFile=0x4a0, lpBuffer=0x70a2d17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a2d17*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.399] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.399] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.399] CloseHandle (hObject=0x4a0) returned 1 [0188.399] GetProcessHeap () returned 0x580000 [0188.399] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0188.399] GetProcessHeap () returned 0x580000 [0188.399] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0188.399] GetProcessHeap () returned 0x580000 [0188.399] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7e78680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1063, dwReserved0=0x420fd28, dwReserved1=0x658970, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9770 [0191.350] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.401] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", len=0x45 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned 1 [0191.401] GetProcessHeap () returned 0x580000 [0191.401] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0191.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0191.401] CloseHandle (hObject=0x494) returned 1 [0191.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD759~1.YOU")) returned 0x5b9770 [0191.402] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0191.403] GetProcessHeap () returned 0x580000 [0191.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a41) returned 0x7057378 [0191.403] GetProcessHeap () returned 0x580000 [0191.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a41) returned 0x6d71658 [0191.403] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.403] ReadFile (in: hFile=0x494, lpBuffer=0x7057378, nNumberOfBytesToRead=0x5a20, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7057378*, lpNumberOfBytesRead=0x420ff14*=0x5a20, lpOverlapped=0x0) returned 1 [0192.989] GetProcessHeap () returned 0x580000 [0192.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0192.989] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.989] WriteFile (in: hFile=0x494, lpBuffer=0x6d71658*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71658*, lpNumberOfBytesWritten=0x420ff14*=0x5a20, lpOverlapped=0x0) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.990] WriteFile (in: hFile=0x494, lpBuffer=0x6d77077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77077*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0192.990] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.990] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0192.990] CloseHandle (hObject=0x494) returned 1 [0192.990] GetProcessHeap () returned 0x580000 [0192.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d71658 | out: hHeap=0x580000) returned 1 [0192.990] GetProcessHeap () returned 0x580000 [0192.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7057378 | out: hHeap=0x580000) returned 1 [0192.990] GetProcessHeap () returned 0x580000 [0192.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0193.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaa5bc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5a58, dwReserved0=0x420fd28, dwReserved1=0x7057378, cFileName="ZPDIR33F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD759~1.YOU")) returned 0x5b97b0 [0193.419] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.460] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", len=0x64 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned 1 [0193.460] GetProcessHeap () returned 0x580000 [0193.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0193.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.569] CloseHandle (hObject=0x44c) returned 1 [0193.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.id_1622540890_.your_last_chance")) returned 1 [0193.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b97f0 [0193.570] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.570] GetProcessHeap () returned 0x580000 [0193.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x7100718 [0193.570] GetProcessHeap () returned 0x580000 [0193.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x7104488 [0193.570] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.570] ReadFile (in: hFile=0x44c, lpBuffer=0x7100718, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesRead=0x420ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0195.229] GetProcessHeap () returned 0x580000 [0195.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.229] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.229] WriteFile (in: hFile=0x44c, lpBuffer=0x7104488*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7104488*, lpNumberOfBytesWritten=0x420ff14*=0x3d40, lpOverlapped=0x0) returned 1 [0195.229] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.230] WriteFile (in: hFile=0x44c, lpBuffer=0x71081c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x71081c7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.230] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.230] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.230] CloseHandle (hObject=0x44c) returned 1 [0195.230] GetProcessHeap () returned 0x580000 [0195.230] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7104488 | out: hHeap=0x580000) returned 1 [0195.230] GetProcessHeap () returned 0x580000 [0195.230] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0195.230] GetProcessHeap () returned 0x580000 [0195.230] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfa20c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d7b, dwReserved0=0x420fd28, dwReserved1=0x7100718, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b97b0 [0195.230] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0198.013] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", len=0x44 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned 1 [0198.013] GetProcessHeap () returned 0x580000 [0198.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0198.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0198.073] CloseHandle (hObject=0x3e4) returned 1 [0198.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.id_1622540890_.your_last_chance")) returned 1 [0198.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4217, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR51~2.YOU")) returned 0x5b97f0 [0198.075] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0198.075] GetProcessHeap () returned 0x580000 [0198.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4221) returned 0x6d14cf8 [0198.075] GetProcessHeap () returned 0x580000 [0198.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4221) returned 0x6d18f28 [0198.075] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.075] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d14cf8, nNumberOfBytesToRead=0x4200, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d14cf8*, lpNumberOfBytesRead=0x420ff14*=0x4200, lpOverlapped=0x0) returned 1 [0198.613] GetProcessHeap () returned 0x580000 [0198.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0198.613] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d18f28*, nNumberOfBytesToWrite=0x4200, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d18f28*, lpNumberOfBytesWritten=0x420ff14*=0x4200, lpOverlapped=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d1d127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1d127*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.613] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.613] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.613] CloseHandle (hObject=0x3e4) returned 1 [0198.798] GetProcessHeap () returned 0x580000 [0198.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d18f28 | out: hHeap=0x580000) returned 1 [0198.798] GetProcessHeap () returned 0x580000 [0198.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d14cf8 | out: hHeap=0x580000) returned 1 [0198.798] GetProcessHeap () returned 0x580000 [0198.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadfeab20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0x420fd28, dwReserved1=0x6d14cf8, cFileName="PDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR51~2.YOU")) returned 0x5b96b0 [0199.653] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.961] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned 1 [0200.961] GetProcessHeap () returned 0x580000 [0200.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc0) returned 0x6f14048 [0200.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.724] CloseHandle (hObject=0x480) returned 1 [0201.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0201.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x4d0073, dwReserved1=0x730061, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOB3ED~1.YOU")) returned 0x5b97b0 [0201.726] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.726] GetProcessHeap () returned 0x580000 [0201.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0201.726] GetProcessHeap () returned 0x580000 [0201.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0201.726] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.726] ReadFile (in: hFile=0x480, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x420ff14*=0x620, lpOverlapped=0x0) returned 1 [0201.733] GetProcessHeap () returned 0x580000 [0201.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.733] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.733] WriteFile (in: hFile=0x480, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x420ff14*=0x620, lpOverlapped=0x0) returned 1 [0201.733] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.733] WriteFile (in: hFile=0x480, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.733] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.733] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.733] CloseHandle (hObject=0x480) returned 1 [0201.733] GetProcessHeap () returned 0x580000 [0201.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0201.733] GetProcessHeap () returned 0x580000 [0201.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0201.733] GetProcessHeap () returned 0x580000 [0201.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdabe20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x420fd28, dwReserved1=0x626d30, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOB3ED~1.YOU")) returned 0x5b9770 [0202.492] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.552] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS", len=0x45 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS") returned 1 [0202.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1edc) returned 0x6f14048 [0202.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0202.702] CloseHandle (hObject=0x464) returned 1 [0202.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css.id_1622540890_.your_last_chance")) returned 1 [0202.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eebe900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eebe900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d124, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCA092~1.YOU")) returned 0x5b9770 [0202.706] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0202.706] GetProcessHeap () returned 0x580000 [0202.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7189e48 [0202.706] GetProcessHeap () returned 0x580000 [0202.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x719b678 [0202.707] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.707] ReadFile (in: hFile=0x464, lpBuffer=0x7189e48, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e48*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.020] GetProcessHeap () returned 0x580000 [0209.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0209.020] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.020] WriteFile (in: hFile=0x464, lpBuffer=0x719b678*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x719b678*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.021] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.021] WriteFile (in: hFile=0x464, lpBuffer=0x71ace77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x71ace77*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.021] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.021] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.021] CloseHandle (hObject=0x464) returned 1 [0209.021] GetProcessHeap () returned 0x580000 [0209.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x719b678 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7189e48 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0210.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eebe900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4326040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d148, dwReserved0=0x420fd28, dwReserved1=0x7189e48, cFileName="SCHEME34.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCA092~1.YOU")) returned 0x5b97b0 [0210.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.124] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", len=0x60 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned 1 [0210.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0210.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.310] CloseHandle (hObject=0x3b8) returned 1 [0215.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.id_1622540890_.your_last_chance")) returned 1 [0215.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b97b0 [0215.311] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.311] GetProcessHeap () returned 0x580000 [0215.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0215.311] GetProcessHeap () returned 0x580000 [0215.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x6c29878 [0215.311] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.311] ReadFile (in: hFile=0x3b8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x420ff14*=0xae0, lpOverlapped=0x0) returned 1 [0215.322] GetProcessHeap () returned 0x580000 [0215.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.322] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.322] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x420ff14*=0xae0, lpOverlapped=0x0) returned 1 [0215.322] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.322] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c2a357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a357*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.322] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.323] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.323] CloseHandle (hObject=0x3b8) returned 1 [0215.323] GetProcessHeap () returned 0x580000 [0215.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0215.323] GetProcessHeap () returned 0x580000 [0215.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0215.323] GetProcessHeap () returned 0x580000 [0215.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f40bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0c, dwReserved0=0x420fd28, dwReserved1=0x677cd0, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b9770 [0217.516] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.541] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", len=0x68 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned 1 [0217.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0217.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.542] CloseHandle (hObject=0x440) returned 1 [0217.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.id_1622540890_.your_last_chance")) returned 1 [0217.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b9770 [0217.543] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.543] GetProcessHeap () returned 0x580000 [0217.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6f668d8 [0217.544] GetProcessHeap () returned 0x580000 [0217.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0217.544] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.544] ReadFile (in: hFile=0x440, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x420ff14*=0xd60, lpOverlapped=0x0) returned 1 [0217.572] GetProcessHeap () returned 0x580000 [0217.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.572] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.572] WriteFile (in: hFile=0x440, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x420ff14*=0xd60, lpOverlapped=0x0) returned 1 [0217.572] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.572] WriteFile (in: hFile=0x440, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.572] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.572] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.573] CloseHandle (hObject=0x440) returned 1 [0217.573] GetProcessHeap () returned 0x580000 [0217.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0217.573] GetProcessHeap () returned 0x580000 [0217.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0217.573] GetProcessHeap () returned 0x580000 [0217.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb94ad1c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x420fd28, dwReserved1=0x6f668d8, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b9770 [0217.573] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.638] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", len=0x64 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned 1 [0217.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0217.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.004] CloseHandle (hObject=0x47c) returned 1 [0221.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.id_1622540890_.your_last_chance")) returned 1 [0221.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b97f0 [0221.005] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.005] GetProcessHeap () returned 0x580000 [0221.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.005] GetProcessHeap () returned 0x580000 [0221.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.005] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.005] ReadFile (in: hFile=0x47c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x420ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.009] GetProcessHeap () returned 0x580000 [0221.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.009] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.009] WriteFile (in: hFile=0x47c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x420ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.010] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.010] WriteFile (in: hFile=0x47c, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.010] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.010] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.010] CloseHandle (hObject=0x47c) returned 1 [0221.010] GetProcessHeap () returned 0x580000 [0221.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.010] GetProcessHeap () returned 0x580000 [0221.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.010] GetProcessHeap () returned 0x580000 [0221.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb58e1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x420fd28, dwReserved1=0x6dcfb90, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b9730 [0221.920] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.420] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned 1 [0223.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0223.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.421] CloseHandle (hObject=0x47c) returned 1 [0223.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0223.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b96f0 [0223.422] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.422] GetProcessHeap () returned 0x580000 [0223.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c79898 [0223.422] GetProcessHeap () returned 0x580000 [0223.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c79c08 [0223.422] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.422] ReadFile (in: hFile=0x47c, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x420ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.447] GetProcessHeap () returned 0x580000 [0223.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.447] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.447] WriteFile (in: hFile=0x47c, lpBuffer=0x6c79c08*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79c08*, lpNumberOfBytesWritten=0x420ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.447] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.447] WriteFile (in: hFile=0x47c, lpBuffer=0x6c79f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79f47*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.447] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.447] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.447] CloseHandle (hObject=0x47c) returned 1 [0223.465] GetProcessHeap () returned 0x580000 [0223.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79c08 | out: hHeap=0x580000) returned 1 [0223.465] GetProcessHeap () returned 0x580000 [0223.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0223.466] GetProcessHeap () returned 0x580000 [0223.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccc3820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x420fd28, dwReserved1=0x6c79898, cFileName="rtf_decreaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_DE~1.YOU")) returned 0x5b9630 [0226.016] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.069] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD", len=0x3c | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 1 [0226.069] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db8) returned 0x6dee6e0 [0226.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.110] CloseHandle (hObject=0x454) returned 1 [0226.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id_1622540890_.your_last_chance")) returned 1 [0226.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACDU~1.YOU")) returned 0x5b9630 [0226.112] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.112] GetProcessHeap () returned 0x580000 [0226.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6037d8 [0226.112] GetProcessHeap () returned 0x580000 [0226.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x603d20 [0226.112] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.112] ReadFile (in: hFile=0x454, lpBuffer=0x6037d8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6037d8*, lpNumberOfBytesRead=0x420ff14*=0x500, lpOverlapped=0x0) returned 1 [0226.158] GetProcessHeap () returned 0x580000 [0226.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.159] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.159] WriteFile (in: hFile=0x454, lpBuffer=0x603d20*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x603d20*, lpNumberOfBytesWritten=0x420ff14*=0x500, lpOverlapped=0x0) returned 1 [0226.159] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.159] WriteFile (in: hFile=0x454, lpBuffer=0x60421f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x60421f*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.159] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.159] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.159] CloseHandle (hObject=0x454) returned 1 [0226.159] GetProcessHeap () returned 0x580000 [0226.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x603d20 | out: hHeap=0x580000) returned 1 [0226.159] GetProcessHeap () returned 0x580000 [0226.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6037d8 | out: hHeap=0x580000) returned 1 [0226.159] GetProcessHeap () returned 0x580000 [0226.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbe5299a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x420fd28, dwReserved1=0x6037d8, cFileName="HVACDUCT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACDU~1.YOU")) returned 0x5b9630 [0226.159] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.179] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", len=0x34 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned 1 [0226.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da8) returned 0x6dee6e0 [0226.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0226.180] CloseHandle (hObject=0x43c) returned 1 [0226.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.id_1622540890_.your_last_chance")) returned 1 [0226.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JFONTD~1.YOU")) returned 0x5b9730 [0226.181] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0226.181] GetProcessHeap () returned 0x580000 [0226.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x49a1) returned 0x6fa99f8 [0226.181] GetProcessHeap () returned 0x580000 [0226.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x49a1) returned 0x7111f48 [0226.181] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.181] ReadFile (in: hFile=0x43c, lpBuffer=0x6fa99f8, nNumberOfBytesToRead=0x4980, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa99f8*, lpNumberOfBytesRead=0x420ff14*=0x4980, lpOverlapped=0x0) returned 1 [0227.776] GetProcessHeap () returned 0x580000 [0227.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0227.777] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.777] WriteFile (in: hFile=0x43c, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x4980, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x420ff14*=0x4980, lpOverlapped=0x0) returned 1 [0227.777] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.777] WriteFile (in: hFile=0x43c, lpBuffer=0x71168c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x71168c7*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0227.777] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.777] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0227.777] CloseHandle (hObject=0x43c) returned 1 [0227.777] GetProcessHeap () returned 0x580000 [0227.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0227.777] GetProcessHeap () returned 0x580000 [0227.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa99f8 | out: hHeap=0x580000) returned 1 [0227.777] GetProcessHeap () returned 0x580000 [0227.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf4a28a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x49c0, dwReserved0=0x420fd28, dwReserved1=0x6fa99f8, cFileName="JFONT.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JFONTD~1.YOU")) returned 0x5b9630 [0230.535] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.636] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", len=0x32 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 1 [0230.636] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0230.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0230.727] CloseHandle (hObject=0x418) returned 1 [0230.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.id_1622540890_.your_last_chance")) returned 1 [0230.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSNICO~1.YOU")) returned 0x5b9630 [0230.729] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msn.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0230.729] GetProcessHeap () returned 0x580000 [0230.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0230.729] GetProcessHeap () returned 0x580000 [0230.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6ece008 [0230.729] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.729] ReadFile (in: hFile=0x418, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x420ff14*=0xe20, lpOverlapped=0x0) returned 1 [0230.805] GetProcessHeap () returned 0x580000 [0230.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0230.805] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.805] WriteFile (in: hFile=0x418, lpBuffer=0x6ece008*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesWritten=0x420ff14*=0xe20, lpOverlapped=0x0) returned 1 [0230.806] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.806] WriteFile (in: hFile=0x418, lpBuffer=0x6ecee27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecee27*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0230.806] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.806] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0230.806] CloseHandle (hObject=0x418) returned 1 [0230.806] GetProcessHeap () returned 0x580000 [0230.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0230.806] GetProcessHeap () returned 0x580000 [0230.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0230.806] GetProcessHeap () returned 0x580000 [0230.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0230.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc117f360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x420fd28, dwReserved1=0x6c29878, cFileName="MSN.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSNICO~1.YOU")) returned 0x5b9630 [0230.807] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.857] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", len=0x36 | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 1 [0230.857] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0230.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0230.956] CloseHandle (hObject=0x468) returned 1 [0230.956] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.id_1622540890_.your_last_chance")) returned 1 [0230.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7E~2.YOU")) returned 0x5b9630 [0230.957] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7es.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0230.957] GetProcessHeap () returned 0x580000 [0230.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75f4ff8 [0230.958] GetProcessHeap () returned 0x580000 [0230.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7606828 [0230.958] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.958] ReadFile (in: hFile=0x468, lpBuffer=0x75f4ff8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x75f4ff8*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.374] GetProcessHeap () returned 0x580000 [0238.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0238.374] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.374] WriteFile (in: hFile=0x468, lpBuffer=0x7606828*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7606828*, lpNumberOfBytesWritten=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.333] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.333] WriteFile (in: hFile=0x468, lpBuffer=0x7618027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7618027*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.384] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.384] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.384] CloseHandle (hObject=0x468) returned 1 [0239.441] GetProcessHeap () returned 0x580000 [0239.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7606828 | out: hHeap=0x580000) returned 1 [0239.455] GetProcessHeap () returned 0x580000 [0239.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75f4ff8 | out: hHeap=0x580000) returned 1 [0239.456] GetProcessHeap () returned 0x580000 [0239.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0241.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc63527a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13ea16, dwReserved0=0x420fd28, dwReserved1=0x580000, cFileName="mset7es.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7E~2.YOU")) returned 0x5b9630 [0241.780] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.822] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML", len=0x3f | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned 1 [0241.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0241.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0244.559] CloseHandle (hObject=0x47c) returned 1 [0244.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml.id_1622540890_.your_last_chance")) returned 1 [0248.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c896a00, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c896a00, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1326, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN06~1.YOU")) returned 0x5b96f0 [0248.993] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0248.993] GetProcessHeap () returned 0x580000 [0248.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0248.993] GetProcessHeap () returned 0x580000 [0248.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6f19958 [0248.993] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.993] ReadFile (in: hFile=0x47c, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x420ff14*=0x1320, lpOverlapped=0x0) returned 1 [0249.020] GetProcessHeap () returned 0x580000 [0249.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0249.020] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.020] WriteFile (in: hFile=0x47c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x420ff14*=0x1320, lpOverlapped=0x0) returned 1 [0249.020] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.020] WriteFile (in: hFile=0x47c, lpBuffer=0x6f1ac77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ac77*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0249.021] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.021] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0249.021] CloseHandle (hObject=0x47c) returned 1 [0249.021] GetProcessHeap () returned 0x580000 [0249.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0249.021] GetProcessHeap () returned 0x580000 [0249.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0249.021] GetProcessHeap () returned 0x580000 [0249.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c896a00, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbf1d800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x134a, dwReserved0=0x420fd28, dwReserved1=0x67ec60, cFileName="PGMN065.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN06~1.YOU")) returned 0x5b9730 [0253.594] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.663] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML", len=0x3d | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML") returned 1 [0253.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f20) returned 0x6dee6e0 [0253.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0253.718] CloseHandle (hObject=0x170) returned 1 [0253.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml.id_1622540890_.your_last_chance")) returned 1 [0253.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147eee00, ftCreationTime.dwHighDateTime=0x1c9c48f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x147eee00, ftLastWriteTime.dwHighDateTime=0x1c9c48f, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCINF~1.YOU")) returned 0x5b9730 [0253.720] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0253.720] GetProcessHeap () returned 0x580000 [0253.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6dcfb90 [0253.720] GetProcessHeap () returned 0x580000 [0253.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6c65108 [0253.720] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.720] ReadFile (in: hFile=0x170, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x420ff14*=0x480, lpOverlapped=0x0) returned 1 [0253.751] GetProcessHeap () returned 0x580000 [0253.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.751] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.751] WriteFile (in: hFile=0x170, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x420ff14*=0x480, lpOverlapped=0x0) returned 1 [0253.752] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.752] WriteFile (in: hFile=0x170, lpBuffer=0x6c65587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65587*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0253.752] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.752] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0253.752] CloseHandle (hObject=0x170) returned 1 [0253.752] GetProcessHeap () returned 0x580000 [0253.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0253.752] GetProcessHeap () returned 0x580000 [0253.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0253.752] GetProcessHeap () returned 0x580000 [0253.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147eee00, ftCreationTime.dwHighDateTime=0x1c9c48f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec57a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x420fd28, dwReserved1=0x6dcfb90, cFileName="DGCINFO.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCINF~1.YOU")) returned 0x5b9730 [0255.014] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.061] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC", len=0x3b | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC") returned 1 [0255.061] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc8) returned 0x72e5948 [0255.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.142] CloseHandle (hObject=0x3b4) returned 1 [0255.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc.id_1622540890_.your_last_chance")) returned 1 [0255.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21183600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21183600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x10c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DVDHMP~1.YOU")) returned 0x5b9730 [0255.143] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.143] GetProcessHeap () returned 0x580000 [0255.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c41) returned 0x6e81700 [0255.144] GetProcessHeap () returned 0x580000 [0255.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c41) returned 0x7166de8 [0255.144] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.144] ReadFile (in: hFile=0x3b4, lpBuffer=0x6e81700, nNumberOfBytesToRead=0x10c20, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e81700*, lpNumberOfBytesRead=0x420ff14*=0x10c20, lpOverlapped=0x0) returned 1 [0258.250] GetProcessHeap () returned 0x580000 [0258.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0258.250] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.250] WriteFile (in: hFile=0x3b4, lpBuffer=0x7166de8*, nNumberOfBytesToWrite=0x10c20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7166de8*, lpNumberOfBytesWritten=0x420ff14*=0x10c20, lpOverlapped=0x0) returned 1 [0258.251] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.251] WriteFile (in: hFile=0x3b4, lpBuffer=0x7177a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x7177a07*, lpNumberOfBytesWritten=0x420ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.251] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.251] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x420ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.251] CloseHandle (hObject=0x3b4) returned 1 [0258.430] GetProcessHeap () returned 0x580000 [0258.430] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7166de8 | out: hHeap=0x580000) returned 1 [0258.430] GetProcessHeap () returned 0x580000 [0258.430] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e81700 | out: hHeap=0x580000) returned 1 [0258.431] GetProcessHeap () returned 0x580000 [0258.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0259.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fccc | out: lpFindFileData=0x420fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21183600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1730600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10c58, dwReserved0=0x420fd28, dwReserved1=0x6e81700, cFileName="DVDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DVDHMP~1.YOU")) returned 0x5b9630 [0259.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.233] SysReAllocStringLen (in: pbstr=0x420ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC", len=0x3e | out: pbstr=0x420ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC") returned 1 [0259.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b8) returned 0x72e5948 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0259.375] CloseHandle (hObject=0x418) returned 1 [0259.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc.id_1622540890_.your_last_chance")) returned 1 [0259.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x420ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x420fc74 | out: lpFindFileData=0x420fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBCALSO.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBCAL~1.YOU")) returned 0x5b9630 [0259.376] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0259.377] GetProcessHeap () returned 0x580000 [0259.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8a640 [0259.377] GetProcessHeap () returned 0x580000 [0259.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x719b678 [0259.378] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.378] ReadFile (in: hFile=0x418, lpBuffer=0x6e8a640, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x420ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a640*, lpNumberOfBytesRead=0x420ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 30 os_tid = 0xa70 [0039.064] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.282] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.744] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.313] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.114] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.204] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.730] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.479] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.510] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.962] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.103] Sleep (dwMilliseconds=0x1) [0045.118] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.243] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.321] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.352] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.415] Sleep (dwMilliseconds=0x1) [0045.430] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.555] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.914] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.961] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.070] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.179] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.226] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.304] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.586] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.616] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.850] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.005] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.177] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.364] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.520] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.583] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.707] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.910] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.019] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.487] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.612] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.643] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.846] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.971] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.113] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.314] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.441] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.626] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.704] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.798] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.831] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.907] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.032] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.406] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.454] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.718] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.827] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.983] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.295] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.373] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.498] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.824] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.902] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.964] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.042] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.073] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.120] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.229] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.354] Sleep (dwMilliseconds=0x1) [0052.370] Sleep (dwMilliseconds=0x1) [0052.385] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.604] Sleep (dwMilliseconds=0x1) [0052.619] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.838] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.978] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.056] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.111] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.368] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.446] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.587] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.649] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.914] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.992] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.070] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.226] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.538] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.616] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.694] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.741] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.897] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.928] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.006] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.038] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.162] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.287] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.318] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.474] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.535] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Boot\\BCD.LOG", len=0xf | out: pbstr=0x434ff84*="C:\\Boot\\BCD.LOG") returned 1 [0055.535] GetProcessHeap () returned 0x580000 [0055.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9588 [0055.535] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.535] Sleep (dwMilliseconds=0x1) [0055.545] Sleep (dwMilliseconds=0x1) [0055.596] Sleep (dwMilliseconds=0x1) [0055.653] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.749] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x434ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0061.749] GetProcessHeap () returned 0x580000 [0061.749] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x60) returned 0x5b5bc8 [0061.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0063.323] CloseHandle (hObject=0x478) returned 1 [0063.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0063.324] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance")) returned 1 [0066.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.405] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0066.405] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.405] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0066.405] GetProcessHeap () returned 0x580000 [0066.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f8d9a0 [0066.405] GetProcessHeap () returned 0x580000 [0066.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6d0c508 [0066.405] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.406] ReadFile (in: hFile=0x478, lpBuffer=0x6f8d9a0, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d9a0*, lpNumberOfBytesRead=0x434ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0066.421] GetProcessHeap () returned 0x580000 [0066.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0066.422] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.422] WriteFile (in: hFile=0x478, lpBuffer=0x6d0c508*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0c508*, lpNumberOfBytesWritten=0x434ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0066.422] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.422] WriteFile (in: hFile=0x478, lpBuffer=0x6d0d5a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0d5a7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.422] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.422] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.422] CloseHandle (hObject=0x478) returned 1 [0066.423] GetProcessHeap () returned 0x580000 [0066.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0c508 | out: hHeap=0x580000) returned 1 [0066.423] GetProcessHeap () returned 0x580000 [0066.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f8d9a0 | out: hHeap=0x580000) returned 1 [0066.423] GetProcessHeap () returned 0x580000 [0066.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0066.491] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0x5f54baa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d6, dwReserved0=0x434fd28, dwReserved1=0x6f8d9a0, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0066.491] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.503] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x434ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0066.504] GetProcessHeap () returned 0x580000 [0066.504] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x34) returned 0x5e9710 [0066.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0073.759] CloseHandle (hObject=0x49c) returned 1 [0073.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.760] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0075.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.533] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0075.533] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.533] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0075.533] GetProcessHeap () returned 0x580000 [0075.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x65d4c0 [0075.534] GetProcessHeap () returned 0x580000 [0075.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x662550 [0075.534] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.534] ReadFile (in: hFile=0x498, lpBuffer=0x65d4c0, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x65d4c0*, lpNumberOfBytesRead=0x434ff14*=0x5060, lpOverlapped=0x0) returned 1 [0076.197] GetProcessHeap () returned 0x580000 [0076.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0076.197] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] WriteFile (in: hFile=0x498, lpBuffer=0x662550*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x662550*, lpNumberOfBytesWritten=0x434ff14*=0x5060, lpOverlapped=0x0) returned 1 [0076.197] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] WriteFile (in: hFile=0x498, lpBuffer=0x6675af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6675af*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0076.197] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0076.198] CloseHandle (hObject=0x498) returned 1 [0076.198] GetProcessHeap () returned 0x580000 [0076.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662550 | out: hHeap=0x580000) returned 1 [0076.200] GetProcessHeap () returned 0x580000 [0076.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d4c0 | out: hHeap=0x580000) returned 1 [0076.200] GetProcessHeap () returned 0x580000 [0076.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0079.342] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x6507e580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5085, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0079.342] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.473] Sleep (dwMilliseconds=0x1) [0084.494] Sleep (dwMilliseconds=0x1) [0084.518] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", len=0x44 | out: pbstr=0x434ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 1 [0084.519] GetProcessHeap () returned 0x580000 [0084.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0084.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0084.524] CloseHandle (hObject=0x478) returned 1 [0084.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.524] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id_1622540890_.your_last_chance")) returned 1 [0084.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METCON~1.YOU")) returned 0x5b9630 [0084.553] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0084.553] GetProcessHeap () returned 0x580000 [0084.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d198d8 [0084.554] GetProcessHeap () returned 0x580000 [0084.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0084.554] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.555] ReadFile (in: hFile=0x478, lpBuffer=0x6d198d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d198d8*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.174] GetProcessHeap () returned 0x580000 [0086.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0086.175] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.175] WriteFile (in: hFile=0x478, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.176] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.176] WriteFile (in: hFile=0x478, lpBuffer=0x6cf6ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ca7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.197] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.197] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.197] CloseHandle (hObject=0x478) returned 1 [0086.198] GetProcessHeap () returned 0x580000 [0086.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0086.206] GetProcessHeap () returned 0x580000 [0086.206] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d198d8 | out: hHeap=0x580000) returned 1 [0086.207] GetProcessHeap () returned 0x580000 [0086.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0086.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6afdb6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x120edc, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="METCONV.TXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METCON~1.YOU")) returned 0x5b9630 [0086.207] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.361] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x434ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 1 [0088.361] GetProcessHeap () returned 0x580000 [0088.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0088.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0091.442] CloseHandle (hObject=0x428) returned 1 [0091.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.248] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0100.222] GetProcessHeap () returned 0x580000 [0100.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6f0c4f8 [0100.525] GetProcessHeap () returned 0x580000 [0100.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6037d8 [0100.525] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.525] ReadFile (in: hFile=0x474, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x434ff14*=0x500, lpOverlapped=0x0) returned 1 [0100.531] GetProcessHeap () returned 0x580000 [0100.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0100.531] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.531] WriteFile (in: hFile=0x474, lpBuffer=0x6037d8*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6037d8*, lpNumberOfBytesWritten=0x434ff14*=0x500, lpOverlapped=0x0) returned 1 [0100.532] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.532] WriteFile (in: hFile=0x474, lpBuffer=0x603cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x603cd7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.532] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.532] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.532] CloseHandle (hObject=0x474) returned 1 [0101.046] GetProcessHeap () returned 0x580000 [0101.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6037d8 | out: hHeap=0x580000) returned 1 [0101.046] GetProcessHeap () returned 0x580000 [0101.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0101.046] GetProcessHeap () returned 0x580000 [0101.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73894680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x52b, dwReserved0=0x434fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.842] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.884] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", len=0x4e | out: pbstr=0x434ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 1 [0106.884] GetProcessHeap () returned 0x580000 [0106.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e92e8 [0106.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0107.196] CloseHandle (hObject=0x454) returned 1 [0107.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id_1622540890_.your_last_chance")) returned 1 [0107.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHINES~1.YOU")) returned 0x5b9630 [0107.198] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0107.198] GetProcessHeap () returned 0x580000 [0107.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ecf008 [0107.199] GetProcessHeap () returned 0x580000 [0107.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ee0838 [0107.199] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.199] ReadFile (in: hFile=0x454, lpBuffer=0x6ecf008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf008*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.657] GetProcessHeap () returned 0x580000 [0111.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0111.657] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.657] WriteFile (in: hFile=0x454, lpBuffer=0x6ee0838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ee0838*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.657] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.657] WriteFile (in: hFile=0x454, lpBuffer=0x6ef2037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2037*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.760] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.760] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.760] CloseHandle (hObject=0x454) returned 1 [0111.760] GetProcessHeap () returned 0x580000 [0111.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ee0838 | out: hHeap=0x580000) returned 1 [0111.760] GetProcessHeap () returned 0x580000 [0111.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf008 | out: hHeap=0x580000) returned 1 [0111.760] GetProcessHeap () returned 0x580000 [0111.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0111.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a3b2480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa2641, dwReserved0=0x434fd28, dwReserved1=0x6ecf008, cFileName="CHINESET.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHINES~1.YOU")) returned 0x5b95f0 [0111.761] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0111.976] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", len=0x49 | out: pbstr=0x434ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 1 [0111.976] GetProcessHeap () returned 0x580000 [0111.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x48) returned 0x596cd8 [0111.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.976] Sleep (dwMilliseconds=0x1) [0112.131] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", len=0x48 | out: pbstr=0x434ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned 1 [0112.132] GetProcessHeap () returned 0x580000 [0112.132] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.132] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.139] Sleep (dwMilliseconds=0x1) [0112.220] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", len=0x57 | out: pbstr=0x434ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.220] GetProcessHeap () returned 0x580000 [0112.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.221] Sleep (dwMilliseconds=0x1) [0112.239] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", len=0x4e | out: pbstr=0x434ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 1 [0112.239] GetProcessHeap () returned 0x580000 [0112.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f880 [0112.239] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.249] Sleep (dwMilliseconds=0x1) [0112.364] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", len=0x48 | out: pbstr=0x434ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png") returned 1 [0112.364] GetProcessHeap () returned 0x580000 [0112.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8b8, Size=0x2c) returned 0x61f880 [0112.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.386] Sleep (dwMilliseconds=0x1) [0113.311] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", len=0x3f | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 1 [0113.311] GetProcessHeap () returned 0x580000 [0113.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x100) returned 0x6f0ceb8 [0113.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0113.496] CloseHandle (hObject=0x428) returned 1 [0113.496] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~3.YOU")) returned 0x5b9630 [0115.082] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0115.082] GetProcessHeap () returned 0x580000 [0115.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x677cd0 [0115.082] GetProcessHeap () returned 0x580000 [0115.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x635768 [0115.082] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.083] ReadFile (in: hFile=0x428, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x434ff14*=0xc40, lpOverlapped=0x0) returned 1 [0115.094] GetProcessHeap () returned 0x580000 [0115.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.094] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.095] WriteFile (in: hFile=0x428, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x434ff14*=0xc40, lpOverlapped=0x0) returned 1 [0115.095] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.095] WriteFile (in: hFile=0x428, lpBuffer=0x6363a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6363a7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.095] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.095] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.095] CloseHandle (hObject=0x428) returned 1 [0115.095] GetProcessHeap () returned 0x580000 [0115.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0115.095] GetProcessHeap () returned 0x580000 [0115.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0115.095] GetProcessHeap () returned 0x580000 [0115.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c362960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc6c, dwReserved0=0x434fd28, dwReserved1=0x677cd0, cFileName="AN04196_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~3.YOU")) returned 0x5b9630 [0116.230] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.318] CloseHandle (hObject=0x428) returned 1 [0116.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.318] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0104~2.YOU")) returned 0x5b9630 [0116.319] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.319] GetProcessHeap () returned 0x580000 [0116.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xce1) returned 0x635768 [0116.319] GetProcessHeap () returned 0x580000 [0116.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xce1) returned 0x6d10048 [0116.319] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.319] ReadFile (in: hFile=0x428, lpBuffer=0x635768, nNumberOfBytesToRead=0xcc0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x434ff14*=0xcc0, lpOverlapped=0x0) returned 1 [0116.332] GetProcessHeap () returned 0x580000 [0116.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.332] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.332] WriteFile (in: hFile=0x428, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x434ff14*=0xcc0, lpOverlapped=0x0) returned 1 [0116.332] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.332] WriteFile (in: hFile=0x428, lpBuffer=0x6d10d07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10d07*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.332] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.332] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.332] CloseHandle (hObject=0x428) returned 1 [0116.332] GetProcessHeap () returned 0x580000 [0116.332] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0116.332] GetProcessHeap () returned 0x580000 [0116.332] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0116.332] GetProcessHeap () returned 0x580000 [0116.332] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cf49760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x434fd28, dwReserved1=0x635768, cFileName="SL01040_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0104~2.YOU")) returned 0x5b9630 [0116.332] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0116.358] CloseHandle (hObject=0x450) returned 1 [0116.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0028~1.YOU")) returned 0x5b9730 [0116.359] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0116.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0116.360] GetProcessHeap () returned 0x580000 [0116.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x6f151b8 [0116.360] GetProcessHeap () returned 0x580000 [0116.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x6de0f50 [0116.360] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.360] ReadFile (in: hFile=0x450, lpBuffer=0x6f151b8, nNumberOfBytesToRead=0x1da0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f151b8*, lpNumberOfBytesRead=0x434ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0117.258] GetProcessHeap () returned 0x580000 [0117.258] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.259] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.259] WriteFile (in: hFile=0x450, lpBuffer=0x6de0f50*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesWritten=0x434ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0117.259] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.259] WriteFile (in: hFile=0x450, lpBuffer=0x6de2cef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de2cef*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.259] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.259] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.259] CloseHandle (hObject=0x450) returned 1 [0117.259] GetProcessHeap () returned 0x580000 [0117.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0117.259] GetProcessHeap () returned 0x580000 [0117.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f151b8 | out: hHeap=0x580000) returned 1 [0117.259] GetProcessHeap () returned 0x580000 [0117.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0119.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d810880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x434fd28, dwReserved1=0x6f151b8, cFileName="SL00286_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0028~1.YOU")) returned 0x5b9630 [0119.027] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.067] CloseHandle (hObject=0x170) returned 1 [0119.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0205~1.YOU")) returned 0x5b9630 [0119.068] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.068] GetProcessHeap () returned 0x580000 [0119.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c61) returned 0x6ef7ca8 [0119.068] GetProcessHeap () returned 0x580000 [0119.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c61) returned 0x6efc918 [0119.069] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.069] ReadFile (in: hFile=0x170, lpBuffer=0x6ef7ca8, nNumberOfBytesToRead=0x4c40, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7ca8*, lpNumberOfBytesRead=0x434ff14*=0x4c40, lpOverlapped=0x0) returned 1 [0119.514] GetProcessHeap () returned 0x580000 [0119.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0119.514] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.514] WriteFile (in: hFile=0x170, lpBuffer=0x6efc918*, nNumberOfBytesToWrite=0x4c40, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc918*, lpNumberOfBytesWritten=0x434ff14*=0x4c40, lpOverlapped=0x0) returned 1 [0119.515] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.515] WriteFile (in: hFile=0x170, lpBuffer=0x6f01557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f01557*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.515] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.515] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.515] CloseHandle (hObject=0x170) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efc918 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef7ca8 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0120.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7eda2fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c70, dwReserved0=0x434fd28, dwReserved1=0x6ef7ca8, cFileName="SO02055_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0205~1.YOU")) returned 0x5b96f0 [0120.133] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.156] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", len=0x4c | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 1 [0120.156] GetProcessHeap () returned 0x580000 [0120.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1798) returned 0x6d06ca8 [0120.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.471] CloseHandle (hObject=0x460) returned 1 [0120.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.471] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.id_1622540890_.your_last_chance")) returned 1 [0120.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0051~1.YOU")) returned 0x5b9630 [0120.472] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.472] GetProcessHeap () returned 0x580000 [0120.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1261) returned 0x67ec60 [0120.472] GetProcessHeap () returned 0x580000 [0120.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1261) returned 0x6f19958 [0120.472] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.472] ReadFile (in: hFile=0x460, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1240, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x434ff14*=0x1240, lpOverlapped=0x0) returned 1 [0120.489] GetProcessHeap () returned 0x580000 [0120.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.489] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.489] WriteFile (in: hFile=0x460, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x434ff14*=0x1240, lpOverlapped=0x0) returned 1 [0120.489] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.489] WriteFile (in: hFile=0x460, lpBuffer=0x6f1ab97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ab97*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.489] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.489] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.489] CloseHandle (hObject=0x460) returned 1 [0120.490] GetProcessHeap () returned 0x580000 [0120.490] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0120.490] GetProcessHeap () returned 0x580000 [0120.490] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0120.490] GetProcessHeap () returned 0x580000 [0120.490] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f6dc520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x126e, dwReserved0=0x434fd28, dwReserved1=0x67ec60, cFileName="WB00516L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0051~1.YOU")) returned 0x5b9630 [0120.490] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.569] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", len=0x4b | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned 1 [0120.569] GetProcessHeap () returned 0x580000 [0120.569] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1864) returned 0x6e00ac0 [0120.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0121.658] CloseHandle (hObject=0x4a8) returned 1 [0121.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.id_1622540890_.your_last_chance")) returned 1 [0122.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x45, dwReserved1=0x0, cFileName="Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEX~1.YOU")) returned 0x5b9730 [0122.233] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0122.233] GetProcessHeap () returned 0x580000 [0122.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.233] GetProcessHeap () returned 0x580000 [0122.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.233] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.233] ReadFile (in: hFile=0x4a8, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x434ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.238] GetProcessHeap () returned 0x580000 [0122.238] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.238] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.238] WriteFile (in: hFile=0x4a8, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x434ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.238] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.238] WriteFile (in: hFile=0x4a8, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.238] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.238] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.238] CloseHandle (hObject=0x4a8) returned 1 [0122.238] GetProcessHeap () returned 0x580000 [0122.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.238] GetProcessHeap () returned 0x580000 [0122.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.238] GetProcessHeap () returned 0x580000 [0122.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80785f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x434fd28, dwReserved1=0x678958, cFileName="Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEX~1.YOU")) returned 0x5b9730 [0124.421] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.086] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", len=0x4d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 1 [0125.086] GetProcessHeap () returned 0x580000 [0125.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1884) returned 0x6f42f08 [0125.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0125.091] CloseHandle (hObject=0x428) returned 1 [0125.128] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.128] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METROE~1.YOU")) returned 0x5b9730 [0125.129] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0125.129] GetProcessHeap () returned 0x580000 [0125.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e41) returned 0x658e60 [0125.129] GetProcessHeap () returned 0x580000 [0125.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e41) returned 0x6dcaa10 [0125.129] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.129] ReadFile (in: hFile=0x428, lpBuffer=0x658e60, nNumberOfBytesToRead=0x5e20, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x658e60*, lpNumberOfBytesRead=0x434ff14*=0x5e20, lpOverlapped=0x0) returned 1 [0125.952] GetProcessHeap () returned 0x580000 [0125.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.952] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.952] WriteFile (in: hFile=0x428, lpBuffer=0x6dcaa10*, nNumberOfBytesToWrite=0x5e20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcaa10*, lpNumberOfBytesWritten=0x434ff14*=0x5e20, lpOverlapped=0x0) returned 1 [0125.953] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.953] WriteFile (in: hFile=0x428, lpBuffer=0x6dd082f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd082f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.953] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.953] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.953] CloseHandle (hObject=0x428) returned 1 [0127.002] GetProcessHeap () returned 0x580000 [0127.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcaa10 | out: hHeap=0x580000) returned 1 [0127.002] GetProcessHeap () returned 0x580000 [0127.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658e60 | out: hHeap=0x580000) returned 1 [0127.002] GetProcessHeap () returned 0x580000 [0127.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0127.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82aee660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5e59, dwReserved0=0x434fd28, dwReserved1=0x658e60, cFileName="Metro.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="METROE~1.YOU")) returned 0x5b9730 [0127.002] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.452] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", len=0x3d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned 1 [0127.452] GetProcessHeap () returned 0x580000 [0127.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c0) returned 0x667250 [0127.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0128.694] CloseHandle (hObject=0x454) returned 1 [0128.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.id_1622540890_.your_last_chance")) returned 1 [0128.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02995~1.YOU")) returned 0x5b96f0 [0128.695] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0128.695] GetProcessHeap () returned 0x580000 [0128.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x62e1) returned 0x6dc0a00 [0128.695] GetProcessHeap () returned 0x580000 [0128.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x62e1) returned 0x6dc6cf0 [0128.695] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.695] ReadFile (in: hFile=0x454, lpBuffer=0x6dc0a00, nNumberOfBytesToRead=0x62c0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesRead=0x434ff14*=0x62c0, lpOverlapped=0x0) returned 1 [0128.965] GetProcessHeap () returned 0x580000 [0128.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0128.965] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.965] WriteFile (in: hFile=0x454, lpBuffer=0x6dc6cf0*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc6cf0*, lpNumberOfBytesWritten=0x434ff14*=0x62c0, lpOverlapped=0x0) returned 1 [0128.965] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.965] WriteFile (in: hFile=0x454, lpBuffer=0x6dccfaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dccfaf*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.965] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.966] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.966] CloseHandle (hObject=0x454) returned 1 [0129.059] GetProcessHeap () returned 0x580000 [0129.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc6cf0 | out: hHeap=0x580000) returned 1 [0129.059] GetProcessHeap () returned 0x580000 [0129.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0129.067] GetProcessHeap () returned 0x580000 [0129.067] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x847cb120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x62ec, dwReserved0=0x580000, dwReserved1=0x6f3db80, cFileName="J0299587.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02995~1.YOU")) returned 0x5b9730 [0129.476] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.496] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", len=0x43 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned 1 [0129.513] GetProcessHeap () returned 0x580000 [0129.513] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0129.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0129.529] CloseHandle (hObject=0x3fc) returned 1 [0129.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.id_1622540890_.your_last_chance")) returned 1 [0129.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93911d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x93911d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2151~1.YOU")) returned 0x5b9630 [0129.530] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0129.530] GetProcessHeap () returned 0x580000 [0129.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0129.531] GetProcessHeap () returned 0x580000 [0129.531] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6f04558 [0129.531] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.531] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x434ff14*=0x340, lpOverlapped=0x0) returned 1 [0129.535] GetProcessHeap () returned 0x580000 [0129.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.535] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.535] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f04558*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesWritten=0x434ff14*=0x340, lpOverlapped=0x0) returned 1 [0129.535] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.535] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f04897*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04897*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.535] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.535] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.535] CloseHandle (hObject=0x3fc) returned 1 [0129.535] GetProcessHeap () returned 0x580000 [0129.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0129.535] GetProcessHeap () returned 0x580000 [0129.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0129.535] GetProcessHeap () returned 0x580000 [0129.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93911d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84d262a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x371, dwReserved0=0x434fd28, dwReserved1=0x6c65108, cFileName="BD21512_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2151~1.YOU")) returned 0x5b9730 [0129.701] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0130.270] CloseHandle (hObject=0x3b4) returned 1 [0130.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0130.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0130.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~1.YOU")) returned 0x5b9730 [0130.278] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0130.279] GetProcessHeap () returned 0x580000 [0130.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0130.279] GetProcessHeap () returned 0x580000 [0130.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0130.279] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.279] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x434ff14*=0x260, lpOverlapped=0x0) returned 1 [0130.310] GetProcessHeap () returned 0x580000 [0130.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.311] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.311] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x434ff14*=0x260, lpOverlapped=0x0) returned 1 [0130.311] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.311] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.311] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.311] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.311] CloseHandle (hObject=0x3b4) returned 1 [0131.779] GetProcessHeap () returned 0x580000 [0131.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0131.779] GetProcessHeap () returned 0x580000 [0131.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0131.780] GetProcessHeap () returned 0x580000 [0131.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0131.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x85496760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x434fd28, dwReserved1=0x6d08520, cFileName="GRAPH_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~1.YOU")) returned 0x5b9730 [0132.641] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0135.359] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", len=0x43 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned 1 [0135.359] GetProcessHeap () returned 0x580000 [0135.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0135.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.426] CloseHandle (hObject=0x488) returned 1 [0135.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a537400, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a537400, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2134~2.YOU")) returned 0x5b96b0 [0135.427] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.427] GetProcessHeap () returned 0x580000 [0135.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd00e8 [0135.427] GetProcessHeap () returned 0x580000 [0135.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd0198 [0135.427] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.427] ReadFile (in: hFile=0x488, lpBuffer=0x6dd00e8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd00e8*, lpNumberOfBytesRead=0x434ff14*=0x80, lpOverlapped=0x0) returned 1 [0135.428] GetProcessHeap () returned 0x580000 [0135.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.428] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.428] WriteFile (in: hFile=0x488, lpBuffer=0x6dd0198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0198*, lpNumberOfBytesWritten=0x434ff14*=0x80, lpOverlapped=0x0) returned 1 [0135.428] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.428] WriteFile (in: hFile=0x488, lpBuffer=0x6dd0217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0217*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.429] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.429] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.429] CloseHandle (hObject=0x488) returned 1 [0135.429] GetProcessHeap () returned 0x580000 [0135.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd0198 | out: hHeap=0x580000) returned 1 [0135.429] GetProcessHeap () returned 0x580000 [0135.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd00e8 | out: hHeap=0x580000) returned 1 [0135.429] GetProcessHeap () returned 0x580000 [0135.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a537400, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88562a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba, dwReserved0=0x434fd28, dwReserved1=0x6dd00e8, cFileName="BD21340_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2134~2.YOU")) returned 0x5b96b0 [0135.429] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.833] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", len=0x59 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css") returned 1 [0135.833] GetProcessHeap () returned 0x580000 [0135.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.836] CloseHandle (hObject=0x484) returned 1 [0135.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance")) returned 1 [0135.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b96b0 [0135.837] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.837] GetProcessHeap () returned 0x580000 [0135.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x6c29878 [0135.837] GetProcessHeap () returned 0x580000 [0135.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x6dd7c30 [0135.837] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.837] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x434ff14*=0xc20, lpOverlapped=0x0) returned 1 [0135.849] GetProcessHeap () returned 0x580000 [0135.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0135.849] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x484, lpBuffer=0x6dd7c30*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesWritten=0x434ff14*=0xc20, lpOverlapped=0x0) returned 1 [0135.849] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x484, lpBuffer=0x6dd884f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd884f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.849] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.849] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.850] CloseHandle (hObject=0x484) returned 1 [0135.850] GetProcessHeap () returned 0x580000 [0135.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0135.850] GetProcessHeap () returned 0x580000 [0135.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0135.850] GetProcessHeap () returned 0x580000 [0135.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0135.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88966f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x434fd28, dwReserved1=0x6c29878, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b96b0 [0135.850] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.361] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", len=0x59 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css") returned 1 [0136.361] GetProcessHeap () returned 0x580000 [0136.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0136.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.362] CloseHandle (hObject=0x484) returned 1 [0136.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance")) returned 1 [0136.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b96b0 [0136.363] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.363] GetProcessHeap () returned 0x580000 [0136.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6c29878 [0136.363] GetProcessHeap () returned 0x580000 [0136.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6dd7c30 [0136.363] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.363] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x434ff14*=0xd00, lpOverlapped=0x0) returned 1 [0136.376] GetProcessHeap () returned 0x580000 [0136.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0136.376] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.376] WriteFile (in: hFile=0x484, lpBuffer=0x6dd7c30*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesWritten=0x434ff14*=0xd00, lpOverlapped=0x0) returned 1 [0136.376] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.376] WriteFile (in: hFile=0x484, lpBuffer=0x6dd892f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd892f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0136.376] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.377] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0136.377] CloseHandle (hObject=0x484) returned 1 [0136.377] GetProcessHeap () returned 0x580000 [0136.377] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0136.377] GetProcessHeap () returned 0x580000 [0136.377] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0136.377] GetProcessHeap () returned 0x580000 [0136.377] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0136.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e75e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd27, dwReserved0=0x434fd28, dwReserved1=0x6c29878, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b96b0 [0136.377] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.391] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", len=0x60 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned 1 [0136.391] GetProcessHeap () returned 0x580000 [0136.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0136.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0138.485] CloseHandle (hObject=0x438) returned 1 [0138.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0138.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b96b0 [0138.486] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0138.486] GetProcessHeap () returned 0x580000 [0138.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0138.486] GetProcessHeap () returned 0x580000 [0138.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0138.486] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.486] ReadFile (in: hFile=0x438, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x434ff14*=0xa0, lpOverlapped=0x0) returned 1 [0138.487] GetProcessHeap () returned 0x580000 [0138.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0138.487] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.487] WriteFile (in: hFile=0x438, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x434ff14*=0xa0, lpOverlapped=0x0) returned 1 [0138.488] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.488] WriteFile (in: hFile=0x438, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.488] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.488] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.488] CloseHandle (hObject=0x438) returned 1 [0138.488] GetProcessHeap () returned 0x580000 [0138.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0138.488] GetProcessHeap () returned 0x580000 [0138.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0138.488] GetProcessHeap () returned 0x580000 [0138.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0138.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x434fd28, dwReserved1=0x60e978, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b96b0 [0138.488] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.511] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", len=0x43 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned 1 [0138.511] GetProcessHeap () returned 0x580000 [0138.511] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0138.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.580] CloseHandle (hObject=0x4a0) returned 1 [0139.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d745b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3d745b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x901, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~2.YOU")) returned 0x5b97b0 [0139.581] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.581] GetProcessHeap () returned 0x580000 [0139.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6cf6cf0 [0139.581] GetProcessHeap () returned 0x580000 [0139.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6cf7678 [0139.581] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.581] ReadFile (in: hFile=0x4a0, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x434ff14*=0x900, lpOverlapped=0x0) returned 1 [0139.591] GetProcessHeap () returned 0x580000 [0139.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.591] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.591] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cf7678*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7678*, lpNumberOfBytesWritten=0x434ff14*=0x900, lpOverlapped=0x0) returned 1 [0139.591] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.591] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cf7f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7f77*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.591] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.591] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.591] CloseHandle (hObject=0x4a0) returned 1 [0139.591] GetProcessHeap () returned 0x580000 [0139.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf7678 | out: hHeap=0x580000) returned 1 [0139.592] GetProcessHeap () returned 0x580000 [0139.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0139.592] GetProcessHeap () returned 0x580000 [0139.592] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d745b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ad1b980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x925, dwReserved0=0x434fd28, dwReserved1=0x6cf6cf0, cFileName="BD21311_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~2.YOU")) returned 0x5b9770 [0140.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.170] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", len=0x5a | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css") returned 1 [0140.170] GetProcessHeap () returned 0x580000 [0140.170] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0140.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.200] CloseHandle (hObject=0x3a8) returned 1 [0140.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.200] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.id_1622540890_.your_last_chance")) returned 1 [0140.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~1.YOU")) returned 0x5b9770 [0140.201] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.201] GetProcessHeap () returned 0x580000 [0140.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dce698 [0140.201] GetProcessHeap () returned 0x580000 [0140.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dce7b0 [0140.201] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.201] ReadFile (in: hFile=0x3a8, lpBuffer=0x6dce698, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce698*, lpNumberOfBytesRead=0x434ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.203] GetProcessHeap () returned 0x580000 [0140.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce8c8 [0140.203] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.203] WriteFile (in: hFile=0x3a8, lpBuffer=0x6dce7b0*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce7b0*, lpNumberOfBytesWritten=0x434ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.203] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.203] WriteFile (in: hFile=0x3a8, lpBuffer=0x6dce88f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce88f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.203] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.203] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.204] CloseHandle (hObject=0x3a8) returned 1 [0140.204] GetProcessHeap () returned 0x580000 [0140.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce7b0 | out: hHeap=0x580000) returned 1 [0140.204] GetProcessHeap () returned 0x580000 [0140.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce698 | out: hHeap=0x580000) returned 1 [0140.204] GetProcessHeap () returned 0x580000 [0140.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce8c8 | out: hHeap=0x580000) returned 1 [0140.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b2e8f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11b, dwReserved0=0x434fd28, dwReserved1=0x6dce698, cFileName="Solutions_Doc.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~1.YOU")) returned 0x5b9770 [0140.490] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.802] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK", len=0x3f | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 1 [0140.802] GetProcessHeap () returned 0x580000 [0140.802] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0140.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.802] CloseHandle (hObject=0x448) returned 1 [0140.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~2.YOU")) returned 0x5b9730 [0140.804] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.804] GetProcessHeap () returned 0x580000 [0140.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.804] GetProcessHeap () returned 0x580000 [0140.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.804] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.804] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x434ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.805] GetProcessHeap () returned 0x580000 [0140.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.805] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x434ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.805] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.805] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.805] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.805] CloseHandle (hObject=0x448) returned 1 [0140.806] GetProcessHeap () returned 0x580000 [0140.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.806] GetProcessHeap () returned 0x580000 [0140.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.806] GetProcessHeap () returned 0x580000 [0140.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b890360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x434fd28, dwReserved1=0x61b540, cFileName="MSOUC_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~2.YOU")) returned 0x5b9730 [0140.806] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.806] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT", len=0x3d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 1 [0140.806] GetProcessHeap () returned 0x580000 [0140.806] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0140.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.807] CloseHandle (hObject=0x448) returned 1 [0140.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0140.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~3.YOU")) returned 0x5b9730 [0140.808] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.809] GetProcessHeap () returned 0x580000 [0140.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0140.809] GetProcessHeap () returned 0x580000 [0140.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0140.809] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.809] ReadFile (in: hFile=0x448, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x434ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.810] GetProcessHeap () returned 0x580000 [0140.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.810] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.810] WriteFile (in: hFile=0x448, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x434ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.810] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.811] WriteFile (in: hFile=0x448, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.811] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.811] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.811] CloseHandle (hObject=0x448) returned 1 [0140.811] GetProcessHeap () returned 0x580000 [0140.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0140.811] GetProcessHeap () returned 0x580000 [0140.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0140.811] GetProcessHeap () returned 0x580000 [0140.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b8b64c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x434fd28, dwReserved1=0x5ad8a0, cFileName="MSOUC_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~3.YOU")) returned 0x5b9730 [0140.811] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.822] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL", len=0x37 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 1 [0140.822] GetProcessHeap () returned 0x580000 [0140.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0140.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.823] CloseHandle (hObject=0x478) returned 1 [0140.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id_1622540890_.your_last_chance")) returned 1 [0140.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x589e0a00, ftLastWriteTime.dwHighDateTime=0x1c99224, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b96f0 [0140.824] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0140.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.824] GetProcessHeap () returned 0x580000 [0140.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x93a1) returned 0x6de0f50 [0140.825] GetProcessHeap () returned 0x580000 [0140.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x93a1) returned 0x6dbf1d0 [0140.825] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x478, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x9380, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x434ff14*=0x9380, lpOverlapped=0x0) returned 1 [0141.449] GetProcessHeap () returned 0x580000 [0141.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0141.449] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.449] WriteFile (in: hFile=0x478, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0x9380, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x434ff14*=0x9380, lpOverlapped=0x0) returned 1 [0141.450] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.450] WriteFile (in: hFile=0x478, lpBuffer=0x6dc854f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc854f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.450] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.450] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.450] CloseHandle (hObject=0x478) returned 1 [0142.195] GetProcessHeap () returned 0x580000 [0142.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0142.195] GetProcessHeap () returned 0x580000 [0142.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0142.195] GetProcessHeap () returned 0x580000 [0142.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0146.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8becfd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x93a6, dwReserved0=0x434fd28, dwReserved1=0x6de0f50, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b96f0 [0146.545] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.689] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS", len=0x45 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS") returned 1 [0146.689] GetProcessHeap () returned 0x580000 [0146.689] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0146.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0146.720] CloseHandle (hObject=0x4ac) returned 1 [0146.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css.id_1622540890_.your_last_chance")) returned 1 [0146.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c1eb00, ftCreationTime.dwHighDateTime=0x1c69597, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67c1eb00, ftLastWriteTime.dwHighDateTime=0x1c69597, nFileSizeHigh=0x0, nFileSizeLow=0x1f064, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~2.YOU")) returned 0x5b96f0 [0146.721] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0146.721] GetProcessHeap () returned 0x580000 [0146.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e4c490 [0146.722] GetProcessHeap () returned 0x580000 [0146.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e5dcc0 [0146.722] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.722] ReadFile (in: hFile=0x4ac, lpBuffer=0x6e4c490, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4c490*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.228] GetProcessHeap () returned 0x580000 [0150.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0150.228] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.228] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e5dcc0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5dcc0*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.229] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.229] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e6f4bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6f4bf*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.229] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.229] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.229] CloseHandle (hObject=0x4ac) returned 1 [0150.229] GetProcessHeap () returned 0x580000 [0150.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e5dcc0 | out: hHeap=0x580000) returned 1 [0150.236] GetProcessHeap () returned 0x580000 [0150.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e4c490 | out: hHeap=0x580000) returned 1 [0150.237] GetProcessHeap () returned 0x580000 [0150.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0150.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c1eb00, ftCreationTime.dwHighDateTime=0x1c69597, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91292340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f088, dwReserved0=0x580000, dwReserved1=0x70a1cf0, cFileName="SCHEME54.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~2.YOU")) returned 0x5b96f0 [0150.634] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.681] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", len=0x44 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned 1 [0150.681] GetProcessHeap () returned 0x580000 [0150.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0150.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.682] CloseHandle (hObject=0x3b8) returned 1 [0150.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x178c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR48~1.YOU")) returned 0x5b96f0 [0150.683] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0150.683] GetProcessHeap () returned 0x580000 [0150.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17a1) returned 0x6cf54a8 [0150.683] GetProcessHeap () returned 0x580000 [0150.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17a1) returned 0x6c20048 [0150.683] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.683] ReadFile (in: hFile=0x3b8, lpBuffer=0x6cf54a8, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf54a8*, lpNumberOfBytesRead=0x434ff14*=0x1780, lpOverlapped=0x0) returned 1 [0150.706] GetProcessHeap () returned 0x580000 [0150.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0150.706] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.706] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c20048*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c20048*, lpNumberOfBytesWritten=0x434ff14*=0x1780, lpOverlapped=0x0) returned 1 [0150.706] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.706] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c217c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c217c7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.706] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.706] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.706] CloseHandle (hObject=0x3b8) returned 1 [0150.706] GetProcessHeap () returned 0x580000 [0150.706] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c20048 | out: hHeap=0x580000) returned 1 [0150.706] GetProcessHeap () returned 0x580000 [0150.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf54a8 | out: hHeap=0x580000) returned 1 [0150.707] GetProcessHeap () returned 0x580000 [0150.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0150.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91708c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17b0, dwReserved0=0x434fd28, dwReserved1=0x6cf54a8, cFileName="PDIR48F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR48~1.YOU")) returned 0x5b96f0 [0150.707] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.904] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", len=0x44 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned 1 [0150.904] GetProcessHeap () returned 0x580000 [0150.904] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0150.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0150.914] CloseHandle (hObject=0x454) returned 1 [0150.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR8~1.YOU")) returned 0x5b9730 [0150.916] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0150.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0150.916] GetProcessHeap () returned 0x580000 [0150.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d61) returned 0x7086938 [0150.916] GetProcessHeap () returned 0x580000 [0150.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d61) returned 0x70896a8 [0150.916] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.916] ReadFile (in: hFile=0x454, lpBuffer=0x7086938, nNumberOfBytesToRead=0x2d40, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x7086938*, lpNumberOfBytesRead=0x434ff14*=0x2d40, lpOverlapped=0x0) returned 1 [0151.423] GetProcessHeap () returned 0x580000 [0151.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0151.423] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.423] WriteFile (in: hFile=0x454, lpBuffer=0x70896a8*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70896a8*, lpNumberOfBytesWritten=0x434ff14*=0x2d40, lpOverlapped=0x0) returned 1 [0151.424] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.424] WriteFile (in: hFile=0x454, lpBuffer=0x708c3e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x708c3e7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.424] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.424] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.424] CloseHandle (hObject=0x454) returned 1 [0151.929] GetProcessHeap () returned 0x580000 [0151.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70896a8 | out: hHeap=0x580000) returned 1 [0151.930] GetProcessHeap () returned 0x580000 [0151.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7086938 | out: hHeap=0x580000) returned 1 [0151.930] GetProcessHeap () returned 0x580000 [0151.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91de0bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d78, dwReserved0=0x434fd28, dwReserved1=0x7086938, cFileName="ZPDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR8~1.YOU")) returned 0x5b9730 [0152.051] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.090] CloseHandle (hObject=0x3a8) returned 1 [0152.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0152.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~4.YOU")) returned 0x5b9730 [0152.091] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.091] GetProcessHeap () returned 0x580000 [0152.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2798 [0152.091] GetProcessHeap () returned 0x580000 [0152.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2a60 [0152.091] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.091] ReadFile (in: hFile=0x3a8, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x434ff14*=0x280, lpOverlapped=0x0) returned 1 [0152.166] GetProcessHeap () returned 0x580000 [0152.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.166] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.166] WriteFile (in: hFile=0x3a8, lpBuffer=0x6df2a60*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a60*, lpNumberOfBytesWritten=0x434ff14*=0x280, lpOverlapped=0x0) returned 1 [0152.166] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.166] WriteFile (in: hFile=0x3a8, lpBuffer=0x6df2cdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2cdf*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.167] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.167] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.167] CloseHandle (hObject=0x3a8) returned 1 [0152.167] GetProcessHeap () returned 0x580000 [0152.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a60 | out: hHeap=0x580000) returned 1 [0152.167] GetProcessHeap () returned 0x580000 [0152.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0152.167] GetProcessHeap () returned 0x580000 [0152.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x92504dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x434fd28, dwReserved1=0x6df2798, cFileName="VISIO.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~4.YOU")) returned 0x5b9730 [0153.446] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0154.544] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", len=0x3f | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA") returned 1 [0154.544] GetProcessHeap () returned 0x580000 [0154.544] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0154.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0160.623] CloseHandle (hObject=0x490) returned 1 [0160.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0160.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.id_1622540890_.your_last_chance")) returned 1 [0160.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0160.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9630 [0160.632] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0160.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0160.632] GetProcessHeap () returned 0x580000 [0160.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71c41a8 [0160.633] GetProcessHeap () returned 0x580000 [0160.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71d59d8 [0160.633] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.633] ReadFile (in: hFile=0x490, lpBuffer=0x71c41a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x71c41a8*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.445] GetProcessHeap () returned 0x580000 [0165.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.445] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.445] WriteFile (in: hFile=0x490, lpBuffer=0x71d59d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x71d59d8*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.446] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.446] WriteFile (in: hFile=0x490, lpBuffer=0x71e71d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x71e71d7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.446] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.447] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.447] CloseHandle (hObject=0x490) returned 1 [0165.447] GetProcessHeap () returned 0x580000 [0165.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71d59d8 | out: hHeap=0x580000) returned 1 [0165.449] GetProcessHeap () returned 0x580000 [0165.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71c41a8 | out: hHeap=0x580000) returned 1 [0165.451] GetProcessHeap () returned 0x580000 [0165.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a39ffe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf024, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="UTILITY.ACCDA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9730 [0169.394] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.536] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", len=0x3d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 1 [0169.536] GetProcessHeap () returned 0x580000 [0169.536] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0169.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0169.607] CloseHandle (hObject=0x484) returned 1 [0169.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id_1622540890_.your_last_chance")) returned 1 [0169.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLAPPT~1.YOU")) returned 0x5b9730 [0169.608] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0169.608] GetProcessHeap () returned 0x580000 [0169.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d66108 [0169.608] GetProcessHeap () returned 0x580000 [0169.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x711c008 [0169.609] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.609] ReadFile (in: hFile=0x484, lpBuffer=0x6d66108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d66108*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.160] GetProcessHeap () returned 0x580000 [0174.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.161] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.161] WriteFile (in: hFile=0x484, lpBuffer=0x711c008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c008*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.161] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.161] WriteFile (in: hFile=0x484, lpBuffer=0x712d807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x712d807*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.161] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.161] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.161] CloseHandle (hObject=0x484) returned 1 [0174.161] GetProcessHeap () returned 0x580000 [0174.161] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c008 | out: hHeap=0x580000) returned 1 [0174.161] GetProcessHeap () returned 0x580000 [0174.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d66108 | out: hHeap=0x580000) returned 1 [0174.162] GetProcessHeap () returned 0x580000 [0174.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f6ca080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ddcc, dwReserved0=0x434fd28, dwReserved1=0x6d66108, cFileName="OLAPPT.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLAPPT~1.YOU")) returned 0x5b96f0 [0176.797] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.838] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", len=0x3b | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM") returned 1 [0176.841] GetProcessHeap () returned 0x580000 [0176.841] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2130) returned 0x6f14048 [0176.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0179.385] CloseHandle (hObject=0x4ac) returned 1 [0179.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.id_1622540890_.your_last_chance")) returned 1 [0179.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33021f00, ftCreationTime.dwHighDateTime=0x1ca6570, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x33021f00, ftLastWriteTime.dwHighDateTime=0x1ca6570, nFileSizeHigh=0x0, nFileSizeLow=0x69d1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSLIS~1.YOU")) returned 0x5b96f0 [0179.386] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslist.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0179.386] GetProcessHeap () returned 0x580000 [0179.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7047008 [0179.386] GetProcessHeap () returned 0x580000 [0179.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0179.387] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.387] ReadFile (in: hFile=0x4ac, lpBuffer=0x7047008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x7047008*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0182.249] GetProcessHeap () returned 0x580000 [0182.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0182.250] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.250] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0182.250] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.250] WriteFile (in: hFile=0x4ac, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.790] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.790] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.790] CloseHandle (hObject=0x4ac) returned 1 [0182.790] GetProcessHeap () returned 0x580000 [0182.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0182.790] GetProcessHeap () returned 0x580000 [0182.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7047008 | out: hHeap=0x580000) returned 1 [0182.790] GetProcessHeap () returned 0x580000 [0182.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33021f00, ftCreationTime.dwHighDateTime=0x1ca6570, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa490f8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69d3e, dwReserved0=0x434fd28, dwReserved1=0x7047008, cFileName="STSLIST.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STSLIS~1.YOU")) returned 0x5b9770 [0183.804] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.818] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", len=0x6e | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned 1 [0183.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0183.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0186.592] CloseHandle (hObject=0x268) returned 1 [0186.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.593] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x36bd, dwReserved0=0x4a002e, dwReserved1=0x470050, cFileName="CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b96b0 [0186.593] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0186.593] GetProcessHeap () returned 0x580000 [0186.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36c1) returned 0x6ff8078 [0186.594] GetProcessHeap () returned 0x580000 [0186.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36c1) returned 0x6ffb748 [0186.594] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.594] ReadFile (in: hFile=0x268, lpBuffer=0x6ff8078, nNumberOfBytesToRead=0x36a0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8078*, lpNumberOfBytesRead=0x434ff14*=0x36a0, lpOverlapped=0x0) returned 1 [0187.685] GetProcessHeap () returned 0x580000 [0187.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0de20 [0187.685] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.685] WriteFile (in: hFile=0x268, lpBuffer=0x6ffb748*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffb748*, lpNumberOfBytesWritten=0x434ff14*=0x36a0, lpOverlapped=0x0) returned 1 [0187.686] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.686] WriteFile (in: hFile=0x268, lpBuffer=0x6ffede7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffede7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.686] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.686] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.686] CloseHandle (hObject=0x268) returned 1 [0187.790] GetProcessHeap () returned 0x580000 [0187.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ffb748 | out: hHeap=0x580000) returned 1 [0187.790] GetProcessHeap () returned 0x580000 [0187.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8078 | out: hHeap=0x580000) returned 1 [0187.790] GetProcessHeap () returned 0x580000 [0187.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0de20 | out: hHeap=0x580000) returned 1 [0188.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa77c68a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x434fd28, dwReserved1=0x6ff8078, cFileName="CONTACT.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b9770 [0188.061] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.084] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", len=0x45 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned 1 [0188.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0188.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0188.590] CloseHandle (hObject=0x484) returned 1 [0188.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.id_1622540890_.your_last_chance")) returned 1 [0188.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~1.YOU")) returned 0x5b9770 [0188.591] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0188.591] GetProcessHeap () returned 0x580000 [0188.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a81) returned 0x6d0e508 [0188.591] GetProcessHeap () returned 0x580000 [0188.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a81) returned 0x6dd40d0 [0188.591] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.591] ReadFile (in: hFile=0x484, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1a60, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x434ff14*=0x1a60, lpOverlapped=0x0) returned 1 [0188.614] GetProcessHeap () returned 0x580000 [0188.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.614] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.614] WriteFile (in: hFile=0x484, lpBuffer=0x6dd40d0*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesWritten=0x434ff14*=0x1a60, lpOverlapped=0x0) returned 1 [0188.615] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x484, lpBuffer=0x6dd5b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd5b2f*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.615] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.615] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.615] CloseHandle (hObject=0x484) returned 1 [0188.615] GetProcessHeap () returned 0x580000 [0188.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0188.615] GetProcessHeap () returned 0x580000 [0188.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0188.615] GetProcessHeap () returned 0x580000 [0188.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa808d9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a9a, dwReserved0=0x434fd28, dwReserved1=0x6d0e508, cFileName="ZPDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~1.YOU")) returned 0x5b9770 [0191.515] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.522] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", len=0x45 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned 1 [0191.524] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0191.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0191.527] CloseHandle (hObject=0x454) returned 1 [0191.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x905a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPB1B7~1.YOU")) returned 0x5b9770 [0191.543] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0191.546] GetProcessHeap () returned 0x580000 [0191.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9061) returned 0x6fd16e8 [0191.550] GetProcessHeap () returned 0x580000 [0191.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9061) returned 0x6fda758 [0191.553] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.554] ReadFile (in: hFile=0x454, lpBuffer=0x6fd16e8, nNumberOfBytesToRead=0x9040, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd16e8*, lpNumberOfBytesRead=0x434ff14*=0x9040, lpOverlapped=0x0) returned 1 [0194.401] GetProcessHeap () returned 0x580000 [0194.401] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0194.401] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.401] WriteFile (in: hFile=0x454, lpBuffer=0x6fda758*, nNumberOfBytesToWrite=0x9040, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fda758*, lpNumberOfBytesWritten=0x434ff14*=0x9040, lpOverlapped=0x0) returned 1 [0194.402] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.402] WriteFile (in: hFile=0x454, lpBuffer=0x6fe3797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe3797*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.402] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.402] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.402] CloseHandle (hObject=0x454) returned 1 [0194.402] GetProcessHeap () returned 0x580000 [0194.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fda758 | out: hHeap=0x580000) returned 1 [0194.402] GetProcessHeap () returned 0x580000 [0194.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd16e8 | out: hHeap=0x580000) returned 1 [0194.402] GetProcessHeap () returned 0x580000 [0194.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0194.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab7bf7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x907e, dwReserved0=0x434fd28, dwReserved1=0x6fd16e8, cFileName="ZPDIR30F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPB1B7~1.YOU")) returned 0x5b97b0 [0194.402] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.666] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", len=0x45 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned 1 [0196.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff0) returned 0x6f14048 [0196.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0196.666] CloseHandle (hObject=0x170) returned 1 [0196.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP0C46~1.YOU")) returned 0x5b97b0 [0196.667] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0196.667] GetProcessHeap () returned 0x580000 [0196.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f81) returned 0x6dc71d0 [0196.668] GetProcessHeap () returned 0x580000 [0196.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3f81) returned 0x6c59108 [0196.668] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.668] ReadFile (in: hFile=0x170, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x3f60, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x434ff14*=0x3f60, lpOverlapped=0x0) returned 1 [0197.288] GetProcessHeap () returned 0x580000 [0197.288] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0197.288] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.288] WriteFile (in: hFile=0x170, lpBuffer=0x6c59108*, nNumberOfBytesToWrite=0x3f60, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesWritten=0x434ff14*=0x3f60, lpOverlapped=0x0) returned 1 [0197.288] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.288] WriteFile (in: hFile=0x170, lpBuffer=0x6c5d067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5d067*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.288] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.288] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.289] CloseHandle (hObject=0x170) returned 1 [0197.769] GetProcessHeap () returned 0x580000 [0197.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0197.769] GetProcessHeap () returned 0x580000 [0197.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0197.769] GetProcessHeap () returned 0x580000 [0197.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0199.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad345640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3f85, dwReserved0=0x434fd28, dwReserved1=0x6dc71d0, cFileName="ZPDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP0C46~1.YOU")) returned 0x5b96b0 [0199.651] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.955] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", len=0x65 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned 1 [0200.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe4) returned 0x6f14048 [0200.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.747] CloseHandle (hObject=0x488) returned 1 [0201.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.id_1622540890_.your_last_chance")) returned 1 [0201.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b97b0 [0201.748] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.748] GetProcessHeap () returned 0x580000 [0201.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.748] GetProcessHeap () returned 0x580000 [0201.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0201.748] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.748] ReadFile (in: hFile=0x488, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x434ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.752] GetProcessHeap () returned 0x580000 [0201.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.752] WriteFile (in: hFile=0x488, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x434ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.752] WriteFile (in: hFile=0x488, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.752] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.753] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.753] CloseHandle (hObject=0x488) returned 1 [0201.753] GetProcessHeap () returned 0x580000 [0201.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0201.753] GetProcessHeap () returned 0x580000 [0201.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.753] GetProcessHeap () returned 0x580000 [0201.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdd1f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x434fd28, dwReserved1=0x6dcfb90, cFileName="rtf_alignright.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b9770 [0202.645] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.698] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS", len=0x45 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS") returned 1 [0202.698] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed0) returned 0x6f14048 [0202.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0202.749] CloseHandle (hObject=0x47c) returned 1 [0202.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css.id_1622540890_.your_last_chance")) returned 1 [0202.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7b2600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff7b2600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC98F0~1.YOU")) returned 0x5b9770 [0202.750] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0202.751] GetProcessHeap () returned 0x580000 [0202.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71f2f68 [0202.751] GetProcessHeap () returned 0x580000 [0202.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7204798 [0202.752] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.752] ReadFile (in: hFile=0x47c, lpBuffer=0x71f2f68, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x71f2f68*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.101] GetProcessHeap () returned 0x580000 [0209.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0209.101] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.101] WriteFile (in: hFile=0x47c, lpBuffer=0x7204798*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x7204798*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.102] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.102] WriteFile (in: hFile=0x47c, lpBuffer=0x7215f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x7215f97*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.102] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.102] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.102] CloseHandle (hObject=0x47c) returned 1 [0209.102] GetProcessHeap () returned 0x580000 [0209.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7204798 | out: hHeap=0x580000) returned 1 [0209.530] GetProcessHeap () returned 0x580000 [0209.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71f2f68 | out: hHeap=0x580000) returned 1 [0209.530] GetProcessHeap () returned 0x580000 [0209.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0210.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7b2600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb43e4720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d676, dwReserved0=0x434fd28, dwReserved1=0x71f2f68, cFileName="SCHEME31.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC98F0~1.YOU")) returned 0x5b97b0 [0210.090] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.125] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", len=0x5a | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned 1 [0210.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0210.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0215.609] CloseHandle (hObject=0x494) returned 1 [0215.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.610] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.id_1622540890_.your_last_chance")) returned 1 [0220.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0220.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b97f0 [0221.052] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.053] GetProcessHeap () returned 0x580000 [0221.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e023e8 [0221.053] GetProcessHeap () returned 0x580000 [0221.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e02670 [0221.053] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.053] ReadFile (in: hFile=0x3e4, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x434ff14*=0x240, lpOverlapped=0x0) returned 1 [0221.056] GetProcessHeap () returned 0x580000 [0221.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.056] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.056] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e02670*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02670*, lpNumberOfBytesWritten=0x434ff14*=0x240, lpOverlapped=0x0) returned 1 [0221.056] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.056] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e028af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e028af*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.056] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.056] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.057] CloseHandle (hObject=0x3e4) returned 1 [0221.057] GetProcessHeap () returned 0x580000 [0221.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02670 | out: hHeap=0x580000) returned 1 [0221.057] GetProcessHeap () returned 0x580000 [0221.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0221.057] GetProcessHeap () returned 0x580000 [0221.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0222.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb6005c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x434fd28, dwReserved1=0x6e023e8, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b96f0 [0222.657] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.669] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", len=0x6e | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned 1 [0222.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0222.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.670] CloseHandle (hObject=0x440) returned 1 [0222.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0222.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x6a002e, dwReserved1=0x670070, cFileName="ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~3.YOU")) returned 0x5b96f0 [0222.671] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.671] GetProcessHeap () returned 0x580000 [0222.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x70c0730 [0222.672] GetProcessHeap () returned 0x580000 [0222.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x70c2938 [0222.672] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.672] ReadFile (in: hFile=0x440, lpBuffer=0x70c0730, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0730*, lpNumberOfBytesRead=0x434ff14*=0x2000, lpOverlapped=0x0) returned 1 [0222.750] GetProcessHeap () returned 0x580000 [0222.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.750] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.750] WriteFile (in: hFile=0x440, lpBuffer=0x70c2938*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c2938*, lpNumberOfBytesWritten=0x434ff14*=0x2000, lpOverlapped=0x0) returned 1 [0222.750] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.750] WriteFile (in: hFile=0x440, lpBuffer=0x70c4937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4937*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.750] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.750] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.750] CloseHandle (hObject=0x440) returned 1 [0222.751] GetProcessHeap () returned 0x580000 [0222.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c2938 | out: hHeap=0x580000) returned 1 [0222.751] GetProcessHeap () returned 0x580000 [0222.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0730 | out: hHeap=0x580000) returned 1 [0222.751] GetProcessHeap () returned 0x580000 [0222.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0222.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc611a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2032, dwReserved0=0x434fd28, dwReserved1=0x70c0730, cFileName="ProjectTaskIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~3.YOU")) returned 0x5b96f0 [0222.751] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0225.416] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", len=0x37 | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 1 [0225.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0225.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0225.418] CloseHandle (hObject=0x46c) returned 1 [0225.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.id_1622540890_.your_last_chance")) returned 1 [0225.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXORAC~1.YOU")) returned 0x5b9630 [0225.420] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0225.420] GetProcessHeap () returned 0x580000 [0225.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0225.421] GetProcessHeap () returned 0x580000 [0225.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0225.421] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.421] ReadFile (in: hFile=0x46c, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.508] GetProcessHeap () returned 0x580000 [0235.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0235.508] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.508] WriteFile (in: hFile=0x46c, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x434ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.509] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.509] WriteFile (in: hFile=0x46c, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.144] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.144] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.144] CloseHandle (hObject=0x46c) returned 1 [0239.407] GetProcessHeap () returned 0x580000 [0239.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0239.412] GetProcessHeap () returned 0x580000 [0239.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0239.413] GetProcessHeap () returned 0x580000 [0239.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0240.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc60f11a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x63fc4, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="IXORACLE.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXORAC~1.YOU")) returned 0x5b9730 [0240.646] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.673] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML", len=0x4e | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned 1 [0240.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0240.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.684] CloseHandle (hObject=0x3a8) returned 1 [0240.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml.id_1622540890_.your_last_chance")) returned 1 [0240.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5A59~1.YOU")) returned 0x5b9730 [0240.685] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.685] GetProcessHeap () returned 0x580000 [0240.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.685] GetProcessHeap () returned 0x580000 [0240.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.685] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.685] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x434ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.731] GetProcessHeap () returned 0x580000 [0240.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.731] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.732] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x434ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.732] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.732] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.732] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.732] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.732] CloseHandle (hObject=0x3a8) returned 1 [0240.732] GetProcessHeap () returned 0x580000 [0240.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.732] GetProcessHeap () returned 0x580000 [0240.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.732] GetProcessHeap () returned 0x580000 [0240.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc701dde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x434fd28, dwReserved1=0x6d07028, cFileName="YAHOO.CO.ID.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5A59~1.YOU")) returned 0x5b9730 [0240.732] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.788] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML", len=0x4d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned 1 [0240.788] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0240.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.788] CloseHandle (hObject=0x418) returned 1 [0240.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWBELL~1.YOU")) returned 0x5b9730 [0240.790] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.790] GetProcessHeap () returned 0x580000 [0240.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0240.790] GetProcessHeap () returned 0x580000 [0240.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0240.790] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.790] ReadFile (in: hFile=0x418, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x434ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.813] GetProcessHeap () returned 0x580000 [0240.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.813] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.813] WriteFile (in: hFile=0x418, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x434ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.813] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.813] WriteFile (in: hFile=0x418, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.813] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.813] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.813] CloseHandle (hObject=0x418) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.848] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc70dc4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x434fd28, dwReserved1=0x6d0a340, cFileName="SWBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWBELL~1.YOU")) returned 0x5b9630 [0241.848] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.867] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML", len=0x3f | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned 1 [0241.867] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0241.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0245.385] CloseHandle (hObject=0x45c) returned 1 [0245.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml.id_1622540890_.your_last_chance")) returned 1 [0248.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x21be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~3.YOU")) returned 0x5b96f0 [0249.024] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0249.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0249.055] GetProcessHeap () returned 0x580000 [0249.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c0730 [0249.055] GetProcessHeap () returned 0x580000 [0249.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c2938 [0249.055] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.055] ReadFile (in: hFile=0x47c, lpBuffer=0x70c0730, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0730*, lpNumberOfBytesRead=0x434ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0249.086] GetProcessHeap () returned 0x580000 [0249.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0249.087] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.087] WriteFile (in: hFile=0x47c, lpBuffer=0x70c2938*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c2938*, lpNumberOfBytesWritten=0x434ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0249.087] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.087] WriteFile (in: hFile=0x47c, lpBuffer=0x70c4ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4ad7*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0249.087] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.087] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0249.087] CloseHandle (hObject=0x47c) returned 1 [0249.087] GetProcessHeap () returned 0x580000 [0249.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c2938 | out: hHeap=0x580000) returned 1 [0249.087] GetProcessHeap () returned 0x580000 [0249.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0730 | out: hHeap=0x580000) returned 1 [0249.087] GetProcessHeap () returned 0x580000 [0249.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbfdbee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21e2, dwReserved0=0x434fd28, dwReserved1=0x70c0730, cFileName="PGMN026.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~3.YOU")) returned 0x5b9730 [0253.607] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.664] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV", len=0x3e | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 1 [0253.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0253.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0257.232] CloseHandle (hObject=0x268) returned 1 [0257.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0257.233] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fc74 | out: lpFindFileData=0x434fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca59dd00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca59dd00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCHKB~2.YOU")) returned 0x5b96f0 [0258.448] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0258.450] GetProcessHeap () returned 0x580000 [0258.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6c9a390 [0258.450] GetProcessHeap () returned 0x580000 [0258.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6c9b498 [0258.450] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.450] ReadFile (in: hFile=0x268, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x434ff14*=0x1000, lpOverlapped=0x0) returned 1 [0258.464] GetProcessHeap () returned 0x580000 [0258.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0258.465] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.465] WriteFile (in: hFile=0x268, lpBuffer=0x6c9b498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b498*, lpNumberOfBytesWritten=0x434ff14*=0x1000, lpOverlapped=0x0) returned 1 [0258.465] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.465] WriteFile (in: hFile=0x268, lpBuffer=0x6c9c497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9c497*, lpNumberOfBytesWritten=0x434ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.465] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.465] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x434ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x434ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.465] CloseHandle (hObject=0x268) returned 1 [0258.465] GetProcessHeap () returned 0x580000 [0258.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b498 | out: hHeap=0x580000) returned 1 [0258.465] GetProcessHeap () returned 0x580000 [0258.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0258.465] GetProcessHeap () returned 0x580000 [0258.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0259.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x434fccc | out: lpFindFileData=0x434fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca59dd00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1945940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1024, dwReserved0=0x434fd28, dwReserved1=0x6c9a390, cFileName="DGCHKBRD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCHKB~2.YOU")) returned 0x5b9630 [0259.222] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.234] SysReAllocStringLen (in: pbstr=0x434ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC", len=0x3d | out: pbstr=0x434ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC") returned 1 [0259.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a8) returned 0x72e5948 [0259.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0264.705] CloseHandle (hObject=0x39c) returned 1 [0264.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x434ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0264.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc.id_1622540890_.your_last_chance")) Thread: id = 31 os_tid = 0xa74 [0039.064] Sleep (dwMilliseconds=0x1) [0039.089] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.575] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.677] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.313] Sleep (dwMilliseconds=0x1) [0042.343] Sleep (dwMilliseconds=0x1) [0042.466] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.086] Sleep (dwMilliseconds=0x1) [0043.114] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.497] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.714] Sleep (dwMilliseconds=0x1) [0043.730] Sleep (dwMilliseconds=0x1) [0043.746] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.824] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.933] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.432] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.463] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.588] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.635] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.775] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.203] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.259] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.675] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.805] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.836] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.039] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.117] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.148] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.201] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.382] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.429] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.663] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.694] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.741] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.772] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.130] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.255] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.286] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.537] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.567] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.683] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.848] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.222] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.378] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.472] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.690] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.723] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.768] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.940] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.002] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.096] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.283] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.392] Sleep (dwMilliseconds=0x1) [0049.408] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.548] Sleep (dwMilliseconds=0x1) [0049.564] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.720] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.860] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.172] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.250] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.344] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.531] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.812] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.030] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.280] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.328] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.389] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.824] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.902] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.964] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.042] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.120] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.370] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.838] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.111] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.368] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.587] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.897] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.006] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.038] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.287] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.318] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.474] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.535] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Boot\\BCD", len=0xb | out: pbstr=0x448ff84*="C:\\Boot\\BCD") returned 1 [0055.535] GetProcessHeap () returned 0x580000 [0055.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9588, Size=0xc) returned 0x5e94b0 [0055.535] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.535] Sleep (dwMilliseconds=0x1) [0055.545] Sleep (dwMilliseconds=0x1) [0055.596] Sleep (dwMilliseconds=0x1) [0055.654] Sleep (dwMilliseconds=0x1) [0055.700] Sleep (dwMilliseconds=0x1) [0061.749] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x448ff84*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0061.749] GetProcessHeap () returned 0x580000 [0061.749] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x5c) returned 0x5b5bc8 [0061.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0070.185] CloseHandle (hObject=0x418) returned 1 [0070.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.186] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance")) returned 1 [0073.120] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0073.120] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0075.374] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.374] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0075.977] GetProcessHeap () returned 0x580000 [0075.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c57108 [0075.978] GetProcessHeap () returned 0x580000 [0075.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c68938 [0075.978] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.978] ReadFile (in: hFile=0x46c, lpBuffer=0x6c57108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.023] GetProcessHeap () returned 0x580000 [0079.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0079.024] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.024] WriteFile (in: hFile=0x46c, lpBuffer=0x6c68938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68938*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.024] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.024] WriteFile (in: hFile=0x46c, lpBuffer=0x6c7a137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a137*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.277] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.277] CloseHandle (hObject=0x46c) returned 1 [0079.278] GetProcessHeap () returned 0x580000 [0079.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c68938 | out: hHeap=0x580000) returned 1 [0079.278] GetProcessHeap () returned 0x580000 [0079.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0079.278] GetProcessHeap () returned 0x580000 [0079.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0079.461] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0x66dcd460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6624, dwReserved0=0x448fd28, dwReserved1=0x6c57108, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0079.461] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.965] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", len=0x43 | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 1 [0085.965] GetProcessHeap () returned 0x580000 [0085.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x8c) returned 0x614a48 [0085.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.967] Sleep (dwMilliseconds=0x1) [0085.982] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", len=0x4a | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 1 [0085.982] GetProcessHeap () returned 0x580000 [0085.982] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x20) returned 0x614a48 [0085.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.982] Sleep (dwMilliseconds=0x1) [0086.328] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", len=0x4d | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 1 [0086.328] GetProcessHeap () returned 0x580000 [0086.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0088.688] CloseHandle (hObject=0x414) returned 1 [0088.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id_1622540890_.your_last_chance")) returned 1 [0090.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0090.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AFTRNO~2.YOU")) returned 0x5b9730 [0090.013] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0090.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0090.014] GetProcessHeap () returned 0x580000 [0090.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6f1c318 [0090.014] GetProcessHeap () returned 0x580000 [0090.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6c57108 [0090.014] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.014] ReadFile (in: hFile=0x414, lpBuffer=0x6f1c318, nNumberOfBytesToRead=0xe580, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c318*, lpNumberOfBytesRead=0x448ff14*=0xe580, lpOverlapped=0x0) returned 1 [0091.551] GetProcessHeap () returned 0x580000 [0091.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0091.551] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.551] WriteFile (in: hFile=0x414, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0xe580, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x448ff14*=0xe580, lpOverlapped=0x0) returned 1 [0091.552] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.552] WriteFile (in: hFile=0x414, lpBuffer=0x6c65687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65687*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.552] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.552] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.552] CloseHandle (hObject=0x414) returned 1 [0092.729] GetProcessHeap () returned 0x580000 [0092.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0092.729] GetProcessHeap () returned 0x580000 [0092.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1c318 | out: hHeap=0x580000) returned 1 [0092.729] GetProcessHeap () returned 0x580000 [0092.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0092.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e2e2e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe5b2, dwReserved0=0x448fd28, dwReserved1=0x6f1c318, cFileName="AFTRNOON.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AFTRNO~2.YOU")) returned 0x5b96f0 [0094.163] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.941] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", len=0x45 | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 1 [0095.941] GetProcessHeap () returned 0x580000 [0095.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0095.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0095.941] CloseHandle (hObject=0x3f4) returned 1 [0095.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0095.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id_1622540890_.your_last_chance")) returned 1 [0098.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0098.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUADIN~1.YOU")) returned 0x5b96b0 [0098.781] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0098.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0098.781] GetProcessHeap () returned 0x580000 [0098.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f04728 [0098.781] GetProcessHeap () returned 0x580000 [0098.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c4f8 [0098.781] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.781] ReadFile (in: hFile=0x3f4, lpBuffer=0x6f04728, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04728*, lpNumberOfBytesRead=0x448ff14*=0x240, lpOverlapped=0x0) returned 1 [0098.784] GetProcessHeap () returned 0x580000 [0098.784] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.784] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.784] WriteFile (in: hFile=0x3f4, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x448ff14*=0x240, lpOverlapped=0x0) returned 1 [0098.785] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.785] WriteFile (in: hFile=0x3f4, lpBuffer=0x6f0c737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c737*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.785] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.785] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.785] CloseHandle (hObject=0x3f4) returned 1 [0098.785] GetProcessHeap () returned 0x580000 [0098.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0098.785] GetProcessHeap () returned 0x580000 [0098.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04728 | out: hHeap=0x580000) returned 1 [0098.785] GetProcessHeap () returned 0x580000 [0098.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x727eac80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x448fd28, dwReserved1=0x6f04728, cFileName="QUAD.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUADIN~1.YOU")) returned 0x5b96b0 [0098.785] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0099.154] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", len=0x49 | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 1 [0099.154] GetProcessHeap () returned 0x580000 [0099.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0099.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0100.216] CloseHandle (hObject=0x474) returned 1 [0100.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0100.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id_1622540890_.your_last_chance")) returned 1 [0100.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.217] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SONORA~1.YOU")) returned 0x5b96f0 [0100.218] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0100.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0100.218] GetProcessHeap () returned 0x580000 [0100.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f0ce0 [0100.218] GetProcessHeap () returned 0x580000 [0100.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5ef528 [0100.218] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.218] ReadFile (in: hFile=0x474, lpBuffer=0x5f0ce0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f0ce0*, lpNumberOfBytesRead=0x448ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0100.220] GetProcessHeap () returned 0x580000 [0100.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0100.220] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.220] WriteFile (in: hFile=0x474, lpBuffer=0x5ef528*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ef528*, lpNumberOfBytesWritten=0x448ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0100.221] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.221] WriteFile (in: hFile=0x474, lpBuffer=0x5ef707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ef707*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.221] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.221] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.221] CloseHandle (hObject=0x474) returned 1 [0100.221] GetProcessHeap () returned 0x580000 [0100.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ef528 | out: hHeap=0x580000) returned 1 [0100.221] GetProcessHeap () returned 0x580000 [0100.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f0ce0 | out: hHeap=0x580000) returned 1 [0100.221] GetProcessHeap () returned 0x580000 [0100.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7359ab00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x448fd28, dwReserved1=0x5f0ce0, cFileName="SONORA.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SONORA~1.YOU")) returned 0x5b96b0 [0101.829] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0102.321] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", len=0x47 | out: pbstr=0x448ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 1 [0102.321] GetProcessHeap () returned 0x580000 [0102.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0102.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0102.321] CloseHandle (hObject=0x498) returned 1 [0102.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id_1622540890_.your_last_chance")) returned 1 [0102.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WT61ES~1.YOU")) returned 0x5b9630 [0102.324] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0102.324] GetProcessHeap () returned 0x580000 [0102.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c39898 [0102.324] GetProcessHeap () returned 0x580000 [0102.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0102.325] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.325] ReadFile (in: hFile=0x498, lpBuffer=0x6c39898, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c39898*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.059] GetProcessHeap () returned 0x580000 [0106.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0106.059] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.059] WriteFile (in: hFile=0x498, lpBuffer=0x6d9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.060] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.060] WriteFile (in: hFile=0x498, lpBuffer=0x6db09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db09cf*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.346] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.346] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.347] CloseHandle (hObject=0x498) returned 1 [0106.347] GetProcessHeap () returned 0x580000 [0106.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0106.348] GetProcessHeap () returned 0x580000 [0106.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c39898 | out: hHeap=0x580000) returned 1 [0106.349] GetProcessHeap () returned 0x580000 [0106.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0106.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77012760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa5c24, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="WT61ES.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WT61ES~1.YOU")) returned 0x5b96f0 [0106.350] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.160] Sleep (dwMilliseconds=0x1) [0112.124] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", len=0x4f | out: pbstr=0x448ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 1 [0112.125] GetProcessHeap () returned 0x580000 [0112.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.137] Sleep (dwMilliseconds=0x1) [0112.195] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.208] Sleep (dwMilliseconds=0x1) [0112.319] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", len=0x60 | out: pbstr=0x448ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.320] GetProcessHeap () returned 0x580000 [0112.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.320] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.320] Sleep (dwMilliseconds=0x1) [0113.338] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", len=0x3f | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 1 [0113.338] GetProcessHeap () returned 0x580000 [0113.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x78) returned 0x6f0ceb8 [0113.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0113.475] CloseHandle (hObject=0x4a0) returned 1 [0113.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id_1622540890_.your_last_chance")) returned 1 [0115.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~1.YOU")) returned 0x5b9630 [0115.308] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.308] GetProcessHeap () returned 0x580000 [0115.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2441) returned 0x6c51c28 [0115.308] GetProcessHeap () returned 0x580000 [0115.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2441) returned 0x6c61108 [0115.309] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.309] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c51c28, nNumberOfBytesToRead=0x2420, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c51c28*, lpNumberOfBytesRead=0x448ff14*=0x2420, lpOverlapped=0x0) returned 1 [0115.342] GetProcessHeap () returned 0x580000 [0115.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.342] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.342] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c61108*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesWritten=0x448ff14*=0x2420, lpOverlapped=0x0) returned 1 [0115.342] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.342] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c63527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c63527*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.342] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.342] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.343] CloseHandle (hObject=0x4a0) returned 1 [0115.343] GetProcessHeap () returned 0x580000 [0115.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0115.343] GetProcessHeap () returned 0x580000 [0115.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c51c28 | out: hHeap=0x580000) returned 1 [0115.343] GetProcessHeap () returned 0x580000 [0115.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c5c3f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2444, dwReserved0=0x448fd28, dwReserved1=0x6c51c28, cFileName="AG00170_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~1.YOU")) returned 0x5b9630 [0117.325] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.509] CloseHandle (hObject=0x460) returned 1 [0118.509] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.509] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.510] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0017~1.YOU")) returned 0x5b9730 [0118.510] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.510] GetProcessHeap () returned 0x580000 [0118.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6f19958 [0118.510] GetProcessHeap () returned 0x580000 [0118.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6f1bec0 [0118.511] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.512] ReadFile (in: hFile=0x460, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x448ff14*=0x1400, lpOverlapped=0x0) returned 1 [0118.530] GetProcessHeap () returned 0x580000 [0118.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.531] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.531] WriteFile (in: hFile=0x460, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x448ff14*=0x1400, lpOverlapped=0x0) returned 1 [0118.531] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.531] WriteFile (in: hFile=0x460, lpBuffer=0x6f1d2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1d2bf*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.531] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.531] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.531] CloseHandle (hObject=0x460) returned 1 [0118.531] GetProcessHeap () returned 0x580000 [0118.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0118.531] GetProcessHeap () returned 0x580000 [0118.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0118.531] GetProcessHeap () returned 0x580000 [0118.531] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e443940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1436, dwReserved0=0x448fd28, dwReserved1=0x6f19958, cFileName="SY00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0017~1.YOU")) returned 0x5b96f0 [0120.124] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.151] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", len=0x4c | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 1 [0120.151] GetProcessHeap () returned 0x580000 [0120.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17cc) returned 0x6d06ca8 [0120.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0121.443] CloseHandle (hObject=0x4a4) returned 1 [0121.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.213] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0208~1.YOU")) returned 0x5b9730 [0122.213] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0122.213] GetProcessHeap () returned 0x580000 [0122.213] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6d00c88 [0122.213] GetProcessHeap () returned 0x580000 [0122.213] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6c676b8 [0122.213] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.213] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d00c88, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00c88*, lpNumberOfBytesRead=0x448ff14*=0x900, lpOverlapped=0x0) returned 1 [0122.222] GetProcessHeap () returned 0x580000 [0122.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.222] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.222] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x448ff14*=0x900, lpOverlapped=0x0) returned 1 [0122.223] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.223] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c67fb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67fb7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.223] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.223] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.223] CloseHandle (hObject=0x4a4) returned 1 [0122.223] GetProcessHeap () returned 0x580000 [0122.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0122.223] GetProcessHeap () returned 0x580000 [0122.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00c88 | out: hHeap=0x580000) returned 1 [0122.223] GetProcessHeap () returned 0x580000 [0122.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8075fdc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x930, dwReserved0=0x448fd28, dwReserved1=0x6d00c88, cFileName="WB02085_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0208~1.YOU")) returned 0x5b9730 [0124.420] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.084] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", len=0x51 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 1 [0125.085] GetProcessHeap () returned 0x580000 [0125.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x188c) returned 0x6f42f08 [0125.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0125.147] CloseHandle (hObject=0x4ac) returned 1 [0125.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.148] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.148] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0125.148] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0125.148] GetProcessHeap () returned 0x580000 [0125.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d4d618 [0125.149] GetProcessHeap () returned 0x580000 [0125.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d5ee48 [0125.150] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.150] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d4d618, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4d618*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.756] GetProcessHeap () returned 0x580000 [0127.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0127.756] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.756] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d5ee48*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d5ee48*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.756] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.756] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d70647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d70647*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.157] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.157] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.157] CloseHandle (hObject=0x4ac) returned 1 [0128.157] GetProcessHeap () returned 0x580000 [0128.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d5ee48 | out: hHeap=0x580000) returned 1 [0128.157] GetProcessHeap () returned 0x580000 [0128.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d4d618 | out: hHeap=0x580000) returned 1 [0128.157] GetProcessHeap () returned 0x580000 [0128.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0128.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8400e9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e325, dwReserved0=0x448fd28, dwReserved1=0x6d4d618, cFileName="Newsprint.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0128.158] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.202] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", len=0x3d | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned 1 [0128.203] GetProcessHeap () returned 0x580000 [0128.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b0) returned 0x667250 [0128.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0129.284] CloseHandle (hObject=0x4a8) returned 1 [0129.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02986~1.YOU")) returned 0x5b9730 [0130.937] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0130.937] GetProcessHeap () returned 0x580000 [0130.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1981) returned 0x6f42f08 [0130.938] GetProcessHeap () returned 0x580000 [0130.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1981) returned 0x6f15f28 [0130.938] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.938] ReadFile (in: hFile=0x4a8, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1960, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x448ff14*=0x1960, lpOverlapped=0x0) returned 1 [0130.961] GetProcessHeap () returned 0x580000 [0130.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.961] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.961] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f15f28*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15f28*, lpNumberOfBytesWritten=0x448ff14*=0x1960, lpOverlapped=0x0) returned 1 [0130.961] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.961] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f17887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f17887*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.962] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.962] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.962] CloseHandle (hObject=0x4a8) returned 1 [0130.962] GetProcessHeap () returned 0x580000 [0130.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f15f28 | out: hHeap=0x580000) returned 1 [0130.962] GetProcessHeap () returned 0x580000 [0130.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0130.962] GetProcessHeap () returned 0x580000 [0130.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85aaffc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x448fd28, dwReserved1=0x6f42f08, cFileName="J0298653.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02986~1.YOU")) returned 0x5b9730 [0130.962] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.643] CloseHandle (hObject=0x428) returned 1 [0132.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0132.644] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~1.YOU")) returned 0x5b9730 [0132.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.644] GetProcessHeap () returned 0x580000 [0132.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0132.644] GetProcessHeap () returned 0x580000 [0132.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0132.644] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.644] ReadFile (in: hFile=0x428, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x448ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.646] GetProcessHeap () returned 0x580000 [0132.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.646] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.646] WriteFile (in: hFile=0x428, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x448ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.646] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.646] WriteFile (in: hFile=0x428, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.646] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.646] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.646] CloseHandle (hObject=0x428) returned 1 [0132.646] GetProcessHeap () returned 0x580000 [0132.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0132.646] GetProcessHeap () returned 0x580000 [0132.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0132.646] GetProcessHeap () returned 0x580000 [0132.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86ac1440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x448fd28, dwReserved1=0x61b540, cFileName="EXCEL_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~1.YOU")) returned 0x5b96f0 [0135.081] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.084] Sleep (dwMilliseconds=0x1) [0135.132] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", len=0x3c | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned 1 [0135.132] GetProcessHeap () returned 0x580000 [0135.132] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0135.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0135.133] CloseHandle (hObject=0x46c) returned 1 [0135.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id_1622540890_.your_last_chance")) returned 1 [0135.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBSAMP~1.YOU")) returned 0x5b96f0 [0135.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0135.134] GetProcessHeap () returned 0x580000 [0135.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0135.134] GetProcessHeap () returned 0x580000 [0135.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e17c00 [0135.134] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.134] ReadFile (in: hFile=0x46c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.263] GetProcessHeap () returned 0x580000 [0138.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0138.334] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.334] WriteFile (in: hFile=0x46c, lpBuffer=0x6e17c00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.514] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.514] WriteFile (in: hFile=0x46c, lpBuffer=0x6e293ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e293ff*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.515] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.515] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.515] CloseHandle (hObject=0x46c) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0139.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a2d7aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x76024, dwReserved0=0x448fd28, dwReserved1=0x6e063d0, cFileName="DBSAMPLE.MDB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DBSAMP~1.YOU")) returned 0x5b9770 [0139.873] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.902] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", len=0x5b | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned 1 [0139.902] GetProcessHeap () returned 0x580000 [0139.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0139.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.322] CloseHandle (hObject=0x488) returned 1 [0140.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.id_1622540890_.your_last_chance")) returned 1 [0140.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dfe600, ftCreationTime.dwHighDateTime=0x1ca2b73, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x60dfe600, ftLastWriteTime.dwHighDateTime=0x1ca2b73, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_SP~1.YOU")) returned 0x5b9770 [0140.323] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.323] GetProcessHeap () returned 0x580000 [0140.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0140.323] GetProcessHeap () returned 0x580000 [0140.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0140.323] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.323] ReadFile (in: hFile=0x488, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x448ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.324] GetProcessHeap () returned 0x580000 [0140.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.324] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.324] WriteFile (in: hFile=0x488, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x448ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.324] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.324] WriteFile (in: hFile=0x488, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.324] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.325] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.325] CloseHandle (hObject=0x488) returned 1 [0140.325] GetProcessHeap () returned 0x580000 [0140.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0140.325] GetProcessHeap () returned 0x580000 [0140.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0140.325] GetProcessHeap () returned 0x580000 [0140.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dfe600, ftCreationTime.dwHighDateTime=0x1ca2b73, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b419a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x448fd28, dwReserved1=0x60e978, cFileName="rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_SP~1.YOU")) returned 0x5b9770 [0140.664] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.674] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", len=0x43 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned 1 [0140.674] GetProcessHeap () returned 0x580000 [0140.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d84) returned 0x6f14048 [0140.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.043] CloseHandle (hObject=0x4a0) returned 1 [0141.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1459~2.YOU")) returned 0x5b9730 [0141.044] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.044] GetProcessHeap () returned 0x580000 [0141.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0141.044] GetProcessHeap () returned 0x580000 [0141.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0141.044] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.044] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x448ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0141.046] GetProcessHeap () returned 0x580000 [0141.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.046] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.046] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x448ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0141.046] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.046] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.047] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.047] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.047] CloseHandle (hObject=0x4a0) returned 1 [0141.047] GetProcessHeap () returned 0x580000 [0141.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0141.047] GetProcessHeap () returned 0x580000 [0141.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0141.047] GetProcessHeap () returned 0x580000 [0141.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8baf1960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fb, dwReserved0=0x448fd28, dwReserved1=0x6f3ef20, cFileName="BD14595_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1459~2.YOU")) returned 0x5b9730 [0146.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.448] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM", len=0x3c | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 1 [0146.448] GetProcessHeap () returned 0x580000 [0146.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0146.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0146.449] CloseHandle (hObject=0x490) returned 1 [0146.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id_1622540890_.your_last_chance")) returned 1 [0146.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBCOL~1.YOU")) returned 0x5b9730 [0146.451] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0146.451] GetProcessHeap () returned 0x580000 [0146.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e21) returned 0x6de0f50 [0146.451] GetProcessHeap () returned 0x580000 [0146.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e21) returned 0x6d21878 [0146.451] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.451] ReadFile (in: hFile=0x490, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x6e00, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x448ff14*=0x6e00, lpOverlapped=0x0) returned 1 [0147.854] GetProcessHeap () returned 0x580000 [0147.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0147.854] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.854] WriteFile (in: hFile=0x490, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x6e00, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x448ff14*=0x6e00, lpOverlapped=0x0) returned 1 [0147.854] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.855] WriteFile (in: hFile=0x490, lpBuffer=0x6d28677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d28677*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0147.855] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.855] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0147.855] CloseHandle (hObject=0x490) returned 1 [0147.855] GetProcessHeap () returned 0x580000 [0147.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0148.275] GetProcessHeap () returned 0x580000 [0148.275] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0148.310] GetProcessHeap () returned 0x580000 [0148.310] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0148.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fbcf0e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6e24, dwReserved0=0x448fd28, dwReserved1=0x6de0f50, cFileName="PUBCOLOR.SCM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBCOL~1.YOU")) returned 0x5b96f0 [0148.310] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.372] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS", len=0x45 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS") returned 1 [0148.372] GetProcessHeap () returned 0x580000 [0148.372] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0148.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0148.426] CloseHandle (hObject=0x478) returned 1 [0148.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css.id_1622540890_.your_last_chance")) returned 1 [0148.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa69a700, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa69a700, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1da6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC81E8~1.YOU")) returned 0x5b96f0 [0148.427] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0148.427] GetProcessHeap () returned 0x580000 [0148.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d448d8 [0148.428] GetProcessHeap () returned 0x580000 [0148.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d56108 [0148.428] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.428] ReadFile (in: hFile=0x478, lpBuffer=0x6d448d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d448d8*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.868] GetProcessHeap () returned 0x580000 [0151.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.869] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] WriteFile (in: hFile=0x478, lpBuffer=0x6d56108*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d56108*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.869] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] WriteFile (in: hFile=0x478, lpBuffer=0x6d67907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d67907*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.869] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.869] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.870] CloseHandle (hObject=0x478) returned 1 [0151.870] GetProcessHeap () returned 0x580000 [0151.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d56108 | out: hHeap=0x580000) returned 1 [0151.870] GetProcessHeap () returned 0x580000 [0151.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d448d8 | out: hHeap=0x580000) returned 1 [0151.870] GetProcessHeap () returned 0x580000 [0151.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa69a700, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x922313a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1da90, dwReserved0=0x448fd28, dwReserved1=0x6d448d8, cFileName="SCHEME49.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC81E8~1.YOU")) returned 0x5b9730 [0152.049] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.595] CloseHandle (hObject=0x460) returned 1 [0153.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id_1622540890_.your_last_chance")) returned 1 [0153.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XMLSDK~1.YOU")) returned 0x5b9730 [0153.597] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.597] GetProcessHeap () returned 0x580000 [0153.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d47d08 [0153.597] GetProcessHeap () returned 0x580000 [0153.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0153.597] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.597] ReadFile (in: hFile=0x460, lpBuffer=0x6d47d08, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d47d08*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.735] GetProcessHeap () returned 0x580000 [0157.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0157.735] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.735] WriteFile (in: hFile=0x460, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.736] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.736] WriteFile (in: hFile=0x460, lpBuffer=0x6fc4737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4737*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.171] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.171] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.172] CloseHandle (hObject=0x460) returned 1 [0158.172] GetProcessHeap () returned 0x580000 [0158.172] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0158.179] GetProcessHeap () returned 0x580000 [0158.179] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d47d08 | out: hHeap=0x580000) returned 1 [0158.180] GetProcessHeap () returned 0x580000 [0158.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0159.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e4bf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x349946, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="XMLSDK5.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XMLSDK~1.YOU")) returned 0x5b9630 [0159.261] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0164.436] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", len=0x37 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 1 [0164.436] GetProcessHeap () returned 0x580000 [0164.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0164.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0165.834] CloseHandle (hObject=0x448) returned 1 [0165.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id_1622540890_.your_last_chance")) returned 1 [0165.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASCIIE~1.YOU")) returned 0x5b9730 [0165.836] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0165.836] GetProcessHeap () returned 0x580000 [0165.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0165.836] GetProcessHeap () returned 0x580000 [0165.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0165.837] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.837] ReadFile (in: hFile=0x448, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0168.907] GetProcessHeap () returned 0x580000 [0168.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0168.907] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.907] WriteFile (in: hFile=0x448, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0168.907] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.907] WriteFile (in: hFile=0x448, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.097] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.097] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.097] CloseHandle (hObject=0x448) returned 1 [0169.097] GetProcessHeap () returned 0x580000 [0169.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0169.098] GetProcessHeap () returned 0x580000 [0169.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0169.098] GetProcessHeap () returned 0x580000 [0169.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0170.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c6701a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x460a4, dwReserved0=0x448fd28, dwReserved1=0x6e063d0, cFileName="ASCIIENG.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASCIIE~1.YOU")) returned 0x5b96b0 [0170.243] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0172.856] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", len=0x40 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 1 [0172.856] GetProcessHeap () returned 0x580000 [0172.856] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2284) returned 0x6f14048 [0172.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0172.857] CloseHandle (hObject=0x390) returned 1 [0172.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.905] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIMES~1.YOU")) returned 0x5b9770 [0172.906] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0172.906] GetProcessHeap () returned 0x580000 [0172.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0172.906] GetProcessHeap () returned 0x580000 [0172.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0172.906] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.906] ReadFile (in: hFile=0x390, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x448ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.917] GetProcessHeap () returned 0x580000 [0172.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.917] WriteFile (in: hFile=0x390, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x448ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.917] WriteFile (in: hFile=0x390, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.917] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.917] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.917] CloseHandle (hObject=0x390) returned 1 [0172.927] GetProcessHeap () returned 0x580000 [0172.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0172.931] GetProcessHeap () returned 0x580000 [0172.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0172.931] GetProcessHeap () returned 0x580000 [0172.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eae3280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x448fd28, dwReserved1=0x6c4a820, cFileName="SMIMES.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIMES~1.YOU")) returned 0x5b9770 [0173.244] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.617] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", len=0x4a | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned 1 [0174.617] GetProcessHeap () returned 0x580000 [0174.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0174.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0175.143] CloseHandle (hObject=0x470) returned 1 [0175.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.id_1622540890_.your_last_chance")) returned 1 [0175.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHOOSH~1.YOU")) returned 0x5b96f0 [0175.144] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0175.144] GetProcessHeap () returned 0x580000 [0175.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6bc1) returned 0x7051908 [0175.144] GetProcessHeap () returned 0x580000 [0175.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6bc1) returned 0x70584d8 [0175.144] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.144] ReadFile (in: hFile=0x470, lpBuffer=0x7051908, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x7051908*, lpNumberOfBytesRead=0x448ff14*=0x6ba0, lpOverlapped=0x0) returned 1 [0176.563] GetProcessHeap () returned 0x580000 [0176.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.563] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.563] WriteFile (in: hFile=0x470, lpBuffer=0x70584d8*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x70584d8*, lpNumberOfBytesWritten=0x448ff14*=0x6ba0, lpOverlapped=0x0) returned 1 [0176.563] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.564] WriteFile (in: hFile=0x470, lpBuffer=0x705f077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f077*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.564] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.564] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.564] CloseHandle (hObject=0x470) returned 1 [0176.564] GetProcessHeap () returned 0x580000 [0176.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70584d8 | out: hHeap=0x580000) returned 1 [0176.564] GetProcessHeap () returned 0x580000 [0176.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7051908 | out: hHeap=0x580000) returned 1 [0176.564] GetProcessHeap () returned 0x580000 [0176.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0db3440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6be0, dwReserved0=0x448fd28, dwReserved1=0x7051908, cFileName="WHOOSH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHOOSH~1.YOU")) returned 0x5b96f0 [0179.054] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.070] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", len=0x46 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx") returned 1 [0179.071] GetProcessHeap () returned 0x580000 [0179.071] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0179.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.413] CloseHandle (hObject=0x488) returned 1 [0182.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.id_1622540890_.your_last_chance")) returned 1 [0182.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x221b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FANCYD~1.YOU")) returned 0x5b9770 [0182.414] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.414] GetProcessHeap () returned 0x580000 [0182.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x7058838 [0182.414] GetProcessHeap () returned 0x580000 [0182.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x711c020 [0182.414] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.414] ReadFile (in: hFile=0x488, lpBuffer=0x7058838, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x7058838*, lpNumberOfBytesRead=0x448ff14*=0x2200, lpOverlapped=0x0) returned 1 [0182.444] GetProcessHeap () returned 0x580000 [0182.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.444] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x488, lpBuffer=0x711c020*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c020*, lpNumberOfBytesWritten=0x448ff14*=0x2200, lpOverlapped=0x0) returned 1 [0182.444] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x488, lpBuffer=0x711e21f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x711e21f*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.444] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.444] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.445] CloseHandle (hObject=0x488) returned 1 [0182.445] GetProcessHeap () returned 0x580000 [0182.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c020 | out: hHeap=0x580000) returned 1 [0182.445] GetProcessHeap () returned 0x580000 [0182.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7058838 | out: hHeap=0x580000) returned 1 [0182.445] GetProcessHeap () returned 0x580000 [0182.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa45c9aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x223f, dwReserved0=0x448fd28, dwReserved1=0x7058838, cFileName="Fancy.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FANCYD~1.YOU")) returned 0x5b9770 [0183.684] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.704] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", len=0x79 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned 1 [0183.704] GetProcessHeap () returned 0x580000 [0183.704] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0183.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.705] CloseHandle (hObject=0x490) returned 1 [0183.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x740074, dwReserved1=0x640065, cFileName="UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNFORM~1.YOU")) returned 0x5b9770 [0183.723] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.723] GetProcessHeap () returned 0x580000 [0183.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x6fa6538 [0183.723] GetProcessHeap () returned 0x580000 [0183.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x6d630a8 [0183.723] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.723] ReadFile (in: hFile=0x490, lpBuffer=0x6fa6538, nNumberOfBytesToRead=0x4120, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6538*, lpNumberOfBytesRead=0x448ff14*=0x4120, lpOverlapped=0x0) returned 1 [0184.462] GetProcessHeap () returned 0x580000 [0184.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0184.462] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.463] WriteFile (in: hFile=0x490, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x448ff14*=0x4120, lpOverlapped=0x0) returned 1 [0184.463] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.463] WriteFile (in: hFile=0x490, lpBuffer=0x6d671c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d671c7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.463] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.463] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.463] CloseHandle (hObject=0x490) returned 1 [0184.877] GetProcessHeap () returned 0x580000 [0184.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0184.877] GetProcessHeap () returned 0x580000 [0184.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa6538 | out: hHeap=0x580000) returned 1 [0184.877] GetProcessHeap () returned 0x580000 [0184.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0185.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa58fac00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x414b, dwReserved0=0x448fd28, dwReserved1=0x6fa6538, cFileName="UnformattedNumeric.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNFORM~1.YOU")) returned 0x5b9770 [0185.532] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.578] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", len=0x5e | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned 1 [0185.578] GetProcessHeap () returned 0x580000 [0185.578] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2110) returned 0x6f14048 [0185.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.826] CloseHandle (hObject=0x4a8) returned 1 [0186.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~3.YOU")) returned 0x5b96b0 [0186.828] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.828] GetProcessHeap () returned 0x580000 [0186.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0186.828] GetProcessHeap () returned 0x580000 [0186.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0186.828] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.828] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x448ff14*=0x820, lpOverlapped=0x0) returned 1 [0186.836] GetProcessHeap () returned 0x580000 [0186.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0186.836] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.836] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x448ff14*=0x820, lpOverlapped=0x0) returned 1 [0186.836] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.837] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.837] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.837] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.837] CloseHandle (hObject=0x4a8) returned 1 [0186.837] GetProcessHeap () returned 0x580000 [0186.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0186.837] GetProcessHeap () returned 0x580000 [0186.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0186.837] GetProcessHeap () returned 0x580000 [0186.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0186.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6f97d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x448fd28, dwReserved1=0x6c79898, cFileName="MessageAttachmentIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~3.YOU")) returned 0x5b96b0 [0186.837] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.860] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", len=0x5b | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned 1 [0186.860] GetProcessHeap () returned 0x580000 [0186.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0186.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.401] CloseHandle (hObject=0x464) returned 1 [0188.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js.id_1622540890_.your_last_chance")) returned 1 [0188.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc118, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9770 [0188.403] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.403] GetProcessHeap () returned 0x580000 [0188.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc121) returned 0x6ff8ff8 [0188.403] GetProcessHeap () returned 0x580000 [0188.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc121) returned 0x70330f8 [0188.403] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.404] ReadFile (in: hFile=0x464, lpBuffer=0x6ff8ff8, nNumberOfBytesToRead=0xc100, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesRead=0x448ff14*=0xc100, lpOverlapped=0x0) returned 1 [0190.219] GetProcessHeap () returned 0x580000 [0190.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0190.219] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x464, lpBuffer=0x70330f8*, nNumberOfBytesToWrite=0xc100, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x70330f8*, lpNumberOfBytesWritten=0x448ff14*=0xc100, lpOverlapped=0x0) returned 1 [0190.219] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.220] WriteFile (in: hFile=0x464, lpBuffer=0x703f1f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x703f1f7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0190.220] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.220] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0190.220] CloseHandle (hObject=0x464) returned 1 [0190.220] GetProcessHeap () returned 0x580000 [0190.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70330f8 | out: hHeap=0x580000) returned 1 [0190.220] GetProcessHeap () returned 0x580000 [0190.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0190.220] GetProcessHeap () returned 0x580000 [0190.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0193.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8fe0760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc13c, dwReserved0=0x448fd28, dwReserved1=0x6ff8ff8, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9770 [0193.186] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.192] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned 1 [0193.192] GetProcessHeap () returned 0x580000 [0193.192] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2088) returned 0x6f14048 [0193.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0193.205] CloseHandle (hObject=0x428) returned 1 [0193.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.id_1622540890_.your_last_chance")) returned 1 [0193.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0193.207] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0193.207] GetProcessHeap () returned 0x580000 [0193.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6d08520 [0193.207] GetProcessHeap () returned 0x580000 [0193.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6d08b68 [0193.207] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.207] ReadFile (in: hFile=0x428, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x448ff14*=0x600, lpOverlapped=0x0) returned 1 [0193.214] GetProcessHeap () returned 0x580000 [0193.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0193.214] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.214] WriteFile (in: hFile=0x428, lpBuffer=0x6d08b68*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08b68*, lpNumberOfBytesWritten=0x448ff14*=0x600, lpOverlapped=0x0) returned 1 [0193.214] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.215] WriteFile (in: hFile=0x428, lpBuffer=0x6d09167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09167*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.215] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.215] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.215] CloseHandle (hObject=0x428) returned 1 [0193.215] GetProcessHeap () returned 0x580000 [0193.215] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08b68 | out: hHeap=0x580000) returned 1 [0193.215] GetProcessHeap () returned 0x580000 [0193.215] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0193.216] GetProcessHeap () returned 0x580000 [0193.216] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0193.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaac70f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x0, dwReserved1=0x580000, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0193.216] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.222] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned 1 [0193.222] GetProcessHeap () returned 0x580000 [0193.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x207c) returned 0x6f14048 [0193.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0193.223] CloseHandle (hObject=0x48c) returned 1 [0193.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.id_1622540890_.your_last_chance")) returned 1 [0193.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b9770 [0193.224] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0193.224] GetProcessHeap () returned 0x580000 [0193.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c3a820 [0193.224] GetProcessHeap () returned 0x580000 [0193.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c3b0a8 [0193.224] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.224] ReadFile (in: hFile=0x48c, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x448ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0193.232] GetProcessHeap () returned 0x580000 [0193.232] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.232] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.232] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3b0a8*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b0a8*, lpNumberOfBytesWritten=0x448ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0193.232] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.232] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3b887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b887*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.232] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.233] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.233] CloseHandle (hObject=0x48c) returned 1 [0193.233] GetProcessHeap () returned 0x580000 [0193.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3b0a8 | out: hHeap=0x580000) returned 1 [0193.233] GetProcessHeap () returned 0x580000 [0193.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0193.233] GetProcessHeap () returned 0x580000 [0193.233] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaac970c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x448fd28, dwReserved1=0x6c3a820, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b9770 [0193.233] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.238] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", len=0x69 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned 1 [0193.238] GetProcessHeap () returned 0x580000 [0193.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2074) returned 0x6f14048 [0193.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0193.239] CloseHandle (hObject=0x48c) returned 1 [0193.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.id_1622540890_.your_last_chance")) returned 1 [0193.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dda, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b9770 [0193.240] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0193.241] GetProcessHeap () returned 0x580000 [0193.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1de1) returned 0x6d31218 [0193.241] GetProcessHeap () returned 0x580000 [0193.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1de1) returned 0x6e0bce0 [0193.241] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.241] ReadFile (in: hFile=0x48c, lpBuffer=0x6d31218, nNumberOfBytesToRead=0x1dc0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d31218*, lpNumberOfBytesRead=0x448ff14*=0x1dc0, lpOverlapped=0x0) returned 1 [0193.268] GetProcessHeap () returned 0x580000 [0193.268] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0193.268] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.268] WriteFile (in: hFile=0x48c, lpBuffer=0x6e0bce0*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0bce0*, lpNumberOfBytesWritten=0x448ff14*=0x1dc0, lpOverlapped=0x0) returned 1 [0193.268] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.268] WriteFile (in: hFile=0x48c, lpBuffer=0x6e0da9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0da9f*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.269] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.269] CloseHandle (hObject=0x48c) returned 1 [0194.989] GetProcessHeap () returned 0x580000 [0194.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0bce0 | out: hHeap=0x580000) returned 1 [0194.989] GetProcessHeap () returned 0x580000 [0194.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d31218 | out: hHeap=0x580000) returned 1 [0194.989] GetProcessHeap () returned 0x580000 [0194.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0194.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabd66c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dfe, dwReserved0=0x448fd28, dwReserved1=0x6d31218, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b97b0 [0194.989] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.185] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", len=0x43 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned 1 [0197.185] GetProcessHeap () returned 0x580000 [0197.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0197.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0197.834] CloseHandle (hObject=0x43c) returned 1 [0197.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x70bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR7F~1.YOU")) returned 0x5b9830 [0197.836] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0197.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0197.836] GetProcessHeap () returned 0x580000 [0197.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x70c1) returned 0x6e063d0 [0197.836] GetProcessHeap () returned 0x580000 [0197.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x70c1) returned 0x715c008 [0197.836] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.836] ReadFile (in: hFile=0x43c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x70a0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x448ff14*=0x70a0, lpOverlapped=0x0) returned 1 [0198.631] GetProcessHeap () returned 0x580000 [0198.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0198.631] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x43c, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x70a0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x448ff14*=0x70a0, lpOverlapped=0x0) returned 1 [0198.631] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x43c, lpBuffer=0x71630a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x71630a7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.631] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.631] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.631] CloseHandle (hObject=0x43c) returned 1 [0198.866] GetProcessHeap () returned 0x580000 [0198.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0198.866] GetProcessHeap () returned 0x580000 [0198.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0198.866] GetProcessHeap () returned 0x580000 [0198.866] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0199.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae010c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x70e0, dwReserved0=0x448fd28, dwReserved1=0x6e063d0, cFileName="PDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR7F~1.YOU")) returned 0x5b96b0 [0199.654] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.965] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", len=0x67 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned 1 [0200.965] GetProcessHeap () returned 0x580000 [0200.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fac) returned 0x6f14048 [0200.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.816] CloseHandle (hObject=0x450) returned 1 [0201.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.id_1622540890_.your_last_chance")) returned 1 [0201.817] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b97b0 [0201.818] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.818] GetProcessHeap () returned 0x580000 [0201.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.818] GetProcessHeap () returned 0x580000 [0201.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.818] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.818] ReadFile (in: hFile=0x450, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x448ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.822] GetProcessHeap () returned 0x580000 [0201.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.822] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.822] WriteFile (in: hFile=0x450, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x448ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.822] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x450, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.823] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.823] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.823] CloseHandle (hObject=0x450) returned 1 [0201.823] GetProcessHeap () returned 0x580000 [0201.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.823] GetProcessHeap () returned 0x580000 [0201.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.823] GetProcessHeap () returned 0x580000 [0201.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafe90660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x448fd28, dwReserved1=0x6eef020, cFileName="Teal.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEALCS~1.YOU")) returned 0x5b9770 [0202.745] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.832] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS", len=0x45 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS") returned 1 [0202.832] GetProcessHeap () returned 0x580000 [0202.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0202.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0202.963] CloseHandle (hObject=0x44c) returned 1 [0202.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.964] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css.id_1622540890_.your_last_chance")) returned 1 [0202.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7FC2~1.YOU")) returned 0x5b9770 [0202.965] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0202.965] GetProcessHeap () returned 0x580000 [0202.965] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x727f0e8 [0202.965] GetProcessHeap () returned 0x580000 [0202.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7290918 [0202.966] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.966] ReadFile (in: hFile=0x44c, lpBuffer=0x727f0e8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x727f0e8*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.259] GetProcessHeap () returned 0x580000 [0209.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.259] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.259] WriteFile (in: hFile=0x44c, lpBuffer=0x7290918*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x7290918*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.260] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.260] WriteFile (in: hFile=0x44c, lpBuffer=0x72a2117*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x72a2117*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.260] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.260] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.260] CloseHandle (hObject=0x44c) returned 1 [0209.260] GetProcessHeap () returned 0x580000 [0209.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7290918 | out: hHeap=0x580000) returned 1 [0209.619] GetProcessHeap () returned 0x580000 [0209.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x727f0e8 | out: hHeap=0x580000) returned 1 [0209.619] GetProcessHeap () returned 0x580000 [0209.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0209.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4587640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fd12, dwReserved0=0x448fd28, dwReserved1=0x727f0e8, cFileName="SCHEME25.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7FC2~1.YOU")) returned 0x5b97f0 [0209.619] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.665] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", len=0x7a | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0209.665] GetProcessHeap () returned 0x580000 [0209.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0209.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.666] CloseHandle (hObject=0x3b8) returned 1 [0209.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0209.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x5c0065, dwReserved1=0x610062, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97f0 [0209.667] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.667] GetProcessHeap () returned 0x580000 [0209.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0209.667] GetProcessHeap () returned 0x580000 [0209.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0209.667] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.667] ReadFile (in: hFile=0x3b8, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x448ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.669] GetProcessHeap () returned 0x580000 [0209.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0209.669] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.669] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x448ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.669] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.669] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.669] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.669] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.670] CloseHandle (hObject=0x3b8) returned 1 [0209.670] GetProcessHeap () returned 0x580000 [0209.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0209.670] GetProcessHeap () returned 0x580000 [0209.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0209.670] GetProcessHeap () returned 0x580000 [0209.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0209.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4965a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x448fd28, dwReserved1=0x6dec6f8, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97f0 [0209.670] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.703] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x72 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0209.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0209.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.775] CloseHandle (hObject=0x450) returned 1 [0210.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.775] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0210.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x540054, dwReserved1=0x4e004f, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0210.776] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.776] GetProcessHeap () returned 0x580000 [0210.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0210.776] GetProcessHeap () returned 0x580000 [0210.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0210.776] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.776] ReadFile (in: hFile=0x450, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x448ff14*=0xa0, lpOverlapped=0x0) returned 1 [0210.778] GetProcessHeap () returned 0x580000 [0210.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0210.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.778] WriteFile (in: hFile=0x450, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x448ff14*=0xa0, lpOverlapped=0x0) returned 1 [0210.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.778] WriteFile (in: hFile=0x450, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.778] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.778] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.778] CloseHandle (hObject=0x450) returned 1 [0210.778] GetProcessHeap () returned 0x580000 [0210.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0210.778] GetProcessHeap () returned 0x580000 [0210.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0210.778] GetProcessHeap () returned 0x580000 [0210.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb53f5ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x448fd28, dwReserved1=0x60e8a8, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0214.644] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.737] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS", len=0x45 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS") returned 1 [0214.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0214.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0214.738] CloseHandle (hObject=0x418) returned 1 [0214.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css.id_1622540890_.your_last_chance")) returned 1 [0214.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1edba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC09C2~1.YOU")) returned 0x5b97b0 [0214.747] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0214.747] GetProcessHeap () returned 0x580000 [0214.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0214.747] GetProcessHeap () returned 0x580000 [0214.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0214.748] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.748] ReadFile (in: hFile=0x418, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.028] GetProcessHeap () returned 0x580000 [0220.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0220.029] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.029] WriteFile (in: hFile=0x418, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.029] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.029] WriteFile (in: hFile=0x418, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.029] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.029] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.029] CloseHandle (hObject=0x418) returned 1 [0220.029] GetProcessHeap () returned 0x580000 [0220.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0220.029] GetProcessHeap () returned 0x580000 [0220.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0220.029] GetProcessHeap () returned 0x580000 [0220.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbac2eb00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1edde, dwReserved0=0x448fd28, dwReserved1=0x6d21878, cFileName="SCHEME05.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC09C2~1.YOU")) returned 0x5b9730 [0221.476] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.610] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", len=0x4c | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 1 [0221.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f40) returned 0x6dee6e0 [0221.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.611] CloseHandle (hObject=0x47c) returned 1 [0221.611] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.611] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id_1622540890_.your_last_chance")) returned 1 [0221.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x450043, dwReserved1=0x0, cFileName="SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SESSIO~1.YOU")) returned 0x5b9730 [0221.612] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.612] GetProcessHeap () returned 0x580000 [0221.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10060 [0221.612] GetProcessHeap () returned 0x580000 [0221.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c10ae8 [0221.613] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.613] ReadFile (in: hFile=0x47c, lpBuffer=0x6c10060, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x448ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0221.638] GetProcessHeap () returned 0x580000 [0221.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.638] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.638] WriteFile (in: hFile=0x47c, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x448ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0221.638] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.638] WriteFile (in: hFile=0x47c, lpBuffer=0x6c114c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c114c7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.638] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.638] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.638] CloseHandle (hObject=0x47c) returned 1 [0221.652] GetProcessHeap () returned 0x580000 [0221.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0221.652] GetProcessHeap () returned 0x580000 [0221.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0221.652] GetProcessHeap () returned 0x580000 [0221.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0223.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbb818a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa1a, dwReserved0=0x448fd28, dwReserved1=0x6c10060, cFileName="SessionOwner.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SESSIO~1.YOU")) returned 0x5b96f0 [0223.403] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.430] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", len=0x62 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned 1 [0223.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0223.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0223.431] CloseHandle (hObject=0x46c) returned 1 [0223.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.id_1622540890_.your_last_chance")) returned 1 [0223.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b96f0 [0223.432] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0223.433] GetProcessHeap () returned 0x580000 [0223.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6599e8 [0223.433] GetProcessHeap () returned 0x580000 [0223.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x659d90 [0223.433] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.433] ReadFile (in: hFile=0x46c, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x448ff14*=0x360, lpOverlapped=0x0) returned 1 [0223.454] GetProcessHeap () returned 0x580000 [0223.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0223.454] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.454] WriteFile (in: hFile=0x46c, lpBuffer=0x659d90*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x659d90*, lpNumberOfBytesWritten=0x448ff14*=0x360, lpOverlapped=0x0) returned 1 [0223.455] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.455] WriteFile (in: hFile=0x46c, lpBuffer=0x65a0ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a0ef*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.456] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.456] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.456] CloseHandle (hObject=0x46c) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659d90 | out: hHeap=0x580000) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0223.461] GetProcessHeap () returned 0x580000 [0223.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0225.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcce9980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x448fd28, dwReserved1=0x6599e8, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b9630 [0225.971] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.014] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK", len=0x48 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 1 [0226.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd0) returned 0x6dee6e0 [0226.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.053] CloseHandle (hObject=0x454) returned 1 [0226.053] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.053] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0226.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN4342~1.YOU")) returned 0x5b9630 [0226.054] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.054] GetProcessHeap () returned 0x580000 [0226.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0226.054] GetProcessHeap () returned 0x580000 [0226.054] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0226.054] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.054] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x448ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.056] GetProcessHeap () returned 0x580000 [0226.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.056] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.056] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x448ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.056] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.056] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.056] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.056] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.056] CloseHandle (hObject=0x454) returned 1 [0226.056] GetProcessHeap () returned 0x580000 [0226.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0226.057] GetProcessHeap () returned 0x580000 [0226.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0226.057] GetProcessHeap () returned 0x580000 [0226.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe41f000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x448fd28, dwReserved1=0x61b540, cFileName="INFOPATHEDITOR_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN4342~1.YOU")) returned 0x5b9630 [0226.427] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.489] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", len=0x59 | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned 1 [0226.489] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d8c) returned 0x6dee6e0 [0226.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0226.489] CloseHandle (hObject=0x430) returned 1 [0226.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0239.320] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9730 [0239.321] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0239.322] GetProcessHeap () returned 0x580000 [0239.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0239.322] GetProcessHeap () returned 0x580000 [0239.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0239.322] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.322] ReadFile (in: hFile=0x3f4, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x448ff14*=0xc0, lpOverlapped=0x0) returned 1 [0239.324] GetProcessHeap () returned 0x580000 [0239.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0239.324] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.324] WriteFile (in: hFile=0x3f4, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x448ff14*=0xc0, lpOverlapped=0x0) returned 1 [0239.324] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.324] WriteFile (in: hFile=0x3f4, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.324] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.324] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.324] CloseHandle (hObject=0x3f4) returned 1 [0239.324] GetProcessHeap () returned 0x580000 [0239.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0239.324] GetProcessHeap () returned 0x580000 [0239.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0239.324] GetProcessHeap () returned 0x580000 [0239.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0240.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc62ba220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x448fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9730 [0240.632] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.646] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML", len=0x4f | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned 1 [0240.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0240.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.647] CloseHandle (hObject=0x3a8) returned 1 [0240.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.647] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml.id_1622540890_.your_last_chance")) returned 1 [0240.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~4.YOU")) returned 0x5b9730 [0240.648] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.648] GetProcessHeap () returned 0x580000 [0240.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.648] GetProcessHeap () returned 0x580000 [0240.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.648] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.648] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x448ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.661] GetProcessHeap () returned 0x580000 [0240.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.661] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.661] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x448ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.661] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.661] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.661] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.661] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.661] CloseHandle (hObject=0x3a8) returned 1 [0240.674] GetProcessHeap () returned 0x580000 [0240.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.674] GetProcessHeap () returned 0x580000 [0240.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.674] GetProcessHeap () returned 0x580000 [0240.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f5f700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x448fd28, dwReserved1=0x6d07028, cFileName="YAHOO.COM.SG.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~4.YOU")) returned 0x5b9630 [0241.780] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.822] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML", len=0x3f | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned 1 [0241.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0241.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0244.959] CloseHandle (hObject=0x414) returned 1 [0244.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml.id_1622540890_.your_last_chance")) returned 1 [0244.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a49300, ftCreationTime.dwHighDateTime=0x1c6946d, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7a49300, ftLastWriteTime.dwHighDateTime=0x1c6946d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN07~1.YOU")) returned 0x5b96f0 [0244.960] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0244.961] GetProcessHeap () returned 0x580000 [0244.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa001) returned 0x7287008 [0244.962] GetProcessHeap () returned 0x580000 [0244.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa001) returned 0x7291018 [0244.962] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.962] ReadFile (in: hFile=0x414, lpBuffer=0x7287008, nNumberOfBytesToRead=0x9fe0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x7287008*, lpNumberOfBytesRead=0x448ff14*=0x9fe0, lpOverlapped=0x0) returned 1 [0246.999] GetProcessHeap () returned 0x580000 [0246.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0246.999] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.000] WriteFile (in: hFile=0x414, lpBuffer=0x7291018*, nNumberOfBytesToWrite=0x9fe0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x7291018*, lpNumberOfBytesWritten=0x448ff14*=0x9fe0, lpOverlapped=0x0) returned 1 [0247.000] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.000] WriteFile (in: hFile=0x414, lpBuffer=0x729aff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x729aff7*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0247.000] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.001] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0247.001] CloseHandle (hObject=0x414) returned 1 [0247.916] GetProcessHeap () returned 0x580000 [0247.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7291018 | out: hHeap=0x580000) returned 1 [0247.916] GetProcessHeap () returned 0x580000 [0247.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7287008 | out: hHeap=0x580000) returned 1 [0247.916] GetProcessHeap () returned 0x580000 [0247.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0249.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a49300, ftCreationTime.dwHighDateTime=0x1c6946d, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcabec6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa018, dwReserved0=0x448fd28, dwReserved1=0x7287008, cFileName="PGMN075.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN07~1.YOU")) returned 0x5b9730 [0249.338] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.414] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC", len=0x3e | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 1 [0249.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0249.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0252.984] CloseHandle (hObject=0x468) returned 1 [0252.984] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0252.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id_1622540890_.your_last_chance")) returned 1 [0253.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x243f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCHUR~2.YOU")) returned 0x5b96f0 [0253.018] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0253.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0253.018] GetProcessHeap () returned 0x580000 [0253.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0253.019] GetProcessHeap () returned 0x580000 [0253.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0253.020] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.020] ReadFile (in: hFile=0x468, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.366] GetProcessHeap () returned 0x580000 [0257.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0257.366] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.366] WriteFile (in: hFile=0x468, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x448ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.367] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.367] WriteFile (in: hFile=0x468, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.870] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.870] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.870] CloseHandle (hObject=0x468) returned 1 [0258.304] GetProcessHeap () returned 0x580000 [0258.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0258.304] GetProcessHeap () returned 0x580000 [0258.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0258.304] GetProcessHeap () returned 0x580000 [0258.304] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0259.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fccc | out: lpFindFileData=0x448fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd139e500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x243f3e, dwReserved0=0x448fd28, dwReserved1=0x72f0208, cFileName="BRCHUR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCHUR~2.YOU")) returned 0x5b9630 [0259.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.232] SysReAllocStringLen (in: pbstr=0x448ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC", len=0x3d | out: pbstr=0x448ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC") returned 1 [0259.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c4) returned 0x72e5948 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0259.388] CloseHandle (hObject=0x430) returned 1 [0259.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc.id_1622540890_.your_last_chance")) returned 1 [0259.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x448ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x448fc74 | out: lpFindFileData=0x448fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBHOME.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBHOM~1.YOU")) returned 0x5b9630 [0259.389] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0259.389] GetProcessHeap () returned 0x580000 [0259.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x6ec9418 [0259.389] GetProcessHeap () returned 0x580000 [0259.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x70ba8c8 [0259.390] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.390] ReadFile (in: hFile=0x430, lpBuffer=0x6ec9418, nNumberOfBytesToRead=0x31c0, lpNumberOfBytesRead=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec9418*, lpNumberOfBytesRead=0x448ff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.860] GetProcessHeap () returned 0x580000 [0261.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0261.860] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.860] WriteFile (in: hFile=0x430, lpBuffer=0x70ba8c8*, nNumberOfBytesToWrite=0x31c0, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x70ba8c8*, lpNumberOfBytesWritten=0x448ff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.861] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.861] WriteFile (in: hFile=0x430, lpBuffer=0x70bda87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bda87*, lpNumberOfBytesWritten=0x448ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.861] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.861] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x448ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x448ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.861] CloseHandle (hObject=0x430) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70ba8c8 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec9418 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 Thread: id = 32 os_tid = 0xa78 [0039.065] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.147] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.837] Sleep (dwMilliseconds=0x1) [0039.867] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.509] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.313] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.696] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.845] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.923] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.015] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.281] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.310] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.388] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.730] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.778] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.949] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.028] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.526] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.666] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.744] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.853] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.931] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.056] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.087] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.290] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.368] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.399] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.446] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.524] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.727] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.351] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.460] Sleep (dwMilliseconds=0x1) [0046.478] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.819] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.897] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.411] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.442] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.754] Sleep (dwMilliseconds=0x1) [0047.770] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.988] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.066] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.113] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.144] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.316] Sleep (dwMilliseconds=0x1) [0048.333] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.456] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.503] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.628] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.924] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.049] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.080] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.127] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.236] Sleep (dwMilliseconds=0x1) [0049.252] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.673] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.751] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.876] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.063] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.484] Sleep (dwMilliseconds=0x1) [0050.500] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.548] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.640] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.108] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.155] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.188] Sleep (dwMilliseconds=0x1) [0052.198] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.682] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.744] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.791] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.134] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.290] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.571] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.602] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.883] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.039] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.117] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.242] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.351] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.398] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.866] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.131] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.178] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.209] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.334] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.536] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", len=0x4a | out: pbstr=0x45cff84*="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 1 [0055.536] GetProcessHeap () returned 0x580000 [0055.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94b0 | out: hHeap=0x580000) returned 1 [0055.536] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0055.536] CloseHandle (hObject=0x3fc) returned 1 [0055.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.536] MoveFileW (lpExistingFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.your_last_chance")) returned 1 [0055.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.537] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKTO~1.YOU")) returned 0x5b95f0 [0055.537] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.537] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0055.537] GetProcessHeap () returned 0x580000 [0055.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x61fc20 [0055.537] GetProcessHeap () returned 0x580000 [0055.537] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x61fcd0 [0055.537] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.537] ReadFile (in: hFile=0x3fc, lpBuffer=0x61fc20, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x61fc20*, lpNumberOfBytesRead=0x45cff14*=0x80, lpOverlapped=0x0) returned 1 [0055.538] GetProcessHeap () returned 0x580000 [0055.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a) returned 0x61f5a8 [0055.538] GetProcessHeap () returned 0x580000 [0055.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x615280 [0055.538] GetProcessHeap () returned 0x580000 [0055.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x5b4cb8 [0055.539] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.539] WriteFile (in: hFile=0x3fc, lpBuffer=0x61fcd0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x61fcd0*, lpNumberOfBytesWritten=0x45cff14*=0x80, lpOverlapped=0x0) returned 1 [0055.539] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.539] WriteFile (in: hFile=0x3fc, lpBuffer=0x61fd4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x61fd4f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0055.539] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.539] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0055.539] CloseHandle (hObject=0x3fc) returned 1 [0055.540] GetProcessHeap () returned 0x580000 [0055.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61fcd0 | out: hHeap=0x580000) returned 1 [0055.540] GetProcessHeap () returned 0x580000 [0055.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61fc20 | out: hHeap=0x580000) returned 1 [0055.540] GetProcessHeap () returned 0x580000 [0055.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b4cb8 | out: hHeap=0x580000) returned 1 [0055.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.540] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x58e7e480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x23, dwReserved1=0x5b4cb0, cFileName="desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKTO~1.YOU")) returned 0x5b95f0 [0055.540] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.540] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.696] Sleep (dwMilliseconds=0x1) [0055.839] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Boot\\Fonts\\jpn_boot.ttf", len=0x1a | out: pbstr=0x45cff84*="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 1 [0055.839] GetProcessHeap () returned 0x580000 [0055.839] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9588 [0055.839] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.846] Sleep (dwMilliseconds=0x1) [0061.798] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", len=0x4d | out: pbstr=0x45cff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 1 [0061.798] GetProcessHeap () returned 0x580000 [0061.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x50) returned 0x5b5bc8 [0061.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0070.280] CloseHandle (hObject=0x43c) returned 1 [0070.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.280] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id_1622540890_.your_last_chance")) returned 1 [0072.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0072.697] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~1.YOU")) returned 0x5b9770 [0072.698] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0072.698] GetProcessHeap () returned 0x580000 [0072.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x6f0b980 [0072.698] GetProcessHeap () returned 0x580000 [0072.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41e1) returned 0x6599d0 [0072.698] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.698] ReadFile (in: hFile=0x170, lpBuffer=0x6f0b980, nNumberOfBytesToRead=0x41c0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0b980*, lpNumberOfBytesRead=0x45cff14*=0x41c0, lpOverlapped=0x0) returned 1 [0073.777] GetProcessHeap () returned 0x580000 [0073.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0073.778] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.778] WriteFile (in: hFile=0x170, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x45cff14*=0x41c0, lpOverlapped=0x0) returned 1 [0073.778] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.778] WriteFile (in: hFile=0x170, lpBuffer=0x65db8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x65db8f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0073.778] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.778] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0073.778] CloseHandle (hObject=0x170) returned 1 [0074.354] GetProcessHeap () returned 0x580000 [0074.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0074.355] GetProcessHeap () returned 0x580000 [0074.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0b980 | out: hHeap=0x580000) returned 1 [0074.355] GetProcessHeap () returned 0x580000 [0074.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0074.648] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63a9fb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x41f8, dwReserved0=0x45cfd28, dwReserved1=0x6f0b980, cFileName="ProPlusrWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~1.YOU")) returned 0x5b9730 [0074.925] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.938] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", len=0x4c | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 1 [0074.938] GetProcessHeap () returned 0x580000 [0074.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0074.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.646] Sleep (dwMilliseconds=0x1) [0084.475] Sleep (dwMilliseconds=0x1) [0084.497] Sleep (dwMilliseconds=0x1) [0086.425] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", len=0x45 | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 1 [0086.425] GetProcessHeap () returned 0x580000 [0086.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0087.519] CloseHandle (hObject=0x46c) returned 1 [0087.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0087.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id_1622540890_.your_last_chance")) returned 1 [0087.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AXISIN~1.YOU")) returned 0x5b96b0 [0087.564] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0087.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0087.564] GetProcessHeap () returned 0x580000 [0087.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0087.565] GetProcessHeap () returned 0x580000 [0087.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0087.565] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.565] ReadFile (in: hFile=0x46c, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x45cff14*=0x200, lpOverlapped=0x0) returned 1 [0087.567] GetProcessHeap () returned 0x580000 [0087.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0087.567] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.567] WriteFile (in: hFile=0x46c, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x45cff14*=0x200, lpOverlapped=0x0) returned 1 [0087.567] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.568] WriteFile (in: hFile=0x46c, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0087.568] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.568] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0087.568] CloseHandle (hObject=0x46c) returned 1 [0087.568] GetProcessHeap () returned 0x580000 [0087.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0087.568] GetProcessHeap () returned 0x580000 [0087.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0087.568] GetProcessHeap () returned 0x580000 [0087.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf2fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x45cfd28, dwReserved1=0x6107d8, cFileName="AXIS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AXISIN~1.YOU")) returned 0x5b96b0 [0088.146] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.853] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", len=0x47 | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 1 [0091.853] GetProcessHeap () returned 0x580000 [0091.853] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f6c0 [0091.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0091.856] CloseHandle (hObject=0x414) returned 1 [0091.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0091.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0091.858] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0091.858] GetProcessHeap () returned 0x580000 [0091.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x646710 [0091.859] GetProcessHeap () returned 0x580000 [0091.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x647120 [0091.859] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.859] ReadFile (in: hFile=0x414, lpBuffer=0x646710, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x646710*, lpNumberOfBytesRead=0x45cff14*=0x9e0, lpOverlapped=0x0) returned 1 [0091.870] GetProcessHeap () returned 0x580000 [0091.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.870] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.870] WriteFile (in: hFile=0x414, lpBuffer=0x647120*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x647120*, lpNumberOfBytesWritten=0x45cff14*=0x9e0, lpOverlapped=0x0) returned 1 [0091.870] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.870] WriteFile (in: hFile=0x414, lpBuffer=0x647aff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x647aff*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0091.871] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.871] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0091.871] CloseHandle (hObject=0x414) returned 1 [0091.871] GetProcessHeap () returned 0x580000 [0091.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x647120 | out: hHeap=0x580000) returned 1 [0091.871] GetProcessHeap () returned 0x580000 [0091.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x646710 | out: hHeap=0x580000) returned 1 [0091.871] GetProcessHeap () returned 0x580000 [0091.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e602b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa1c, dwReserved0=0x45cfd28, dwReserved1=0x646710, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0091.871] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.884] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", len=0x48 | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 1 [0091.885] GetProcessHeap () returned 0x580000 [0091.885] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669420, Size=0x48) returned 0x596c88 [0091.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0092.008] CloseHandle (hObject=0x450) returned 1 [0092.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0092.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0092.009] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0092.010] GetProcessHeap () returned 0x580000 [0092.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6c676b8 [0092.010] GetProcessHeap () returned 0x580000 [0092.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6c55668 [0092.010] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.010] ReadFile (in: hFile=0x450, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x45cff14*=0x9a0, lpOverlapped=0x0) returned 1 [0092.127] GetProcessHeap () returned 0x580000 [0092.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.127] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.127] WriteFile (in: hFile=0x450, lpBuffer=0x6c55668*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55668*, lpNumberOfBytesWritten=0x45cff14*=0x9a0, lpOverlapped=0x0) returned 1 [0092.127] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.127] WriteFile (in: hFile=0x450, lpBuffer=0x6c56007*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56007*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.127] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.128] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.128] CloseHandle (hObject=0x450) returned 1 [0092.128] GetProcessHeap () returned 0x580000 [0092.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c55668 | out: hHeap=0x580000) returned 1 [0092.128] GetProcessHeap () returned 0x580000 [0092.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0092.128] GetProcessHeap () returned 0x580000 [0092.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e864160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x45cfd28, dwReserved1=0x6c676b8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0092.128] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0092.142] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", len=0x49 | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 1 [0092.142] GetProcessHeap () returned 0x580000 [0092.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x84) returned 0x61b4b0 [0092.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0094.693] CloseHandle (hObject=0x4b0) returned 1 [0094.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0099.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.192] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0099.193] GetProcessHeap () returned 0x580000 [0099.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6d04600 [0099.193] GetProcessHeap () returned 0x580000 [0099.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6f0c4f8 [0099.193] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.193] ReadFile (in: hFile=0x4b0, lpBuffer=0x6d04600, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04600*, lpNumberOfBytesRead=0x45cff14*=0x620, lpOverlapped=0x0) returned 1 [0099.200] GetProcessHeap () returned 0x580000 [0099.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.200] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.200] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x45cff14*=0x620, lpOverlapped=0x0) returned 1 [0099.200] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.200] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f0cb17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cb17*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0099.200] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.200] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0099.201] CloseHandle (hObject=0x4b0) returned 1 [0099.201] GetProcessHeap () returned 0x580000 [0099.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0099.201] GetProcessHeap () returned 0x580000 [0099.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04600 | out: hHeap=0x580000) returned 1 [0099.201] GetProcessHeap () returned 0x580000 [0099.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72bc9040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65d, dwReserved0=0x45cfd28, dwReserved1=0x6d04600, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.201] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.402] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", len=0x4a | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 1 [0101.402] GetProcessHeap () returned 0x580000 [0101.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0101.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0101.418] CloseHandle (hObject=0x3f8) returned 1 [0101.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0101.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.419] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0101.419] GetProcessHeap () returned 0x580000 [0101.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6f0c4f8 [0101.419] GetProcessHeap () returned 0x580000 [0101.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c676b8 [0101.419] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.420] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x45cff14*=0x680, lpOverlapped=0x0) returned 1 [0101.427] GetProcessHeap () returned 0x580000 [0101.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.427] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.427] WriteFile (in: hFile=0x3f8, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x45cff14*=0x680, lpOverlapped=0x0) returned 1 [0101.427] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.427] WriteFile (in: hFile=0x3f8, lpBuffer=0x6c67d37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67d37*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0101.427] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.427] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0101.427] CloseHandle (hObject=0x3f8) returned 1 [0101.427] GetProcessHeap () returned 0x580000 [0101.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0101.427] GetProcessHeap () returned 0x580000 [0101.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0101.428] GetProcessHeap () returned 0x580000 [0101.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7410f4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6af, dwReserved0=0x45cfd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.428] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.432] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", len=0x4d | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 1 [0101.432] GetProcessHeap () returned 0x580000 [0101.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0101.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0101.573] CloseHandle (hObject=0x40c) returned 1 [0101.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id_1622540890_.your_last_chance")) returned 1 [0101.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMIPN~1.YOU")) returned 0x5b9630 [0101.623] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0101.623] GetProcessHeap () returned 0x580000 [0101.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x67c940 [0101.623] GetProcessHeap () returned 0x580000 [0101.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6d011e8 [0101.623] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.623] ReadFile (in: hFile=0x40c, lpBuffer=0x67c940, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x45cff14*=0x220, lpOverlapped=0x0) returned 1 [0101.663] GetProcessHeap () returned 0x580000 [0101.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.663] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.663] WriteFile (in: hFile=0x40c, lpBuffer=0x6d011e8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d011e8*, lpNumberOfBytesWritten=0x45cff14*=0x220, lpOverlapped=0x0) returned 1 [0101.663] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.664] WriteFile (in: hFile=0x40c, lpBuffer=0x6d01407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01407*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0101.664] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.664] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0101.664] CloseHandle (hObject=0x40c) returned 1 [0101.664] GetProcessHeap () returned 0x580000 [0101.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d011e8 | out: hHeap=0x580000) returned 1 [0101.664] GetProcessHeap () returned 0x580000 [0101.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0101.664] GetProcessHeap () returned 0x580000 [0101.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7434a980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x45cfd28, dwReserved1=0x67c940, cFileName="SUMIPNTG.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMIPN~1.YOU")) returned 0x5b9630 [0101.664] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.712] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", len=0x47 | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 1 [0101.713] GetProcessHeap () returned 0x580000 [0101.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0101.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0102.618] CloseHandle (hObject=0x43c) returned 1 [0102.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id_1622540890_.your_last_chance")) returned 1 [0103.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0103.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERI~1.YOU")) returned 0x5b9630 [0104.708] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0105.735] GetProcessHeap () returned 0x580000 [0105.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5bad00 [0105.735] GetProcessHeap () returned 0x580000 [0105.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5b0428 [0105.735] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.735] ReadFile (in: hFile=0x45c, lpBuffer=0x5bad00, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesRead=0x45cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0105.738] GetProcessHeap () returned 0x580000 [0105.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0105.738] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.738] WriteFile (in: hFile=0x45c, lpBuffer=0x5b0428*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5b0428*, lpNumberOfBytesWritten=0x45cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0105.738] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.738] WriteFile (in: hFile=0x45c, lpBuffer=0x5b05c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5b05c7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0105.738] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.738] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0105.739] CloseHandle (hObject=0x45c) returned 1 [0106.370] GetProcessHeap () returned 0x580000 [0106.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b0428 | out: hHeap=0x580000) returned 1 [0106.370] GetProcessHeap () returned 0x580000 [0106.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0106.370] GetProcessHeap () returned 0x580000 [0106.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0106.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a451c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x45cfd28, dwReserved1=0x5bad00, cFileName="WATER.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERI~1.YOU")) returned 0x5b96f0 [0106.370] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.873] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", len=0x4d | out: pbstr=0x45cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 1 [0106.873] GetProcessHeap () returned 0x580000 [0106.873] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x2c) returned 0x61f420 [0106.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0107.721] CloseHandle (hObject=0x458) returned 1 [0107.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id_1622540890_.your_last_chance")) returned 1 [0107.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHTMTX~1.YOU")) returned 0x5b9730 [0107.722] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0107.722] GetProcessHeap () returned 0x580000 [0107.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dd3a60 [0107.722] GetProcessHeap () returned 0x580000 [0107.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de5290 [0107.722] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.722] ReadFile (in: hFile=0x458, lpBuffer=0x6dd3a60, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a60*, lpNumberOfBytesRead=0x45cff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.391] GetProcessHeap () returned 0x580000 [0111.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0111.391] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.391] WriteFile (in: hFile=0x458, lpBuffer=0x6de5290*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5290*, lpNumberOfBytesWritten=0x45cff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.391] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.392] WriteFile (in: hFile=0x458, lpBuffer=0x6df6a8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a8f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0111.664] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.664] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0111.664] CloseHandle (hObject=0x458) returned 1 [0111.664] GetProcessHeap () returned 0x580000 [0111.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5290 | out: hHeap=0x580000) returned 1 [0111.664] GetProcessHeap () returned 0x580000 [0111.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd3a60 | out: hHeap=0x580000) returned 1 [0111.664] GetProcessHeap () returned 0x580000 [0111.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0111.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a2a7ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdfcbc, dwReserved0=0x45cfd28, dwReserved1=0x6dd3a60, cFileName="WHTMTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHTMTX~1.YOU")) returned 0x5b9730 [0111.664] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.048] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", len=0x49 | out: pbstr=0x45cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 1 [0112.048] GetProcessHeap () returned 0x580000 [0112.048] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61abb8 [0112.048] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.067] Sleep (dwMilliseconds=0x1) [0112.190] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.206] Sleep (dwMilliseconds=0x1) [0112.315] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", len=0x40 | out: pbstr=0x45cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned 1 [0112.315] GetProcessHeap () returned 0x580000 [0112.315] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.328] Sleep (dwMilliseconds=0x1) [0113.331] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", len=0x3f | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 1 [0113.331] GetProcessHeap () returned 0x580000 [0113.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xa0) returned 0x6f0ceb8 [0113.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0113.481] CloseHandle (hObject=0x448) returned 1 [0113.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0091~1.YOU")) returned 0x5b9630 [0114.513] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0114.514] GetProcessHeap () returned 0x580000 [0114.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x652c90 [0114.514] GetProcessHeap () returned 0x580000 [0114.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x655700 [0114.514] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.514] ReadFile (in: hFile=0x448, lpBuffer=0x652c90, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x652c90*, lpNumberOfBytesRead=0x45cff14*=0x2a40, lpOverlapped=0x0) returned 1 [0116.675] GetProcessHeap () returned 0x580000 [0116.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.675] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.675] WriteFile (in: hFile=0x448, lpBuffer=0x655700*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x655700*, lpNumberOfBytesWritten=0x45cff14*=0x2a40, lpOverlapped=0x0) returned 1 [0116.675] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.675] WriteFile (in: hFile=0x448, lpBuffer=0x65813f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x65813f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0116.676] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.676] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0116.676] CloseHandle (hObject=0x448) returned 1 [0116.676] GetProcessHeap () returned 0x580000 [0116.676] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x655700 | out: hHeap=0x580000) returned 1 [0116.676] GetProcessHeap () returned 0x580000 [0116.676] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x652c90 | out: hHeap=0x580000) returned 1 [0116.676] GetProcessHeap () returned 0x580000 [0116.676] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d28f5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a74, dwReserved0=0x45cfd28, dwReserved1=0x652c90, cFileName="AN00914_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0091~1.YOU")) returned 0x5b9630 [0117.995] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0118.655] CloseHandle (hObject=0x48c) returned 1 [0118.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~2.YOU")) returned 0x5b9730 [0118.656] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0118.656] GetProcessHeap () returned 0x580000 [0118.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b81) returned 0x6df0e30 [0118.656] GetProcessHeap () returned 0x580000 [0118.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b81) returned 0x6eef008 [0118.657] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.657] ReadFile (in: hFile=0x48c, lpBuffer=0x6df0e30, nNumberOfBytesToRead=0x5b60, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df0e30*, lpNumberOfBytesRead=0x45cff14*=0x5b60, lpOverlapped=0x0) returned 1 [0119.317] GetProcessHeap () returned 0x580000 [0119.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0119.317] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.317] WriteFile (in: hFile=0x48c, lpBuffer=0x6eef008*, nNumberOfBytesToWrite=0x5b60, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesWritten=0x45cff14*=0x5b60, lpOverlapped=0x0) returned 1 [0119.317] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.318] WriteFile (in: hFile=0x48c, lpBuffer=0x6ef4b67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef4b67*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0119.318] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.318] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0119.318] CloseHandle (hObject=0x48c) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df0e30 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ebb3e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b94, dwReserved0=0x45cfd28, dwReserved1=0x6df0e30, cFileName="SO02793_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~2.YOU")) returned 0x5b96f0 [0120.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.157] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", len=0x4c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 1 [0120.157] GetProcessHeap () returned 0x580000 [0120.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1788) returned 0x6d06ca8 [0120.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.773] CloseHandle (hObject=0x48c) returned 1 [0120.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.id_1622540890_.your_last_chance")) returned 1 [0120.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J0C8A9~1.YOU")) returned 0x5b9630 [0120.774] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.775] GetProcessHeap () returned 0x580000 [0120.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c65108 [0120.775] GetProcessHeap () returned 0x580000 [0120.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0120.775] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.775] ReadFile (in: hFile=0x48c, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x45cff14*=0x400, lpOverlapped=0x0) returned 1 [0120.780] GetProcessHeap () returned 0x580000 [0120.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.780] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.780] WriteFile (in: hFile=0x48c, lpBuffer=0x6c6a110*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesWritten=0x45cff14*=0x400, lpOverlapped=0x0) returned 1 [0120.780] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.780] WriteFile (in: hFile=0x48c, lpBuffer=0x6c6a50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a50f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.781] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.781] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.781] CloseHandle (hObject=0x48c) returned 1 [0120.781] GetProcessHeap () returned 0x580000 [0120.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0120.781] GetProcessHeap () returned 0x580000 [0120.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0120.781] GetProcessHeap () returned 0x580000 [0120.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f9aff40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x45cfd28, dwReserved1=0x6c65108, cFileName="J0143752.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J0C8A9~1.YOU")) returned 0x5b9630 [0120.781] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.791] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", len=0x4c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 1 [0120.791] GetProcessHeap () returned 0x580000 [0120.791] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x183c) returned 0x6e00ac0 [0120.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.636] CloseHandle (hObject=0x3fc) returned 1 [0122.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.id_1622540890_.your_last_chance")) returned 1 [0122.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0122.637] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.638] GetProcessHeap () returned 0x580000 [0122.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.638] GetProcessHeap () returned 0x580000 [0122.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.638] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.638] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x45cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.643] GetProcessHeap () returned 0x580000 [0122.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.643] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.643] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x45cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.643] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.643] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.643] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.643] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.643] CloseHandle (hObject=0x3fc) returned 1 [0122.643] GetProcessHeap () returned 0x580000 [0122.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.643] GetProcessHeap () returned 0x580000 [0122.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.643] GetProcessHeap () returned 0x580000 [0122.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b642e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x45cfd28, dwReserved1=0x678958, cFileName="Origin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0124.520] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.541] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", len=0x4b | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned 1 [0124.541] GetProcessHeap () returned 0x580000 [0124.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f0) returned 0x6f42f08 [0124.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0124.581] CloseHandle (hObject=0x48c) returned 1 [0124.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.id_1622540890_.your_last_chance")) returned 1 [0124.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x45, dwReserved1=0x0, cFileName="Equity.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQUITY~1.YOU")) returned 0x5b9730 [0124.582] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0124.582] GetProcessHeap () returned 0x580000 [0124.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0124.582] GetProcessHeap () returned 0x580000 [0124.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0124.582] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.582] ReadFile (in: hFile=0x48c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x45cff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.628] GetProcessHeap () returned 0x580000 [0124.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0124.628] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.628] WriteFile (in: hFile=0x48c, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x45cff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.629] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.629] WriteFile (in: hFile=0x48c, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.629] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.629] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.629] CloseHandle (hObject=0x48c) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0125.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81e6f2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x45cfd28, dwReserved1=0x6c29878, cFileName="Equity.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQUITY~1.YOU")) returned 0x5b9730 [0125.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.343] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", len=0x3d | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned 1 [0125.343] GetProcessHeap () returned 0x580000 [0125.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1948) returned 0x6f42f08 [0125.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0128.881] CloseHandle (hObject=0x480) returned 1 [0128.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02333~1.YOU")) returned 0x5b9730 [0130.199] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0130.199] GetProcessHeap () returned 0x580000 [0130.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8101) returned 0x6d35fa8 [0130.199] GetProcessHeap () returned 0x580000 [0130.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8101) returned 0x6d3e0b8 [0130.199] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.199] ReadFile (in: hFile=0x480, lpBuffer=0x6d35fa8, nNumberOfBytesToRead=0x80e0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35fa8*, lpNumberOfBytesRead=0x45cff14*=0x80e0, lpOverlapped=0x0) returned 1 [0132.267] GetProcessHeap () returned 0x580000 [0132.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0132.268] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.268] WriteFile (in: hFile=0x480, lpBuffer=0x6d3e0b8*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3e0b8*, lpNumberOfBytesWritten=0x45cff14*=0x80e0, lpOverlapped=0x0) returned 1 [0132.268] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.268] WriteFile (in: hFile=0x480, lpBuffer=0x6d46197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d46197*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0132.268] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.268] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0132.268] CloseHandle (hObject=0x480) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d3e0b8 | out: hHeap=0x580000) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35fa8 | out: hHeap=0x580000) returned 1 [0133.715] GetProcessHeap () returned 0x580000 [0133.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0135.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8672f340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x811c, dwReserved0=0x45cfd28, dwReserved1=0x6d35fa8, cFileName="J0233312.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02333~1.YOU")) returned 0x5b96f0 [0135.384] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.450] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", len=0x4d | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned 1 [0135.450] GetProcessHeap () returned 0x580000 [0135.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.450] CloseHandle (hObject=0x45c) returned 1 [0135.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.450] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.id_1622540890_.your_last_chance")) returned 1 [0135.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b96b0 [0135.451] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.451] GetProcessHeap () returned 0x580000 [0135.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x636970 [0135.451] GetProcessHeap () returned 0x580000 [0135.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5161) returned 0x63bae0 [0135.451] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.451] ReadFile (in: hFile=0x45c, lpBuffer=0x636970, nNumberOfBytesToRead=0x5140, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x45cff14*=0x5140, lpOverlapped=0x0) returned 1 [0137.571] GetProcessHeap () returned 0x580000 [0137.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0137.571] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.571] WriteFile (in: hFile=0x45c, lpBuffer=0x63bae0*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x63bae0*, lpNumberOfBytesWritten=0x45cff14*=0x5140, lpOverlapped=0x0) returned 1 [0138.493] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] WriteFile (in: hFile=0x45c, lpBuffer=0x640c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x640c1f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.493] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.493] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.493] CloseHandle (hObject=0x45c) returned 1 [0138.494] GetProcessHeap () returned 0x580000 [0138.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63bae0 | out: hHeap=0x580000) returned 1 [0138.494] GetProcessHeap () returned 0x580000 [0138.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0138.494] GetProcessHeap () returned 0x580000 [0138.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0138.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5165, dwReserved0=0x45cfd28, dwReserved1=0x636970, cFileName="bg_SlateBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_SLA~1.YOU")) returned 0x5b96b0 [0138.494] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.665] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", len=0x55 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css") returned 1 [0138.665] GetProcessHeap () returned 0x580000 [0138.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0138.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0138.682] CloseHandle (hObject=0x428) returned 1 [0138.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.id_1622540890_.your_last_chance")) returned 1 [0138.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b9770 [0138.683] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0138.683] GetProcessHeap () returned 0x580000 [0138.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cda390 [0138.683] GetProcessHeap () returned 0x580000 [0138.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cdab18 [0138.683] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.683] ReadFile (in: hFile=0x428, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x45cff14*=0x740, lpOverlapped=0x0) returned 1 [0138.697] GetProcessHeap () returned 0x580000 [0138.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0138.698] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.698] WriteFile (in: hFile=0x428, lpBuffer=0x6cdab18*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab18*, lpNumberOfBytesWritten=0x45cff14*=0x740, lpOverlapped=0x0) returned 1 [0138.698] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.698] WriteFile (in: hFile=0x428, lpBuffer=0x6cdb257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb257*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.698] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.698] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.698] CloseHandle (hObject=0x428) returned 1 [0138.698] GetProcessHeap () returned 0x580000 [0138.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab18 | out: hHeap=0x580000) returned 1 [0138.698] GetProcessHeap () returned 0x580000 [0138.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0138.698] GetProcessHeap () returned 0x580000 [0138.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0139.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a47a9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x45cfd28, dwReserved1=0x6cda390, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b9770 [0140.117] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0141.012] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one", len=0x42 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one") returned 1 [0141.012] GetProcessHeap () returned 0x580000 [0141.012] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0141.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0144.076] CloseHandle (hObject=0x454) returned 1 [0144.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.id_1622540890_.your_last_chance")) returned 1 [0144.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3491f00, ftLastWriteTime.dwHighDateTime=0x1ca0f52, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INVITE~1.YOU")) returned 0x5b96f0 [0144.077] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\invite or link.one.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0144.078] GetProcessHeap () returned 0x580000 [0144.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2be1) returned 0x6dc8d80 [0144.078] GetProcessHeap () returned 0x580000 [0144.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2be1) returned 0x6dec6e0 [0144.078] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.078] ReadFile (in: hFile=0x454, lpBuffer=0x6dc8d80, nNumberOfBytesToRead=0x2bc0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc8d80*, lpNumberOfBytesRead=0x45cff14*=0x2bc0, lpOverlapped=0x0) returned 1 [0144.742] GetProcessHeap () returned 0x580000 [0144.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0144.742] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.742] WriteFile (in: hFile=0x454, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x45cff14*=0x2bc0, lpOverlapped=0x0) returned 1 [0144.742] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.743] WriteFile (in: hFile=0x454, lpBuffer=0x6def29f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6def29f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0144.743] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.743] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0144.743] CloseHandle (hObject=0x454) returned 1 [0145.658] GetProcessHeap () returned 0x580000 [0145.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0145.658] GetProcessHeap () returned 0x580000 [0145.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc8d80 | out: hHeap=0x580000) returned 1 [0145.658] GetProcessHeap () returned 0x580000 [0145.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0146.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8de33f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bec, dwReserved0=0x45cfd28, dwReserved1=0x6dc8d80, cFileName="Invite or Link.one.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INVITE~1.YOU")) returned 0x5b96f0 [0146.866] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.881] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", len=0x44 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned 1 [0146.881] GetProcessHeap () returned 0x580000 [0146.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0146.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0152.709] CloseHandle (hObject=0x170) returned 1 [0152.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR15~1.YOU")) returned 0x5b9730 [0152.710] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0152.710] GetProcessHeap () returned 0x580000 [0152.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x6d79168 [0152.710] GetProcessHeap () returned 0x580000 [0152.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x6dc4970 [0152.710] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.710] ReadFile (in: hFile=0x170, lpBuffer=0x6d79168, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d79168*, lpNumberOfBytesRead=0x45cff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0152.737] GetProcessHeap () returned 0x580000 [0152.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x170, lpBuffer=0x6dc4970*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc4970*, lpNumberOfBytesWritten=0x45cff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0152.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x170, lpBuffer=0x6dc660f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc660f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0152.737] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.737] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0152.737] CloseHandle (hObject=0x170) returned 1 [0152.738] GetProcessHeap () returned 0x580000 [0152.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc4970 | out: hHeap=0x580000) returned 1 [0152.738] GetProcessHeap () returned 0x580000 [0152.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d79168 | out: hHeap=0x580000) returned 1 [0152.738] GetProcessHeap () returned 0x580000 [0152.738] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92a5ff40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cdc, dwReserved0=0x45cfd28, dwReserved1=0x6d79168, cFileName="PDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR15~1.YOU")) returned 0x5b9630 [0153.752] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0155.626] CloseHandle (hObject=0x480) returned 1 [0155.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.id_1622540890_.your_last_chance")) returned 1 [0155.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fff8a00, ftCreationTime.dwHighDateTime=0x1bdff9a, ftLastAccessTime.dwLowDateTime=0x1548bc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fff8a00, ftLastWriteTime.dwHighDateTime=0x1bdff9a, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WZCNFL~1.YOU")) returned 0x5b9730 [0155.628] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wzcnflct.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0155.628] GetProcessHeap () returned 0x580000 [0155.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x6d98da8 [0155.628] GetProcessHeap () returned 0x580000 [0155.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x6dc9760 [0155.628] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.628] ReadFile (in: hFile=0x480, lpBuffer=0x6d98da8, nNumberOfBytesToRead=0x34c0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98da8*, lpNumberOfBytesRead=0x45cff14*=0x34c0, lpOverlapped=0x0) returned 1 [0156.659] GetProcessHeap () returned 0x580000 [0156.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0156.659] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.659] WriteFile (in: hFile=0x480, lpBuffer=0x6dc9760*, nNumberOfBytesToWrite=0x34c0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc9760*, lpNumberOfBytesWritten=0x45cff14*=0x34c0, lpOverlapped=0x0) returned 1 [0156.659] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.659] WriteFile (in: hFile=0x480, lpBuffer=0x6dccc1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dccc1f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0156.660] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.660] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0156.660] CloseHandle (hObject=0x480) returned 1 [0156.660] GetProcessHeap () returned 0x580000 [0156.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc9760 | out: hHeap=0x580000) returned 1 [0156.660] GetProcessHeap () returned 0x580000 [0156.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98da8 | out: hHeap=0x580000) returned 1 [0156.660] GetProcessHeap () returned 0x580000 [0156.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0156.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fff8a00, ftCreationTime.dwHighDateTime=0x1bdff9a, ftLastAccessTime.dwLowDateTime=0x1548bc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94fdd9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34fc, dwReserved0=0x45cfd28, dwReserved1=0x6d98da8, cFileName="WZCNFLCT.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WZCNFL~1.YOU")) returned 0x5b9630 [0156.660] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0157.451] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", len=0x3e | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 1 [0157.451] GetProcessHeap () returned 0x580000 [0157.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0157.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0158.372] CloseHandle (hObject=0x4a0) returned 1 [0158.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSBCF4~1.YOU")) returned 0x5b9630 [0158.373] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0158.374] GetProcessHeap () returned 0x580000 [0158.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x78e1) returned 0x6f54e88 [0158.374] GetProcessHeap () returned 0x580000 [0158.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x78e1) returned 0x6f5c778 [0158.374] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.374] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f54e88, nNumberOfBytesToRead=0x78c0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f54e88*, lpNumberOfBytesRead=0x45cff14*=0x78c0, lpOverlapped=0x0) returned 1 [0161.395] GetProcessHeap () returned 0x580000 [0161.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0161.396] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.396] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f5c778*, nNumberOfBytesToWrite=0x78c0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5c778*, lpNumberOfBytesWritten=0x45cff14*=0x78c0, lpOverlapped=0x0) returned 1 [0161.396] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.396] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f64037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f64037*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0161.396] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.396] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0161.396] CloseHandle (hObject=0x4a0) returned 1 [0162.835] GetProcessHeap () returned 0x580000 [0162.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f5c778 | out: hHeap=0x580000) returned 1 [0162.835] GetProcessHeap () returned 0x580000 [0162.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f54e88 | out: hHeap=0x580000) returned 1 [0162.835] GetProcessHeap () returned 0x580000 [0162.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0166.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97cf1a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x78ec, dwReserved0=0x45cfd28, dwReserved1=0x6f54e88, cFileName="MSART11.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSBCF4~1.YOU")) returned 0x5b9730 [0166.185] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.206] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", len=0x3d | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 1 [0166.206] GetProcessHeap () returned 0x580000 [0166.206] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0166.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0166.238] CloseHandle (hObject=0x4ac) returned 1 [0166.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id_1622540890_.your_last_chance")) returned 1 [0166.239] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLNOTE~1.YOU")) returned 0x5b9730 [0166.239] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0166.239] GetProcessHeap () returned 0x580000 [0166.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcba1) returned 0x6dbf1d0 [0166.240] GetProcessHeap () returned 0x580000 [0166.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcba1) returned 0x711c008 [0166.241] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.241] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dbf1d0, nNumberOfBytesToRead=0xcb80, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesRead=0x45cff14*=0xcb80, lpOverlapped=0x0) returned 1 [0168.688] GetProcessHeap () returned 0x580000 [0168.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0168.688] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.688] WriteFile (in: hFile=0x4ac, lpBuffer=0x711c008*, nNumberOfBytesToWrite=0xcb80, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x711c008*, lpNumberOfBytesWritten=0x45cff14*=0xcb80, lpOverlapped=0x0) returned 1 [0168.689] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.689] WriteFile (in: hFile=0x4ac, lpBuffer=0x7128b87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7128b87*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0168.689] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.689] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0168.689] CloseHandle (hObject=0x4ac) returned 1 [0168.689] GetProcessHeap () returned 0x580000 [0168.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c008 | out: hHeap=0x580000) returned 1 [0168.689] GetProcessHeap () returned 0x580000 [0168.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0168.689] GetProcessHeap () returned 0x580000 [0168.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0170.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c291de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcbbc, dwReserved0=0x45cfd28, dwReserved1=0x6dbf1d0, cFileName="OLNOTE.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLNOTE~1.YOU")) returned 0x5b96b0 [0170.238] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.244] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", len=0x42 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 1 [0170.244] GetProcessHeap () returned 0x580000 [0170.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a4) returned 0x6f14048 [0170.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0170.265] CloseHandle (hObject=0x3a8) returned 1 [0170.265] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.265] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id_1622540890_.your_last_chance")) returned 1 [0170.266] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~1.YOU")) returned 0x5b96b0 [0170.266] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0170.266] GetProcessHeap () returned 0x580000 [0170.266] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0170.266] GetProcessHeap () returned 0x580000 [0170.266] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0170.266] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.266] ReadFile (in: hFile=0x3a8, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x45cff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.300] GetProcessHeap () returned 0x580000 [0170.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.300] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.300] WriteFile (in: hFile=0x3a8, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x45cff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.301] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.301] WriteFile (in: hFile=0x3a8, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.301] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.301] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.301] CloseHandle (hObject=0x3a8) returned 1 [0170.301] GetProcessHeap () returned 0x580000 [0170.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0170.301] GetProcessHeap () returned 0x580000 [0170.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0170.301] GetProcessHeap () returned 0x580000 [0170.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d1e4b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x45cfd28, dwReserved1=0x660a78, cFileName="TASKDECS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~1.YOU")) returned 0x5b9770 [0172.983] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.006] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", len=0x42 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 1 [0173.006] GetProcessHeap () returned 0x580000 [0173.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x224c) returned 0x6f14048 [0173.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.019] CloseHandle (hObject=0x43c) returned 1 [0173.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.020] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~3.YOU")) returned 0x5b9770 [0173.020] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.020] GetProcessHeap () returned 0x580000 [0173.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x67fc68 [0173.020] GetProcessHeap () returned 0x580000 [0173.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6e17c00 [0173.020] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.020] ReadFile (in: hFile=0x43c, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x45cff14*=0x340, lpOverlapped=0x0) returned 1 [0173.036] GetProcessHeap () returned 0x580000 [0173.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.036] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] WriteFile (in: hFile=0x43c, lpBuffer=0x6e17c00*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesWritten=0x45cff14*=0x340, lpOverlapped=0x0) returned 1 [0173.036] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] WriteFile (in: hFile=0x43c, lpBuffer=0x6e17f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17f3f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.036] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.036] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.036] CloseHandle (hObject=0x43c) returned 1 [0173.037] GetProcessHeap () returned 0x580000 [0173.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0173.037] GetProcessHeap () returned 0x580000 [0173.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0173.037] GetProcessHeap () returned 0x580000 [0173.037] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec13d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x367, dwReserved0=0x45cfd28, dwReserved1=0x67fc68, cFileName="SCHDRESN.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~3.YOU")) returned 0x5b9770 [0173.283] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.333] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", len=0x41 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 1 [0173.333] GetProcessHeap () returned 0x580000 [0173.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0173.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.345] CloseHandle (hObject=0x3fc) returned 1 [0173.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.345] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~2.YOU")) returned 0x5b9770 [0173.346] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.346] GetProcessHeap () returned 0x580000 [0173.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.346] GetProcessHeap () returned 0x580000 [0173.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.346] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.346] ReadFile (in: hFile=0x3fc, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x45cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.374] GetProcessHeap () returned 0x580000 [0173.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.375] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.375] WriteFile (in: hFile=0x3fc, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x45cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.375] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.375] WriteFile (in: hFile=0x3fc, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.375] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.375] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.375] CloseHandle (hObject=0x3fc) returned 1 [0173.375] GetProcessHeap () returned 0x580000 [0173.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.375] GetProcessHeap () returned 0x580000 [0173.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.375] GetProcessHeap () returned 0x580000 [0173.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef33a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x45cfd28, dwReserved1=0x5d0090, cFileName="POSTITL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~2.YOU")) returned 0x5b9770 [0173.375] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.409] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", len=0x43 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 1 [0173.409] GetProcessHeap () returned 0x580000 [0173.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0173.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.452] CloseHandle (hObject=0x46c) returned 1 [0173.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id_1622540890_.your_last_chance")) returned 1 [0173.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLAPPT~1.YOU")) returned 0x5b9770 [0173.453] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.454] GetProcessHeap () returned 0x580000 [0173.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2dc1) returned 0x7162068 [0173.454] GetProcessHeap () returned 0x580000 [0173.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2dc1) returned 0x6dec6e0 [0173.454] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.454] ReadFile (in: hFile=0x46c, lpBuffer=0x7162068, nNumberOfBytesToRead=0x2da0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7162068*, lpNumberOfBytesRead=0x45cff14*=0x2da0, lpOverlapped=0x0) returned 1 [0174.020] GetProcessHeap () returned 0x580000 [0174.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0174.021] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] WriteFile (in: hFile=0x46c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x45cff14*=0x2da0, lpOverlapped=0x0) returned 1 [0174.021] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] WriteFile (in: hFile=0x46c, lpBuffer=0x6def47f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6def47f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.021] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.021] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.021] CloseHandle (hObject=0x46c) returned 1 [0174.021] GetProcessHeap () returned 0x580000 [0174.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0174.021] GetProcessHeap () returned 0x580000 [0174.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162068 | out: hHeap=0x580000) returned 1 [0174.021] GetProcessHeap () returned 0x580000 [0174.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0176.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f573420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ddc, dwReserved0=0x45cfd28, dwReserved1=0x7162068, cFileName="OLAPPTR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLAPPT~1.YOU")) returned 0x5b96f0 [0176.715] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.753] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", len=0x49 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned 1 [0176.753] GetProcessHeap () returned 0x580000 [0176.753] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0176.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0177.888] CloseHandle (hObject=0x448) returned 1 [0177.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.id_1622540890_.your_last_chance")) returned 1 [0177.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADARW~1.YOU")) returned 0x5b96f0 [0177.889] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0177.890] GetProcessHeap () returned 0x580000 [0177.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10101) returned 0x6d607c8 [0177.890] GetProcessHeap () returned 0x580000 [0177.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10101) returned 0x711c008 [0177.890] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.890] ReadFile (in: hFile=0x448, lpBuffer=0x6d607c8, nNumberOfBytesToRead=0x100e0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d607c8*, lpNumberOfBytesRead=0x45cff14*=0x100e0, lpOverlapped=0x0) returned 1 [0179.853] GetProcessHeap () returned 0x580000 [0179.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.853] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.853] WriteFile (in: hFile=0x448, lpBuffer=0x711c008*, nNumberOfBytesToWrite=0x100e0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x711c008*, lpNumberOfBytesWritten=0x45cff14*=0x100e0, lpOverlapped=0x0) returned 1 [0179.854] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.854] WriteFile (in: hFile=0x448, lpBuffer=0x712c0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x712c0e7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0179.854] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.854] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0179.854] CloseHandle (hObject=0x448) returned 1 [0179.854] GetProcessHeap () returned 0x580000 [0179.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c008 | out: hHeap=0x580000) returned 1 [0179.854] GetProcessHeap () returned 0x580000 [0179.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d607c8 | out: hHeap=0x580000) returned 1 [0179.854] GetProcessHeap () returned 0x580000 [0179.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0181.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2d17660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1010e, dwReserved0=0x45cfd28, dwReserved1=0x6d607c8, cFileName="RADAR.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADARW~1.YOU")) returned 0x5b9770 [0181.350] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.360] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", len=0x6f | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned 1 [0181.360] GetProcessHeap () returned 0x580000 [0181.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0181.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.448] CloseHandle (hObject=0x430) returned 1 [0182.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x2e006b, dwReserved1=0x6d0062, cFileName="AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALACFD~1.YOU")) returned 0x5b9770 [0182.449] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.449] GetProcessHeap () returned 0x580000 [0182.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0182.450] GetProcessHeap () returned 0x580000 [0182.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0182.450] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.450] ReadFile (in: hFile=0x430, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x45cff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.475] GetProcessHeap () returned 0x580000 [0182.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0182.475] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.475] WriteFile (in: hFile=0x430, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x45cff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.475] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.475] WriteFile (in: hFile=0x430, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0182.475] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.475] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0182.475] CloseHandle (hObject=0x430) returned 1 [0182.475] GetProcessHeap () returned 0x580000 [0182.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0182.475] GetProcessHeap () returned 0x580000 [0182.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0182.475] GetProcessHeap () returned 0x580000 [0182.475] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4615d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x45cfd28, dwReserved1=0x6cbc098, cFileName="AlertImage_ContactHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALACFD~1.YOU")) returned 0x5b9770 [0183.733] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.801] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", len=0x6c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned 1 [0183.801] GetProcessHeap () returned 0x580000 [0183.801] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0183.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0186.234] CloseHandle (hObject=0x43c) returned 1 [0186.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x470050, dwReserved1=0x69002e, cFileName="RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIOJ~1.YOU")) returned 0x5b96b0 [0186.235] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0186.236] GetProcessHeap () returned 0x580000 [0186.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x43e1) returned 0x6d250a8 [0186.236] GetProcessHeap () returned 0x580000 [0186.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x43e1) returned 0x6d29498 [0186.236] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.236] ReadFile (in: hFile=0x43c, lpBuffer=0x6d250a8, nNumberOfBytesToRead=0x43c0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d250a8*, lpNumberOfBytesRead=0x45cff14*=0x43c0, lpOverlapped=0x0) returned 1 [0187.496] GetProcessHeap () returned 0x580000 [0187.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdef0 [0187.497] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.497] WriteFile (in: hFile=0x43c, lpBuffer=0x6d29498*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29498*, lpNumberOfBytesWritten=0x45cff14*=0x43c0, lpOverlapped=0x0) returned 1 [0187.502] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.502] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2d857*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2d857*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0187.502] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.503] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0187.503] CloseHandle (hObject=0x43c) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d29498 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d250a8 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdef0 | out: hHeap=0x580000) returned 1 [0188.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa75fd820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x43ec, dwReserved0=0x45cfd28, dwReserved1=0x6d250a8, cFileName="RADIO.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIOJ~1.YOU")) returned 0x5b9770 [0188.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.078] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", len=0x45 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned 1 [0188.079] GetProcessHeap () returned 0x580000 [0188.079] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2074) returned 0x6f14048 [0188.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0191.914] CloseHandle (hObject=0x488) returned 1 [0191.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x67f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP327C~1.YOU")) returned 0x5b97b0 [0194.705] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0194.705] GetProcessHeap () returned 0x580000 [0194.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6801) returned 0x704c968 [0194.705] GetProcessHeap () returned 0x580000 [0194.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6801) returned 0x7062940 [0194.705] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.705] ReadFile (in: hFile=0x488, lpBuffer=0x704c968, nNumberOfBytesToRead=0x67e0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x704c968*, lpNumberOfBytesRead=0x45cff14*=0x67e0, lpOverlapped=0x0) returned 1 [0196.060] GetProcessHeap () returned 0x580000 [0196.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.060] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.060] WriteFile (in: hFile=0x488, lpBuffer=0x7062940*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesWritten=0x45cff14*=0x67e0, lpOverlapped=0x0) returned 1 [0196.060] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.060] WriteFile (in: hFile=0x488, lpBuffer=0x706911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x706911f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.060] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.060] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.060] CloseHandle (hObject=0x488) returned 1 [0196.060] GetProcessHeap () returned 0x580000 [0196.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0196.061] GetProcessHeap () returned 0x580000 [0196.061] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704c968 | out: hHeap=0x580000) returned 1 [0196.062] GetProcessHeap () returned 0x580000 [0196.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac7849a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x681d, dwReserved0=0x45cfd28, dwReserved1=0x704c968, cFileName="ZPDIR48B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP327C~1.YOU")) returned 0x5b97f0 [0198.946] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.954] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", len=0x44 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned 1 [0198.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0198.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.053] CloseHandle (hObject=0x4ac) returned 1 [0199.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.054] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.id_1622540890_.your_last_chance")) returned 1 [0199.054] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3606, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR44~2.YOU")) returned 0x5b97f0 [0199.055] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.055] GetProcessHeap () returned 0x580000 [0199.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3621) returned 0x6dc71d0 [0199.055] GetProcessHeap () returned 0x580000 [0199.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3621) returned 0x6e063d0 [0199.055] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.055] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x3600, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x45cff14*=0x3600, lpOverlapped=0x0) returned 1 [0199.691] GetProcessHeap () returned 0x580000 [0199.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0199.691] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.691] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x45cff14*=0x3600, lpOverlapped=0x0) returned 1 [0199.691] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.691] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e099cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e099cf*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0199.691] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.691] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0199.691] CloseHandle (hObject=0x4ac) returned 1 [0199.691] GetProcessHeap () returned 0x580000 [0199.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0199.691] GetProcessHeap () returned 0x580000 [0199.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0199.691] GetProcessHeap () returned 0x580000 [0199.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaea2ea00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x362a, dwReserved0=0x45cfd28, dwReserved1=0x6dc71d0, cFileName="PDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR44~2.YOU")) returned 0x5b9770 [0201.041] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.028] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", len=0x6f | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0202.028] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0202.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.028] CloseHandle (hObject=0x4ac) returned 1 [0202.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.028] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0202.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x2e0052, dwReserved1=0x490047, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0202.029] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.029] GetProcessHeap () returned 0x580000 [0202.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6c79898 [0202.029] GetProcessHeap () returned 0x580000 [0202.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6d00cd8 [0202.030] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.030] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x45cff14*=0x860, lpOverlapped=0x0) returned 1 [0202.041] GetProcessHeap () returned 0x580000 [0202.041] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.041] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.041] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x45cff14*=0x860, lpOverlapped=0x0) returned 1 [0202.041] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d01537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01537*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0202.042] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.042] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0202.042] CloseHandle (hObject=0x4ac) returned 1 [0202.042] GetProcessHeap () returned 0x580000 [0202.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0202.042] GetProcessHeap () returned 0x580000 [0202.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0202.042] GetProcessHeap () returned 0x580000 [0202.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb00a59a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x45cfd28, dwReserved1=0x6c79898, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0202.042] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.085] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", len=0x44 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned 1 [0202.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f10) returned 0x6f14048 [0202.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.597] CloseHandle (hObject=0x170) returned 1 [0203.597] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.597] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.id_1622540890_.your_last_chance")) returned 1 [0203.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1631, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR33~1.YOU")) returned 0x5b97b0 [0203.598] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.598] GetProcessHeap () returned 0x580000 [0203.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x706ecb0 [0203.598] GetProcessHeap () returned 0x580000 [0203.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x70703b8 [0203.598] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.599] ReadFile (in: hFile=0x170, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x1620, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x45cff14*=0x1620, lpOverlapped=0x0) returned 1 [0203.624] GetProcessHeap () returned 0x580000 [0203.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.624] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x170, lpBuffer=0x70703b8*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x70703b8*, lpNumberOfBytesWritten=0x45cff14*=0x1620, lpOverlapped=0x0) returned 1 [0203.624] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x170, lpBuffer=0x70719d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x70719d7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0203.624] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0203.624] CloseHandle (hObject=0x170) returned 1 [0203.625] GetProcessHeap () returned 0x580000 [0203.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70703b8 | out: hHeap=0x580000) returned 1 [0203.625] GetProcessHeap () returned 0x580000 [0203.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0203.625] GetProcessHeap () returned 0x580000 [0203.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0203.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0fac480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1655, dwReserved0=0x45cfd28, dwReserved1=0x706ecb0, cFileName="PDIR33B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR33~1.YOU")) returned 0x5b97b0 [0203.625] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.627] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", len=0x68 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned 1 [0203.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0203.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0203.715] CloseHandle (hObject=0x448) returned 1 [0203.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.id_1622540890_.your_last_chance")) returned 1 [0208.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0208.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97f0 [0209.158] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0209.159] GetProcessHeap () returned 0x580000 [0209.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e023e8 [0209.159] GetProcessHeap () returned 0x580000 [0209.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e02670 [0209.159] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.159] ReadFile (in: hFile=0x41c, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x45cff14*=0x240, lpOverlapped=0x0) returned 1 [0209.162] GetProcessHeap () returned 0x580000 [0209.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.162] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.162] WriteFile (in: hFile=0x41c, lpBuffer=0x6e02670*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02670*, lpNumberOfBytesWritten=0x45cff14*=0x240, lpOverlapped=0x0) returned 1 [0209.162] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.162] WriteFile (in: hFile=0x41c, lpBuffer=0x6e028af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e028af*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0209.163] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.163] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0209.163] CloseHandle (hObject=0x41c) returned 1 [0209.163] GetProcessHeap () returned 0x580000 [0209.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02670 | out: hHeap=0x580000) returned 1 [0209.163] GetProcessHeap () returned 0x580000 [0209.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0209.163] GetProcessHeap () returned 0x580000 [0209.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0210.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb447cca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x45cfd28, dwReserved1=0x6e023e8, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0210.088] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.123] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", len=0x60 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned 1 [0210.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0210.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.398] CloseHandle (hObject=0x46c) returned 1 [0215.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.id_1622540890_.your_last_chance")) returned 1 [0215.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b97b0 [0215.399] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.399] GetProcessHeap () returned 0x580000 [0215.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6f19958 [0215.400] GetProcessHeap () returned 0x580000 [0215.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6efb008 [0215.400] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.400] ReadFile (in: hFile=0x46c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x45cff14*=0x1320, lpOverlapped=0x0) returned 1 [0215.417] GetProcessHeap () returned 0x580000 [0215.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.417] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.417] WriteFile (in: hFile=0x46c, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x45cff14*=0x1320, lpOverlapped=0x0) returned 1 [0215.418] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.418] WriteFile (in: hFile=0x46c, lpBuffer=0x6efc327*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc327*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0215.418] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.418] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0215.418] CloseHandle (hObject=0x46c) returned 1 [0215.418] GetProcessHeap () returned 0x580000 [0215.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0215.418] GetProcessHeap () returned 0x580000 [0215.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0215.418] GetProcessHeap () returned 0x580000 [0215.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8025400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x134e, dwReserved0=0x45cfd28, dwReserved1=0x6f19958, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b9770 [0217.545] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.605] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", len=0x66 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned 1 [0217.605] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0217.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.606] CloseHandle (hObject=0x48c) returned 1 [0217.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0217.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca5a, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9770 [0217.607] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.607] GetProcessHeap () returned 0x580000 [0217.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca61) returned 0x7189e48 [0217.608] GetProcessHeap () returned 0x580000 [0217.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca61) returned 0x71968b8 [0217.609] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.609] ReadFile (in: hFile=0x48c, lpBuffer=0x7189e48, nNumberOfBytesToRead=0xca40, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e48*, lpNumberOfBytesRead=0x45cff14*=0xca40, lpOverlapped=0x0) returned 1 [0220.748] GetProcessHeap () returned 0x580000 [0220.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0220.748] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.748] WriteFile (in: hFile=0x48c, lpBuffer=0x71968b8*, nNumberOfBytesToWrite=0xca40, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x71968b8*, lpNumberOfBytesWritten=0x45cff14*=0xca40, lpOverlapped=0x0) returned 1 [0220.748] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.748] WriteFile (in: hFile=0x48c, lpBuffer=0x71a32f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x71a32f7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0220.748] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.748] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0220.748] CloseHandle (hObject=0x48c) returned 1 [0220.934] GetProcessHeap () returned 0x580000 [0220.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71968b8 | out: hHeap=0x580000) returned 1 [0220.935] GetProcessHeap () returned 0x580000 [0220.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7189e48 | out: hHeap=0x580000) returned 1 [0220.935] GetProcessHeap () returned 0x580000 [0220.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb306a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xca7e, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9730 [0221.885] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.902] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", len=0x66 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned 1 [0221.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0221.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.915] CloseHandle (hObject=0x3e4) returned 1 [0221.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABMAS~1.YOU")) returned 0x5b9730 [0221.916] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.916] GetProcessHeap () returned 0x580000 [0221.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0221.916] GetProcessHeap () returned 0x580000 [0221.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5d57a0 [0221.916] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.916] ReadFile (in: hFile=0x3e4, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x45cff14*=0x120, lpOverlapped=0x0) returned 1 [0221.918] GetProcessHeap () returned 0x580000 [0221.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0221.918] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.918] WriteFile (in: hFile=0x3e4, lpBuffer=0x5d57a0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d57a0*, lpNumberOfBytesWritten=0x45cff14*=0x120, lpOverlapped=0x0) returned 1 [0221.918] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.918] WriteFile (in: hFile=0x3e4, lpBuffer=0x5d58bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d58bf*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.919] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.919] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.919] CloseHandle (hObject=0x3e4) returned 1 [0221.919] GetProcessHeap () returned 0x580000 [0221.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d57a0 | out: hHeap=0x580000) returned 1 [0221.919] GetProcessHeap () returned 0x580000 [0221.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0221.919] GetProcessHeap () returned 0x580000 [0221.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0221.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbe2f160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x45cfd28, dwReserved1=0x65f0b0, cFileName="TABMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABMAS~1.YOU")) returned 0x5b9730 [0221.919] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.407] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", len=0x62 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned 1 [0223.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0223.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.417] CloseHandle (hObject=0x49c) returned 1 [0223.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.id_1622540890_.your_last_chance")) returned 1 [0223.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b96f0 [0223.418] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.419] GetProcessHeap () returned 0x580000 [0223.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6f04558 [0223.419] GetProcessHeap () returned 0x580000 [0223.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6d045f8 [0223.419] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.419] ReadFile (in: hFile=0x49c, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x45cff14*=0x340, lpOverlapped=0x0) returned 1 [0223.443] GetProcessHeap () returned 0x580000 [0223.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0223.443] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.443] WriteFile (in: hFile=0x49c, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x45cff14*=0x340, lpOverlapped=0x0) returned 1 [0223.443] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.443] WriteFile (in: hFile=0x49c, lpBuffer=0x6d04937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04937*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0223.443] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.443] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0223.443] CloseHandle (hObject=0x49c) returned 1 [0223.466] GetProcessHeap () returned 0x580000 [0223.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0223.466] GetProcessHeap () returned 0x580000 [0223.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0223.466] GetProcessHeap () returned 0x580000 [0223.466] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0226.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccc3820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x45cfd28, dwReserved1=0x6f04558, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b9630 [0226.022] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.069] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD", len=0x3c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 1 [0226.070] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db4) returned 0x6dee6e0 [0226.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.095] CloseHandle (hObject=0x488) returned 1 [0226.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id_1622540890_.your_last_chance")) returned 1 [0226.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACDI~1.YOU")) returned 0x5b9630 [0226.097] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.097] GetProcessHeap () returned 0x580000 [0226.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0226.097] GetProcessHeap () returned 0x580000 [0226.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0226.097] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.097] ReadFile (in: hFile=0x488, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x45cff14*=0x760, lpOverlapped=0x0) returned 1 [0226.105] GetProcessHeap () returned 0x580000 [0226.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.105] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.105] WriteFile (in: hFile=0x488, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x45cff14*=0x760, lpOverlapped=0x0) returned 1 [0226.105] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.105] WriteFile (in: hFile=0x488, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0226.105] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.105] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0226.105] CloseHandle (hObject=0x488) returned 1 [0226.106] GetProcessHeap () returned 0x580000 [0226.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0226.106] GetProcessHeap () returned 0x580000 [0226.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0226.106] GetProcessHeap () returned 0x580000 [0226.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbe491420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7a3, dwReserved0=0x45cfd28, dwReserved1=0x6ef3020, cFileName="HVACDIFF.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACDI~1.YOU")) returned 0x5b9630 [0226.545] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.195] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", len=0x3d | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned 1 [0230.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d88) returned 0x6dee6e0 [0230.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0230.197] CloseHandle (hObject=0x494) returned 1 [0230.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.id_1622540890_.your_last_chance")) returned 1 [0230.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPLAU~1.YOU")) returned 0x5b9730 [0230.198] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0230.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\media\\applause.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0230.198] GetProcessHeap () returned 0x580000 [0230.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6dc1) returned 0x6e063d0 [0230.198] GetProcessHeap () returned 0x580000 [0230.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6dc1) returned 0x715c008 [0230.198] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.198] ReadFile (in: hFile=0x494, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6da0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x45cff14*=0x6da0, lpOverlapped=0x0) returned 1 [0234.272] GetProcessHeap () returned 0x580000 [0234.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0234.272] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.273] WriteFile (in: hFile=0x494, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x6da0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x45cff14*=0x6da0, lpOverlapped=0x0) returned 1 [0234.273] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.273] WriteFile (in: hFile=0x494, lpBuffer=0x7162da7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7162da7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0234.273] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.273] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0234.273] CloseHandle (hObject=0x494) returned 1 [0234.273] GetProcessHeap () returned 0x580000 [0234.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0234.273] GetProcessHeap () returned 0x580000 [0234.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0234.274] GetProcessHeap () returned 0x580000 [0234.274] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0234.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc32864a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6dce, dwReserved0=0x45cfd28, dwReserved1=0x6e063d0, cFileName="APPLAUSE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPLAU~1.YOU")) returned 0x5b9630 [0234.274] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0240.539] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML", len=0x4b | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned 1 [0240.539] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0240.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.541] CloseHandle (hObject=0x488) returned 1 [0240.541] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml.id_1622540890_.your_last_chance")) returned 1 [0240.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOS~1.YOU")) returned 0x5b9730 [0240.543] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.543] GetProcessHeap () returned 0x580000 [0240.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.543] GetProcessHeap () returned 0x580000 [0240.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.543] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.543] ReadFile (in: hFile=0x488, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x45cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.547] GetProcessHeap () returned 0x580000 [0240.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.547] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.547] WriteFile (in: hFile=0x488, lpBuffer=0x6d07028*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesWritten=0x45cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.547] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.547] WriteFile (in: hFile=0x488, lpBuffer=0x6d07347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07347*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.547] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.547] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.548] CloseHandle (hObject=0x488) returned 1 [0240.548] GetProcessHeap () returned 0x580000 [0240.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.548] GetProcessHeap () returned 0x580000 [0240.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.548] GetProcessHeap () returned 0x580000 [0240.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6e54d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x45cfd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.SE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOS~1.YOU")) returned 0x5b9730 [0240.548] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.564] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", len=0x4b | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned 1 [0240.564] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0240.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.598] CloseHandle (hObject=0x170) returned 1 [0240.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml.id_1622540890_.your_last_chance")) returned 1 [0240.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOF~1.YOU")) returned 0x5b9730 [0240.622] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.622] GetProcessHeap () returned 0x580000 [0240.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.622] GetProcessHeap () returned 0x580000 [0240.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.622] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.622] ReadFile (in: hFile=0x170, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x45cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.626] GetProcessHeap () returned 0x580000 [0240.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.626] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.626] WriteFile (in: hFile=0x170, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x45cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.626] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.626] WriteFile (in: hFile=0x170, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.629] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.629] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.629] CloseHandle (hObject=0x170) returned 1 [0240.629] GetProcessHeap () returned 0x580000 [0240.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.629] GetProcessHeap () returned 0x580000 [0240.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.629] GetProcessHeap () returned 0x580000 [0240.629] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f13440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x45cfd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.FR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOF~1.YOU")) returned 0x5b9630 [0241.770] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.798] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML", len=0x3f | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned 1 [0241.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0241.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.800] CloseHandle (hObject=0x45c) returned 1 [0241.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml.id_1622540890_.your_last_chance")) returned 1 [0241.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0x11a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~1.YOU")) returned 0x5b9630 [0241.801] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.801] GetProcessHeap () returned 0x580000 [0241.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x6d77dc8 [0241.801] GetProcessHeap () returned 0x580000 [0241.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11c1) returned 0x65d9d0 [0241.801] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.801] ReadFile (in: hFile=0x45c, lpBuffer=0x6d77dc8, nNumberOfBytesToRead=0x11a0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77dc8*, lpNumberOfBytesRead=0x45cff14*=0x11a0, lpOverlapped=0x0) returned 1 [0242.668] GetProcessHeap () returned 0x580000 [0242.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0242.668] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.669] WriteFile (in: hFile=0x45c, lpBuffer=0x65d9d0*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x65d9d0*, lpNumberOfBytesWritten=0x45cff14*=0x11a0, lpOverlapped=0x0) returned 1 [0242.669] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.669] WriteFile (in: hFile=0x45c, lpBuffer=0x65eb6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x65eb6f*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0242.669] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.669] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0242.669] CloseHandle (hObject=0x45c) returned 1 [0244.016] GetProcessHeap () returned 0x580000 [0244.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x580000) returned 1 [0244.227] GetProcessHeap () returned 0x580000 [0244.227] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d77dc8 | out: hHeap=0x580000) returned 1 [0244.227] GetProcessHeap () returned 0x580000 [0244.227] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0248.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8290860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x45cfd28, dwReserved1=0x6d77dc8, cFileName="PGMN089.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~1.YOU")) returned 0x5b9630 [0248.271] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.288] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR", len=0x3b | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 1 [0248.288] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0248.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0248.289] CloseHandle (hObject=0x468) returned 1 [0248.289] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.289] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.id_1622540890_.your_last_chance")) returned 1 [0248.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB8~1.YOU")) returned 0x5b9630 [0248.290] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0248.290] GetProcessHeap () returned 0x580000 [0248.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe6c1) returned 0x6fb2e00 [0248.291] GetProcessHeap () returned 0x580000 [0248.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe6c1) returned 0x6d630a8 [0248.291] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.292] ReadFile (in: hFile=0x468, lpBuffer=0x6fb2e00, nNumberOfBytesToRead=0xe6a0, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2e00*, lpNumberOfBytesRead=0x45cff14*=0xe6a0, lpOverlapped=0x0) returned 1 [0252.243] GetProcessHeap () returned 0x580000 [0252.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.243] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.243] WriteFile (in: hFile=0x468, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0xe6a0, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x45cff14*=0xe6a0, lpOverlapped=0x0) returned 1 [0252.243] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.243] WriteFile (in: hFile=0x468, lpBuffer=0x6d71747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71747*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0252.244] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.244] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0252.244] CloseHandle (hObject=0x468) returned 1 [0252.244] GetProcessHeap () returned 0x580000 [0252.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0252.244] GetProcessHeap () returned 0x580000 [0252.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2e00 | out: hHeap=0x580000) returned 1 [0252.244] GetProcessHeap () returned 0x580000 [0252.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdde94a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe6ce, dwReserved0=0x45cfd28, dwReserved1=0x6fb2e00, cFileName="MSPUB8.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB8~1.YOU")) returned 0x5b9730 [0254.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.359] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML", len=0x41 | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML") returned 1 [0255.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f80) returned 0x72e5948 [0255.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.403] CloseHandle (hObject=0x3b8) returned 1 [0260.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.404] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml.id_1622540890_.your_last_chance")) returned 1 [0260.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f7200, ftCreationTime.dwHighDateTime=0x1c976e9, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62f7200, ftLastWriteTime.dwHighDateTime=0x1c976e9, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSTOR~2.YOU")) returned 0x5b9630 [0260.405] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0260.405] GetProcessHeap () returned 0x580000 [0260.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x677cd0 [0260.405] GetProcessHeap () returned 0x580000 [0260.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x635768 [0260.405] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.405] ReadFile (in: hFile=0x3b8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x45cff14*=0xb80, lpOverlapped=0x0) returned 1 [0260.416] GetProcessHeap () returned 0x580000 [0260.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.416] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.416] WriteFile (in: hFile=0x3b8, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x45cff14*=0xb80, lpOverlapped=0x0) returned 1 [0260.416] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.416] WriteFile (in: hFile=0x3b8, lpBuffer=0x6362e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x6362e7*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0260.416] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.416] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0260.417] CloseHandle (hObject=0x3b8) returned 1 [0260.417] GetProcessHeap () returned 0x580000 [0260.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0260.417] GetProcessHeap () returned 0x580000 [0260.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0260.417] GetProcessHeap () returned 0x580000 [0260.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f7200, ftCreationTime.dwHighDateTime=0x1c976e9, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2bde520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba8, dwReserved0=0x45cfd28, dwReserved1=0x677cd0, cFileName="DGSTORYVERT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSTOR~2.YOU")) returned 0x5b9630 [0260.417] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.427] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML", len=0x3c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML") returned 1 [0260.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2064) returned 0x72e5948 [0260.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.428] CloseHandle (hObject=0x410) returned 1 [0260.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.428] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml.id_1622540890_.your_last_chance")) returned 1 [0260.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad1500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x6d1b5730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfad1500, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESUME~1.YOU")) returned 0x5b9630 [0260.429] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.429] GetProcessHeap () returned 0x580000 [0260.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706ecb0 [0260.429] GetProcessHeap () returned 0x580000 [0260.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706f538 [0260.429] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.429] ReadFile (in: hFile=0x410, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x45cff14*=0x840, lpOverlapped=0x0) returned 1 [0260.440] GetProcessHeap () returned 0x580000 [0260.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.440] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.440] WriteFile (in: hFile=0x410, lpBuffer=0x706f538*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x706f538*, lpNumberOfBytesWritten=0x45cff14*=0x840, lpOverlapped=0x0) returned 1 [0260.440] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.440] WriteFile (in: hFile=0x410, lpBuffer=0x706fd77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x706fd77*, lpNumberOfBytesWritten=0x45cff14*=0x20, lpOverlapped=0x0) returned 1 [0260.440] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.440] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x45cff14*=0x4, lpOverlapped=0x0) returned 1 [0260.440] CloseHandle (hObject=0x410) returned 1 [0260.440] GetProcessHeap () returned 0x580000 [0260.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706f538 | out: hHeap=0x580000) returned 1 [0260.440] GetProcessHeap () returned 0x580000 [0260.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0260.440] GetProcessHeap () returned 0x580000 [0260.440] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfccc | out: lpFindFileData=0x45cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad1500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x6d1b5730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c04680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x87e, dwReserved0=0x45cfd28, dwReserved1=0x706ecb0, cFileName="RESUME.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESUME~1.YOU")) returned 0x5b9630 [0260.440] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.458] SysReAllocStringLen (in: pbstr=0x45cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC", len=0x3c | out: pbstr=0x45cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC") returned 1 [0260.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x205c) returned 0x72e5948 [0260.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.459] CloseHandle (hObject=0x410) returned 1 [0260.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc.id_1622540890_.your_last_chance")) returned 1 [0260.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x45cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x45cfc74 | out: lpFindFileData=0x45cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa6c00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x6d1b5730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16aa6c00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1effa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESP98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESP98~1.YOU")) returned 0x5b9630 [0260.460] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0260.460] GetProcessHeap () returned 0x580000 [0260.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7496d78 [0260.461] GetProcessHeap () returned 0x580000 [0260.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74a85a8 [0260.461] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.461] ReadFile (in: hFile=0x410, lpBuffer=0x7496d78, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x45cff14, lpOverlapped=0x0 | out: lpBuffer=0x7496d78*, lpNumberOfBytesRead=0x45cff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 33 os_tid = 0xa7c [0039.065] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.611] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.922] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.313] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.644] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.466] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.730] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.793] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.557] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.682] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.713] Sleep (dwMilliseconds=0x1) [0044.729] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.822] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.947] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.978] Sleep (dwMilliseconds=0x1) [0044.994] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.134] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.212] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.571] Sleep (dwMilliseconds=0x1) [0045.587] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.822] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.885] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.320] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.507] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.539] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.099] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.380] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.832] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.004] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.160] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.347] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.401] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.195] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.361] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.461] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.517] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.616] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.985] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.297] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.375] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.687] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.796] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.874] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.094] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.264] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.576] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.730] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.886] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.495] Sleep (dwMilliseconds=0x1) [0052.510] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.548] Sleep (dwMilliseconds=0x1) [0052.557] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.666] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.713] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.869] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.025] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.337] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.493] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.727] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.774] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.805] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.852] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.429] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.507] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.632] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.663] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.819] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.975] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.053] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.365] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.443] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.540] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.696] Sleep (dwMilliseconds=0x1) [0055.839] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Boot\\Fonts\\cht_boot.ttf", len=0x1a | out: pbstr=0x470ff84*="C:\\Boot\\Fonts\\cht_boot.ttf") returned 1 [0055.839] GetProcessHeap () returned 0x580000 [0055.839] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9588, Size=0xc) returned 0x5e94b0 [0055.839] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.846] Sleep (dwMilliseconds=0x1) [0061.799] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", len=0x4d | out: pbstr=0x470ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 1 [0061.799] GetProcessHeap () returned 0x580000 [0061.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x4c) returned 0x5b5bc8 [0061.799] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0070.281] CloseHandle (hObject=0x3f4) returned 1 [0070.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.281] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id_1622540890_.your_last_chance")) returned 1 [0073.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0073.894] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~2.YOU")) returned 0x5b96f0 [0074.968] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.968] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0074.968] GetProcessHeap () returned 0x580000 [0074.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cf6cd8 [0074.968] GetProcessHeap () returned 0x580000 [0074.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0074.969] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.969] ReadFile (in: hFile=0x170, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.782] GetProcessHeap () returned 0x580000 [0078.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0078.782] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.782] WriteFile (in: hFile=0x170, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.783] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.783] WriteFile (in: hFile=0x170, lpBuffer=0x64816f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x64816f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.043] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.043] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.043] CloseHandle (hObject=0x170) returned 1 [0079.043] GetProcessHeap () returned 0x580000 [0079.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0079.043] GetProcessHeap () returned 0x580000 [0079.043] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0079.044] GetProcessHeap () returned 0x580000 [0079.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0079.453] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x66b91fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c24, dwReserved0=0x470fd28, dwReserved1=0x6cf6cd8, cFileName="ProPlusrWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPLU~2.YOU")) returned 0x5b96b0 [0079.453] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0079.488] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", len=0x68 | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 1 [0079.488] GetProcessHeap () returned 0x580000 [0079.488] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0079.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0079.492] CloseHandle (hObject=0x170) returned 1 [0079.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id_1622540890_.your_last_chance")) returned 1 [0079.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~1.YOU")) returned 0x5b96f0 [0079.532] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0079.532] GetProcessHeap () returned 0x580000 [0079.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6f0c4f8 [0079.532] GetProcessHeap () returned 0x580000 [0079.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6f094f0 [0079.532] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.532] ReadFile (in: hFile=0x170, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x470ff14*=0x600, lpOverlapped=0x0) returned 1 [0079.550] GetProcessHeap () returned 0x580000 [0079.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.550] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.550] WriteFile (in: hFile=0x170, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x470ff14*=0x600, lpOverlapped=0x0) returned 1 [0079.550] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.550] WriteFile (in: hFile=0x170, lpBuffer=0x6f09aef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09aef*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.550] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.550] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.550] CloseHandle (hObject=0x170) returned 1 [0079.551] GetProcessHeap () returned 0x580000 [0079.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0079.551] GetProcessHeap () returned 0x580000 [0079.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0079.551] GetProcessHeap () returned 0x580000 [0079.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6707ad20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x641, dwReserved0=0x470fd28, dwReserved1=0x6f0c4f8, cFileName="ExcelMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~1.YOU")) returned 0x5b96f0 [0079.551] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.968] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", len=0x49 | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 1 [0085.968] GetProcessHeap () returned 0x580000 [0085.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x7c) returned 0x614a48 [0085.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.968] Sleep (dwMilliseconds=0x1) [0085.983] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", len=0x4b | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 1 [0085.983] GetProcessHeap () returned 0x580000 [0085.983] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x14) returned 0x614a48 [0085.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.992] Sleep (dwMilliseconds=0x1) [0092.411] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", len=0x43 | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 1 [0092.411] GetProcessHeap () returned 0x580000 [0092.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x2c) returned 0x61f7a0 [0092.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0092.462] CloseHandle (hObject=0x460) returned 1 [0092.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id_1622540890_.your_last_chance")) returned 1 [0092.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICEINF~1.YOU")) returned 0x5b96f0 [0092.463] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0092.463] GetProcessHeap () returned 0x580000 [0092.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x67fc68 [0092.464] GetProcessHeap () returned 0x580000 [0092.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6f1bea8 [0092.464] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.464] ReadFile (in: hFile=0x460, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x470ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0092.466] GetProcessHeap () returned 0x580000 [0092.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.466] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.466] WriteFile (in: hFile=0x460, lpBuffer=0x6f1bea8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesWritten=0x470ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0092.466] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.466] WriteFile (in: hFile=0x460, lpBuffer=0x6f1c047*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c047*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.466] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.466] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.466] CloseHandle (hObject=0x460) returned 1 [0092.467] GetProcessHeap () returned 0x580000 [0092.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0092.467] GetProcessHeap () returned 0x580000 [0092.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0092.467] GetProcessHeap () returned 0x580000 [0092.467] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6eba9fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x470fd28, dwReserved1=0x67fc68, cFileName="ICE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICEINF~1.YOU")) returned 0x5b96f0 [0092.467] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.526] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", len=0x4d | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 1 [0092.526] GetProcessHeap () returned 0x580000 [0092.526] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0092.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.594] CloseHandle (hObject=0x3f8) returned 1 [0092.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id_1622540890_.your_last_chance")) returned 1 [0092.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPEDI~2.YOU")) returned 0x5b96f0 [0092.595] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0092.595] GetProcessHeap () returned 0x580000 [0092.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d70c70 [0092.595] GetProcessHeap () returned 0x580000 [0092.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d824a0 [0092.595] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.595] ReadFile (in: hFile=0x3f8, lpBuffer=0x6d70c70, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d70c70*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0098.898] GetProcessHeap () returned 0x580000 [0098.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0098.899] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.899] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d824a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d824a0*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0098.899] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.899] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d93c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d93c9f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.899] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.899] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.900] CloseHandle (hObject=0x3f8) returned 1 [0098.900] GetProcessHeap () returned 0x580000 [0098.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d824a0 | out: hHeap=0x580000) returned 1 [0098.900] GetProcessHeap () returned 0x580000 [0098.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d70c70 | out: hHeap=0x580000) returned 1 [0098.900] GetProcessHeap () returned 0x580000 [0098.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0098.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x728f5620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1955d, dwReserved0=0x470fd28, dwReserved1=0x6d70c70, cFileName="EXPEDITN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPEDI~2.YOU")) returned 0x5b96b0 [0098.901] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.368] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", len=0x49 | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 1 [0101.368] GetProcessHeap () returned 0x580000 [0101.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x28) returned 0x5dc550 [0101.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0101.579] CloseHandle (hObject=0x498) returned 1 [0101.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id_1622540890_.your_last_chance")) returned 1 [0101.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUDIO~2.YOU")) returned 0x5b9630 [0101.651] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0101.651] GetProcessHeap () returned 0x580000 [0101.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f444a8 [0101.651] GetProcessHeap () returned 0x580000 [0101.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c4f8 [0101.651] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.651] ReadFile (in: hFile=0x498, lpBuffer=0x6f444a8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f444a8*, lpNumberOfBytesRead=0x470ff14*=0x240, lpOverlapped=0x0) returned 1 [0101.667] GetProcessHeap () returned 0x580000 [0101.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.667] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.667] WriteFile (in: hFile=0x498, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x470ff14*=0x240, lpOverlapped=0x0) returned 1 [0101.667] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.667] WriteFile (in: hFile=0x498, lpBuffer=0x6f0c737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c737*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.667] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.667] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.667] CloseHandle (hObject=0x498) returned 1 [0101.668] GetProcessHeap () returned 0x580000 [0101.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0101.668] GetProcessHeap () returned 0x580000 [0101.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f444a8 | out: hHeap=0x580000) returned 1 [0101.668] GetProcessHeap () returned 0x580000 [0101.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74370ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x470fd28, dwReserved1=0x6f444a8, cFileName="STUDIO.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STUDIO~2.YOU")) returned 0x5b9630 [0101.668] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.759] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x470ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 1 [0101.759] GetProcessHeap () returned 0x580000 [0101.759] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0101.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0103.979] CloseHandle (hObject=0x4a0) returned 1 [0103.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0103.979] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0106.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0106.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0106.584] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0106.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0106.584] GetProcessHeap () returned 0x580000 [0106.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa5e1) returned 0x6f10048 [0106.585] GetProcessHeap () returned 0x580000 [0106.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa5e1) returned 0x6dfaac0 [0106.585] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.585] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f10048, nNumberOfBytesToRead=0xa5c0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x470ff14*=0xa5c0, lpOverlapped=0x0) returned 1 [0107.022] GetProcessHeap () returned 0x580000 [0107.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0107.023] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.023] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dfaac0*, nNumberOfBytesToWrite=0xa5c0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesWritten=0x470ff14*=0xa5c0, lpOverlapped=0x0) returned 1 [0107.023] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.023] WriteFile (in: hFile=0x4a0, lpBuffer=0x6e0507f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0507f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0107.023] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.023] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0107.023] CloseHandle (hObject=0x4a0) returned 1 [0107.024] GetProcessHeap () returned 0x580000 [0107.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0107.025] GetProcessHeap () returned 0x580000 [0107.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0107.025] GetProcessHeap () returned 0x580000 [0107.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0107.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77678280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa5f9, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0107.025] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.151] Sleep (dwMilliseconds=0x1) [0111.787] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\directshowtap.ax", len=0x2b | out: pbstr=0x470ff84*="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 1 [0111.787] GetProcessHeap () returned 0x580000 [0111.787] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.787] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.864] Sleep (dwMilliseconds=0x1) [0111.911] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", len=0x46 | out: pbstr=0x470ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 1 [0111.911] GetProcessHeap () returned 0x580000 [0111.911] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0111.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.945] Sleep (dwMilliseconds=0x1) [0112.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.046] Sleep (dwMilliseconds=0x1) [0112.161] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", len=0x57 | out: pbstr=0x470ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 1 [0112.161] GetProcessHeap () returned 0x580000 [0112.161] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b96b0 [0112.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.161] Sleep (dwMilliseconds=0x1) [0112.189] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.205] Sleep (dwMilliseconds=0x1) [0112.313] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", len=0x4b | out: pbstr=0x470ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned 1 [0112.313] GetProcessHeap () returned 0x580000 [0112.314] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1828 [0112.314] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.327] Sleep (dwMilliseconds=0x1) [0113.328] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", len=0x3f | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 1 [0113.328] GetProcessHeap () returned 0x580000 [0113.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xac) returned 0x6f0ceb8 [0113.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0113.483] CloseHandle (hObject=0x3e4) returned 1 [0113.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0103~1.YOU")) returned 0x5b9630 [0114.626] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0114.626] GetProcessHeap () returned 0x580000 [0114.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0114.626] GetProcessHeap () returned 0x580000 [0114.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6d10048 [0114.626] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.626] ReadFile (in: hFile=0x3e4, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x470ff14*=0xd00, lpOverlapped=0x0) returned 1 [0114.639] GetProcessHeap () returned 0x580000 [0114.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.639] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.639] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x470ff14*=0xd00, lpOverlapped=0x0) returned 1 [0114.640] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.640] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d10d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10d47*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.640] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.640] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.640] CloseHandle (hObject=0x3e4) returned 1 [0114.640] GetProcessHeap () returned 0x580000 [0114.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0114.640] GetProcessHeap () returned 0x580000 [0114.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.640] GetProcessHeap () returned 0x580000 [0114.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bf12180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd34, dwReserved0=0x470fd28, dwReserved1=0x635768, cFileName="AN01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0103~1.YOU")) returned 0x5b9630 [0115.610] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0115.653] CloseHandle (hObject=0x390) returned 1 [0115.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.653] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~2.YOU")) returned 0x5b9630 [0115.654] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0115.654] GetProcessHeap () returned 0x580000 [0115.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27e1) returned 0x6c61108 [0115.654] GetProcessHeap () returned 0x580000 [0115.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27e1) returned 0x6c75898 [0115.654] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.654] ReadFile (in: hFile=0x390, lpBuffer=0x6c61108, nNumberOfBytesToRead=0x27c0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesRead=0x470ff14*=0x27c0, lpOverlapped=0x0) returned 1 [0116.980] GetProcessHeap () returned 0x580000 [0116.980] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.980] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.980] WriteFile (in: hFile=0x390, lpBuffer=0x6c75898*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75898*, lpNumberOfBytesWritten=0x470ff14*=0x27c0, lpOverlapped=0x0) returned 1 [0116.980] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.980] WriteFile (in: hFile=0x390, lpBuffer=0x6c78057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78057*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.980] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.981] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.981] CloseHandle (hObject=0x390) returned 1 [0116.981] GetProcessHeap () returned 0x580000 [0116.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75898 | out: hHeap=0x580000) returned 1 [0116.981] GetProcessHeap () returned 0x580000 [0116.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0116.981] GetProcessHeap () returned 0x580000 [0116.981] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d562fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27e4, dwReserved0=0x470fd28, dwReserved1=0x6c61108, cFileName="SO00194_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~2.YOU")) returned 0x5b9630 [0118.053] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.808] CloseHandle (hObject=0x49c) returned 1 [0118.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0246~2.YOU")) returned 0x5b9730 [0118.809] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.809] GetProcessHeap () returned 0x580000 [0118.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a61) returned 0x667250 [0118.809] GetProcessHeap () returned 0x580000 [0118.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a61) returned 0x6d0e508 [0118.809] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.809] ReadFile (in: hFile=0x49c, lpBuffer=0x667250, nNumberOfBytesToRead=0x1a40, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x470ff14*=0x1a40, lpOverlapped=0x0) returned 1 [0118.833] GetProcessHeap () returned 0x580000 [0118.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.833] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.833] WriteFile (in: hFile=0x49c, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x470ff14*=0x1a40, lpOverlapped=0x0) returned 1 [0118.834] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.834] WriteFile (in: hFile=0x49c, lpBuffer=0x6d0ff47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ff47*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.834] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.834] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.834] CloseHandle (hObject=0x49c) returned 1 [0118.834] GetProcessHeap () returned 0x580000 [0118.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0118.834] GetProcessHeap () returned 0x580000 [0118.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0118.834] GetProcessHeap () returned 0x580000 [0118.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e717360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a78, dwReserved0=0x470fd28, dwReserved1=0x667250, cFileName="SO02464_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0246~2.YOU")) returned 0x5b96f0 [0120.125] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.152] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", len=0x4c | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 1 [0120.152] GetProcessHeap () returned 0x580000 [0120.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17bc) returned 0x6d06ca8 [0120.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.117] CloseHandle (hObject=0x438) returned 1 [0122.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~3.YOU")) returned 0x5b9730 [0122.118] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.118] GetProcessHeap () returned 0x580000 [0122.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c65108 [0122.119] GetProcessHeap () returned 0x580000 [0122.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4e820 [0122.119] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.119] ReadFile (in: hFile=0x438, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0122.124] GetProcessHeap () returned 0x580000 [0122.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.124] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.124] WriteFile (in: hFile=0x438, lpBuffer=0x6c4e820*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesWritten=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0122.124] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.124] WriteFile (in: hFile=0x438, lpBuffer=0x6c4eb7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4eb7f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.124] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.124] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.124] CloseHandle (hObject=0x438) returned 1 [0122.124] GetProcessHeap () returned 0x580000 [0122.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0122.124] GetProcessHeap () returned 0x580000 [0122.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0122.124] GetProcessHeap () returned 0x580000 [0122.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8067b580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x470fd28, dwReserved1=0x6c65108, cFileName="WB02073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~3.YOU")) returned 0x5b9730 [0124.419] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.081] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", len=0x53 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 1 [0125.081] GetProcessHeap () returned 0x580000 [0125.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a0) returned 0x6f42f08 [0125.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0125.137] CloseHandle (hObject=0x450) returned 1 [0125.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0125.138] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0125.138] GetProcessHeap () returned 0x580000 [0125.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x53c1) returned 0x6dd0860 [0125.138] GetProcessHeap () returned 0x580000 [0125.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x53c1) returned 0x6d10048 [0125.138] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.139] ReadFile (in: hFile=0x450, lpBuffer=0x6dd0860, nNumberOfBytesToRead=0x53a0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0860*, lpNumberOfBytesRead=0x470ff14*=0x53a0, lpOverlapped=0x0) returned 1 [0126.463] GetProcessHeap () returned 0x580000 [0126.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0126.463] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.463] WriteFile (in: hFile=0x450, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x470ff14*=0x53a0, lpOverlapped=0x0) returned 1 [0126.463] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.463] WriteFile (in: hFile=0x450, lpBuffer=0x6d153e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d153e7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.464] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.464] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.464] CloseHandle (hObject=0x450) returned 1 [0127.001] GetProcessHeap () returned 0x580000 [0127.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0127.001] GetProcessHeap () returned 0x580000 [0127.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd0860 | out: hHeap=0x580000) returned 1 [0127.001] GetProcessHeap () returned 0x580000 [0127.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0127.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82fd73c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x53d3, dwReserved0=0x470fd28, dwReserved1=0x6dd0860, cFileName="Perspective.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9730 [0127.002] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.451] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", len=0x3d | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned 1 [0127.451] GetProcessHeap () returned 0x580000 [0127.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c4) returned 0x667250 [0127.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0129.284] CloseHandle (hObject=0x390) returned 1 [0129.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02996~1.YOU")) returned 0x5b9730 [0130.917] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0130.918] GetProcessHeap () returned 0x580000 [0130.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x67ec60 [0130.918] GetProcessHeap () returned 0x580000 [0130.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6c7a390 [0130.918] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.918] ReadFile (in: hFile=0x390, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1300, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x470ff14*=0x1300, lpOverlapped=0x0) returned 1 [0130.935] GetProcessHeap () returned 0x580000 [0130.935] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.935] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.936] WriteFile (in: hFile=0x390, lpBuffer=0x6c7a390*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a390*, lpNumberOfBytesWritten=0x470ff14*=0x1300, lpOverlapped=0x0) returned 1 [0130.936] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.936] WriteFile (in: hFile=0x390, lpBuffer=0x6c7b68f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7b68f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.936] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.936] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.936] CloseHandle (hObject=0x390) returned 1 [0130.936] GetProcessHeap () returned 0x580000 [0130.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a390 | out: hHeap=0x580000) returned 1 [0130.936] GetProcessHeap () returned 0x580000 [0130.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0130.936] GetProcessHeap () returned 0x580000 [0130.936] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85a89e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x470fd28, dwReserved1=0x67ec60, cFileName="J0299611.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02996~1.YOU")) returned 0x5b9730 [0130.936] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0132.819] CloseHandle (hObject=0x460) returned 1 [0132.819] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.id_1622540890_.your_last_chance")) returned 1 [0132.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPTOO~1.YOU")) returned 0x5b9730 [0132.820] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0132.820] GetProcessHeap () returned 0x580000 [0132.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703f0b8 [0132.821] GetProcessHeap () returned 0x580000 [0132.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70508e8 [0132.821] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.821] ReadFile (in: hFile=0x460, lpBuffer=0x703f0b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x703f0b8*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.620] GetProcessHeap () returned 0x580000 [0137.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0137.621] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.621] WriteFile (in: hFile=0x460, lpBuffer=0x70508e8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x70508e8*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.496] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.496] WriteFile (in: hFile=0x460, lpBuffer=0x70620e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x70620e7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.497] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.497] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.497] CloseHandle (hObject=0x460) returned 1 [0138.567] GetProcessHeap () returned 0x580000 [0138.567] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70508e8 | out: hHeap=0x580000) returned 1 [0138.568] GetProcessHeap () returned 0x580000 [0138.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703f0b8 | out: hHeap=0x580000) returned 1 [0138.571] GetProcessHeap () returned 0x580000 [0138.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0139.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c024, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="EXPTOOWS.XLA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXPTOO~1.YOU")) returned 0x5b9770 [0139.877] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.903] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", len=0x55 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned 1 [0139.903] GetProcessHeap () returned 0x580000 [0139.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0139.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.302] CloseHandle (hObject=0x488) returned 1 [0140.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.id_1622540890_.your_last_chance")) returned 1 [0140.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b9770 [0140.303] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.303] GetProcessHeap () returned 0x580000 [0140.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4e820 [0140.303] GetProcessHeap () returned 0x580000 [0140.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4ebc8 [0140.303] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.303] ReadFile (in: hFile=0x488, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0140.308] GetProcessHeap () returned 0x580000 [0140.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.308] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.308] WriteFile (in: hFile=0x488, lpBuffer=0x6c4ebc8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ebc8*, lpNumberOfBytesWritten=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0140.308] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.308] WriteFile (in: hFile=0x488, lpBuffer=0x6c4ef27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ef27*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.309] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.309] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.309] CloseHandle (hObject=0x488) returned 1 [0140.309] GetProcessHeap () returned 0x580000 [0140.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4ebc8 | out: hHeap=0x580000) returned 1 [0140.309] GetProcessHeap () returned 0x580000 [0140.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0140.309] GetProcessHeap () returned 0x580000 [0140.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3f38c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38a, dwReserved0=0x470fd28, dwReserved1=0x6c4e820, cFileName="RTF_BOLD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BO~1.YOU")) returned 0x5b9770 [0140.663] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.673] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", len=0x43 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned 1 [0140.673] GetProcessHeap () returned 0x580000 [0140.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d90) returned 0x6f14048 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.789] CloseHandle (hObject=0x478) returned 1 [0140.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.790] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1471~1.YOU")) returned 0x5b9730 [0140.790] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.790] GetProcessHeap () returned 0x580000 [0140.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x6e063d0 [0140.790] GetProcessHeap () returned 0x580000 [0140.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x677cd0 [0140.790] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.790] ReadFile (in: hFile=0x478, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x470ff14*=0xa80, lpOverlapped=0x0) returned 1 [0140.801] GetProcessHeap () returned 0x580000 [0140.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.801] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.801] WriteFile (in: hFile=0x478, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x470ff14*=0xa80, lpOverlapped=0x0) returned 1 [0140.801] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.801] WriteFile (in: hFile=0x478, lpBuffer=0x67874f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x67874f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.801] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.801] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.801] CloseHandle (hObject=0x478) returned 1 [0140.801] GetProcessHeap () returned 0x580000 [0140.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0140.801] GetProcessHeap () returned 0x580000 [0140.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0140.801] GetProcessHeap () returned 0x580000 [0140.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b890360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xabb, dwReserved0=0x470fd28, dwReserved1=0x6e063d0, cFileName="BD14711_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1471~1.YOU")) returned 0x5b9730 [0141.930] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.953] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS", len=0x3c | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 1 [0141.953] GetProcessHeap () returned 0x580000 [0141.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ecc) returned 0x6f14048 [0141.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0141.954] CloseHandle (hObject=0x3e4) returned 1 [0141.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id_1622540890_.your_last_chance")) returned 1 [0141.955] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x68013d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POB82E~1.YOU")) returned 0x5b9730 [0141.956] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0141.956] GetProcessHeap () returned 0x580000 [0141.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d330a8 [0141.956] GetProcessHeap () returned 0x580000 [0141.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d448d8 [0141.956] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.956] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.962] GetProcessHeap () returned 0x580000 [0143.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0143.962] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.962] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d448d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d448d8*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.962] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.963] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d560d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d560d7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.012] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.012] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.012] CloseHandle (hObject=0x3e4) returned 1 [0144.031] GetProcessHeap () returned 0x580000 [0144.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d448d8 | out: hHeap=0x580000) returned 1 [0144.031] GetProcessHeap () returned 0x580000 [0144.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0144.031] GetProcessHeap () returned 0x580000 [0144.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0146.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8d735ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x680161, dwReserved0=0x470fd28, dwReserved1=0x6d330a8, cFileName="POWERPNT.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POB82E~1.YOU")) returned 0x5b96f0 [0146.863] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.877] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", len=0x44 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned 1 [0146.877] GetProcessHeap () returned 0x580000 [0146.877] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.354] CloseHandle (hObject=0x4a4) returned 1 [0152.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.355] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR27~1.YOU")) returned 0x5b9730 [0152.356] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.356] GetProcessHeap () returned 0x580000 [0152.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6d79168 [0152.356] GetProcessHeap () returned 0x580000 [0152.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6cba390 [0152.356] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.356] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d79168, nNumberOfBytesToRead=0x1cc0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d79168*, lpNumberOfBytesRead=0x470ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0152.383] GetProcessHeap () returned 0x580000 [0152.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.383] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.383] WriteFile (in: hFile=0x4a4, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x470ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0152.383] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.383] WriteFile (in: hFile=0x4a4, lpBuffer=0x6cbc04f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc04f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.383] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.383] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.383] CloseHandle (hObject=0x4a4) returned 1 [0152.383] GetProcessHeap () returned 0x580000 [0152.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0152.383] GetProcessHeap () returned 0x580000 [0152.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d79168 | out: hHeap=0x580000) returned 1 [0152.384] GetProcessHeap () returned 0x580000 [0152.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9271a100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cf7, dwReserved0=0x470fd28, dwReserved1=0x6d79168, cFileName="PDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR27~1.YOU")) returned 0x5b9730 [0153.600] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0153.659] CloseHandle (hObject=0x3fc) returned 1 [0153.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id_1622540890_.your_last_chance")) returned 1 [0153.660] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b9630 [0153.661] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0153.661] GetProcessHeap () returned 0x580000 [0153.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa41) returned 0x6d59538 [0153.661] GetProcessHeap () returned 0x580000 [0153.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa41) returned 0x6fc4768 [0153.662] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.662] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d59538, nNumberOfBytesToRead=0xaa20, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d59538*, lpNumberOfBytesRead=0x470ff14*=0xaa20, lpOverlapped=0x0) returned 1 [0156.240] GetProcessHeap () returned 0x580000 [0156.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0156.240] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.240] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0xaa20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x470ff14*=0xaa20, lpOverlapped=0x0) returned 1 [0156.240] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.240] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fcf187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fcf187*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0156.241] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.241] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0156.241] CloseHandle (hObject=0x3fc) returned 1 [0156.241] GetProcessHeap () returned 0x580000 [0156.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0156.241] GetProcessHeap () returned 0x580000 [0156.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d59538 | out: hHeap=0x580000) returned 1 [0156.241] GetProcessHeap () returned 0x580000 [0156.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0156.241] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94bd94a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaa4a, dwReserved0=0x470fd28, dwReserved1=0x6d59538, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b9630 [0156.241] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0157.061] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", len=0x3e | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 1 [0157.061] GetProcessHeap () returned 0x580000 [0157.061] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0157.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0158.368] CloseHandle (hObject=0x4ac) returned 1 [0158.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~4.YOU")) returned 0x5b9630 [0158.369] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0158.370] GetProcessHeap () returned 0x580000 [0158.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6d89698 [0158.370] GetProcessHeap () returned 0x580000 [0158.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe5a1) returned 0x6f468d8 [0158.370] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.370] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d89698, nNumberOfBytesToRead=0xe580, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d89698*, lpNumberOfBytesRead=0x470ff14*=0xe580, lpOverlapped=0x0) returned 1 [0163.533] GetProcessHeap () returned 0x580000 [0163.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0163.534] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.534] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0xe580, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x470ff14*=0xe580, lpOverlapped=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.534] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f54e57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f54e57*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0163.534] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.534] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0163.534] CloseHandle (hObject=0x4ac) returned 1 [0164.381] GetProcessHeap () returned 0x580000 [0164.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0164.388] GetProcessHeap () returned 0x580000 [0164.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d89698 | out: hHeap=0x580000) returned 1 [0164.388] GetProcessHeap () returned 0x580000 [0164.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0166.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991536c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe5a8, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="MSART12.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~4.YOU")) returned 0x5b9730 [0166.453] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.507] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", len=0x42 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 1 [0166.508] GetProcessHeap () returned 0x580000 [0166.508] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2254) returned 0x6f14048 [0166.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0166.546] CloseHandle (hObject=0x428) returned 1 [0166.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.547] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id_1622540890_.your_last_chance")) returned 1 [0169.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb999900, ftLastWriteTime.dwHighDateTime=0x1c451be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOMA~1.YOU")) returned 0x5b96b0 [0169.242] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.247] GetProcessHeap () returned 0x580000 [0169.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0169.247] GetProcessHeap () returned 0x580000 [0169.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0169.247] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.247] ReadFile (in: hFile=0x450, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x470ff14*=0x260, lpOverlapped=0x0) returned 1 [0169.251] GetProcessHeap () returned 0x580000 [0169.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.251] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.251] WriteFile (in: hFile=0x450, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x470ff14*=0x260, lpOverlapped=0x0) returned 1 [0169.251] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.251] WriteFile (in: hFile=0x450, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.251] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.251] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.251] CloseHandle (hObject=0x450) returned 1 [0169.251] GetProcessHeap () returned 0x580000 [0169.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0169.251] GetProcessHeap () returned 0x580000 [0169.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0169.251] GetProcessHeap () returned 0x580000 [0169.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7ecf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28c, dwReserved0=0x470fd28, dwReserved1=0x6df2798, cFileName="INFOMAIL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOMA~1.YOU")) returned 0x5b9770 [0172.814] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.862] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", len=0x40 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 1 [0172.862] GetProcessHeap () returned 0x580000 [0172.862] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2258) returned 0x6f14048 [0172.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0172.933] CloseHandle (hObject=0x390) returned 1 [0172.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ca1800, ftCreationTime.dwHighDateTime=0x1c2b07e, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84ca1800, ftLastWriteTime.dwHighDateTime=0x1c2b07e, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~3.YOU")) returned 0x5b9770 [0172.970] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0172.970] GetProcessHeap () returned 0x580000 [0172.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0172.971] GetProcessHeap () returned 0x580000 [0172.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0172.971] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.971] ReadFile (in: hFile=0x390, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x470ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.974] GetProcessHeap () returned 0x580000 [0172.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0172.974] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x390, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x470ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x390, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.974] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.974] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.975] CloseHandle (hObject=0x390) returned 1 [0172.975] GetProcessHeap () returned 0x580000 [0172.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0172.975] GetProcessHeap () returned 0x580000 [0172.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0172.975] GetProcessHeap () returned 0x580000 [0172.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ca1800, ftCreationTime.dwHighDateTime=0x1c2b07e, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb7b800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x470fd28, dwReserved1=0x6c4a820, cFileName="SECREC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~3.YOU")) returned 0x5b9770 [0173.247] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.255] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", len=0x3d | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 1 [0173.255] GetProcessHeap () returned 0x580000 [0173.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0173.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.283] CloseHandle (hObject=0x454) returned 1 [0173.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="REC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECCFG~1.YOU")) returned 0x5b9770 [0173.285] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.285] GetProcessHeap () returned 0x580000 [0173.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x626d30 [0173.285] GetProcessHeap () returned 0x580000 [0173.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6273b8 [0173.285] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.285] ReadFile (in: hFile=0x454, lpBuffer=0x626d30, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x470ff14*=0x640, lpOverlapped=0x0) returned 1 [0173.353] GetProcessHeap () returned 0x580000 [0173.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.353] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.353] WriteFile (in: hFile=0x454, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x470ff14*=0x640, lpOverlapped=0x0) returned 1 [0173.353] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.353] WriteFile (in: hFile=0x454, lpBuffer=0x6279f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279f7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.353] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.353] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.353] CloseHandle (hObject=0x454) returned 1 [0173.353] GetProcessHeap () returned 0x580000 [0173.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0173.353] GetProcessHeap () returned 0x580000 [0173.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0173.353] GetProcessHeap () returned 0x580000 [0173.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef0d900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x675, dwReserved0=0x470fd28, dwReserved1=0x626d30, cFileName="REC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RECCFG~1.YOU")) returned 0x5b9770 [0173.354] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.390] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", len=0x3f | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 1 [0173.390] GetProcessHeap () returned 0x580000 [0173.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0173.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0174.227] CloseHandle (hObject=0x460) returned 1 [0174.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id_1622540890_.your_last_chance")) returned 1 [0174.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTELI~1.YOU")) returned 0x5b9770 [0174.229] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0174.230] GetProcessHeap () returned 0x580000 [0174.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0174.230] GetProcessHeap () returned 0x580000 [0174.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0174.230] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.230] ReadFile (in: hFile=0x460, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x470ff14*=0x420, lpOverlapped=0x0) returned 1 [0174.234] GetProcessHeap () returned 0x580000 [0174.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.234] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.235] WriteFile (in: hFile=0x460, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x470ff14*=0x420, lpOverlapped=0x0) returned 1 [0174.235] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.235] WriteFile (in: hFile=0x460, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.235] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.235] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.235] CloseHandle (hObject=0x460) returned 1 [0174.235] GetProcessHeap () returned 0x580000 [0174.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0174.235] GetProcessHeap () returned 0x580000 [0174.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0174.235] GetProcessHeap () returned 0x580000 [0174.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0176.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f762600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x470fd28, dwReserved1=0x5d09a0, cFileName="NOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTELI~1.YOU")) returned 0x5b96f0 [0176.798] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.843] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", len=0x37 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS") returned 1 [0176.843] GetProcessHeap () returned 0x580000 [0176.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x211c) returned 0x6f14048 [0176.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.518] CloseHandle (hObject=0x41c) returned 1 [0179.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.518] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.id_1622540890_.your_last_chance")) returned 1 [0179.519] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYCSS~1.YOU")) returned 0x5b96f0 [0179.519] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sky.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0179.519] GetProcessHeap () returned 0x580000 [0179.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.519] GetProcessHeap () returned 0x580000 [0179.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.519] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.520] ReadFile (in: hFile=0x41c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x470ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.532] GetProcessHeap () returned 0x580000 [0179.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.532] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.532] WriteFile (in: hFile=0x41c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x470ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.532] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.532] WriteFile (in: hFile=0x41c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.532] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.532] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.532] CloseHandle (hObject=0x41c) returned 1 [0179.532] GetProcessHeap () returned 0x580000 [0179.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.532] GetProcessHeap () returned 0x580000 [0179.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.532] GetProcessHeap () returned 0x580000 [0179.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa29f7980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x470fd28, dwReserved1=0x635768, cFileName="SKY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYCSS~1.YOU")) returned 0x5b9770 [0181.423] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.257] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", len=0x56 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.302] CloseHandle (hObject=0x3fc) returned 1 [0183.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x4c005f, dwReserved1=0x530041, cFileName="OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTOFS~1.YOU")) returned 0x5b9770 [0183.303] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.303] GetProcessHeap () returned 0x580000 [0183.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0183.303] GetProcessHeap () returned 0x580000 [0183.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0183.303] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.304] ReadFile (in: hFile=0x3fc, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x470ff14*=0xc0, lpOverlapped=0x0) returned 1 [0183.305] GetProcessHeap () returned 0x580000 [0183.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.305] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.305] WriteFile (in: hFile=0x3fc, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x470ff14*=0xc0, lpOverlapped=0x0) returned 1 [0183.305] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.305] WriteFile (in: hFile=0x3fc, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.305] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.305] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.306] CloseHandle (hObject=0x3fc) returned 1 [0183.306] GetProcessHeap () returned 0x580000 [0183.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0183.306] GetProcessHeap () returned 0x580000 [0183.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0183.306] GetProcessHeap () returned 0x580000 [0183.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4df8640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x470fd28, dwReserved1=0x5ad8a0, cFileName="OutofSyncIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTOFS~1.YOU")) returned 0x5b9770 [0183.808] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.825] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", len=0x69 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned 1 [0183.825] GetProcessHeap () returned 0x580000 [0183.825] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0183.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.834] CloseHandle (hObject=0x450) returned 1 [0183.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.id_1622540890_.your_last_chance")) returned 1 [0183.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b9770 [0183.836] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.836] GetProcessHeap () returned 0x580000 [0183.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x616020 [0183.836] GetProcessHeap () returned 0x580000 [0183.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x616138 [0183.836] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.836] ReadFile (in: hFile=0x450, lpBuffer=0x616020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x616020*, lpNumberOfBytesRead=0x470ff14*=0xe0, lpOverlapped=0x0) returned 1 [0183.838] GetProcessHeap () returned 0x580000 [0183.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0183.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.838] WriteFile (in: hFile=0x450, lpBuffer=0x616138*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x616138*, lpNumberOfBytesWritten=0x470ff14*=0xe0, lpOverlapped=0x0) returned 1 [0183.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.838] WriteFile (in: hFile=0x450, lpBuffer=0x616217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x616217*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.838] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.838] CloseHandle (hObject=0x450) returned 1 [0183.838] GetProcessHeap () returned 0x580000 [0183.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0183.838] GetProcessHeap () returned 0x580000 [0183.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0183.838] GetProcessHeap () returned 0x580000 [0183.838] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5307500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x470fd28, dwReserved1=0x616020, cFileName="button_left_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b9770 [0183.838] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.861] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", len=0x63 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned 1 [0183.861] GetProcessHeap () returned 0x580000 [0183.861] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0183.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0183.896] CloseHandle (hObject=0x428) returned 1 [0183.896] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.id_1622540890_.your_last_chance")) returned 1 [0183.897] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b9770 [0183.897] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0183.897] GetProcessHeap () returned 0x580000 [0183.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x704ad78 [0183.898] GetProcessHeap () returned 0x580000 [0183.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x704ea08 [0183.898] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.898] ReadFile (in: hFile=0x428, lpBuffer=0x704ad78, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x704ad78*, lpNumberOfBytesRead=0x470ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0184.578] GetProcessHeap () returned 0x580000 [0184.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0184.578] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] WriteFile (in: hFile=0x428, lpBuffer=0x704ea08*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x704ea08*, lpNumberOfBytesWritten=0x470ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0184.579] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] WriteFile (in: hFile=0x428, lpBuffer=0x7052667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7052667*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.579] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.579] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.579] CloseHandle (hObject=0x428) returned 1 [0184.924] GetProcessHeap () returned 0x580000 [0184.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704ea08 | out: hHeap=0x580000) returned 1 [0184.924] GetProcessHeap () returned 0x580000 [0184.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704ad78 | out: hHeap=0x580000) returned 1 [0184.924] GetProcessHeap () returned 0x580000 [0184.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0185.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5a055a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c88, dwReserved0=0x470fd28, dwReserved1=0x704ad78, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b9770 [0185.532] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.579] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", len=0x5a | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned 1 [0185.579] GetProcessHeap () returned 0x580000 [0185.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x210c) returned 0x6f14048 [0185.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0187.185] CloseHandle (hObject=0x458) returned 1 [0187.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~4.YOU")) returned 0x5b96b0 [0187.186] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0187.187] GetProcessHeap () returned 0x580000 [0187.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2601) returned 0x6fbe818 [0187.187] GetProcessHeap () returned 0x580000 [0187.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2601) returned 0x715faf8 [0187.187] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.187] ReadFile (in: hFile=0x458, lpBuffer=0x6fbe818, nNumberOfBytesToRead=0x25e0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbe818*, lpNumberOfBytesRead=0x470ff14*=0x25e0, lpOverlapped=0x0) returned 1 [0187.219] GetProcessHeap () returned 0x580000 [0187.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.219] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x458, lpBuffer=0x715faf8*, nNumberOfBytesToWrite=0x25e0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x715faf8*, lpNumberOfBytesWritten=0x470ff14*=0x25e0, lpOverlapped=0x0) returned 1 [0187.219] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.219] WriteFile (in: hFile=0x458, lpBuffer=0x71620d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x71620d7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.220] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.220] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.220] CloseHandle (hObject=0x458) returned 1 [0187.220] GetProcessHeap () returned 0x580000 [0187.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715faf8 | out: hHeap=0x580000) returned 1 [0187.220] GetProcessHeap () returned 0x580000 [0187.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbe818 | out: hHeap=0x580000) returned 1 [0187.220] GetProcessHeap () returned 0x580000 [0187.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0187.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa734ff60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2609, dwReserved0=0x470fd28, dwReserved1=0x6fbe818, cFileName="MessageAttachmentIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~4.YOU")) returned 0x5b96b0 [0187.220] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0188.070] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", len=0x45 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned 1 [0188.070] GetProcessHeap () returned 0x580000 [0188.070] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2094) returned 0x6f14048 [0188.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0190.279] CloseHandle (hObject=0x45c) returned 1 [0190.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0190.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.id_1622540890_.your_last_chance")) returned 1 [0191.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1418~1.YOU")) returned 0x5b97b0 [0194.470] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0194.470] GetProcessHeap () returned 0x580000 [0194.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6dc71d0 [0194.471] GetProcessHeap () returned 0x580000 [0194.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6fffbe8 [0194.471] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.471] ReadFile (in: hFile=0x420, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x2380, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x470ff14*=0x2380, lpOverlapped=0x0) returned 1 [0194.514] GetProcessHeap () returned 0x580000 [0194.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.514] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.514] WriteFile (in: hFile=0x420, lpBuffer=0x6fffbe8*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fffbe8*, lpNumberOfBytesWritten=0x470ff14*=0x2380, lpOverlapped=0x0) returned 1 [0194.514] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.515] WriteFile (in: hFile=0x420, lpBuffer=0x7001f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7001f67*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.515] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.515] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.515] CloseHandle (hObject=0x420) returned 1 [0194.515] GetProcessHeap () returned 0x580000 [0194.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fffbe8 | out: hHeap=0x580000) returned 1 [0194.515] GetProcessHeap () returned 0x580000 [0194.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0194.515] GetProcessHeap () returned 0x580000 [0194.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8ca180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23b9, dwReserved0=0x470fd28, dwReserved1=0x6dc71d0, cFileName="ZPDIR51B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1418~1.YOU")) returned 0x5b97b0 [0194.515] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.856] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", len=0x45 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned 1 [0196.856] GetProcessHeap () returned 0x580000 [0196.856] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc4) returned 0x6f14048 [0196.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.857] CloseHandle (hObject=0x4ac) returned 1 [0196.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x452b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPCF6D~1.YOU")) returned 0x5b97b0 [0196.858] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.858] GetProcessHeap () returned 0x580000 [0196.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4541) returned 0x7100718 [0196.859] GetProcessHeap () returned 0x580000 [0196.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4541) returned 0x7104c68 [0196.859] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.859] ReadFile (in: hFile=0x4ac, lpBuffer=0x7100718, nNumberOfBytesToRead=0x4520, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesRead=0x470ff14*=0x4520, lpOverlapped=0x0) returned 1 [0197.444] GetProcessHeap () returned 0x580000 [0197.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0197.444] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x4ac, lpBuffer=0x7104c68*, nNumberOfBytesToWrite=0x4520, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7104c68*, lpNumberOfBytesWritten=0x470ff14*=0x4520, lpOverlapped=0x0) returned 1 [0197.444] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x4ac, lpBuffer=0x7109187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7109187*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.444] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.444] CloseHandle (hObject=0x4ac) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7104c68 | out: hHeap=0x580000) returned 1 [0197.766] GetProcessHeap () returned 0x580000 [0197.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0197.766] GetProcessHeap () returned 0x580000 [0197.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0199.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad4c2400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x454f, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="ZPDIR15F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPCF6D~1.YOU")) returned 0x5b96b0 [0199.622] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.650] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", len=0x62 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned 1 [0199.650] GetProcessHeap () returned 0x580000 [0199.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0199.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.759] CloseHandle (hObject=0x488) returned 1 [0201.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.id_1622540890_.your_last_chance")) returned 1 [0201.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b97b0 [0201.762] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.762] GetProcessHeap () returned 0x580000 [0201.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0201.762] GetProcessHeap () returned 0x580000 [0201.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0201.762] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.762] ReadFile (in: hFile=0x488, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.766] GetProcessHeap () returned 0x580000 [0201.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.766] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.766] WriteFile (in: hFile=0x488, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x470ff14*=0x360, lpOverlapped=0x0) returned 1 [0201.767] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.767] WriteFile (in: hFile=0x488, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.767] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.767] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.767] CloseHandle (hObject=0x488) returned 1 [0201.767] GetProcessHeap () returned 0x580000 [0201.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0201.767] GetProcessHeap () returned 0x580000 [0201.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0201.767] GetProcessHeap () returned 0x580000 [0201.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdf80e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x470fd28, dwReserved1=0x6eef020, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b9770 [0202.698] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.753] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS", len=0x45 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS") returned 1 [0202.754] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec8) returned 0x6f14048 [0202.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0202.755] CloseHandle (hObject=0x3b8) returned 1 [0202.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css.id_1622540890_.your_last_chance")) returned 1 [0202.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66e800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb66e800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF427~1.YOU")) returned 0x5b9770 [0202.756] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0202.756] GetProcessHeap () returned 0x580000 [0202.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7215fc8 [0202.757] GetProcessHeap () returned 0x580000 [0202.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72277f8 [0202.757] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.757] ReadFile (in: hFile=0x3b8, lpBuffer=0x7215fc8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7215fc8*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.124] GetProcessHeap () returned 0x580000 [0209.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0209.125] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.125] WriteFile (in: hFile=0x3b8, lpBuffer=0x72277f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x72277f8*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.125] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.125] WriteFile (in: hFile=0x3b8, lpBuffer=0x7238ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7238ff7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.125] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.126] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.126] CloseHandle (hObject=0x3b8) returned 1 [0209.126] GetProcessHeap () returned 0x580000 [0209.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72277f8 | out: hHeap=0x580000) returned 1 [0209.530] GetProcessHeap () returned 0x580000 [0209.530] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7215fc8 | out: hHeap=0x580000) returned 1 [0209.532] GetProcessHeap () returned 0x580000 [0209.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0210.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66e800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44309e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6e, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SCHEME29.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCF427~1.YOU")) returned 0x5b97b0 [0210.090] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.125] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS", len=0x45 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS") returned 1 [0210.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0210.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.126] CloseHandle (hObject=0x3b8) returned 1 [0210.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css.id_1622540890_.your_last_chance")) returned 1 [0210.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13bf2300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13bf2300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC155A~1.YOU")) returned 0x5b97b0 [0210.127] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.127] GetProcessHeap () returned 0x580000 [0210.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7450048 [0210.127] GetProcessHeap () returned 0x580000 [0210.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0210.128] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.128] ReadFile (in: hFile=0x3b8, lpBuffer=0x7450048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.839] GetProcessHeap () returned 0x580000 [0213.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0213.839] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x3b8, lpBuffer=0x72f0208*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.840] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x3b8, lpBuffer=0x7301a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a07*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0213.840] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.840] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0213.840] CloseHandle (hObject=0x3b8) returned 1 [0213.840] GetProcessHeap () returned 0x580000 [0213.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0214.248] GetProcessHeap () returned 0x580000 [0214.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0214.249] GetProcessHeap () returned 0x580000 [0214.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0214.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13bf2300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb711e920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f61e, dwReserved0=0x470fd28, dwReserved1=0x7450048, cFileName="SCHEME23.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC155A~1.YOU")) returned 0x5b97b0 [0214.762] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.876] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI", len=0x45 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI") returned 1 [0214.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0214.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0214.876] CloseHandle (hObject=0x42c) returned 1 [0214.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini.id_1622540890_.your_last_chance")) returned 1 [0214.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FONTSC~1.YOU")) returned 0x5b97b0 [0214.877] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0214.878] GetProcessHeap () returned 0x580000 [0214.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0214.878] GetProcessHeap () returned 0x580000 [0214.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6f668d8 [0214.878] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.878] ReadFile (in: hFile=0x42c, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x470ff14*=0xca0, lpOverlapped=0x0) returned 1 [0214.939] GetProcessHeap () returned 0x580000 [0214.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0214.939] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.939] WriteFile (in: hFile=0x42c, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x470ff14*=0xca0, lpOverlapped=0x0) returned 1 [0214.939] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.939] WriteFile (in: hFile=0x42c, lpBuffer=0x6f67577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67577*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.940] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.940] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.940] CloseHandle (hObject=0x42c) returned 1 [0214.940] GetProcessHeap () returned 0x580000 [0214.940] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0214.940] GetProcessHeap () returned 0x580000 [0214.940] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0214.940] GetProcessHeap () returned 0x580000 [0214.940] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0214.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7baeac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcdb, dwReserved0=0x470fd28, dwReserved1=0x635768, cFileName="FONTSCHM.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FONTSC~1.YOU")) returned 0x5b97b0 [0214.940] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.004] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS", len=0x3b | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 1 [0215.004] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0215.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.005] CloseHandle (hObject=0x42c) returned 1 [0215.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id_1622540890_.your_last_chance")) returned 1 [0215.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ON4E5B~1.YOU")) returned 0x5b97b0 [0215.006] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0215.006] GetProcessHeap () returned 0x580000 [0215.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0215.006] GetProcessHeap () returned 0x580000 [0215.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0215.006] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.006] ReadFile (in: hFile=0x42c, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.681] GetProcessHeap () returned 0x580000 [0220.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0220.681] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.681] WriteFile (in: hFile=0x42c, lpBuffer=0x6fe77c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.681] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.681] WriteFile (in: hFile=0x42c, lpBuffer=0x6ff8fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8fc7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.840] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.840] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.840] CloseHandle (hObject=0x42c) returned 1 [0220.840] GetProcessHeap () returned 0x580000 [0220.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0220.841] GetProcessHeap () returned 0x580000 [0220.841] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0220.841] GetProcessHeap () returned 0x580000 [0220.841] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb3eb280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7f4, dwReserved0=0x470fd28, dwReserved1=0x6fd5f98, cFileName="ONENOTE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ON4E5B~1.YOU")) returned 0x5b9730 [0221.879] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.884] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", len=0x67 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned 1 [0221.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0221.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.920] CloseHandle (hObject=0x3e4) returned 1 [0221.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHITEB~1.YOU")) returned 0x5b9730 [0221.921] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.921] GetProcessHeap () returned 0x580000 [0221.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6f668d8 [0221.921] GetProcessHeap () returned 0x580000 [0221.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6c29878 [0221.921] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.921] ReadFile (in: hFile=0x3e4, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x470ff14*=0xde0, lpOverlapped=0x0) returned 1 [0221.977] GetProcessHeap () returned 0x580000 [0221.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0221.977] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.977] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x470ff14*=0xde0, lpOverlapped=0x0) returned 1 [0221.977] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.977] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c2a657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a657*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.977] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.978] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.978] CloseHandle (hObject=0x3e4) returned 1 [0221.978] GetProcessHeap () returned 0x580000 [0221.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0221.978] GetProcessHeap () returned 0x580000 [0221.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0221.978] GetProcessHeap () returned 0x580000 [0221.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0221.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbec76e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe23, dwReserved0=0x470fd28, dwReserved1=0x6f668d8, cFileName="WHITEBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHITEB~1.YOU")) returned 0x5b96f0 [0222.624] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0225.423] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", len=0x36 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 1 [0225.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0225.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0225.424] CloseHandle (hObject=0x3fc) returned 1 [0225.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.id_1622540890_.your_last_chance")) returned 1 [0225.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXOLED~1.YOU")) returned 0x5b9630 [0225.425] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0225.425] GetProcessHeap () returned 0x580000 [0225.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0225.425] GetProcessHeap () returned 0x580000 [0225.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0225.426] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.426] ReadFile (in: hFile=0x3fc, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.833] GetProcessHeap () returned 0x580000 [0233.833] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0233.833] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.834] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fe77c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.834] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.834] WriteFile (in: hFile=0x3fc, lpBuffer=0x6ff8fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8fc7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.834] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.834] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.834] CloseHandle (hObject=0x3fc) returned 1 [0235.460] GetProcessHeap () returned 0x580000 [0235.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0235.460] GetProcessHeap () returned 0x580000 [0235.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0239.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2e5be20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2adc4, dwReserved0=0x470fd28, dwReserved1=0x6fd5f98, cFileName="IXOLEDB.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXOLED~1.YOU")) returned 0x5b9730 [0239.575] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.586] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", len=0x37 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned 1 [0239.586] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0239.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0239.587] CloseHandle (hObject=0x468) returned 1 [0239.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.587] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id_1622540890_.your_last_chance")) returned 1 [0239.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLFL~1.YOU")) returned 0x5b9630 [0239.588] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0239.589] GetProcessHeap () returned 0x580000 [0239.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0239.589] GetProcessHeap () returned 0x580000 [0239.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0239.590] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.590] ReadFile (in: hFile=0x468, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.260] GetProcessHeap () returned 0x580000 [0242.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0242.260] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.260] WriteFile (in: hFile=0x468, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.261] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.261] WriteFile (in: hFile=0x468, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0242.262] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.262] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0242.262] CloseHandle (hObject=0x468) returned 1 [0242.262] GetProcessHeap () returned 0x580000 [0242.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0242.262] GetProcessHeap () returned 0x580000 [0242.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0242.262] GetProcessHeap () returned 0x580000 [0242.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0242.262] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7eb24a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x380024, dwReserved0=0x470fd28, dwReserved1=0x72f0208, cFileName="OUTLFLTR.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLFL~1.YOU")) returned 0x5b9630 [0242.263] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.910] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML", len=0x40 | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned 1 [0242.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0242.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0244.566] CloseHandle (hObject=0x3f4) returned 1 [0244.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml.id_1622540890_.your_last_chance")) returned 1 [0244.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~1.YOU")) returned 0x5b96f0 [0244.567] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0244.568] GetProcessHeap () returned 0x580000 [0244.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0244.568] GetProcessHeap () returned 0x580000 [0244.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0244.569] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.569] ReadFile (in: hFile=0x3f4, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0247.954] GetProcessHeap () returned 0x580000 [0247.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0247.954] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.955] WriteFile (in: hFile=0x3f4, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 [0247.955] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.955] WriteFile (in: hFile=0x3f4, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0247.955] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.955] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0247.955] CloseHandle (hObject=0x3f4) returned 1 [0248.224] GetProcessHeap () returned 0x580000 [0248.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0248.224] GetProcessHeap () returned 0x580000 [0248.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0248.225] GetProcessHeap () returned 0x580000 [0248.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0253.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb4ffa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x124d6, dwReserved0=0x470fd28, dwReserved1=0x6d630a8, cFileName="PGLBL090.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~1.YOU")) returned 0x5b9730 [0253.081] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.158] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML", len=0x3d | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned 1 [0253.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0253.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0253.189] CloseHandle (hObject=0x41c) returned 1 [0253.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.190] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml.id_1622540890_.your_last_chance")) returned 1 [0253.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x397fc500, ftCreationTime.dwHighDateTime=0x1ca5c59, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x397fc500, ftLastWriteTime.dwHighDateTime=0x1ca5c59, nFileSizeHigh=0x0, nFileSizeLow=0x10a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZFOR~1.YOU")) returned 0x5b9730 [0253.191] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0253.191] GetProcessHeap () returned 0x580000 [0253.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a61) returned 0x7296118 [0253.191] GetProcessHeap () returned 0x580000 [0253.191] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a61) returned 0x72a6b88 [0253.191] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.191] ReadFile (in: hFile=0x41c, lpBuffer=0x7296118, nNumberOfBytesToRead=0x10a40, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x7296118*, lpNumberOfBytesRead=0x470ff14*=0x10a40, lpOverlapped=0x0) returned 1 [0257.889] GetProcessHeap () returned 0x580000 [0257.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0257.889] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.889] WriteFile (in: hFile=0x41c, lpBuffer=0x72a6b88*, nNumberOfBytesToWrite=0x10a40, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x72a6b88*, lpNumberOfBytesWritten=0x470ff14*=0x10a40, lpOverlapped=0x0) returned 1 [0257.890] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.890] WriteFile (in: hFile=0x41c, lpBuffer=0x72b75c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x72b75c7*, lpNumberOfBytesWritten=0x470ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.890] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.890] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x470ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.890] CloseHandle (hObject=0x41c) returned 1 [0258.302] GetProcessHeap () returned 0x580000 [0258.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72a6b88 | out: hHeap=0x580000) returned 1 [0258.302] GetProcessHeap () returned 0x580000 [0258.302] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7296118 | out: hHeap=0x580000) returned 1 [0258.303] GetProcessHeap () returned 0x580000 [0258.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0259.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fccc | out: lpFindFileData=0x470fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x397fc500, ftCreationTime.dwHighDateTime=0x1ca5c59, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd13c4660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10a6a, dwReserved0=0x470fd28, dwReserved1=0x7296118, cFileName="BIZFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZFOR~1.YOU")) returned 0x5b9630 [0259.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.232] SysReAllocStringLen (in: pbstr=0x470ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV", len=0x3d | out: pbstr=0x470ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV") returned 1 [0259.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20cc) returned 0x72e5948 [0259.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0259.397] CloseHandle (hObject=0x460) returned 1 [0259.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x470ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x470fc74 | out: lpFindFileData=0x470fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec02d00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ec02d00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xfeb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBPAGE.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBPAG~1.YOU")) returned 0x5b9630 [0259.398] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0259.398] GetProcessHeap () returned 0x580000 [0259.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71cff08 [0259.399] GetProcessHeap () returned 0x580000 [0259.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71e1738 [0259.399] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.399] ReadFile (in: hFile=0x460, lpBuffer=0x71cff08, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x470ff14, lpOverlapped=0x0 | out: lpBuffer=0x71cff08*, lpNumberOfBytesRead=0x470ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 34 os_tid = 0xa80 [0039.065] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.816] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.546] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.136] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.560] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.730] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.871] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.905] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.018] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.365] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.417] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.838] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.900] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.025] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.181] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.977] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.008] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.164] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.414] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.554] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.757] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.788] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.866] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.933] Sleep (dwMilliseconds=0x1) [0046.944] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.021] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.068] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.723] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.957] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.035] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.099] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.269] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.425] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.581] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.659] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.815] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.893] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.486] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.689] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.141] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.609] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.765] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.938] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.124] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.311] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.436] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.467] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.633] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.777] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.261] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.401] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.885] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.947] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.994] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.181] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.415] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.462] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.931] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.523] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.648] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.710] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.022] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.069] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.540] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.696] Sleep (dwMilliseconds=0x1) [0055.839] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Boot\\Fonts\\chs_boot.ttf", len=0x1a | out: pbstr=0x484ff84*="C:\\Boot\\Fonts\\chs_boot.ttf") returned 1 [0055.840] GetProcessHeap () returned 0x580000 [0055.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94b0 | out: hHeap=0x580000) returned 1 [0055.840] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.840] Sleep (dwMilliseconds=0x1) [0055.892] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", len=0x48 | out: pbstr=0x484ff84*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 1 [0055.892] GetProcessHeap () returned 0x580000 [0055.892] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x6152f8 [0055.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0055.947] CloseHandle (hObject=0x408) returned 1 [0055.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.947] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id_1622540890_.your_last_chance")) returned 1 [0055.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.949] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTLRC~1.YOU")) returned 0x5b9630 [0055.950] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0055.950] GetProcessHeap () returned 0x580000 [0055.950] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0055.951] GetProcessHeap () returned 0x580000 [0055.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c21878 [0055.951] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.951] ReadFile (in: hFile=0x408, lpBuffer=0x6c10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesRead=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0057.679] GetProcessHeap () returned 0x580000 [0057.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0057.680] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.680] WriteFile (in: hFile=0x408, lpBuffer=0x6c21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21878*, lpNumberOfBytesWritten=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0057.680] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.680] WriteFile (in: hFile=0x408, lpBuffer=0x6c33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c33077*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0058.092] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.092] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0058.092] CloseHandle (hObject=0x408) returned 1 [0066.441] GetProcessHeap () returned 0x580000 [0066.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21878 | out: hHeap=0x580000) returned 1 [0066.441] GetProcessHeap () returned 0x580000 [0066.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0066.452] GetProcessHeap () returned 0x580000 [0066.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0066.491] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5ef7e500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x431a2b4, dwReserved0=0x484fd28, dwReserved1=0x6c10048, cFileName="PptLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPTLRC~1.YOU")) returned 0x5b96b0 [0066.492] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.504] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x484ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0066.504] GetProcessHeap () returned 0x580000 [0066.504] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x28) returned 0x5e9710 [0066.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0073.759] CloseHandle (hObject=0x498) returned 1 [0073.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.759] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance")) returned 1 [0075.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.512] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0075.512] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0075.513] GetProcessHeap () returned 0x580000 [0075.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f03898 [0075.513] GetProcessHeap () returned 0x580000 [0075.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6d0e508 [0075.513] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.513] ReadFile (in: hFile=0x498, lpBuffer=0x6f03898, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03898*, lpNumberOfBytesRead=0x484ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0075.529] GetProcessHeap () returned 0x580000 [0075.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0075.529] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.529] WriteFile (in: hFile=0x498, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x484ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0075.532] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.532] WriteFile (in: hFile=0x498, lpBuffer=0x6d0f5a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f5a7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.532] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.532] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.532] CloseHandle (hObject=0x498) returned 1 [0075.532] GetProcessHeap () returned 0x580000 [0075.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0075.532] GetProcessHeap () returned 0x580000 [0075.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03898 | out: hHeap=0x580000) returned 1 [0075.532] GetProcessHeap () returned 0x580000 [0075.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0079.340] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x64a18a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d6, dwReserved0=0x484fd28, dwReserved1=0x6f03898, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0079.340] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.488] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 1 [0079.488] GetProcessHeap () returned 0x580000 [0079.488] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0079.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.512] CloseHandle (hObject=0x478) returned 1 [0079.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0079.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.513] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0079.513] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.513] GetProcessHeap () returned 0x580000 [0079.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6d0f510 [0079.513] GetProcessHeap () returned 0x580000 [0079.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6f0c4f8 [0079.513] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.513] ReadFile (in: hFile=0x478, lpBuffer=0x6d0f510, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f510*, lpNumberOfBytesRead=0x484ff14*=0xa40, lpOverlapped=0x0) returned 1 [0079.524] GetProcessHeap () returned 0x580000 [0079.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.524] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.524] WriteFile (in: hFile=0x478, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x484ff14*=0xa40, lpOverlapped=0x0) returned 1 [0079.524] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.524] WriteFile (in: hFile=0x478, lpBuffer=0x6f0cf37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cf37*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.525] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.525] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.525] CloseHandle (hObject=0x478) returned 1 [0079.525] GetProcessHeap () returned 0x580000 [0079.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0079.525] GetProcessHeap () returned 0x580000 [0079.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0f510 | out: hHeap=0x580000) returned 1 [0079.525] GetProcessHeap () returned 0x580000 [0079.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6702ea60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x484fd28, dwReserved1=0x6d0f510, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0079.525] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.716] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", len=0x67 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 1 [0080.716] GetProcessHeap () returned 0x580000 [0080.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x1c) returned 0x615398 [0080.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0080.728] CloseHandle (hObject=0x488) returned 1 [0080.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id_1622540890_.your_last_chance")) returned 1 [0080.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10O~1.YOU")) returned 0x5b96f0 [0080.733] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.733] GetProcessHeap () returned 0x580000 [0080.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6941) returned 0x671cd0 [0080.734] GetProcessHeap () returned 0x580000 [0080.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6941) returned 0x678620 [0080.734] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.734] ReadFile (in: hFile=0x458, lpBuffer=0x671cd0, nNumberOfBytesToRead=0x6920, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x671cd0*, lpNumberOfBytesRead=0x484ff14*=0x6920, lpOverlapped=0x0) returned 1 [0081.491] GetProcessHeap () returned 0x580000 [0081.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0081.491] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.492] WriteFile (in: hFile=0x458, lpBuffer=0x678620*, nNumberOfBytesToWrite=0x6920, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x678620*, lpNumberOfBytesWritten=0x484ff14*=0x6920, lpOverlapped=0x0) returned 1 [0081.493] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x458, lpBuffer=0x67ef3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ef3f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.493] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.493] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.493] CloseHandle (hObject=0x458) returned 1 [0081.557] GetProcessHeap () returned 0x580000 [0081.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678620 | out: hHeap=0x580000) returned 1 [0081.559] GetProcessHeap () returned 0x580000 [0081.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x671cd0 | out: hHeap=0x580000) returned 1 [0081.559] GetProcessHeap () returned 0x580000 [0081.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0081.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x682ed7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6955, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="PSS10O.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10O~1.YOU")) returned 0x5b9730 [0081.669] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.970] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", len=0x45 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 1 [0085.970] GetProcessHeap () returned 0x580000 [0085.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x6c) returned 0x614a48 [0085.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.971] Sleep (dwMilliseconds=0x1) [0086.368] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", len=0x49 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 1 [0086.368] GetProcessHeap () returned 0x580000 [0086.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0086.375] CloseHandle (hObject=0x498) returned 1 [0086.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id_1622540890_.your_last_chance")) returned 1 [0086.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARCTIC~1.YOU")) returned 0x5b96b0 [0086.387] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0086.387] GetProcessHeap () returned 0x580000 [0086.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0086.387] GetProcessHeap () returned 0x580000 [0086.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0086.387] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.388] ReadFile (in: hFile=0x498, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x484ff14*=0x200, lpOverlapped=0x0) returned 1 [0086.390] GetProcessHeap () returned 0x580000 [0086.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0086.390] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.390] WriteFile (in: hFile=0x498, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x484ff14*=0x200, lpOverlapped=0x0) returned 1 [0086.390] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.390] WriteFile (in: hFile=0x498, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.391] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.391] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.391] CloseHandle (hObject=0x498) returned 1 [0086.391] GetProcessHeap () returned 0x580000 [0086.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0086.391] GetProcessHeap () returned 0x580000 [0086.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0086.391] GetProcessHeap () returned 0x580000 [0086.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0086.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b1a4760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x484fd28, dwReserved1=0x6107d8, cFileName="ARCTIC.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARCTIC~1.YOU")) returned 0x5b96b0 [0086.391] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.483] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 1 [0086.483] GetProcessHeap () returned 0x580000 [0086.483] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0086.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0086.483] CloseHandle (hObject=0x170) returned 1 [0086.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0086.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0086.591] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8101) returned 0x6f1c318 [0086.591] GetProcessHeap () returned 0x580000 [0086.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8101) returned 0x6f24428 [0086.592] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.592] ReadFile (in: hFile=0x170, lpBuffer=0x6f1c318, nNumberOfBytesToRead=0x80e0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c318*, lpNumberOfBytesRead=0x484ff14*=0x80e0, lpOverlapped=0x0) returned 1 [0088.594] GetProcessHeap () returned 0x580000 [0088.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.594] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.594] WriteFile (in: hFile=0x170, lpBuffer=0x6f24428*, nNumberOfBytesToWrite=0x80e0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f24428*, lpNumberOfBytesWritten=0x484ff14*=0x80e0, lpOverlapped=0x0) returned 1 [0088.594] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.594] WriteFile (in: hFile=0x170, lpBuffer=0x6f2c507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2c507*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.595] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.595] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.595] CloseHandle (hObject=0x170) returned 1 [0089.779] GetProcessHeap () returned 0x580000 [0089.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f24428 | out: hHeap=0x580000) returned 1 [0089.779] GetProcessHeap () returned 0x580000 [0089.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1c318 | out: hHeap=0x580000) returned 1 [0089.779] GetProcessHeap () returned 0x580000 [0089.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0089.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c6c4aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8115, dwReserved0=0x484fd28, dwReserved1=0x6f1c318, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0089.779] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.676] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", len=0x45 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 1 [0092.676] GetProcessHeap () returned 0x580000 [0092.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0092.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0092.676] CloseHandle (hObject=0x428) returned 1 [0092.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id_1622540890_.your_last_chance")) returned 1 [0092.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EDGEIN~1.YOU")) returned 0x5b96f0 [0092.677] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0092.677] GetProcessHeap () returned 0x580000 [0092.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0092.677] GetProcessHeap () returned 0x580000 [0092.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0092.677] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.677] ReadFile (in: hFile=0x428, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x484ff14*=0x200, lpOverlapped=0x0) returned 1 [0092.683] GetProcessHeap () returned 0x580000 [0092.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0092.683] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.683] WriteFile (in: hFile=0x428, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x484ff14*=0x200, lpOverlapped=0x0) returned 1 [0092.683] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.683] WriteFile (in: hFile=0x428, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.683] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.683] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.684] CloseHandle (hObject=0x428) returned 1 [0092.684] GetProcessHeap () returned 0x580000 [0092.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0092.684] GetProcessHeap () returned 0x580000 [0092.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0092.684] GetProcessHeap () returned 0x580000 [0092.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0092.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6edbf2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x484fd28, dwReserved1=0x6107d8, cFileName="EDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EDGEIN~1.YOU")) returned 0x5b96f0 [0092.684] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.249] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 1 [0094.250] GetProcessHeap () returned 0x580000 [0094.250] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c56120 [0094.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0094.250] CloseHandle (hObject=0x44c) returned 1 [0094.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0095.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0095.863] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0095.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0095.863] GetProcessHeap () returned 0x580000 [0095.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8581) returned 0x6e7ea40 [0095.863] GetProcessHeap () returned 0x580000 [0095.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8581) returned 0x6f10048 [0095.863] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.863] ReadFile (in: hFile=0x44c, lpBuffer=0x6e7ea40, nNumberOfBytesToRead=0x8560, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7ea40*, lpNumberOfBytesRead=0x484ff14*=0x8560, lpOverlapped=0x0) returned 1 [0099.187] GetProcessHeap () returned 0x580000 [0099.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.187] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.187] WriteFile (in: hFile=0x44c, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x8560, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x484ff14*=0x8560, lpOverlapped=0x0) returned 1 [0099.187] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.187] WriteFile (in: hFile=0x44c, lpBuffer=0x6f185a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f185a7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.188] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.188] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.188] CloseHandle (hObject=0x44c) returned 1 [0099.188] GetProcessHeap () returned 0x580000 [0099.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0099.188] GetProcessHeap () returned 0x580000 [0099.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e7ea40 | out: hHeap=0x580000) returned 1 [0099.191] GetProcessHeap () returned 0x580000 [0099.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72bc9040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8597, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0099.192] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.414] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", len=0x42 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 1 [0101.414] GetProcessHeap () returned 0x580000 [0101.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0101.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0101.573] CloseHandle (hObject=0x448) returned 1 [0101.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id_1622540890_.your_last_chance")) returned 1 [0101.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THEMES~1.YOU")) returned 0x5b9630 [0101.574] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0101.575] GetProcessHeap () returned 0x580000 [0101.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6e057f0 [0101.575] GetProcessHeap () returned 0x580000 [0101.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x631f48 [0101.575] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.575] ReadFile (in: hFile=0x448, lpBuffer=0x6e057f0, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e057f0*, lpNumberOfBytesRead=0x484ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0101.649] GetProcessHeap () returned 0x580000 [0101.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.649] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.649] WriteFile (in: hFile=0x448, lpBuffer=0x631f48*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x631f48*, lpNumberOfBytesWritten=0x484ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0101.649] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.649] WriteFile (in: hFile=0x448, lpBuffer=0x633ba7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x633ba7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.649] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.649] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.649] CloseHandle (hObject=0x448) returned 1 [0101.649] GetProcessHeap () returned 0x580000 [0101.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x631f48 | out: hHeap=0x580000) returned 1 [0101.649] GetProcessHeap () returned 0x580000 [0101.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e057f0 | out: hHeap=0x580000) returned 1 [0101.649] GetProcessHeap () returned 0x580000 [0101.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74324820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c90, dwReserved0=0x484fd28, dwReserved1=0x6e057f0, cFileName="THEMES.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THEMES~1.YOU")) returned 0x5b9630 [0101.650] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.664] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", len=0x4c | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 1 [0101.664] GetProcessHeap () returned 0x580000 [0101.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0101.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0104.646] CloseHandle (hObject=0x3e4) returned 1 [0104.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0104.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9630 [0104.647] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0104.647] GetProcessHeap () returned 0x580000 [0104.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6f0c4f8 [0104.647] GetProcessHeap () returned 0x580000 [0104.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6c676b8 [0104.647] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.648] ReadFile (in: hFile=0x3e4, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x484ff14*=0x620, lpOverlapped=0x0) returned 1 [0104.655] GetProcessHeap () returned 0x580000 [0104.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0104.655] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.655] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x484ff14*=0x620, lpOverlapped=0x0) returned 1 [0104.655] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.655] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c67cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67cd7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0104.655] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.655] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0104.655] CloseHandle (hObject=0x3e4) returned 1 [0104.655] GetProcessHeap () returned 0x580000 [0104.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0104.655] GetProcessHeap () returned 0x580000 [0104.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0104.655] GetProcessHeap () returned 0x580000 [0104.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0104.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fdb180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x647, dwReserved0=0x484fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9630 [0104.656] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.671] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", len=0x34 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 1 [0109.671] GetProcessHeap () returned 0x580000 [0109.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0109.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.708] Sleep (dwMilliseconds=0x1) [0111.108] Sleep (dwMilliseconds=0x1) [0111.119] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.150] Sleep (dwMilliseconds=0x1) [0111.712] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", len=0x37 | out: pbstr=0x484ff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 1 [0111.712] GetProcessHeap () returned 0x580000 [0111.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0111.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.716] Sleep (dwMilliseconds=0x1) [0111.885] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", len=0x4d | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 1 [0111.885] GetProcessHeap () returned 0x580000 [0111.885] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0111.885] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.890] Sleep (dwMilliseconds=0x1) [0111.902] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", len=0x53 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 1 [0111.902] GetProcessHeap () returned 0x580000 [0111.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f928 [0111.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.906] Sleep (dwMilliseconds=0x1) [0111.930] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", len=0x43 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 1 [0111.930] GetProcessHeap () returned 0x580000 [0111.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0111.930] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.934] Sleep (dwMilliseconds=0x1) [0111.956] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", len=0x4b | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 1 [0111.957] GetProcessHeap () returned 0x580000 [0111.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9b08, Size=0x78) returned 0x5d6258 [0111.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.957] Sleep (dwMilliseconds=0x1) [0111.967] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", len=0x47 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 1 [0111.967] GetProcessHeap () returned 0x580000 [0111.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0111.967] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.969] Sleep (dwMilliseconds=0x1) [0112.004] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", len=0x4b | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 1 [0112.004] GetProcessHeap () returned 0x580000 [0112.004] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x2c) returned 0x61f8f0 [0112.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.007] Sleep (dwMilliseconds=0x1) [0112.057] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", len=0x39 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 1 [0112.057] GetProcessHeap () returned 0x580000 [0112.057] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.061] Sleep (dwMilliseconds=0x1) [0112.087] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", len=0x49 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 1 [0112.088] GetProcessHeap () returned 0x580000 [0112.088] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.088] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.088] Sleep (dwMilliseconds=0x1) [0112.118] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", len=0x3e | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 1 [0112.118] GetProcessHeap () returned 0x580000 [0112.118] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61daa8, Size=0x88) returned 0x61b540 [0112.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.120] Sleep (dwMilliseconds=0x1) [0112.153] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", len=0x43 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 1 [0112.153] GetProcessHeap () returned 0x580000 [0112.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b96b0 [0112.153] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.155] Sleep (dwMilliseconds=0x1) [0112.169] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", len=0x4e | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 1 [0112.169] GetProcessHeap () returned 0x580000 [0112.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.169] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.171] Sleep (dwMilliseconds=0x1) [0112.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.186] Sleep (dwMilliseconds=0x1) [0112.200] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.202] Sleep (dwMilliseconds=0x1) [0112.261] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", len=0x59 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned 1 [0112.261] GetProcessHeap () returned 0x580000 [0112.261] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.261] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.261] Sleep (dwMilliseconds=0x1) [0112.275] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", len=0x55 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned 1 [0112.275] GetProcessHeap () returned 0x580000 [0112.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.275] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.275] Sleep (dwMilliseconds=0x1) [0112.292] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", len=0x61 | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned 1 [0112.292] GetProcessHeap () returned 0x580000 [0112.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.292] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.294] Sleep (dwMilliseconds=0x1) [0112.308] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", len=0x4f | out: pbstr=0x484ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 1 [0112.308] GetProcessHeap () returned 0x580000 [0112.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x68) returned 0x6f09508 [0112.308] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.326] Sleep (dwMilliseconds=0x1) [0113.325] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", len=0x3f | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 1 [0113.325] GetProcessHeap () returned 0x580000 [0113.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xbc) returned 0x6f0ceb8 [0113.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0113.485] CloseHandle (hObject=0x43c) returned 1 [0113.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0117~1.YOU")) returned 0x5b9630 [0114.688] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0114.688] GetProcessHeap () returned 0x580000 [0114.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x66e1) returned 0x6c10048 [0114.689] GetProcessHeap () returned 0x580000 [0114.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x66e1) returned 0x6c16738 [0114.689] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.689] ReadFile (in: hFile=0x43c, lpBuffer=0x6c10048, nNumberOfBytesToRead=0x66c0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesRead=0x484ff14*=0x66c0, lpOverlapped=0x0) returned 1 [0117.480] GetProcessHeap () returned 0x580000 [0117.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0117.480] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.480] WriteFile (in: hFile=0x43c, lpBuffer=0x6c16738*, nNumberOfBytesToWrite=0x66c0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c16738*, lpNumberOfBytesWritten=0x484ff14*=0x66c0, lpOverlapped=0x0) returned 1 [0117.480] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.480] WriteFile (in: hFile=0x43c, lpBuffer=0x6c1cdf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c1cdf7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.480] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.480] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.481] CloseHandle (hObject=0x43c) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c16738 | out: hHeap=0x580000) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0120.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da25bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6700, dwReserved0=0x484fd28, dwReserved1=0x6c10048, cFileName="AN01173_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0117~1.YOU")) returned 0x5b96f0 [0120.013] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.029] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", len=0x3f | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF") returned 1 [0120.029] GetProcessHeap () returned 0x580000 [0120.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a4) returned 0x6d06ca8 [0120.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.968] CloseHandle (hObject=0x488) returned 1 [0121.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.969] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0222~1.YOU")) returned 0x5b9730 [0121.969] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0121.969] GetProcessHeap () returned 0x580000 [0121.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x67ec60 [0121.969] GetProcessHeap () returned 0x580000 [0121.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x6f19958 [0121.969] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.969] ReadFile (in: hFile=0x488, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x484ff14*=0x1020, lpOverlapped=0x0) returned 1 [0121.985] GetProcessHeap () returned 0x580000 [0121.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.985] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.985] WriteFile (in: hFile=0x488, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x484ff14*=0x1020, lpOverlapped=0x0) returned 1 [0121.985] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.985] WriteFile (in: hFile=0x488, lpBuffer=0x6f1a977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a977*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.985] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.985] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.986] CloseHandle (hObject=0x488) returned 1 [0121.986] GetProcessHeap () returned 0x580000 [0121.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0121.986] GetProcessHeap () returned 0x580000 [0121.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0121.986] GetProcessHeap () returned 0x580000 [0121.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80524920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x104f, dwReserved0=0x484fd28, dwReserved1=0x67ec60, cFileName="WB02229_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0222~1.YOU")) returned 0x5b9730 [0122.634] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.634] Sleep (dwMilliseconds=0x1) [0124.520] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", len=0x49 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned 1 [0124.520] GetProcessHeap () returned 0x580000 [0124.520] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18fc) returned 0x6f42f08 [0124.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.522] CloseHandle (hObject=0x4a0) returned 1 [0124.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.id_1622540890_.your_last_chance")) returned 1 [0124.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLOWXM~1.YOU")) returned 0x5b9730 [0124.523] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.523] GetProcessHeap () returned 0x580000 [0124.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdc1) returned 0x635768 [0124.523] GetProcessHeap () returned 0x580000 [0124.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdc1) returned 0x6c29878 [0124.523] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.523] ReadFile (in: hFile=0x4a0, lpBuffer=0x635768, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x484ff14*=0xda0, lpOverlapped=0x0) returned 1 [0124.536] GetProcessHeap () returned 0x580000 [0124.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.536] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.536] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x484ff14*=0xda0, lpOverlapped=0x0) returned 1 [0124.537] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.537] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c2a617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a617*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.537] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.537] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.537] CloseHandle (hObject=0x4a0) returned 1 [0124.537] GetProcessHeap () returned 0x580000 [0124.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.537] GetProcessHeap () returned 0x580000 [0124.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0124.537] GetProcessHeap () returned 0x580000 [0124.537] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81d8aaa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x484fd28, dwReserved1=0x635768, cFileName="Flow.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLOWXM~1.YOU")) returned 0x5b9730 [0124.537] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.551] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", len=0x4e | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned 1 [0124.551] GetProcessHeap () returned 0x580000 [0124.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e4) returned 0x6f42f08 [0124.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0124.583] CloseHandle (hObject=0x4a8) returned 1 [0124.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.id_1622540890_.your_last_chance")) returned 1 [0124.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCOU~1.YOU")) returned 0x5b9730 [0124.584] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0124.584] GetProcessHeap () returned 0x580000 [0124.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xde1) returned 0x67ec60 [0124.584] GetProcessHeap () returned 0x580000 [0124.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xde1) returned 0x6f19958 [0124.585] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.585] ReadFile (in: hFile=0x4a8, lpBuffer=0x67ec60, nNumberOfBytesToRead=0xdc0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x484ff14*=0xdc0, lpOverlapped=0x0) returned 1 [0124.641] GetProcessHeap () returned 0x580000 [0124.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0xdc0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x484ff14*=0xdc0, lpOverlapped=0x0) returned 1 [0124.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f1a717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a717*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.641] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.641] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.641] CloseHandle (hObject=0x4a8) returned 1 [0124.696] GetProcessHeap () returned 0x580000 [0124.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0124.696] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0125.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81e6f2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdea, dwReserved0=0x484fd28, dwReserved1=0x67ec60, cFileName="Concourse.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCOU~1.YOU")) returned 0x5b9730 [0125.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.343] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", len=0x3d | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned 1 [0125.343] GetProcessHeap () returned 0x580000 [0125.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x194c) returned 0x6f42f08 [0125.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0128.881] CloseHandle (hObject=0x478) returned 1 [0128.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.881] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02341~1.YOU")) returned 0x5b9730 [0130.152] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0130.152] GetProcessHeap () returned 0x580000 [0130.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6641) returned 0x6ef3008 [0130.152] GetProcessHeap () returned 0x580000 [0130.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6641) returned 0x6d2f958 [0130.152] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.152] ReadFile (in: hFile=0x478, lpBuffer=0x6ef3008, nNumberOfBytesToRead=0x6620, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesRead=0x484ff14*=0x6620, lpOverlapped=0x0) returned 1 [0131.445] GetProcessHeap () returned 0x580000 [0131.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0131.445] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.445] WriteFile (in: hFile=0x478, lpBuffer=0x6d2f958*, nNumberOfBytesToWrite=0x6620, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f958*, lpNumberOfBytesWritten=0x484ff14*=0x6620, lpOverlapped=0x0) returned 1 [0131.446] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.447] WriteFile (in: hFile=0x478, lpBuffer=0x6d35f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35f77*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.447] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.447] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.447] CloseHandle (hObject=0x478) returned 1 [0132.905] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2f958 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0135.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85f4ca60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6656, dwReserved0=0x484fd28, dwReserved1=0x6ef3008, cFileName="J0234131.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02341~1.YOU")) returned 0x5b96f0 [0135.291] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.291] Sleep (dwMilliseconds=0x1) [0135.299] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", len=0x3c | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 1 [0135.299] GetProcessHeap () returned 0x580000 [0135.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0135.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0138.846] CloseHandle (hObject=0x428) returned 1 [0138.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id_1622540890_.your_last_chance")) returned 1 [0138.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AECUTI~1.YOU")) returned 0x5b9770 [0138.888] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0138.889] GetProcessHeap () returned 0x580000 [0138.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa3a1) returned 0x6d8e818 [0138.889] GetProcessHeap () returned 0x580000 [0138.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa3a1) returned 0x6dbf1d0 [0138.889] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.889] ReadFile (in: hFile=0x428, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xa380, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x484ff14*=0xa380, lpOverlapped=0x0) returned 1 [0139.538] GetProcessHeap () returned 0x580000 [0139.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.539] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.539] WriteFile (in: hFile=0x428, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0xa380, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x484ff14*=0xa380, lpOverlapped=0x0) returned 1 [0139.539] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.539] WriteFile (in: hFile=0x428, lpBuffer=0x6dc954f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc954f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.539] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.539] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.539] CloseHandle (hObject=0x428) returned 1 [0139.539] GetProcessHeap () returned 0x580000 [0139.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0139.539] GetProcessHeap () returned 0x580000 [0139.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0139.539] GetProcessHeap () returned 0x580000 [0139.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8ac83400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa3ac, dwReserved0=0x484fd28, dwReserved1=0x6d8e818, cFileName="AECUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AECUTI~1.YOU")) returned 0x5b9770 [0140.123] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.169] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", len=0x5d | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css") returned 1 [0140.169] GetProcessHeap () returned 0x580000 [0140.169] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0140.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.617] CloseHandle (hObject=0x428) returned 1 [0140.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.id_1622540890_.your_last_chance")) returned 1 [0140.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~4.YOU")) returned 0x5b9770 [0140.618] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.618] GetProcessHeap () returned 0x580000 [0140.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0140.618] GetProcessHeap () returned 0x580000 [0140.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0140.618] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.618] ReadFile (in: hFile=0x428, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x484ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.620] GetProcessHeap () returned 0x580000 [0140.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0140.620] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.620] WriteFile (in: hFile=0x428, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x484ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.620] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.620] WriteFile (in: hFile=0x428, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.620] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.620] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.622] CloseHandle (hObject=0x428) returned 1 [0140.622] GetProcessHeap () returned 0x580000 [0140.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0140.622] GetProcessHeap () returned 0x580000 [0140.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0140.622] GetProcessHeap () returned 0x580000 [0140.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0141.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6ed440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x484fd28, dwReserved1=0x60e978, cFileName="Solutions_Person.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~4.YOU")) returned 0x5b9730 [0141.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.316] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK", len=0x45 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 1 [0144.316] GetProcessHeap () returned 0x580000 [0144.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0144.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.317] CloseHandle (hObject=0x484) returned 1 [0144.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0144.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU7D04~1.YOU")) returned 0x5b9730 [0144.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.318] GetProcessHeap () returned 0x580000 [0144.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0144.318] GetProcessHeap () returned 0x580000 [0144.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0144.318] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.318] ReadFile (in: hFile=0x484, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x484ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.319] GetProcessHeap () returned 0x580000 [0144.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.319] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.319] WriteFile (in: hFile=0x484, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x484ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.320] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.320] WriteFile (in: hFile=0x484, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.320] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.320] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.320] CloseHandle (hObject=0x484) returned 1 [0144.320] GetProcessHeap () returned 0x580000 [0144.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0144.320] GetProcessHeap () returned 0x580000 [0144.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0144.320] GetProcessHeap () returned 0x580000 [0144.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8da2fa20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x484fd28, dwReserved1=0x61b540, cFileName="OUTLOOK.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU7D04~1.YOU")) returned 0x5b9730 [0144.320] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.419] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC", len=0x43 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 1 [0144.419] GetProcessHeap () returned 0x580000 [0144.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0144.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.420] CloseHandle (hObject=0x484) returned 1 [0144.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0144.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU314E~1.YOU")) returned 0x5b9730 [0144.421] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.421] GetProcessHeap () returned 0x580000 [0144.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2798 [0144.421] GetProcessHeap () returned 0x580000 [0144.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2a60 [0144.421] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.421] ReadFile (in: hFile=0x484, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x484ff14*=0x280, lpOverlapped=0x0) returned 1 [0144.464] GetProcessHeap () returned 0x580000 [0144.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.464] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.464] WriteFile (in: hFile=0x484, lpBuffer=0x6df2a60*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a60*, lpNumberOfBytesWritten=0x484ff14*=0x280, lpOverlapped=0x0) returned 1 [0144.464] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.464] WriteFile (in: hFile=0x484, lpBuffer=0x6df2cdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2cdf*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.464] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.464] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.464] CloseHandle (hObject=0x484) returned 1 [0144.464] GetProcessHeap () returned 0x580000 [0144.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a60 | out: hHeap=0x580000) returned 1 [0144.464] GetProcessHeap () returned 0x580000 [0144.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0144.464] GetProcessHeap () returned 0x580000 [0144.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8db86680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x484fd28, dwReserved1=0x6df2798, cFileName="OUTLOOK.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU314E~1.YOU")) returned 0x5b9730 [0144.465] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.535] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD", len=0x3a | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 1 [0144.535] GetProcessHeap () returned 0x580000 [0144.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0144.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.582] CloseHandle (hObject=0x3b4) returned 1 [0144.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id_1622540890_.your_last_chance")) returned 1 [0144.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGPOS~1.YOU")) returned 0x5b9730 [0144.583] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0144.583] GetProcessHeap () returned 0x580000 [0144.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6dcfb90 [0144.583] GetProcessHeap () returned 0x580000 [0144.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6c65108 [0144.583] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.583] ReadFile (in: hFile=0x3b4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x484ff14*=0x440, lpOverlapped=0x0) returned 1 [0144.602] GetProcessHeap () returned 0x580000 [0144.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.602] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.602] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x484ff14*=0x440, lpOverlapped=0x0) returned 1 [0144.602] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.602] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c65547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65547*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.602] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.603] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.603] CloseHandle (hObject=0x3b4) returned 1 [0144.603] GetProcessHeap () returned 0x580000 [0144.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0144.603] GetProcessHeap () returned 0x580000 [0144.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0144.603] GetProcessHeap () returned 0x580000 [0144.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0144.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8dcdd2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46e, dwReserved0=0x484fd28, dwReserved1=0x6dcfb90, cFileName="ORGPOS.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGPOS~1.YOU")) returned 0x5b9730 [0146.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0147.623] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", len=0x44 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned 1 [0147.624] GetProcessHeap () returned 0x580000 [0147.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0147.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0147.901] CloseHandle (hObject=0x490) returned 1 [0147.901] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0147.901] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.id_1622540890_.your_last_chance")) returned 1 [0147.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0147.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3bb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR10~1.YOU")) returned 0x5b96f0 [0147.902] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0147.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0147.903] GetProcessHeap () returned 0x580000 [0147.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3bc1) returned 0x705fc58 [0148.274] GetProcessHeap () returned 0x580000 [0148.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3bc1) returned 0x6c7a390 [0148.274] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.274] ReadFile (in: hFile=0x490, lpBuffer=0x705fc58, nNumberOfBytesToRead=0x3ba0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x705fc58*, lpNumberOfBytesRead=0x484ff14*=0x3ba0, lpOverlapped=0x0) returned 1 [0149.108] GetProcessHeap () returned 0x580000 [0149.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0149.108] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.108] WriteFile (in: hFile=0x490, lpBuffer=0x6c7a390*, nNumberOfBytesToWrite=0x3ba0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a390*, lpNumberOfBytesWritten=0x484ff14*=0x3ba0, lpOverlapped=0x0) returned 1 [0149.108] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.108] WriteFile (in: hFile=0x490, lpBuffer=0x6c7df2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7df2f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0149.108] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.108] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0149.109] CloseHandle (hObject=0x490) returned 1 [0149.902] GetProcessHeap () returned 0x580000 [0149.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a390 | out: hHeap=0x580000) returned 1 [0149.902] GetProcessHeap () returned 0x580000 [0149.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705fc58 | out: hHeap=0x580000) returned 1 [0149.903] GetProcessHeap () returned 0x580000 [0149.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0149.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x907dc040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3bd9, dwReserved0=0x484fd28, dwReserved1=0x705fc58, cFileName="PDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR10~1.YOU")) returned 0x5b96f0 [0150.577] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0151.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0151.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.041] CloseHandle (hObject=0x3e4) returned 1 [0152.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0152.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~2.YOU")) returned 0x5b9730 [0152.043] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0152.043] GetProcessHeap () returned 0x580000 [0152.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0152.043] GetProcessHeap () returned 0x580000 [0152.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0152.043] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.043] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x484ff14*=0x260, lpOverlapped=0x0) returned 1 [0152.047] GetProcessHeap () returned 0x580000 [0152.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.047] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.047] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x484ff14*=0x260, lpOverlapped=0x0) returned 1 [0152.047] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.047] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.047] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.047] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.047] CloseHandle (hObject=0x3e4) returned 1 [0152.047] GetProcessHeap () returned 0x580000 [0152.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0152.047] GetProcessHeap () returned 0x580000 [0152.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0152.047] GetProcessHeap () returned 0x580000 [0152.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x923d42c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x484fd28, dwReserved1=0x6d08520, cFileName="VISIO_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~2.YOU")) returned 0x5b9730 [0152.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.290] CloseHandle (hObject=0x488) returned 1 [0155.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.290] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0155.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~1.YOU")) returned 0x5b9730 [0155.291] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.291] GetProcessHeap () returned 0x580000 [0155.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0155.291] GetProcessHeap () returned 0x580000 [0155.291] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0155.291] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.291] ReadFile (in: hFile=0x488, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x484ff14*=0x280, lpOverlapped=0x0) returned 1 [0155.295] GetProcessHeap () returned 0x580000 [0155.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.295] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.295] WriteFile (in: hFile=0x488, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x484ff14*=0x280, lpOverlapped=0x0) returned 1 [0155.295] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.296] WriteFile (in: hFile=0x488, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.298] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.298] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.298] CloseHandle (hObject=0x488) returned 1 [0155.298] GetProcessHeap () returned 0x580000 [0155.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0155.298] GetProcessHeap () returned 0x580000 [0155.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0155.298] GetProcessHeap () returned 0x580000 [0155.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x942c60c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2af, dwReserved0=0x484fd28, dwReserved1=0x6c4a820, cFileName="WINWORD.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~1.YOU")) returned 0x5b9630 [0155.912] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.970] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", len=0x3d | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 1 [0155.970] GetProcessHeap () returned 0x580000 [0155.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0155.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0155.970] CloseHandle (hObject=0x454) returned 1 [0155.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART9~1.YOU")) returned 0x5b9630 [0158.362] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0158.362] GetProcessHeap () returned 0x580000 [0158.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc6a1) returned 0x702b718 [0158.363] GetProcessHeap () returned 0x580000 [0158.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc6a1) returned 0x6d7cfe8 [0158.363] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.363] ReadFile (in: hFile=0x454, lpBuffer=0x702b718, nNumberOfBytesToRead=0xc680, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x702b718*, lpNumberOfBytesRead=0x484ff14*=0xc680, lpOverlapped=0x0) returned 1 [0163.485] GetProcessHeap () returned 0x580000 [0163.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0163.486] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] WriteFile (in: hFile=0x454, lpBuffer=0x6d7cfe8*, nNumberOfBytesToWrite=0xc680, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesWritten=0x484ff14*=0xc680, lpOverlapped=0x0) returned 1 [0163.486] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] WriteFile (in: hFile=0x454, lpBuffer=0x6d89667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d89667*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0163.486] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.486] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0163.487] CloseHandle (hObject=0x454) returned 1 [0164.388] GetProcessHeap () returned 0x580000 [0164.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0164.388] GetProcessHeap () returned 0x580000 [0164.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702b718 | out: hHeap=0x580000) returned 1 [0164.390] GetProcessHeap () returned 0x580000 [0164.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0166.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x990e12a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc6ba, dwReserved0=0x484fd28, dwReserved1=0x702b718, cFileName="MSART9.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART9~1.YOU")) returned 0x5b9730 [0166.507] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.548] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", len=0x40 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 1 [0166.548] GetProcessHeap () returned 0x580000 [0166.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2248) returned 0x6f14048 [0166.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.581] CloseHandle (hObject=0x41c) returned 1 [0166.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id_1622540890_.your_last_chance")) returned 1 [0166.596] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x473e9c00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~1.YOU")) returned 0x5b9730 [0166.596] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0166.596] GetProcessHeap () returned 0x580000 [0166.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6e17c00 [0166.596] GetProcessHeap () returned 0x580000 [0166.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0166.596] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.596] ReadFile (in: hFile=0x464, lpBuffer=0x6e17c00, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesRead=0x484ff14*=0x340, lpOverlapped=0x0) returned 1 [0166.601] GetProcessHeap () returned 0x580000 [0166.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.601] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.601] WriteFile (in: hFile=0x464, lpBuffer=0x6dcfb90*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesWritten=0x484ff14*=0x340, lpOverlapped=0x0) returned 1 [0166.601] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.601] WriteFile (in: hFile=0x464, lpBuffer=0x6dcfecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfecf*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.601] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.601] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.601] CloseHandle (hObject=0x464) returned 1 [0166.601] GetProcessHeap () returned 0x580000 [0166.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0166.601] GetProcessHeap () returned 0x580000 [0166.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0166.601] GetProcessHeap () returned 0x580000 [0166.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aea25a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36a, dwReserved0=0x484fd28, dwReserved1=0x6e17c00, cFileName="EXITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXITEM~1.YOU")) returned 0x5b9730 [0166.602] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.608] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", len=0x41 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 1 [0166.608] GetProcessHeap () returned 0x580000 [0166.609] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0166.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.609] CloseHandle (hObject=0x460) returned 1 [0166.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id_1622540890_.your_last_chance")) returned 1 [0166.610] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~2.YOU")) returned 0x5b9730 [0166.610] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.610] GetProcessHeap () returned 0x580000 [0166.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0166.610] GetProcessHeap () returned 0x580000 [0166.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x707ec98 [0166.610] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.610] ReadFile (in: hFile=0x460, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x484ff14*=0x300, lpOverlapped=0x0) returned 1 [0166.614] GetProcessHeap () returned 0x580000 [0166.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.614] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.614] WriteFile (in: hFile=0x460, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x484ff14*=0x300, lpOverlapped=0x0) returned 1 [0166.615] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x460, lpBuffer=0x707ef97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ef97*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.615] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.615] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.615] CloseHandle (hObject=0x460) returned 1 [0166.615] GetProcessHeap () returned 0x580000 [0166.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0166.615] GetProcessHeap () returned 0x580000 [0166.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0166.615] GetProcessHeap () returned 0x580000 [0166.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aec8700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x484fd28, dwReserved1=0x6df6780, cFileName="CONTACT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~2.YOU")) returned 0x5b9730 [0166.615] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.624] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", len=0x40 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 1 [0166.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0166.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.235] CloseHandle (hObject=0x450) returned 1 [0169.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id_1622540890_.your_last_chance")) returned 1 [0169.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec8ed400, ftLastWriteTime.dwHighDateTime=0x1c68837, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFNOT~1.YOU")) returned 0x5b96b0 [0169.241] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.241] GetProcessHeap () returned 0x580000 [0169.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0169.241] GetProcessHeap () returned 0x580000 [0169.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0169.241] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.241] ReadFile (in: hFile=0x450, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x484ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.246] GetProcessHeap () returned 0x580000 [0169.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.246] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.246] WriteFile (in: hFile=0x450, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x484ff14*=0x420, lpOverlapped=0x0) returned 1 [0169.246] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.246] WriteFile (in: hFile=0x450, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.246] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.246] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.246] CloseHandle (hObject=0x450) returned 1 [0169.247] GetProcessHeap () returned 0x580000 [0169.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0169.247] GetProcessHeap () returned 0x580000 [0169.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0169.247] GetProcessHeap () returned 0x580000 [0169.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7ecf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x484fd28, dwReserved1=0x5cf780, cFileName="CNFNOT.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFNOT~1.YOU")) returned 0x5b9770 [0172.814] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.862] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", len=0x41 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 1 [0172.862] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x225c) returned 0x6f14048 [0172.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.933] CloseHandle (hObject=0x490) returned 1 [0172.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.933] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id_1622540890_.your_last_chance")) returned 1 [0172.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~2.YOU")) returned 0x5b9770 [0172.952] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.952] GetProcessHeap () returned 0x580000 [0172.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0172.952] GetProcessHeap () returned 0x580000 [0172.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0172.952] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.952] ReadFile (in: hFile=0x490, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x484ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.968] GetProcessHeap () returned 0x580000 [0172.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0172.968] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.968] WriteFile (in: hFile=0x490, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x484ff14*=0x420, lpOverlapped=0x0) returned 1 [0172.969] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.969] WriteFile (in: hFile=0x490, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.969] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.969] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.969] CloseHandle (hObject=0x490) returned 1 [0172.969] GetProcessHeap () returned 0x580000 [0172.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0172.969] GetProcessHeap () returned 0x580000 [0172.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0172.969] GetProcessHeap () returned 0x580000 [0172.969] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb556a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x484fd28, dwReserved1=0x5cf780, cFileName="SECRECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECREC~2.YOU")) returned 0x5b9770 [0173.247] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.622] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", len=0x4a | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned 1 [0174.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0174.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.705] CloseHandle (hObject=0x440) returned 1 [0174.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.id_1622540890_.your_last_chance")) returned 1 [0174.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xedd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~1.YOU")) returned 0x5b96f0 [0174.706] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.706] GetProcessHeap () returned 0x580000 [0174.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xede1) returned 0x636970 [0174.707] GetProcessHeap () returned 0x580000 [0174.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xede1) returned 0x645760 [0174.707] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.707] ReadFile (in: hFile=0x440, lpBuffer=0x636970, nNumberOfBytesToRead=0xedc0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x484ff14*=0xedc0, lpOverlapped=0x0) returned 1 [0177.541] GetProcessHeap () returned 0x580000 [0177.541] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.541] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.541] WriteFile (in: hFile=0x440, lpBuffer=0x645760*, nNumberOfBytesToWrite=0xedc0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x645760*, lpNumberOfBytesWritten=0x484ff14*=0xedc0, lpOverlapped=0x0) returned 1 [0177.541] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.541] WriteFile (in: hFile=0x440, lpBuffer=0x65451f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x65451f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.541] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.541] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.542] CloseHandle (hObject=0x440) returned 1 [0177.542] GetProcessHeap () returned 0x580000 [0177.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x645760 | out: hHeap=0x580000) returned 1 [0177.542] GetProcessHeap () returned 0x580000 [0177.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0177.542] GetProcessHeap () returned 0x580000 [0177.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa16ec980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xedfa, dwReserved0=0x484fd28, dwReserved1=0x636970, cFileName="SPLASH.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~1.YOU")) returned 0x5b96f0 [0180.027] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.050] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", len=0x55 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned 1 [0180.050] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0180.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0180.055] CloseHandle (hObject=0x488) returned 1 [0180.055] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.056] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.056] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2308, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~1.YOU")) returned 0x5b96b0 [0180.056] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0180.056] GetProcessHeap () returned 0x580000 [0180.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2321) returned 0x7058838 [0180.056] GetProcessHeap () returned 0x580000 [0180.057] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2321) returned 0x6d98da8 [0180.057] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.057] ReadFile (in: hFile=0x488, lpBuffer=0x7058838, nNumberOfBytesToRead=0x2300, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7058838*, lpNumberOfBytesRead=0x484ff14*=0x2300, lpOverlapped=0x0) returned 1 [0181.185] GetProcessHeap () returned 0x580000 [0181.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.185] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.185] WriteFile (in: hFile=0x488, lpBuffer=0x6d98da8*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98da8*, lpNumberOfBytesWritten=0x484ff14*=0x2300, lpOverlapped=0x0) returned 1 [0181.185] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.185] WriteFile (in: hFile=0x488, lpBuffer=0x6d9b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9b0a7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.185] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.185] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.185] CloseHandle (hObject=0x488) returned 1 [0181.185] GetProcessHeap () returned 0x580000 [0181.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98da8 | out: hHeap=0x580000) returned 1 [0181.185] GetProcessHeap () returned 0x580000 [0181.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7058838 | out: hHeap=0x580000) returned 1 [0181.185] GetProcessHeap () returned 0x580000 [0181.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa39bcb40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x232c, dwReserved0=0x484fd28, dwReserved1=0x7058838, cFileName="WSSFilesToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~1.YOU")) returned 0x5b9770 [0182.670] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.686] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", len=0x4f | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned 1 [0182.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0182.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.687] CloseHandle (hObject=0x3fc) returned 1 [0182.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKETCH~1.YOU")) returned 0x5b9770 [0182.688] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.688] GetProcessHeap () returned 0x580000 [0182.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x656970 [0182.688] GetProcessHeap () returned 0x580000 [0182.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x715c008 [0182.688] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.689] ReadFile (in: hFile=0x3fc, lpBuffer=0x656970, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesRead=0x484ff14*=0x2d20, lpOverlapped=0x0) returned 1 [0182.962] GetProcessHeap () returned 0x580000 [0182.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.962] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.962] WriteFile (in: hFile=0x3fc, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x484ff14*=0x2d20, lpOverlapped=0x0) returned 1 [0182.962] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.962] WriteFile (in: hFile=0x3fc, lpBuffer=0x715ed27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x715ed27*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.962] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.962] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.962] CloseHandle (hObject=0x3fc) returned 1 [0183.069] GetProcessHeap () returned 0x580000 [0183.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0183.081] GetProcessHeap () returned 0x580000 [0183.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0183.081] GetProcessHeap () returned 0x580000 [0183.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ab2800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d5c, dwReserved0=0x484fd28, dwReserved1=0x656970, cFileName="SketchIconImages.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKETCH~1.YOU")) returned 0x5b9770 [0183.806] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.821] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", len=0x65 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned 1 [0183.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0183.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.843] CloseHandle (hObject=0x450) returned 1 [0183.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.id_1622540890_.your_last_chance")) returned 1 [0183.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2091~1.YOU")) returned 0x5b9770 [0183.844] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.844] GetProcessHeap () returned 0x580000 [0183.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0183.844] GetProcessHeap () returned 0x580000 [0183.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0183.844] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.844] ReadFile (in: hFile=0x450, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x484ff14*=0xa0, lpOverlapped=0x0) returned 1 [0183.846] GetProcessHeap () returned 0x580000 [0183.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0183.846] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.846] WriteFile (in: hFile=0x450, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x484ff14*=0xa0, lpOverlapped=0x0) returned 1 [0183.846] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.846] WriteFile (in: hFile=0x450, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.846] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.846] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.846] CloseHandle (hObject=0x450) returned 1 [0183.846] GetProcessHeap () returned 0x580000 [0183.846] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0183.846] GetProcessHeap () returned 0x580000 [0183.846] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0183.849] GetProcessHeap () returned 0x580000 [0183.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5307500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x484fd28, dwReserved1=0x60e8a8, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2091~1.YOU")) returned 0x5b9770 [0183.853] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.863] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", len=0x60 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned 1 [0183.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0183.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0183.905] CloseHandle (hObject=0x43c) returned 1 [0183.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.id_1622540890_.your_last_chance")) returned 1 [0183.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b9770 [0183.906] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0183.906] GetProcessHeap () returned 0x580000 [0183.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6c9a390 [0183.906] GetProcessHeap () returned 0x580000 [0183.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6c9bc98 [0183.906] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.906] ReadFile (in: hFile=0x43c, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x484ff14*=0x1840, lpOverlapped=0x0) returned 1 [0184.092] GetProcessHeap () returned 0x580000 [0184.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.092] WriteFile (in: hFile=0x43c, lpBuffer=0x6c9bc98*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9bc98*, lpNumberOfBytesWritten=0x484ff14*=0x1840, lpOverlapped=0x0) returned 1 [0184.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.092] WriteFile (in: hFile=0x43c, lpBuffer=0x6c9d4d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d4d7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.092] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.092] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.093] CloseHandle (hObject=0x43c) returned 1 [0184.093] GetProcessHeap () returned 0x580000 [0184.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9bc98 | out: hHeap=0x580000) returned 1 [0184.093] GetProcessHeap () returned 0x580000 [0184.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0184.093] GetProcessHeap () returned 0x580000 [0184.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5568b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1869, dwReserved0=0x484fd28, dwReserved1=0x6c9a390, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b9770 [0184.093] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.102] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", len=0x66 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned 1 [0184.103] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0184.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0184.173] CloseHandle (hObject=0x43c) returned 1 [0184.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.id_1622540890_.your_last_chance")) returned 1 [0184.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9b8, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b9770 [0184.174] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0184.174] GetProcessHeap () returned 0x580000 [0184.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb9c1) returned 0x6d10048 [0184.175] GetProcessHeap () returned 0x580000 [0184.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb9c1) returned 0x6d1ba18 [0184.175] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.175] ReadFile (in: hFile=0x43c, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xb9a0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x484ff14*=0xb9a0, lpOverlapped=0x0) returned 1 [0185.047] GetProcessHeap () returned 0x580000 [0185.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.047] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.047] WriteFile (in: hFile=0x43c, lpBuffer=0x6d1ba18*, nNumberOfBytesToWrite=0xb9a0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1ba18*, lpNumberOfBytesWritten=0x484ff14*=0xb9a0, lpOverlapped=0x0) returned 1 [0185.047] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.047] WriteFile (in: hFile=0x43c, lpBuffer=0x6d273b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d273b7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.047] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.048] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.048] CloseHandle (hObject=0x43c) returned 1 [0185.204] GetProcessHeap () returned 0x580000 [0185.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1ba18 | out: hHeap=0x580000) returned 1 [0185.235] GetProcessHeap () returned 0x580000 [0185.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0185.235] GetProcessHeap () returned 0x580000 [0185.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5ea2040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb9dc, dwReserved0=0x484fd28, dwReserved1=0x6d10048, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b9770 [0185.535] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.583] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", len=0x51 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned 1 [0185.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0185.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0186.987] CloseHandle (hObject=0x3b4) returned 1 [0186.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATAVI~1.YOU")) returned 0x5b96b0 [0186.988] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0186.988] GetProcessHeap () returned 0x580000 [0186.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x706ecb0 [0186.988] GetProcessHeap () returned 0x580000 [0186.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x70703b8 [0186.988] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.988] ReadFile (in: hFile=0x3b4, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x484ff14*=0x16c0, lpOverlapped=0x0) returned 1 [0187.015] GetProcessHeap () returned 0x580000 [0187.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.015] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x3b4, lpBuffer=0x70703b8*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x70703b8*, lpNumberOfBytesWritten=0x484ff14*=0x16c0, lpOverlapped=0x0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x3b4, lpBuffer=0x7071a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7071a77*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.015] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.015] CloseHandle (hObject=0x3b4) returned 1 [0187.015] GetProcessHeap () returned 0x580000 [0187.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70703b8 | out: hHeap=0x580000) returned 1 [0187.015] GetProcessHeap () returned 0x580000 [0187.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0187.015] GetProcessHeap () returned 0x580000 [0187.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0187.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7160d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16eb, dwReserved0=0x484fd28, dwReserved1=0x706ecb0, cFileName="DataViewIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATAVI~1.YOU")) returned 0x5b96b0 [0187.016] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.029] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", len=0x72 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned 1 [0187.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0187.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.642] CloseHandle (hObject=0x478) returned 1 [0188.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.643] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0188.643] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x61004d, dwReserved1=0x6b0073, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b9770 [0188.644] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.644] GetProcessHeap () returned 0x580000 [0188.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0188.644] GetProcessHeap () returned 0x580000 [0188.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0188.644] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.644] ReadFile (in: hFile=0x478, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x484ff14*=0x620, lpOverlapped=0x0) returned 1 [0188.650] GetProcessHeap () returned 0x580000 [0188.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.650] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.650] WriteFile (in: hFile=0x478, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x484ff14*=0x620, lpOverlapped=0x0) returned 1 [0188.650] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.650] WriteFile (in: hFile=0x478, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.651] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.651] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.651] CloseHandle (hObject=0x478) returned 1 [0188.651] GetProcessHeap () returned 0x580000 [0188.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0188.651] GetProcessHeap () returned 0x580000 [0188.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0188.651] GetProcessHeap () returned 0x580000 [0188.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80d9c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x484fd28, dwReserved1=0x626d30, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~4.YOU")) returned 0x5b9770 [0191.680] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.718] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", len=0x45 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned 1 [0191.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff4) returned 0x6f14048 [0191.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0194.434] CloseHandle (hObject=0x454) returned 1 [0194.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x326c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP0FF7~1.YOU")) returned 0x5b97b0 [0194.435] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0194.436] GetProcessHeap () returned 0x580000 [0194.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3281) returned 0x6d777c8 [0194.436] GetProcessHeap () returned 0x580000 [0194.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3281) returned 0x6dec6e0 [0194.436] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.436] ReadFile (in: hFile=0x454, lpBuffer=0x6d777c8, nNumberOfBytesToRead=0x3260, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d777c8*, lpNumberOfBytesRead=0x484ff14*=0x3260, lpOverlapped=0x0) returned 1 [0195.606] GetProcessHeap () returned 0x580000 [0195.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.606] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.606] WriteFile (in: hFile=0x454, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x3260, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x484ff14*=0x3260, lpOverlapped=0x0) returned 1 [0195.606] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.606] WriteFile (in: hFile=0x454, lpBuffer=0x6def93f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def93f*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.606] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.606] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.606] CloseHandle (hObject=0x454) returned 1 [0195.606] GetProcessHeap () returned 0x580000 [0195.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0195.606] GetProcessHeap () returned 0x580000 [0195.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d777c8 | out: hHeap=0x580000) returned 1 [0195.606] GetProcessHeap () returned 0x580000 [0195.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac3341c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3290, dwReserved0=0x484fd28, dwReserved1=0x6d777c8, cFileName="ZPDIR25F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP0FF7~1.YOU")) returned 0x5b97b0 [0196.833] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.919] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", len=0x45 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned 1 [0196.919] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc0) returned 0x6f14048 [0196.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.920] CloseHandle (hObject=0x4a0) returned 1 [0196.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x645b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPC22F~1.YOU")) returned 0x5b97b0 [0196.921] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.921] GetProcessHeap () returned 0x580000 [0196.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6461) returned 0x71091b8 [0196.921] GetProcessHeap () returned 0x580000 [0196.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6461) returned 0x710f628 [0196.921] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.921] ReadFile (in: hFile=0x4a0, lpBuffer=0x71091b8, nNumberOfBytesToRead=0x6440, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x71091b8*, lpNumberOfBytesRead=0x484ff14*=0x6440, lpOverlapped=0x0) returned 1 [0197.686] GetProcessHeap () returned 0x580000 [0197.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0197.686] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.686] WriteFile (in: hFile=0x4a0, lpBuffer=0x710f628*, nNumberOfBytesToWrite=0x6440, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x710f628*, lpNumberOfBytesWritten=0x484ff14*=0x6440, lpOverlapped=0x0) returned 1 [0197.687] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.687] WriteFile (in: hFile=0x4a0, lpBuffer=0x7115a67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7115a67*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.687] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.687] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.687] CloseHandle (hObject=0x4a0) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710f628 | out: hHeap=0x580000) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71091b8 | out: hHeap=0x580000) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0199.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad723a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x647f, dwReserved0=0x484fd28, dwReserved1=0x71091b8, cFileName="ZPDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPC22F~1.YOU")) returned 0x5b96b0 [0199.651] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.957] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", len=0x64 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned 1 [0200.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd8) returned 0x6f14048 [0200.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0200.982] CloseHandle (hObject=0x170) returned 1 [0200.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.id_1622540890_.your_last_chance")) returned 1 [0200.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b9770 [0200.984] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0200.984] GetProcessHeap () returned 0x580000 [0200.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0200.984] GetProcessHeap () returned 0x580000 [0200.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0200.985] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.985] ReadFile (in: hFile=0x170, lpBuffer=0x7100718, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesRead=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0203.198] GetProcessHeap () returned 0x580000 [0203.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.199] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.199] WriteFile (in: hFile=0x170, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0203.199] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.199] WriteFile (in: hFile=0x170, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.199] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.199] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.199] CloseHandle (hObject=0x170) returned 1 [0203.199] GetProcessHeap () returned 0x580000 [0203.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0203.200] GetProcessHeap () returned 0x580000 [0203.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0203.200] GetProcessHeap () returned 0x580000 [0203.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0203.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ba7f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x30098, dwReserved0=0x484fd28, dwReserved1=0x7100718, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b97b0 [0203.200] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0204.765] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", len=0x70 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0204.765] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0204.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0207.965] CloseHandle (hObject=0x46c) returned 1 [0207.965] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0207.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0208.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0208.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x520045, dwReserved1=0x47002e, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9830 [0208.977] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0208.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0208.978] GetProcessHeap () returned 0x580000 [0208.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6f3bec0 [0208.978] GetProcessHeap () returned 0x580000 [0208.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6f3bf70 [0208.978] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.978] ReadFile (in: hFile=0x46c, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x484ff14*=0x80, lpOverlapped=0x0) returned 1 [0208.979] GetProcessHeap () returned 0x580000 [0208.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0208.979] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.979] WriteFile (in: hFile=0x46c, lpBuffer=0x6f3bf70*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bf70*, lpNumberOfBytesWritten=0x484ff14*=0x80, lpOverlapped=0x0) returned 1 [0208.979] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.979] WriteFile (in: hFile=0x46c, lpBuffer=0x6f3bfef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bfef*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.980] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.980] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.980] CloseHandle (hObject=0x46c) returned 1 [0208.980] GetProcessHeap () returned 0x580000 [0208.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bf70 | out: hHeap=0x580000) returned 1 [0208.980] GetProcessHeap () returned 0x580000 [0208.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0208.980] GetProcessHeap () returned 0x580000 [0208.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0210.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb42d9d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x484fd28, dwReserved1=0x6f3bec0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0210.088] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.122] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", len=0x62 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned 1 [0210.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0210.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0215.491] CloseHandle (hObject=0x484) returned 1 [0215.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.id_1622540890_.your_last_chance")) returned 1 [0215.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b97b0 [0215.492] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0215.493] GetProcessHeap () returned 0x580000 [0215.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x6fa8f28 [0215.493] GetProcessHeap () returned 0x580000 [0215.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x7301a38 [0215.493] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.493] ReadFile (in: hFile=0x484, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x5680, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x484ff14*=0x5680, lpOverlapped=0x0) returned 1 [0217.968] GetProcessHeap () returned 0x580000 [0217.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0217.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.969] WriteFile (in: hFile=0x484, lpBuffer=0x7301a38*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesWritten=0x484ff14*=0x5680, lpOverlapped=0x0) returned 1 [0217.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.969] WriteFile (in: hFile=0x484, lpBuffer=0x73070b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x73070b7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.969] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.969] CloseHandle (hObject=0x484) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0221.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb988b580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x56b4, dwReserved0=0x484fd28, dwReserved1=0x6fa8f28, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b97b0 [0221.391] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0223.314] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", len=0x6c | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned 1 [0223.315] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0223.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.315] CloseHandle (hObject=0x480) returned 1 [0223.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0223.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x670070, dwReserved1=0x69002e, cFileName="BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIEFC~2.YOU")) returned 0x5b96f0 [0223.317] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.317] GetProcessHeap () returned 0x580000 [0223.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6c3a820 [0223.317] GetProcessHeap () returned 0x580000 [0223.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6c3bd28 [0223.317] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.317] ReadFile (in: hFile=0x480, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x484ff14*=0x1400, lpOverlapped=0x0) returned 1 [0223.355] GetProcessHeap () returned 0x580000 [0223.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.355] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.355] WriteFile (in: hFile=0x480, lpBuffer=0x6c3bd28*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3bd28*, lpNumberOfBytesWritten=0x484ff14*=0x1400, lpOverlapped=0x0) returned 1 [0223.355] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.355] WriteFile (in: hFile=0x480, lpBuffer=0x6c3d127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3d127*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.355] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.355] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.355] CloseHandle (hObject=0x480) returned 1 [0223.355] GetProcessHeap () returned 0x580000 [0223.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3bd28 | out: hHeap=0x580000) returned 1 [0223.355] GetProcessHeap () returned 0x580000 [0223.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0223.355] GetProcessHeap () returned 0x580000 [0223.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbdefe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x484fd28, dwReserved1=0x6c3a820, cFileName="BriefcaseIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIEFC~2.YOU")) returned 0x5b96f0 [0223.356] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.381] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", len=0x5b | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned 1 [0223.381] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0223.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.382] CloseHandle (hObject=0x49c) returned 1 [0223.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.id_1622540890_.your_last_chance")) returned 1 [0223.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b96f0 [0223.393] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.394] GetProcessHeap () returned 0x580000 [0223.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0223.394] GetProcessHeap () returned 0x580000 [0223.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0223.394] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.394] ReadFile (in: hFile=0x49c, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x484ff14*=0x260, lpOverlapped=0x0) returned 1 [0223.397] GetProcessHeap () returned 0x580000 [0223.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.397] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.397] WriteFile (in: hFile=0x49c, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x484ff14*=0x260, lpOverlapped=0x0) returned 1 [0223.397] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.397] WriteFile (in: hFile=0x49c, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.397] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.397] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.398] CloseHandle (hObject=0x49c) returned 1 [0223.398] GetProcessHeap () returned 0x580000 [0223.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0223.398] GetProcessHeap () returned 0x580000 [0223.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0223.398] GetProcessHeap () returned 0x580000 [0223.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc51400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x484fd28, dwReserved1=0x6c61120, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b96f0 [0223.398] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.408] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned 1 [0223.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0223.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0223.409] CloseHandle (hObject=0x440) returned 1 [0223.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.409] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0223.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b96f0 [0223.410] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0223.410] GetProcessHeap () returned 0x580000 [0223.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0223.411] GetProcessHeap () returned 0x580000 [0223.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0223.411] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.411] ReadFile (in: hFile=0x440, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x484ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.988] GetProcessHeap () returned 0x580000 [0223.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.988] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.989] WriteFile (in: hFile=0x440, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x484ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.989] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.989] WriteFile (in: hFile=0x440, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.989] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.989] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.989] CloseHandle (hObject=0x440) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd1f8840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x484fd28, dwReserved1=0x6dcfb90, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b9630 [0226.275] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.313] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", len=0x49 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned 1 [0226.313] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da4) returned 0x6dee6e0 [0226.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0226.373] CloseHandle (hObject=0x490) returned 1 [0226.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam.id_1622540890_.your_last_chance")) returned 1 [0226.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATPVBA~1.YOU")) returned 0x5b9630 [0226.374] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0226.374] GetProcessHeap () returned 0x580000 [0226.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe0e1) returned 0x7241db8 [0226.375] GetProcessHeap () returned 0x580000 [0226.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe0e1) returned 0x724fea8 [0226.375] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.375] ReadFile (in: hFile=0x490, lpBuffer=0x7241db8, nNumberOfBytesToRead=0xe0c0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7241db8*, lpNumberOfBytesRead=0x484ff14*=0xe0c0, lpOverlapped=0x0) returned 1 [0233.560] GetProcessHeap () returned 0x580000 [0233.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0233.560] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.561] WriteFile (in: hFile=0x490, lpBuffer=0x724fea8*, nNumberOfBytesToWrite=0xe0c0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x724fea8*, lpNumberOfBytesWritten=0x484ff14*=0xe0c0, lpOverlapped=0x0) returned 1 [0233.561] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.561] WriteFile (in: hFile=0x490, lpBuffer=0x725df67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x725df67*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.561] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.561] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.561] CloseHandle (hObject=0x490) returned 1 [0233.562] GetProcessHeap () returned 0x580000 [0233.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x724fea8 | out: hHeap=0x580000) returned 1 [0233.562] GetProcessHeap () returned 0x580000 [0233.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7241db8 | out: hHeap=0x580000) returned 1 [0233.562] GetProcessHeap () returned 0x580000 [0233.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0233.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc2bae560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe0eb, dwReserved0=0x484fd28, dwReserved1=0x7241db8, cFileName="ATPVBAEN.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATPVBA~1.YOU")) returned 0x5b9630 [0233.562] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0235.373] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", len=0x66 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned 1 [0235.374] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0235.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0236.732] CloseHandle (hObject=0x41c) returned 1 [0236.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0236.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.id_1622540890_.your_last_chance")) returned 1 [0239.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~4.YOU")) returned 0x5b96f0 [0239.525] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0239.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0239.525] GetProcessHeap () returned 0x580000 [0239.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0239.526] GetProcessHeap () returned 0x580000 [0239.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0239.526] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.526] ReadFile (in: hFile=0x41c, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.227] GetProcessHeap () returned 0x580000 [0242.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0242.227] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.227] WriteFile (in: hFile=0x41c, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0242.227] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.227] WriteFile (in: hFile=0x41c, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0242.227] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.227] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0242.228] CloseHandle (hObject=0x41c) returned 1 [0242.228] GetProcessHeap () returned 0x580000 [0242.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0242.228] GetProcessHeap () returned 0x580000 [0242.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0242.228] GetProcessHeap () returned 0x580000 [0242.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0242.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7e661e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x311d4, dwReserved0=0x484fd28, dwReserved1=0x6d630a8, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~4.YOU")) returned 0x5b9630 [0242.228] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0242.910] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML", len=0x40 | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned 1 [0242.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0242.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0245.390] CloseHandle (hObject=0x49c) returned 1 [0245.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml.id_1622540890_.your_last_chance")) returned 1 [0248.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4628f00, ftLastWriteTime.dwHighDateTime=0x1ca1b44, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~2.YOU")) returned 0x5b96f0 [0248.697] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0248.697] GetProcessHeap () returned 0x580000 [0248.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0248.697] GetProcessHeap () returned 0x580000 [0248.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0248.698] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.698] ReadFile (in: hFile=0x49c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.532] GetProcessHeap () returned 0x580000 [0252.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.533] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.533] WriteFile (in: hFile=0x49c, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x484ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.533] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.533] WriteFile (in: hFile=0x49c, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.533] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.533] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.534] CloseHandle (hObject=0x49c) returned 1 [0252.534] GetProcessHeap () returned 0x580000 [0252.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0252.534] GetProcessHeap () returned 0x580000 [0252.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0252.534] GetProcessHeap () returned 0x580000 [0252.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce0bcec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a46, dwReserved0=0x484fd28, dwReserved1=0x6d21878, cFileName="PGLBL092.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL0~2.YOU")) returned 0x5b9730 [0254.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.360] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML", len=0x3e | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML") returned 1 [0255.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f74) returned 0x72e5948 [0255.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.738] CloseHandle (hObject=0x4a8) returned 1 [0258.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml.id_1622540890_.your_last_chance")) returned 1 [0258.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d1d600, ftCreationTime.dwHighDateTime=0x1c976eb, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2d1d600, ftLastWriteTime.dwHighDateTime=0x1c976eb, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSIDE~1.YOU")) returned 0x5b96f0 [0258.740] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.740] GetProcessHeap () returned 0x580000 [0258.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20e1) returned 0x6fbc1b0 [0258.740] GetProcessHeap () returned 0x580000 [0258.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20e1) returned 0x706acd8 [0258.740] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.740] ReadFile (in: hFile=0x4a8, lpBuffer=0x6fbc1b0, nNumberOfBytesToRead=0x20c0, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbc1b0*, lpNumberOfBytesRead=0x484ff14*=0x20c0, lpOverlapped=0x0) returned 1 [0258.768] GetProcessHeap () returned 0x580000 [0258.768] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.769] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.769] WriteFile (in: hFile=0x4a8, lpBuffer=0x706acd8*, nNumberOfBytesToWrite=0x20c0, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x706acd8*, lpNumberOfBytesWritten=0x484ff14*=0x20c0, lpOverlapped=0x0) returned 1 [0258.770] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.770] WriteFile (in: hFile=0x4a8, lpBuffer=0x706cd97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x706cd97*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.770] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.770] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.770] CloseHandle (hObject=0x4a8) returned 1 [0258.770] GetProcessHeap () returned 0x580000 [0258.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706acd8 | out: hHeap=0x580000) returned 1 [0258.771] GetProcessHeap () returned 0x580000 [0258.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbc1b0 | out: hHeap=0x580000) returned 1 [0258.771] GetProcessHeap () returned 0x580000 [0258.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fccc | out: lpFindFileData=0x484fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d1d600, ftCreationTime.dwHighDateTime=0x1c976eb, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1c19360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20f2, dwReserved0=0x484fd28, dwReserved1=0x6fbc1b0, cFileName="DGSIDEBR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSIDE~1.YOU")) returned 0x5b9630 [0259.224] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.237] SysReAllocStringLen (in: pbstr=0x484ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC", len=0x3c | out: pbstr=0x484ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC") returned 1 [0259.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2088) returned 0x72e5948 [0259.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0259.330] CloseHandle (hObject=0x4a0) returned 1 [0259.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x484ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x484fc74 | out: lpFindFileData=0x484fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17db9900, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17db9900, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0xbb82, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGN98~1.YOU")) returned 0x5b9630 [0259.331] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0259.332] GetProcessHeap () returned 0x580000 [0259.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbba1) returned 0x707ec98 [0259.333] GetProcessHeap () returned 0x580000 [0259.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbba1) returned 0x708a848 [0259.333] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.333] ReadFile (in: hFile=0x4a0, lpBuffer=0x707ec98, nNumberOfBytesToRead=0xbb80, lpNumberOfBytesRead=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x484ff14*=0xbb80, lpOverlapped=0x0) returned 1 [0264.374] GetProcessHeap () returned 0x580000 [0265.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0265.731] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.731] WriteFile (in: hFile=0x4a0, lpBuffer=0x708a848*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x708a848*, lpNumberOfBytesWritten=0x484ff14*=0xbb80, lpOverlapped=0x0) returned 1 [0265.732] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.732] WriteFile (in: hFile=0x4a0, lpBuffer=0x70963c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x70963c7*, lpNumberOfBytesWritten=0x484ff14*=0x20, lpOverlapped=0x0) returned 1 [0265.732] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.732] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x484ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x484ff14*=0x4, lpOverlapped=0x0) returned 1 [0265.732] CloseHandle (hObject=0x4a0) Thread: id = 35 os_tid = 0xa84 [0039.065] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.289] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.371] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.593] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.509] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.657] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.811] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.137] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.326] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.435] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.529] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.592] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.840] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.918] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.981] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.448] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.760] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.791] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.150] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.307] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.495] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.681] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.791] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.899] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.930] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.086] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.242] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.398] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.530] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.632] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.710] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.975] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.146] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.356] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.489] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.786] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.737] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.143] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.205] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.346] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.892] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.954] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.847] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0050.999] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.233] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.545] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.699] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.855] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.933] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.011] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.136] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.167] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.214] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.323] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.479] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.635] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.823] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.150] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.201] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.259] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.306] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.362] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.431] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.618] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.100] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.147] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.198] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.412] Sleep (dwMilliseconds=0x1) [0055.429] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.892] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", len=0x50 | out: pbstr=0x498ff84*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 1 [0055.892] GetProcessHeap () returned 0x580000 [0055.892] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6152f8, Size=0x1c) returned 0x6152d0 [0055.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0056.026] CloseHandle (hObject=0x410) returned 1 [0056.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.052] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id_1622540890_.your_last_chance")) returned 1 [0056.052] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.052] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~2.YOU")) returned 0x5b9630 [0056.052] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0056.053] GetProcessHeap () returned 0x580000 [0056.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0056.053] GetProcessHeap () returned 0x580000 [0056.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c56108 [0056.053] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.053] ReadFile (in: hFile=0x410, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x498ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0056.059] GetProcessHeap () returned 0x580000 [0056.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0056.059] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.059] WriteFile (in: hFile=0x410, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x498ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0056.059] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.059] WriteFile (in: hFile=0x410, lpBuffer=0x6c566a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c566a7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0056.059] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.059] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0056.060] CloseHandle (hObject=0x410) returned 1 [0056.060] GetProcessHeap () returned 0x580000 [0056.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0056.060] GetProcessHeap () returned 0x580000 [0056.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0056.060] GetProcessHeap () returned 0x580000 [0056.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0056.061] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x593671e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0x498fd28, dwReserved1=0x5f3908, cFileName="PowerPointMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~2.YOU")) returned 0x5b9670 [0056.061] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0056.067] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", len=0x48 | out: pbstr=0x498ff84*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 1 [0056.067] GetProcessHeap () returned 0x580000 [0056.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0056.068] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0056.078] CloseHandle (hObject=0x414) returned 1 [0056.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.078] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id_1622540890_.your_last_chance")) returned 1 [0056.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.079] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLRC~1.YOU")) returned 0x5b9630 [0056.079] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.079] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0056.079] GetProcessHeap () returned 0x580000 [0056.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c57328 [0056.080] GetProcessHeap () returned 0x580000 [0056.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c68b58 [0056.080] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.080] ReadFile (in: hFile=0x414, lpBuffer=0x6c57328, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57328*, lpNumberOfBytesRead=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.346] GetProcessHeap () returned 0x580000 [0058.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0058.347] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.347] WriteFile (in: hFile=0x414, lpBuffer=0x6c68b58*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68b58*, lpNumberOfBytesWritten=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.347] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.347] WriteFile (in: hFile=0x414, lpBuffer=0x6c7a357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a357*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.088] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.088] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.089] CloseHandle (hObject=0x414) returned 1 [0064.472] GetProcessHeap () returned 0x580000 [0064.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c68b58 | out: hHeap=0x580000) returned 1 [0064.472] GetProcessHeap () returned 0x580000 [0064.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57328 | out: hHeap=0x580000) returned 1 [0064.473] GetProcessHeap () returned 0x580000 [0064.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0064.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0064.473] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5d633b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x97f418, dwReserved0=0x498fd28, dwReserved1=0x6c57328, cFileName="PubLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLRC~1.YOU")) returned 0x5b9630 [0064.473] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0064.473] Sleep (dwMilliseconds=0x1) [0065.335] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", len=0x4b | out: pbstr=0x498ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 1 [0065.335] GetProcessHeap () returned 0x580000 [0065.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x40) returned 0x5e9710 [0065.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0073.760] CloseHandle (hObject=0x4a0) returned 1 [0073.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.760] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id_1622540890_.your_last_chance")) returned 1 [0075.569] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.569] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x45, dwReserved1=0x0, cFileName="VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~2.YOU")) returned 0x5b96f0 [0075.569] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0075.570] GetProcessHeap () returned 0x580000 [0075.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x66fcd0 [0075.570] GetProcessHeap () returned 0x580000 [0075.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x671f00 [0075.570] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.570] ReadFile (in: hFile=0x4a0, lpBuffer=0x66fcd0, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x66fcd0*, lpNumberOfBytesRead=0x498ff14*=0x2200, lpOverlapped=0x0) returned 1 [0075.602] GetProcessHeap () returned 0x580000 [0075.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0075.602] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x4a0, lpBuffer=0x671f00*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x671f00*, lpNumberOfBytesWritten=0x498ff14*=0x2200, lpOverlapped=0x0) returned 1 [0075.602] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x4a0, lpBuffer=0x6740ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6740ff*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.602] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.602] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.602] CloseHandle (hObject=0x4a0) returned 1 [0075.602] GetProcessHeap () returned 0x580000 [0075.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x671f00 | out: hHeap=0x580000) returned 1 [0075.602] GetProcessHeap () returned 0x580000 [0075.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x66fcd0 | out: hHeap=0x580000) returned 1 [0075.603] GetProcessHeap () returned 0x580000 [0075.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0079.341] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x64ad7140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2237, dwReserved0=0x498fd28, dwReserved1=0x66fcd0, cFileName="VisiorWW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~2.YOU")) returned 0x5b96f0 [0079.341] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.488] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", len=0x6d | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 1 [0079.489] GetProcessHeap () returned 0x580000 [0079.489] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0079.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.525] CloseHandle (hObject=0x478) returned 1 [0079.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.526] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id_1622540890_.your_last_chance")) returned 1 [0079.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x4d0058, dwReserved1=0x2e004c, cFileName="AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b9730 [0079.526] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.527] GetProcessHeap () returned 0x580000 [0079.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f3a40 [0079.527] GetProcessHeap () returned 0x580000 [0079.527] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6f06bb8 [0079.527] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.527] ReadFile (in: hFile=0x478, lpBuffer=0x5f3a40, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3a40*, lpNumberOfBytesRead=0x498ff14*=0x320, lpOverlapped=0x0) returned 1 [0079.543] GetProcessHeap () returned 0x580000 [0079.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.543] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.543] WriteFile (in: hFile=0x478, lpBuffer=0x6f06bb8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesWritten=0x498ff14*=0x320, lpOverlapped=0x0) returned 1 [0079.543] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.543] WriteFile (in: hFile=0x478, lpBuffer=0x6f06ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06ed7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.544] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.544] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.544] CloseHandle (hObject=0x478) returned 1 [0079.544] GetProcessHeap () returned 0x580000 [0079.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0079.544] GetProcessHeap () returned 0x580000 [0079.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3a40 | out: hHeap=0x580000) returned 1 [0079.544] GetProcessHeap () returned 0x580000 [0079.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67054bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x498fd28, dwReserved1=0x5f3a40, cFileName="AccessMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b96f0 [0079.544] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.967] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", len=0x43 | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 1 [0085.967] GetProcessHeap () returned 0x580000 [0085.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x84) returned 0x614a48 [0085.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.967] Sleep (dwMilliseconds=0x1) [0085.982] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", len=0x45 | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 1 [0085.982] GetProcessHeap () returned 0x580000 [0085.982] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x1c) returned 0x614a48 [0085.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0085.993] CloseHandle (hObject=0x488) returned 1 [0085.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0085.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id_1622540890_.your_last_chance")) returned 1 [0085.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0085.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="")) returned 0x5b96f0 [0085.994] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0085.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0085.994] GetProcessHeap () returned 0x580000 [0085.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6f0c4f8 [0085.994] GetProcessHeap () returned 0x580000 [0085.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6087d8 [0085.994] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.994] ReadFile (in: hFile=0x488, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x498ff14*=0x280, lpOverlapped=0x0) returned 1 [0085.997] GetProcessHeap () returned 0x580000 [0085.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0085.997] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x488, lpBuffer=0x6087d8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6087d8*, lpNumberOfBytesWritten=0x498ff14*=0x280, lpOverlapped=0x0) returned 1 [0085.997] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.997] WriteFile (in: hFile=0x488, lpBuffer=0x608a57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x608a57*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0085.998] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.998] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0085.998] CloseHandle (hObject=0x488) returned 1 [0085.998] GetProcessHeap () returned 0x580000 [0085.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6087d8 | out: hHeap=0x580000) returned 1 [0085.998] GetProcessHeap () returned 0x580000 [0085.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0085.998] GetProcessHeap () returned 0x580000 [0085.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0085.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x6adec500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x498fd28, dwReserved1=0x6f0c4f8, cFileName="Desktop.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="")) returned 0x5b96f0 [0085.998] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.943] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", len=0x4d | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 1 [0086.943] GetProcessHeap () returned 0x580000 [0086.943] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.959] CloseHandle (hObject=0x448) returned 1 [0086.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id_1622540890_.your_last_chance")) returned 1 [0086.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUEPR~2.YOU")) returned 0x5b96f0 [0086.960] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.960] GetProcessHeap () returned 0x580000 [0086.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdaa1) returned 0x6ecf008 [0086.961] GetProcessHeap () returned 0x580000 [0086.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdaa1) returned 0x6edcab8 [0086.961] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.961] ReadFile (in: hFile=0x448, lpBuffer=0x6ecf008, nNumberOfBytesToRead=0xda80, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf008*, lpNumberOfBytesRead=0x498ff14*=0xda80, lpOverlapped=0x0) returned 1 [0090.404] GetProcessHeap () returned 0x580000 [0090.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0090.405] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.405] WriteFile (in: hFile=0x448, lpBuffer=0x6edcab8*, nNumberOfBytesToWrite=0xda80, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6edcab8*, lpNumberOfBytesWritten=0x498ff14*=0xda80, lpOverlapped=0x0) returned 1 [0090.763] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.763] WriteFile (in: hFile=0x448, lpBuffer=0x6eea537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eea537*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.439] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.439] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.439] CloseHandle (hObject=0x448) returned 1 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6edcab8 | out: hHeap=0x580000) returned 1 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf008 | out: hHeap=0x580000) returned 1 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0091.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdaaa, dwReserved0=0x498fd28, dwReserved1=0x6ecf008, cFileName="BLUEPRNT.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUEPR~2.YOU")) returned 0x5b96b0 [0091.629] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.406] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 1 [0092.406] GetProcessHeap () returned 0x580000 [0092.406] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x3c) returned 0x61aa08 [0092.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0092.407] CloseHandle (hObject=0x434) returned 1 [0092.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0092.469] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0092.469] GetProcessHeap () returned 0x580000 [0092.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8321) returned 0x6dc7060 [0092.469] GetProcessHeap () returned 0x580000 [0092.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8321) returned 0x6d458e0 [0092.471] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.471] ReadFile (in: hFile=0x434, lpBuffer=0x6dc7060, nNumberOfBytesToRead=0x8300, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7060*, lpNumberOfBytesRead=0x498ff14*=0x8300, lpOverlapped=0x0) returned 1 [0095.063] GetProcessHeap () returned 0x580000 [0095.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0095.063] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.063] WriteFile (in: hFile=0x434, lpBuffer=0x6d458e0*, nNumberOfBytesToWrite=0x8300, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesWritten=0x498ff14*=0x8300, lpOverlapped=0x0) returned 1 [0095.063] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.063] WriteFile (in: hFile=0x434, lpBuffer=0x6d4dbdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4dbdf*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0095.063] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.064] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0095.064] CloseHandle (hObject=0x434) returned 1 [0095.064] GetProcessHeap () returned 0x580000 [0095.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0095.064] GetProcessHeap () returned 0x580000 [0095.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7060 | out: hHeap=0x580000) returned 1 [0095.064] GetProcessHeap () returned 0x580000 [0095.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0095.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7045c3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x833b, dwReserved0=0x498fd28, dwReserved1=0x6dc7060, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0095.064] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0096.424] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", len=0x45 | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 1 [0096.424] GetProcessHeap () returned 0x580000 [0096.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0096.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0099.043] CloseHandle (hObject=0x4a0) returned 1 [0099.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id_1622540890_.your_last_chance")) returned 1 [0099.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUADEL~1.YOU")) returned 0x5b96b0 [0099.044] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0099.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0099.044] GetProcessHeap () returned 0x580000 [0099.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbbc1) returned 0x626d18 [0099.045] GetProcessHeap () returned 0x580000 [0099.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbbc1) returned 0x6c6a0f8 [0099.045] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.045] ReadFile (in: hFile=0x4a0, lpBuffer=0x626d18, nNumberOfBytesToRead=0xbba0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x498ff14*=0xbba0, lpOverlapped=0x0) returned 1 [0100.869] GetProcessHeap () returned 0x580000 [0100.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0100.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0xbba0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x498ff14*=0xbba0, lpOverlapped=0x0) returned 1 [0100.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.870] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c75c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75c97*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.198] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.198] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.198] CloseHandle (hObject=0x4a0) returned 1 [0101.198] GetProcessHeap () returned 0x580000 [0101.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0101.200] GetProcessHeap () returned 0x580000 [0101.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0101.200] GetProcessHeap () returned 0x580000 [0101.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73efa1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbbcb, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="QUAD.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUADEL~1.YOU")) returned 0x5b96b0 [0101.843] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.650] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", len=0x5a | out: pbstr=0x498ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 1 [0109.650] GetProcessHeap () returned 0x580000 [0109.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9510 [0109.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0109.664] CloseHandle (hObject=0x41c) returned 1 [0109.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0109.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id_1622540890_.your_last_chance")) returned 1 [0109.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0109.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FPEXTM~1.YOU")) returned 0x5b9730 [0109.665] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0109.665] GetProcessHeap () returned 0x580000 [0109.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0109.665] GetProcessHeap () returned 0x580000 [0109.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cc0438 [0109.665] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.665] ReadFile (in: hFile=0x41c, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.858] GetProcessHeap () returned 0x580000 [0111.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0111.858] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.858] WriteFile (in: hFile=0x41c, lpBuffer=0x6cc0438*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0438*, lpNumberOfBytesWritten=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.859] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.859] WriteFile (in: hFile=0x41c, lpBuffer=0x6cd1c37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cd1c37*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.859] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.859] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.859] CloseHandle (hObject=0x41c) returned 1 [0111.859] GetProcessHeap () returned 0x580000 [0111.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cc0438 | out: hHeap=0x580000) returned 1 [0111.861] GetProcessHeap () returned 0x580000 [0111.861] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0111.861] GetProcessHeap () returned 0x580000 [0111.861] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0111.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a496cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x296c9, dwReserved0=0x498fd28, dwReserved1=0x636970, cFileName="FPEXT.MSG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FPEXTM~1.YOU")) returned 0x5b9670 [0111.861] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0111.911] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", len=0x43 | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 1 [0111.911] GetProcessHeap () returned 0x580000 [0111.911] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0111.911] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.944] Sleep (dwMilliseconds=0x1) [0112.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.021] Sleep (dwMilliseconds=0x1) [0112.128] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", len=0x4e | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned 1 [0112.128] GetProcessHeap () returned 0x580000 [0112.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x30) returned 0x61f880 [0112.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.138] Sleep (dwMilliseconds=0x1) [0112.219] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", len=0x39 | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned 1 [0112.219] GetProcessHeap () returned 0x580000 [0112.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x28) returned 0x5dc550 [0112.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.219] Sleep (dwMilliseconds=0x1) [0112.236] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", len=0x4d | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned 1 [0112.236] GetProcessHeap () returned 0x580000 [0112.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.236] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.250] Sleep (dwMilliseconds=0x1) [0112.370] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", len=0x4c | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 1 [0112.371] GetProcessHeap () returned 0x580000 [0112.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.371] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.371] Sleep (dwMilliseconds=0x1) [0112.390] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", len=0x42 | out: pbstr=0x498ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned 1 [0112.390] GetProcessHeap () returned 0x580000 [0112.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.390] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.391] Sleep (dwMilliseconds=0x1) [0113.317] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", len=0x3f | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 1 [0113.317] GetProcessHeap () returned 0x580000 [0113.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xe0) returned 0x6f0ceb8 [0113.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0113.490] CloseHandle (hObject=0x464) returned 1 [0113.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0272~1.YOU")) returned 0x5b9630 [0114.921] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0114.921] GetProcessHeap () returned 0x580000 [0114.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00d78 [0114.921] GetProcessHeap () returned 0x580000 [0114.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79858 [0114.921] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.921] ReadFile (in: hFile=0x464, lpBuffer=0x6d00d78, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00d78*, lpNumberOfBytesRead=0x498ff14*=0x820, lpOverlapped=0x0) returned 1 [0114.930] GetProcessHeap () returned 0x580000 [0114.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.930] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.930] WriteFile (in: hFile=0x464, lpBuffer=0x6c79858*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79858*, lpNumberOfBytesWritten=0x498ff14*=0x820, lpOverlapped=0x0) returned 1 [0114.930] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.930] WriteFile (in: hFile=0x464, lpBuffer=0x6c7a077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a077*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.930] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.930] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.930] CloseHandle (hObject=0x464) returned 1 [0114.930] GetProcessHeap () returned 0x580000 [0114.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79858 | out: hHeap=0x580000) returned 1 [0114.930] GetProcessHeap () returned 0x580000 [0114.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00d78 | out: hHeap=0x580000) returned 1 [0114.930] GetProcessHeap () returned 0x580000 [0114.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c1e5ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x498fd28, dwReserved1=0x6d00d78, cFileName="AN02724_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0272~1.YOU")) returned 0x5b9630 [0115.997] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0116.064] CloseHandle (hObject=0x4ac) returned 1 [0116.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~2.YOU")) returned 0x5b9630 [0116.112] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0116.112] GetProcessHeap () returned 0x580000 [0116.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4761) returned 0x6db52d0 [0116.112] GetProcessHeap () returned 0x580000 [0116.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4761) returned 0x6db9a40 [0116.112] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.112] ReadFile (in: hFile=0x4ac, lpBuffer=0x6db52d0, nNumberOfBytesToRead=0x4740, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db52d0*, lpNumberOfBytesRead=0x498ff14*=0x4740, lpOverlapped=0x0) returned 1 [0117.160] GetProcessHeap () returned 0x580000 [0117.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.160] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.160] WriteFile (in: hFile=0x4ac, lpBuffer=0x6db9a40*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db9a40*, lpNumberOfBytesWritten=0x498ff14*=0x4740, lpOverlapped=0x0) returned 1 [0117.160] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.160] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dbe17f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbe17f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.160] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.160] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.160] CloseHandle (hObject=0x4ac) returned 1 [0117.160] GetProcessHeap () returned 0x580000 [0117.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db9a40 | out: hHeap=0x580000) returned 1 [0117.160] GetProcessHeap () returned 0x580000 [0117.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db52d0 | out: hHeap=0x580000) returned 1 [0117.160] GetProcessHeap () returned 0x580000 [0117.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d72c040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4778, dwReserved0=0x498fd28, dwReserved1=0x6db52d0, cFileName="SO00157_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~2.YOU")) returned 0x5b9630 [0118.879] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.894] CloseHandle (hObject=0x49c) returned 1 [0118.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0241~1.YOU")) returned 0x5b9630 [0118.895] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.895] GetProcessHeap () returned 0x580000 [0118.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0118.895] GetProcessHeap () returned 0x580000 [0118.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0118.895] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.895] ReadFile (in: hFile=0x49c, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0119.931] GetProcessHeap () returned 0x580000 [0119.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0119.931] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.931] WriteFile (in: hFile=0x49c, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0119.932] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.932] WriteFile (in: hFile=0x49c, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.932] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.932] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.932] CloseHandle (hObject=0x49c) returned 1 [0119.949] GetProcessHeap () returned 0x580000 [0119.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0119.949] GetProcessHeap () returned 0x580000 [0119.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0119.949] GetProcessHeap () returned 0x580000 [0119.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f1813a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17a40, dwReserved0=0x498fd28, dwReserved1=0x636970, cFileName="SO02413_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0241~1.YOU")) returned 0x5b96f0 [0120.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.158] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", len=0x4c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 1 [0120.158] GetProcessHeap () returned 0x580000 [0120.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x177c) returned 0x6d06ca8 [0120.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.725] CloseHandle (hObject=0x48c) returned 1 [0120.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.id_1622540890_.your_last_chance")) returned 1 [0120.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J013F1~1.YOU")) returned 0x5b9630 [0120.727] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.728] GetProcessHeap () returned 0x580000 [0120.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x67ec60 [0120.728] GetProcessHeap () returned 0x580000 [0120.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11e1) returned 0x6f19958 [0120.728] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.728] ReadFile (in: hFile=0x48c, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x11c0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x498ff14*=0x11c0, lpOverlapped=0x0) returned 1 [0120.745] GetProcessHeap () returned 0x580000 [0120.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.745] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.745] WriteFile (in: hFile=0x48c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x498ff14*=0x11c0, lpOverlapped=0x0) returned 1 [0120.745] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.745] WriteFile (in: hFile=0x48c, lpBuffer=0x6f1ab17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ab17*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.745] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.745] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.745] CloseHandle (hObject=0x48c) returned 1 [0120.745] GetProcessHeap () returned 0x580000 [0120.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0120.745] GetProcessHeap () returned 0x580000 [0120.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0120.745] GetProcessHeap () returned 0x580000 [0120.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f963c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11f5, dwReserved0=0x498fd28, dwReserved1=0x67ec60, cFileName="J0143748.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J013F1~1.YOU")) returned 0x5b9630 [0120.746] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.766] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", len=0x4d | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 1 [0120.766] GetProcessHeap () returned 0x580000 [0120.766] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1848) returned 0x6e00ac0 [0120.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.679] CloseHandle (hObject=0x3fc) returned 1 [0122.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.id_1622540890_.your_last_chance")) returned 1 [0122.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0122.681] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.681] GetProcessHeap () returned 0x580000 [0122.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.681] GetProcessHeap () returned 0x580000 [0122.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.681] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.681] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x498ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.686] GetProcessHeap () returned 0x580000 [0122.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.686] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.686] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x498ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.686] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.686] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.686] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.686] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.687] CloseHandle (hObject=0x3fc) returned 1 [0122.687] GetProcessHeap () returned 0x580000 [0122.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.687] GetProcessHeap () returned 0x580000 [0122.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.687] GetProcessHeap () returned 0x580000 [0122.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0125.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bd6700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e6, dwReserved0=0x498fd28, dwReserved1=0x678958, cFileName="Pushpin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0125.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.342] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", len=0x3d | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned 1 [0125.342] GetProcessHeap () returned 0x580000 [0125.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1954) returned 0x6f42f08 [0125.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0128.879] CloseHandle (hObject=0x44c) returned 1 [0128.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02346~2.YOU")) returned 0x5b9730 [0130.074] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0130.074] GetProcessHeap () returned 0x580000 [0130.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2801) returned 0x6d98c08 [0130.074] GetProcessHeap () returned 0x580000 [0130.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2801) returned 0x6ef3008 [0130.074] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.074] ReadFile (in: hFile=0x44c, lpBuffer=0x6d98c08, nNumberOfBytesToRead=0x27e0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98c08*, lpNumberOfBytesRead=0x498ff14*=0x27e0, lpOverlapped=0x0) returned 1 [0130.111] GetProcessHeap () returned 0x580000 [0130.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.111] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.111] WriteFile (in: hFile=0x44c, lpBuffer=0x6ef3008*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesWritten=0x498ff14*=0x27e0, lpOverlapped=0x0) returned 1 [0130.111] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.111] WriteFile (in: hFile=0x44c, lpBuffer=0x6ef57e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef57e7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.111] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.111] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.111] CloseHandle (hObject=0x44c) returned 1 [0130.111] GetProcessHeap () returned 0x580000 [0130.111] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0130.111] GetProcessHeap () returned 0x580000 [0130.111] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98c08 | out: hHeap=0x580000) returned 1 [0130.112] GetProcessHeap () returned 0x580000 [0130.112] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0130.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x852a7580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2812, dwReserved0=0x498fd28, dwReserved1=0x6d98c08, cFileName="J0234657.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02346~2.YOU")) returned 0x5b9730 [0130.112] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb0) returned 0x6f14048 [0131.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.401] CloseHandle (hObject=0x3e4) returned 1 [0132.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0132.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~1.YOU")) returned 0x5b9730 [0132.403] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.403] GetProcessHeap () returned 0x580000 [0132.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0132.403] GetProcessHeap () returned 0x580000 [0132.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0132.403] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.403] ReadFile (in: hFile=0x3e4, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.404] GetProcessHeap () returned 0x580000 [0132.404] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.404] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.404] WriteFile (in: hFile=0x3e4, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0132.404] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.404] WriteFile (in: hFile=0x3e4, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.404] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.404] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.405] CloseHandle (hObject=0x3e4) returned 1 [0132.405] GetProcessHeap () returned 0x580000 [0132.405] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0132.405] GetProcessHeap () returned 0x580000 [0132.405] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0132.405] GetProcessHeap () returned 0x580000 [0132.405] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86885fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x498fd28, dwReserved1=0x61b540, cFileName="EXCEL.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~1.YOU")) returned 0x5b96f0 [0134.935] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.935] Sleep (dwMilliseconds=0x1) [0134.941] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK", len=0x3f | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 1 [0134.941] GetProcessHeap () returned 0x580000 [0134.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0134.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.942] CloseHandle (hObject=0x3b8) returned 1 [0134.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0134.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~2.YOU")) returned 0x5b96f0 [0134.943] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.943] GetProcessHeap () returned 0x580000 [0134.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0134.943] GetProcessHeap () returned 0x580000 [0134.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0134.943] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.943] ReadFile (in: hFile=0x3b8, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0134.944] GetProcessHeap () returned 0x580000 [0134.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.945] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.945] WriteFile (in: hFile=0x3b8, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0134.945] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.945] WriteFile (in: hFile=0x3b8, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.945] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.945] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.945] CloseHandle (hObject=0x3b8) returned 1 [0134.945] GetProcessHeap () returned 0x580000 [0134.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0134.945] GetProcessHeap () returned 0x580000 [0134.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0134.945] GetProcessHeap () returned 0x580000 [0134.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0134.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x880c5fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x498fd28, dwReserved1=0x61b540, cFileName="GRAPH_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~2.YOU")) returned 0x5b96f0 [0134.946] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.946] Sleep (dwMilliseconds=0x1) [0134.956] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK", len=0x3f | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 1 [0134.956] GetProcessHeap () returned 0x580000 [0134.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0134.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.957] CloseHandle (hObject=0x3b8) returned 1 [0134.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0134.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~3.YOU")) returned 0x5b96f0 [0134.958] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.958] GetProcessHeap () returned 0x580000 [0134.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0134.958] GetProcessHeap () returned 0x580000 [0134.958] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0134.958] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.958] ReadFile (in: hFile=0x3b8, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0134.959] GetProcessHeap () returned 0x580000 [0134.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.959] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.959] WriteFile (in: hFile=0x3b8, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x498ff14*=0x60, lpOverlapped=0x0) returned 1 [0134.959] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.960] WriteFile (in: hFile=0x3b8, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.960] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.960] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.960] CloseHandle (hObject=0x3b8) returned 1 [0134.960] GetProcessHeap () returned 0x580000 [0134.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0134.960] GetProcessHeap () returned 0x580000 [0134.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0134.960] GetProcessHeap () returned 0x580000 [0134.960] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0134.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x880ec120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x498fd28, dwReserved1=0x61b540, cFileName="GRAPH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~3.YOU")) returned 0x5b96f0 [0134.960] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.960] Sleep (dwMilliseconds=0x1) [0134.972] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT", len=0x3d | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 1 [0134.972] GetProcessHeap () returned 0x580000 [0134.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb0) returned 0x6f14048 [0134.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.972] CloseHandle (hObject=0x3b8) returned 1 [0134.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0134.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~4.YOU")) returned 0x5b96f0 [0134.973] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.973] GetProcessHeap () returned 0x580000 [0134.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0134.974] GetProcessHeap () returned 0x580000 [0134.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0134.974] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.974] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0134.975] GetProcessHeap () returned 0x580000 [0134.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.975] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.975] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0134.975] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.975] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.975] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.976] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.976] CloseHandle (hObject=0x3b8) returned 1 [0134.976] GetProcessHeap () returned 0x580000 [0134.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0134.976] GetProcessHeap () returned 0x580000 [0134.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0134.976] GetProcessHeap () returned 0x580000 [0134.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0134.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88112280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x498fd28, dwReserved1=0x5ad8a0, cFileName="GRAPH_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPH_~4.YOU")) returned 0x5b96f0 [0134.976] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.976] Sleep (dwMilliseconds=0x1) [0134.987] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT", len=0x41 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 1 [0134.987] GetProcessHeap () returned 0x580000 [0134.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eac) returned 0x6f14048 [0134.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.988] CloseHandle (hObject=0x3b8) returned 1 [0134.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0134.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~3.YOU")) returned 0x5b96f0 [0134.989] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.989] GetProcessHeap () returned 0x580000 [0134.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0134.989] GetProcessHeap () returned 0x580000 [0134.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0134.989] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.989] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0134.991] GetProcessHeap () returned 0x580000 [0134.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.991] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.991] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0134.991] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.991] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.991] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.991] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.991] CloseHandle (hObject=0x3b8) returned 1 [0134.991] GetProcessHeap () returned 0x580000 [0134.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0134.991] GetProcessHeap () returned 0x580000 [0134.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0134.991] GetProcessHeap () returned 0x580000 [0134.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0134.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x881383e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x498fd28, dwReserved1=0x5ad8a0, cFileName="EXCEL.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~3.YOU")) returned 0x5b96f0 [0134.992] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.992] Sleep (dwMilliseconds=0x1) [0135.694] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", len=0x4a | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned 1 [0135.694] GetProcessHeap () returned 0x580000 [0135.694] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0135.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.694] CloseHandle (hObject=0x48c) returned 1 [0135.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.694] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.id_1622540890_.your_last_chance")) returned 1 [0135.695] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b96b0 [0135.695] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.695] GetProcessHeap () returned 0x580000 [0135.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0135.695] GetProcessHeap () returned 0x580000 [0135.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6f19958 [0135.695] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.695] ReadFile (in: hFile=0x48c, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x498ff14*=0x1320, lpOverlapped=0x0) returned 1 [0135.713] GetProcessHeap () returned 0x580000 [0135.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.713] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x48c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x498ff14*=0x1320, lpOverlapped=0x0) returned 1 [0135.713] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.713] WriteFile (in: hFile=0x48c, lpBuffer=0x6f1ac77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ac77*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.714] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.714] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.714] CloseHandle (hObject=0x48c) returned 1 [0135.714] GetProcessHeap () returned 0x580000 [0135.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0135.714] GetProcessHeap () returned 0x580000 [0135.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0135.714] GetProcessHeap () returned 0x580000 [0135.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88810320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x134e, dwReserved0=0x498fd28, dwReserved1=0x67ec60, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b96b0 [0135.857] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.387] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x60 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0136.387] GetProcessHeap () returned 0x580000 [0136.387] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0136.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.387] CloseHandle (hObject=0x484) returned 1 [0136.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0136.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0136.388] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.389] GetProcessHeap () returned 0x580000 [0136.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0136.389] GetProcessHeap () returned 0x580000 [0136.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0136.389] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.389] ReadFile (in: hFile=0x484, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x498ff14*=0x160, lpOverlapped=0x0) returned 1 [0136.391] GetProcessHeap () returned 0x580000 [0136.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.391] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.391] WriteFile (in: hFile=0x484, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x498ff14*=0x160, lpOverlapped=0x0) returned 1 [0136.391] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.391] WriteFile (in: hFile=0x484, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0136.391] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.391] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0136.391] CloseHandle (hObject=0x484) returned 1 [0136.392] GetProcessHeap () returned 0x580000 [0136.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0136.392] GetProcessHeap () returned 0x580000 [0136.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0136.392] GetProcessHeap () returned 0x580000 [0136.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0136.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e9bfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x498fd28, dwReserved1=0x5aa990, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0136.392] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.407] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x5c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0136.407] GetProcessHeap () returned 0x580000 [0136.407] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0136.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0138.587] CloseHandle (hObject=0x488) returned 1 [0138.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0138.588] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0138.588] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0138.588] GetProcessHeap () returned 0x580000 [0138.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0138.588] GetProcessHeap () returned 0x580000 [0138.589] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0138.589] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.589] ReadFile (in: hFile=0x488, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x498ff14*=0xa0, lpOverlapped=0x0) returned 1 [0138.590] GetProcessHeap () returned 0x580000 [0138.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0138.590] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.590] WriteFile (in: hFile=0x488, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x498ff14*=0xa0, lpOverlapped=0x0) returned 1 [0138.590] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.590] WriteFile (in: hFile=0x488, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.590] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.590] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.591] CloseHandle (hObject=0x488) returned 1 [0138.591] GetProcessHeap () returned 0x580000 [0138.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0138.591] GetProcessHeap () returned 0x580000 [0138.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0138.591] GetProcessHeap () returned 0x580000 [0138.591] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a370020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x498fd28, dwReserved1=0x60e978, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0139.879] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.906] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x58 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0139.906] GetProcessHeap () returned 0x580000 [0139.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0139.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.906] CloseHandle (hObject=0x3b4) returned 1 [0139.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0139.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0139.919] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.919] GetProcessHeap () returned 0x580000 [0139.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0139.919] GetProcessHeap () returned 0x580000 [0139.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0139.920] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.920] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x498ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.921] GetProcessHeap () returned 0x580000 [0139.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdef0 [0139.921] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.921] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x498ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.921] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.921] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.922] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.922] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.922] CloseHandle (hObject=0x3b4) returned 1 [0139.922] GetProcessHeap () returned 0x580000 [0139.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0139.922] GetProcessHeap () returned 0x580000 [0139.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0139.922] GetProcessHeap () returned 0x580000 [0139.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdef0 | out: hHeap=0x580000) returned 1 [0140.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b03b660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x498fd28, dwReserved1=0x6f0a9f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.131] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.140] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", len=0x5d | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned 1 [0140.140] GetProcessHeap () returned 0x580000 [0140.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.143] CloseHandle (hObject=0x170) returned 1 [0140.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0140.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0140.157] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.157] GetProcessHeap () returned 0x580000 [0140.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0140.157] GetProcessHeap () returned 0x580000 [0140.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0140.157] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.157] ReadFile (in: hFile=0x170, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x498ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.160] GetProcessHeap () returned 0x580000 [0140.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.160] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x170, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x498ff14*=0x140, lpOverlapped=0x0) returned 1 [0140.160] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x170, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.160] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.160] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.160] CloseHandle (hObject=0x170) returned 1 [0140.160] GetProcessHeap () returned 0x580000 [0140.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0140.160] GetProcessHeap () returned 0x580000 [0140.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0140.160] GetProcessHeap () returned 0x580000 [0140.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b276b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x498fd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0140.161] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.409] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", len=0x5c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned 1 [0140.409] GetProcessHeap () returned 0x580000 [0140.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.410] CloseHandle (hObject=0x488) returned 1 [0140.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.410] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0140.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0140.411] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.411] GetProcessHeap () returned 0x580000 [0140.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcec10 [0140.411] GetProcessHeap () returned 0x580000 [0140.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dced28 [0140.411] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.411] ReadFile (in: hFile=0x488, lpBuffer=0x6dcec10, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcec10*, lpNumberOfBytesRead=0x498ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.413] GetProcessHeap () returned 0x580000 [0140.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.413] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.413] WriteFile (in: hFile=0x488, lpBuffer=0x6dced28*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dced28*, lpNumberOfBytesWritten=0x498ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.413] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.413] WriteFile (in: hFile=0x488, lpBuffer=0x6dcee07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcee07*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.413] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.413] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.414] CloseHandle (hObject=0x488) returned 1 [0140.414] GetProcessHeap () returned 0x580000 [0140.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0140.414] GetProcessHeap () returned 0x580000 [0140.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.414] GetProcessHeap () returned 0x580000 [0140.414] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b4d8100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x498fd28, dwReserved1=0x6dcec10, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0140.414] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.674] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", len=0x43 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned 1 [0140.674] GetProcessHeap () returned 0x580000 [0140.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d80) returned 0x6f14048 [0140.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.786] CloseHandle (hObject=0x490) returned 1 [0140.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1459~1.YOU")) returned 0x5b9730 [0140.812] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.812] GetProcessHeap () returned 0x580000 [0140.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c4a820 [0140.812] GetProcessHeap () returned 0x580000 [0140.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c4aaa8 [0140.812] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.812] ReadFile (in: hFile=0x490, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x498ff14*=0x240, lpOverlapped=0x0) returned 1 [0140.819] GetProcessHeap () returned 0x580000 [0140.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.819] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.819] WriteFile (in: hFile=0x490, lpBuffer=0x6c4aaa8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aaa8*, lpNumberOfBytesWritten=0x498ff14*=0x240, lpOverlapped=0x0) returned 1 [0140.819] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.819] WriteFile (in: hFile=0x490, lpBuffer=0x6c4ace7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ace7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.819] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.819] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.819] CloseHandle (hObject=0x490) returned 1 [0140.819] GetProcessHeap () returned 0x580000 [0140.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aaa8 | out: hHeap=0x580000) returned 1 [0140.820] GetProcessHeap () returned 0x580000 [0140.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0140.820] GetProcessHeap () returned 0x580000 [0140.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b64c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x498fd28, dwReserved1=0x6c4a820, cFileName="BD14594_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1459~1.YOU")) returned 0x5b9730 [0140.820] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.873] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC", len=0x40 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 1 [0140.873] GetProcessHeap () returned 0x580000 [0140.873] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.873] CloseHandle (hObject=0x448) returned 1 [0140.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0140.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~4.YOU")) returned 0x5b9730 [0140.874] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.875] GetProcessHeap () returned 0x580000 [0140.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0140.875] GetProcessHeap () returned 0x580000 [0140.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0140.875] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.875] ReadFile (in: hFile=0x448, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x498ff14*=0x260, lpOverlapped=0x0) returned 1 [0140.930] GetProcessHeap () returned 0x580000 [0140.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.930] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.930] WriteFile (in: hFile=0x448, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x498ff14*=0x260, lpOverlapped=0x0) returned 1 [0140.930] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.930] WriteFile (in: hFile=0x448, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.930] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.930] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.930] CloseHandle (hObject=0x448) returned 1 [0140.930] GetProcessHeap () returned 0x580000 [0140.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0140.930] GetProcessHeap () returned 0x580000 [0140.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0140.931] GetProcessHeap () returned 0x580000 [0140.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9c0e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x498fd28, dwReserved1=0x6d08520, cFileName="MSACCESS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~4.YOU")) returned 0x5b9730 [0140.931] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.972] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL", len=0x44 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 1 [0140.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.018] CloseHandle (hObject=0x3a8) returned 1 [0144.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0144.036] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x9b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MOR6IN~1.YOU")) returned 0x5b96f0 [0144.036] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0144.036] GetProcessHeap () returned 0x580000 [0144.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ba1) returned 0x6dbf1d0 [0144.037] GetProcessHeap () returned 0x580000 [0144.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ba1) returned 0x6f976f8 [0144.037] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.037] ReadFile (in: hFile=0x3a8, lpBuffer=0x6dbf1d0, nNumberOfBytesToRead=0x9b80, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesRead=0x498ff14*=0x9b80, lpOverlapped=0x0) returned 1 [0145.683] GetProcessHeap () returned 0x580000 [0145.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0145.684] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.684] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x9b80, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x498ff14*=0x9b80, lpOverlapped=0x0) returned 1 [0145.684] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.684] WriteFile (in: hFile=0x3a8, lpBuffer=0x6fa1277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa1277*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0145.684] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.684] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0145.684] CloseHandle (hObject=0x3a8) returned 1 [0145.684] GetProcessHeap () returned 0x580000 [0145.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0145.684] GetProcessHeap () returned 0x580000 [0145.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0145.685] GetProcessHeap () returned 0x580000 [0145.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0146.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e7211c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ba4, dwReserved0=0x498fd28, dwReserved1=0x6dbf1d0, cFileName="MOR6INT.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MOR6IN~1.YOU")) returned 0x5b96f0 [0146.866] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.881] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", len=0x44 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned 1 [0146.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0146.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0152.738] CloseHandle (hObject=0x3b8) returned 1 [0152.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5cb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR14~1.YOU")) returned 0x5b9730 [0152.739] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0152.739] GetProcessHeap () returned 0x580000 [0152.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5cc1) returned 0x7045798 [0152.739] GetProcessHeap () returned 0x580000 [0152.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5cc1) returned 0x704b468 [0152.739] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.739] ReadFile (in: hFile=0x3b8, lpBuffer=0x7045798, nNumberOfBytesToRead=0x5ca0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7045798*, lpNumberOfBytesRead=0x498ff14*=0x5ca0, lpOverlapped=0x0) returned 1 [0154.681] GetProcessHeap () returned 0x580000 [0154.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.681] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.681] WriteFile (in: hFile=0x3b8, lpBuffer=0x704b468*, nNumberOfBytesToWrite=0x5ca0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x704b468*, lpNumberOfBytesWritten=0x498ff14*=0x5ca0, lpOverlapped=0x0) returned 1 [0154.681] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.681] WriteFile (in: hFile=0x3b8, lpBuffer=0x7051107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7051107*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.682] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.682] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.682] CloseHandle (hObject=0x3b8) returned 1 [0154.682] GetProcessHeap () returned 0x580000 [0154.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704b468 | out: hHeap=0x580000) returned 1 [0154.682] GetProcessHeap () returned 0x580000 [0154.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7045798 | out: hHeap=0x580000) returned 1 [0154.682] GetProcessHeap () returned 0x580000 [0154.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93cf8b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5cdb, dwReserved0=0x498fd28, dwReserved1=0x7045798, cFileName="PDIR14F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR14~1.YOU")) returned 0x5b9630 [0154.682] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.749] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", len=0x42 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned 1 [0155.749] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0155.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0155.750] CloseHandle (hObject=0x438) returned 1 [0155.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.id_1622540890_.your_last_chance")) returned 1 [0155.751] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCMET~1.YOU")) returned 0x5b9630 [0155.751] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0155.751] GetProcessHeap () returned 0x580000 [0155.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3341) returned 0x705f068 [0155.752] GetProcessHeap () returned 0x580000 [0155.752] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3341) returned 0x6ec4068 [0155.752] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.752] ReadFile (in: hFile=0x438, lpBuffer=0x705f068, nNumberOfBytesToRead=0x3320, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f068*, lpNumberOfBytesRead=0x498ff14*=0x3320, lpOverlapped=0x0) returned 1 [0156.712] GetProcessHeap () returned 0x580000 [0156.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0156.712] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.712] WriteFile (in: hFile=0x438, lpBuffer=0x6ec4068*, nNumberOfBytesToWrite=0x3320, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesWritten=0x498ff14*=0x3320, lpOverlapped=0x0) returned 1 [0156.712] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.712] WriteFile (in: hFile=0x438, lpBuffer=0x6ec7387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec7387*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0156.712] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.712] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0156.712] CloseHandle (hObject=0x438) returned 1 [0157.857] GetProcessHeap () returned 0x580000 [0157.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0157.857] GetProcessHeap () returned 0x580000 [0157.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f068 | out: hHeap=0x580000) returned 1 [0157.857] GetProcessHeap () returned 0x580000 [0157.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0157.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9504fde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3345, dwReserved0=0x498fd28, dwReserved1=0x705f068, cFileName="bdcmetadataresource.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCMET~1.YOU")) returned 0x5b9630 [0159.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0164.567] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", len=0x3c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 1 [0164.567] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0164.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0165.426] CloseHandle (hObject=0x48c) returned 1 [0165.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id_1622540890_.your_last_chance")) returned 1 [0165.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTEX2~1.YOU")) returned 0x5b9730 [0165.879] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0165.880] GetProcessHeap () returned 0x580000 [0165.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6e17c00 [0165.880] GetProcessHeap () returned 0x580000 [0165.880] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0165.880] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.880] ReadFile (in: hFile=0x48c, lpBuffer=0x6e17c00, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesRead=0x498ff14*=0x340, lpOverlapped=0x0) returned 1 [0165.884] GetProcessHeap () returned 0x580000 [0165.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.884] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.884] WriteFile (in: hFile=0x48c, lpBuffer=0x6dcfb90*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesWritten=0x498ff14*=0x340, lpOverlapped=0x0) returned 1 [0165.884] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.884] WriteFile (in: hFile=0x48c, lpBuffer=0x6dcfecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfecf*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.885] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.885] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.885] CloseHandle (hObject=0x48c) returned 1 [0165.885] GetProcessHeap () returned 0x580000 [0165.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0165.885] GetProcessHeap () returned 0x580000 [0165.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0165.885] GetProcessHeap () returned 0x580000 [0165.885] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a7ca660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x498fd28, dwReserved1=0x6e17c00, cFileName="OUTEX2.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTEX2~1.YOU")) returned 0x5b9730 [0169.657] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.728] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", len=0x3e | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 1 [0169.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0169.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0169.729] CloseHandle (hObject=0x43c) returned 1 [0169.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id_1622540890_.your_last_chance")) returned 1 [0169.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKSA~1.YOU")) returned 0x5b9730 [0169.730] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0169.730] GetProcessHeap () returned 0x580000 [0169.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ba1) returned 0x6dec6e0 [0169.731] GetProcessHeap () returned 0x580000 [0169.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ba1) returned 0x6d96da8 [0169.731] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.731] ReadFile (in: hFile=0x43c, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x5b80, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x498ff14*=0x5b80, lpOverlapped=0x0) returned 1 [0170.944] GetProcessHeap () returned 0x580000 [0170.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.944] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.944] WriteFile (in: hFile=0x43c, lpBuffer=0x6d96da8*, nNumberOfBytesToWrite=0x5b80, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d96da8*, lpNumberOfBytesWritten=0x498ff14*=0x5b80, lpOverlapped=0x0) returned 1 [0170.944] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.944] WriteFile (in: hFile=0x43c, lpBuffer=0x6d9c927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9c927*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.945] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.945] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.945] CloseHandle (hObject=0x43c) returned 1 [0170.945] GetProcessHeap () returned 0x580000 [0170.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d96da8 | out: hHeap=0x580000) returned 1 [0170.945] GetProcessHeap () returned 0x580000 [0170.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0170.945] GetProcessHeap () returned 0x580000 [0170.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d7fe3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ba4, dwReserved0=0x498fd28, dwReserved1=0x6dec6e0, cFileName="DESKSAM.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKSA~1.YOU")) returned 0x5b9770 [0173.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.083] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", len=0x41 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 1 [0173.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0173.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.114] CloseHandle (hObject=0x454) returned 1 [0173.114] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.114] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id_1622540890_.your_last_chance")) returned 1 [0173.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDREQ~2.YOU")) returned 0x5b9770 [0173.115] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.115] GetProcessHeap () returned 0x580000 [0173.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0173.115] GetProcessHeap () returned 0x580000 [0173.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0173.115] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.116] ReadFile (in: hFile=0x454, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x498ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.149] GetProcessHeap () returned 0x580000 [0173.149] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.149] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.149] WriteFile (in: hFile=0x454, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x498ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.149] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.149] WriteFile (in: hFile=0x454, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.149] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.149] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.149] CloseHandle (hObject=0x454) returned 1 [0173.149] GetProcessHeap () returned 0x580000 [0173.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0173.149] GetProcessHeap () returned 0x580000 [0173.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0173.149] GetProcessHeap () returned 0x580000 [0173.149] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed1e720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x498fd28, dwReserved1=0x5d09a0, cFileName="SCDREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDREQ~2.YOU")) returned 0x5b9770 [0173.150] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.243] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", len=0x42 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 1 [0174.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0174.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0176.671] CloseHandle (hObject=0x488) returned 1 [0176.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id_1622540890_.your_last_chance")) returned 1 [0176.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMR~1.YOU")) returned 0x5b96b0 [0176.673] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0176.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0176.673] GetProcessHeap () returned 0x580000 [0176.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6dcb1d0 [0176.673] GetProcessHeap () returned 0x580000 [0176.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x654550 [0176.673] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.673] ReadFile (in: hFile=0x488, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x498ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0176.709] GetProcessHeap () returned 0x580000 [0176.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.709] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.709] WriteFile (in: hFile=0x488, lpBuffer=0x654550*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x654550*, lpNumberOfBytesWritten=0x498ff14*=0x27a0, lpOverlapped=0x0) returned 1 [0176.709] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.709] WriteFile (in: hFile=0x488, lpBuffer=0x656cef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x656cef*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.709] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.709] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.709] CloseHandle (hObject=0x488) returned 1 [0176.710] GetProcessHeap () returned 0x580000 [0176.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x654550 | out: hHeap=0x580000) returned 1 [0176.710] GetProcessHeap () returned 0x580000 [0176.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0176.710] GetProcessHeap () returned 0x580000 [0176.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.055] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0f0a0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27c4, dwReserved0=0x498fd28, dwReserved1=0x6dcb1d0, cFileName="DELIMR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMR~1.YOU")) returned 0x5b96f0 [0179.055] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.072] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", len=0x4c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx") returned 1 [0179.072] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0179.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.042] CloseHandle (hObject=0x440) returned 1 [0181.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.id_1622540890_.your_last_chance")) returned 1 [0181.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTIN~1.YOU")) returned 0x5b96b0 [0181.043] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.043] GetProcessHeap () returned 0x580000 [0181.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x6dcb1d0 [0181.044] GetProcessHeap () returned 0x580000 [0181.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x6f1bec0 [0181.044] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.044] ReadFile (in: hFile=0x440, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x2160, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x498ff14*=0x2160, lpOverlapped=0x0) returned 1 [0181.073] GetProcessHeap () returned 0x580000 [0181.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.073] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.073] WriteFile (in: hFile=0x440, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x498ff14*=0x2160, lpOverlapped=0x0) returned 1 [0181.073] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.073] WriteFile (in: hFile=0x440, lpBuffer=0x6f1e01f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e01f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.073] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.073] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.073] CloseHandle (hObject=0x440) returned 1 [0181.073] GetProcessHeap () returned 0x580000 [0181.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0181.073] GetProcessHeap () returned 0x580000 [0181.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0181.073] GetProcessHeap () returned 0x580000 [0181.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa38b21a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x218d, dwReserved0=0x498fd28, dwReserved1=0x6dcb1d0, cFileName="Distinctive.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTIN~1.YOU")) returned 0x5b9770 [0182.214] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.581] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", len=0x67 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned 1 [0183.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0183.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.582] CloseHandle (hObject=0x488) returned 1 [0183.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.582] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.id_1622540890_.your_last_chance")) returned 1 [0183.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0183.583] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.583] GetProcessHeap () returned 0x580000 [0183.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0183.583] GetProcessHeap () returned 0x580000 [0183.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0183.583] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.583] ReadFile (in: hFile=0x488, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x498ff14*=0x400, lpOverlapped=0x0) returned 1 [0183.601] GetProcessHeap () returned 0x580000 [0183.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.601] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.601] WriteFile (in: hFile=0x488, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x498ff14*=0x400, lpOverlapped=0x0) returned 1 [0183.601] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.601] WriteFile (in: hFile=0x488, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.602] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.602] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.602] CloseHandle (hObject=0x488) returned 1 [0183.602] GetProcessHeap () returned 0x580000 [0183.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0183.602] GetProcessHeap () returned 0x580000 [0183.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0183.602] GetProcessHeap () returned 0x580000 [0183.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa50cc060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x43f, dwReserved0=0x498fd28, dwReserved1=0x6c6a110, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0183.625] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.628] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", len=0x64 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned 1 [0183.628] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0183.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.629] CloseHandle (hObject=0x484) returned 1 [0183.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.629] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.id_1622540890_.your_last_chance")) returned 1 [0183.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b9770 [0183.630] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.630] GetProcessHeap () returned 0x580000 [0183.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x635768 [0183.630] GetProcessHeap () returned 0x580000 [0183.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x6f668d8 [0183.631] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.631] ReadFile (in: hFile=0x484, lpBuffer=0x635768, nNumberOfBytesToRead=0xc80, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x498ff14*=0xc80, lpOverlapped=0x0) returned 1 [0183.642] GetProcessHeap () returned 0x580000 [0183.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.642] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.642] WriteFile (in: hFile=0x484, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x498ff14*=0xc80, lpOverlapped=0x0) returned 1 [0183.643] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.643] WriteFile (in: hFile=0x484, lpBuffer=0x6f67557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67557*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.643] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.643] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.643] CloseHandle (hObject=0x484) returned 1 [0183.643] GetProcessHeap () returned 0x580000 [0183.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0183.643] GetProcessHeap () returned 0x580000 [0183.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0183.643] GetProcessHeap () returned 0x580000 [0183.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5118320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcba, dwReserved0=0x498fd28, dwReserved1=0x635768, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~2.YOU")) returned 0x5b9770 [0183.643] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.644] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", len=0x66 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned 1 [0183.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0183.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.645] CloseHandle (hObject=0x484) returned 1 [0183.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.id_1622540890_.your_last_chance")) returned 1 [0183.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x805, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSD~1.YOU")) returned 0x5b9770 [0183.646] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0183.646] GetProcessHeap () returned 0x580000 [0183.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6c79898 [0183.646] GetProcessHeap () returned 0x580000 [0183.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6d00cd8 [0183.646] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.646] ReadFile (in: hFile=0x484, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x498ff14*=0x800, lpOverlapped=0x0) returned 1 [0183.654] GetProcessHeap () returned 0x580000 [0183.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.654] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x484, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x498ff14*=0x800, lpOverlapped=0x0) returned 1 [0183.654] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x484, lpBuffer=0x6d014d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014d7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.654] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.654] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.655] CloseHandle (hObject=0x484) returned 1 [0183.655] GetProcessHeap () returned 0x580000 [0183.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0183.655] GetProcessHeap () returned 0x580000 [0183.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0183.655] GetProcessHeap () returned 0x580000 [0183.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa513e480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x498fd28, dwReserved1=0x6c79898, cFileName="FormsDoNotTrust.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSD~1.YOU")) returned 0x5b9770 [0183.655] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.382] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", len=0x69 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned 1 [0184.382] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0184.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.382] CloseHandle (hObject=0x49c) returned 1 [0185.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.id_1622540890_.your_last_chance")) returned 1 [0185.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b9770 [0185.383] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.384] GetProcessHeap () returned 0x580000 [0185.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0185.384] GetProcessHeap () returned 0x580000 [0185.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0185.384] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.384] ReadFile (in: hFile=0x49c, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x498ff14*=0x260, lpOverlapped=0x0) returned 1 [0185.387] GetProcessHeap () returned 0x580000 [0185.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.387] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.387] WriteFile (in: hFile=0x49c, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x498ff14*=0x260, lpOverlapped=0x0) returned 1 [0185.387] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.387] WriteFile (in: hFile=0x49c, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.388] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.388] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.388] CloseHandle (hObject=0x49c) returned 1 [0185.388] GetProcessHeap () returned 0x580000 [0185.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0185.388] GetProcessHeap () returned 0x580000 [0185.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0185.388] GetProcessHeap () returned 0x580000 [0185.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa61c1d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x498fd28, dwReserved1=0x6df2798, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b9770 [0185.536] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.584] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", len=0x52 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned 1 [0185.584] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0185.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.887] CloseHandle (hObject=0x478) returned 1 [0186.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHESSI~2.YOU")) returned 0x5b96b0 [0186.888] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.888] GetProcessHeap () returned 0x580000 [0186.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce54c0 [0186.888] GetProcessHeap () returned 0x580000 [0186.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce5e48 [0186.888] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.888] ReadFile (in: hFile=0x478, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x498ff14*=0x920, lpOverlapped=0x0) returned 1 [0186.897] GetProcessHeap () returned 0x580000 [0186.897] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf930 [0186.897] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.897] WriteFile (in: hFile=0x478, lpBuffer=0x6ce5e48*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5e48*, lpNumberOfBytesWritten=0x498ff14*=0x920, lpOverlapped=0x0) returned 1 [0186.897] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.898] WriteFile (in: hFile=0x478, lpBuffer=0x6ce6767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6767*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.898] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.898] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.898] CloseHandle (hObject=0x478) returned 1 [0186.898] GetProcessHeap () returned 0x580000 [0186.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5e48 | out: hHeap=0x580000) returned 1 [0186.898] GetProcessHeap () returned 0x580000 [0186.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0186.898] GetProcessHeap () returned 0x580000 [0186.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf930 | out: hHeap=0x580000) returned 1 [0186.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7030280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x498fd28, dwReserved1=0x6ce54c0, cFileName="ChessIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHESSI~2.YOU")) returned 0x5b96b0 [0186.898] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.937] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", len=0x5a | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned 1 [0186.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0186.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.455] CloseHandle (hObject=0x4a0) returned 1 [0188.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js.id_1622540890_.your_last_chance")) returned 1 [0188.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MENUSJ~1.YOU")) returned 0x5b9770 [0188.456] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.456] GetProcessHeap () returned 0x580000 [0188.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0188.456] GetProcessHeap () returned 0x580000 [0188.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6f668d8 [0188.457] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.457] ReadFile (in: hFile=0x4a0, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x498ff14*=0xca0, lpOverlapped=0x0) returned 1 [0188.468] GetProcessHeap () returned 0x580000 [0188.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.468] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.468] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x498ff14*=0xca0, lpOverlapped=0x0) returned 1 [0188.469] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.469] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f67577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67577*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.469] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.469] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.469] CloseHandle (hObject=0x4a0) returned 1 [0188.469] GetProcessHeap () returned 0x580000 [0188.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0188.469] GetProcessHeap () returned 0x580000 [0188.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0188.469] GetProcessHeap () returned 0x580000 [0188.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7f36d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcca, dwReserved0=0x498fd28, dwReserved1=0x635768, cFileName="MENUS.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MENUSJ~1.YOU")) returned 0x5b9770 [0191.400] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.602] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", len=0x44 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned 1 [0191.603] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0191.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0191.603] CloseHandle (hObject=0x440) returned 1 [0191.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x154f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~1.YOU")) returned 0x5b9770 [0191.604] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0191.604] GetProcessHeap () returned 0x580000 [0191.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1561) returned 0x6d035f8 [0191.604] GetProcessHeap () returned 0x580000 [0191.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1561) returned 0x6de8f50 [0191.605] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.605] ReadFile (in: hFile=0x440, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1540, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x498ff14*=0x1540, lpOverlapped=0x0) returned 1 [0191.665] GetProcessHeap () returned 0x580000 [0191.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0191.665] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.665] WriteFile (in: hFile=0x440, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1540, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x498ff14*=0x1540, lpOverlapped=0x0) returned 1 [0191.665] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.665] WriteFile (in: hFile=0x440, lpBuffer=0x6dea48f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea48f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.665] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.665] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.665] CloseHandle (hObject=0x440) returned 1 [0191.666] GetProcessHeap () returned 0x580000 [0191.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0191.666] GetProcessHeap () returned 0x580000 [0191.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0191.666] GetProcessHeap () returned 0x580000 [0191.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0191.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9db6740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1573, dwReserved0=0x498fd28, dwReserved1=0x6d035f8, cFileName="ZPDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~1.YOU")) returned 0x5b9770 [0191.666] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.680] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", len=0x45 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned 1 [0191.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0191.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0191.715] CloseHandle (hObject=0x448) returned 1 [0191.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD5C3~1.YOU")) returned 0x5b9770 [0191.716] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0191.717] GetProcessHeap () returned 0x580000 [0191.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f67710 [0191.717] GetProcessHeap () returned 0x580000 [0191.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f68818 [0191.717] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.717] ReadFile (in: hFile=0x448, lpBuffer=0x6f67710, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x498ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0191.790] GetProcessHeap () returned 0x580000 [0191.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0191.790] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x448, lpBuffer=0x6f68818*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68818*, lpNumberOfBytesWritten=0x498ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0191.790] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.790] WriteFile (in: hFile=0x448, lpBuffer=0x6f698b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f698b7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.790] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.791] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.791] CloseHandle (hObject=0x448) returned 1 [0192.558] GetProcessHeap () returned 0x580000 [0192.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68818 | out: hHeap=0x580000) returned 1 [0192.558] GetProcessHeap () returned 0x580000 [0192.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0192.558] GetProcessHeap () returned 0x580000 [0192.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0193.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9ee7240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10c7, dwReserved0=0x498fd28, dwReserved1=0x6f67710, cFileName="ZPDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPD5C3~1.YOU")) returned 0x5b97b0 [0193.418] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.459] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", len=0x66 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned 1 [0193.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0193.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.553] CloseHandle (hObject=0x39c) returned 1 [0193.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.id_1622540890_.your_last_chance")) returned 1 [0193.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b97f0 [0193.555] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.555] GetProcessHeap () returned 0x580000 [0193.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6f42f08 [0193.555] GetProcessHeap () returned 0x580000 [0193.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x667250 [0193.555] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.555] ReadFile (in: hFile=0x39c, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1920, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x498ff14*=0x1920, lpOverlapped=0x0) returned 1 [0193.634] GetProcessHeap () returned 0x580000 [0193.634] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.634] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.634] WriteFile (in: hFile=0x39c, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x498ff14*=0x1920, lpOverlapped=0x0) returned 1 [0193.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.635] WriteFile (in: hFile=0x39c, lpBuffer=0x668b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x668b6f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.635] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.635] CloseHandle (hObject=0x39c) returned 1 [0193.635] GetProcessHeap () returned 0x580000 [0193.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0193.635] GetProcessHeap () returned 0x580000 [0193.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0193.635] GetProcessHeap () returned 0x580000 [0193.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab075480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x498fd28, dwReserved1=0x6f42f08, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b97f0 [0193.635] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0195.180] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x76 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0195.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0195.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0195.180] CloseHandle (hObject=0x438) returned 1 [0195.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0196.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5c0077, dwReserved1=0x410054, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0196.407] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0196.407] GetProcessHeap () returned 0x580000 [0196.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0196.407] GetProcessHeap () returned 0x580000 [0196.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0196.407] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.407] ReadFile (in: hFile=0x438, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.409] GetProcessHeap () returned 0x580000 [0196.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.409] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x438, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x498ff14*=0xc0, lpOverlapped=0x0) returned 1 [0196.409] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x438, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.409] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.409] CloseHandle (hObject=0x438) returned 1 [0196.409] GetProcessHeap () returned 0x580000 [0196.409] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0196.409] GetProcessHeap () returned 0x580000 [0196.409] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0196.410] GetProcessHeap () returned 0x580000 [0196.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacaf0940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x498fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0198.954] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.963] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", len=0x44 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned 1 [0198.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0198.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0199.088] CloseHandle (hObject=0x488) returned 1 [0199.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR43~2.YOU")) returned 0x5b97f0 [0199.089] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0199.089] GetProcessHeap () returned 0x580000 [0199.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c10060 [0199.090] GetProcessHeap () returned 0x580000 [0199.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c10ae8 [0199.090] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.090] ReadFile (in: hFile=0x488, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x498ff14*=0xa40, lpOverlapped=0x0) returned 1 [0199.099] GetProcessHeap () returned 0x580000 [0199.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0199.099] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.099] WriteFile (in: hFile=0x488, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x498ff14*=0xa40, lpOverlapped=0x0) returned 1 [0199.100] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.100] WriteFile (in: hFile=0x488, lpBuffer=0x6c11527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11527*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.100] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.100] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.100] CloseHandle (hObject=0x488) returned 1 [0199.100] GetProcessHeap () returned 0x580000 [0199.100] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0199.100] GetProcessHeap () returned 0x580000 [0199.100] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0199.100] GetProcessHeap () returned 0x580000 [0199.100] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0199.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae4875c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x498fd28, dwReserved1=0x6c10060, cFileName="PDIR43F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR43~2.YOU")) returned 0x5b96b0 [0199.656] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.040] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", len=0x6f | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned 1 [0201.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0201.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.201] CloseHandle (hObject=0x170) returned 1 [0203.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0203.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e0066, dwReserved1=0x690067, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0203.202] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0203.202] GetProcessHeap () returned 0x580000 [0203.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0203.202] GetProcessHeap () returned 0x580000 [0203.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0203.202] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.202] ReadFile (in: hFile=0x170, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x498ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0203.205] GetProcessHeap () returned 0x580000 [0203.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.205] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.205] WriteFile (in: hFile=0x170, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x498ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0203.205] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.205] WriteFile (in: hFile=0x170, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.205] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.205] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.205] CloseHandle (hObject=0x170) returned 1 [0203.205] GetProcessHeap () returned 0x580000 [0203.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0203.205] GetProcessHeap () returned 0x580000 [0203.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0203.205] GetProcessHeap () returned 0x580000 [0203.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0203.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ba7f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x498fd28, dwReserved1=0x6f3ef20, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0203.206] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0204.766] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", len=0x6a | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned 1 [0204.766] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0204.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0206.873] CloseHandle (hObject=0x484) returned 1 [0206.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0206.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.id_1622540890_.your_last_chance")) returned 1 [0209.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="Country.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUNTR~1.YOU")) returned 0x5b9830 [0209.127] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.127] GetProcessHeap () returned 0x580000 [0209.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0209.127] GetProcessHeap () returned 0x580000 [0209.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0209.127] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.127] ReadFile (in: hFile=0x484, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x498ff14*=0x720, lpOverlapped=0x0) returned 1 [0209.135] GetProcessHeap () returned 0x580000 [0209.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.135] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.135] WriteFile (in: hFile=0x484, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x498ff14*=0x720, lpOverlapped=0x0) returned 1 [0209.135] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.135] WriteFile (in: hFile=0x484, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.136] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.136] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.136] CloseHandle (hObject=0x484) returned 1 [0209.136] GetProcessHeap () returned 0x580000 [0209.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0209.136] GetProcessHeap () returned 0x580000 [0209.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0209.136] GetProcessHeap () returned 0x580000 [0209.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0210.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4456b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x755, dwReserved0=0x498fd28, dwReserved1=0x6c4e820, cFileName="Country.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUNTR~1.YOU")) returned 0x5b97b0 [0210.088] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.122] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", len=0x6c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned 1 [0210.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0210.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0215.484] CloseHandle (hObject=0x484) returned 1 [0215.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.id_1622540890_.your_last_chance")) returned 1 [0215.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x660069, dwReserved1=0x69002e, cFileName="bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~3.YOU")) returned 0x5b97b0 [0215.485] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0215.485] GetProcessHeap () returned 0x580000 [0215.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0215.485] GetProcessHeap () returned 0x580000 [0215.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0215.485] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.485] ReadFile (in: hFile=0x484, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x498ff14*=0x400, lpOverlapped=0x0) returned 1 [0215.490] GetProcessHeap () returned 0x580000 [0215.490] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.490] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.490] WriteFile (in: hFile=0x484, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x498ff14*=0x400, lpOverlapped=0x0) returned 1 [0215.490] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.490] WriteFile (in: hFile=0x484, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.490] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.490] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.490] CloseHandle (hObject=0x484) returned 1 [0215.491] GetProcessHeap () returned 0x580000 [0215.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0215.491] GetProcessHeap () returned 0x580000 [0215.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0215.491] GetProcessHeap () returned 0x580000 [0215.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.573] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb80e3ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x498fd28, dwReserved1=0x6c6a110, cFileName="bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~3.YOU")) returned 0x5b9770 [0217.573] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.638] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", len=0x65 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned 1 [0217.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0217.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0220.992] CloseHandle (hObject=0x47c) returned 1 [0220.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0220.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.id_1622540890_.your_last_chance")) returned 1 [0220.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0220.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_SP~1.YOU")) returned 0x5b97f0 [0220.993] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0220.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0220.993] GetProcessHeap () returned 0x580000 [0220.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0220.993] GetProcessHeap () returned 0x580000 [0220.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0220.994] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.994] ReadFile (in: hFile=0x47c, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x498ff14*=0xa0, lpOverlapped=0x0) returned 1 [0220.995] GetProcessHeap () returned 0x580000 [0220.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0220.995] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.995] WriteFile (in: hFile=0x47c, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x498ff14*=0xa0, lpOverlapped=0x0) returned 1 [0220.995] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.995] WriteFile (in: hFile=0x47c, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.995] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.995] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.996] CloseHandle (hObject=0x47c) returned 1 [0220.996] GetProcessHeap () returned 0x580000 [0220.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0220.996] GetProcessHeap () returned 0x580000 [0220.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0220.996] GetProcessHeap () returned 0x580000 [0220.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb568040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x498fd28, dwReserved1=0x60e8a8, cFileName="rtf_spellcheck.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_SP~1.YOU")) returned 0x5b9730 [0221.904] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.961] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", len=0x89 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned 1 [0221.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0221.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0221.962] CloseHandle (hObject=0x45c) returned 1 [0221.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.962] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.id_1622540890_.your_last_chance")) returned 1 [0221.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PLUSGI~1.YOU")) returned 0x5b9730 [0221.963] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0221.963] GetProcessHeap () returned 0x580000 [0221.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.963] GetProcessHeap () returned 0x580000 [0221.963] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.963] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.963] ReadFile (in: hFile=0x45c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x498ff14*=0x340, lpOverlapped=0x0) returned 1 [0222.073] GetProcessHeap () returned 0x580000 [0222.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.073] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.073] WriteFile (in: hFile=0x45c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x498ff14*=0x340, lpOverlapped=0x0) returned 1 [0222.074] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.074] WriteFile (in: hFile=0x45c, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.074] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.074] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.074] CloseHandle (hObject=0x45c) returned 1 [0222.074] GetProcessHeap () returned 0x580000 [0222.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0222.074] GetProcessHeap () returned 0x580000 [0222.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0222.074] GetProcessHeap () returned 0x580000 [0222.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0223.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbfabf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36d, dwReserved0=0x498fd28, dwReserved1=0x6dcfb90, cFileName="PLUS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PLUSGI~1.YOU")) returned 0x5b96f0 [0223.460] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.483] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", len=0x64 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned 1 [0223.483] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0223.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0223.484] CloseHandle (hObject=0x494) returned 1 [0223.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.id_1622540890_.your_last_chance")) returned 1 [0223.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b96f0 [0223.486] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0223.486] GetProcessHeap () returned 0x580000 [0223.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0223.486] GetProcessHeap () returned 0x580000 [0223.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0223.486] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.486] ReadFile (in: hFile=0x494, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0226.948] GetProcessHeap () returned 0x580000 [0226.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0226.948] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.948] WriteFile (in: hFile=0x494, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0226.949] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.949] WriteFile (in: hFile=0x494, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.949] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.949] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.949] CloseHandle (hObject=0x494) returned 1 [0226.950] GetProcessHeap () returned 0x580000 [0226.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0226.950] GetProcessHeap () returned 0x580000 [0226.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0226.950] GetProcessHeap () returned 0x580000 [0226.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0230.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbec99e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x30098, dwReserved0=0x498fd28, dwReserved1=0x72f0208, cFileName="macroprogress.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MACROP~1.YOU")) returned 0x5b9630 [0230.350] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.460] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", len=0x35 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 1 [0230.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0230.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.461] CloseHandle (hObject=0x480) returned 1 [0230.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.id_1622540890_.your_last_chance")) returned 1 [0230.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWORD~1.YOU")) returned 0x5b9630 [0230.462] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msword.olb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0230.462] GetProcessHeap () returned 0x580000 [0230.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7496c38 [0230.463] GetProcessHeap () returned 0x580000 [0230.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74a8468 [0230.463] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.463] ReadFile (in: hFile=0x480, lpBuffer=0x7496c38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7496c38*, lpNumberOfBytesRead=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.325] GetProcessHeap () returned 0x580000 [0238.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0238.326] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.326] WriteFile (in: hFile=0x480, lpBuffer=0x74a8468*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x74a8468*, lpNumberOfBytesWritten=0x498ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.329] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.329] WriteFile (in: hFile=0x480, lpBuffer=0x74b9c67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x74b9c67*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.383] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.383] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.383] CloseHandle (hObject=0x480) returned 1 [0239.460] GetProcessHeap () returned 0x580000 [0239.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74a8468 | out: hHeap=0x580000) returned 1 [0239.461] GetProcessHeap () returned 0x580000 [0239.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7496c38 | out: hHeap=0x580000) returned 1 [0239.463] GetProcessHeap () returned 0x580000 [0239.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0240.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc63527a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdc17c, dwReserved0=0x498fd28, dwReserved1=0x580000, cFileName="MSWORD.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWORD~1.YOU")) returned 0x5b9730 [0240.794] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.821] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", len=0x53 | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned 1 [0240.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd8) returned 0x6dee6e0 [0240.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.903] CloseHandle (hObject=0x418) returned 1 [0240.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.id_1622540890_.your_last_chance")) returned 1 [0240.908] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~2.YOU")) returned 0x5b9730 [0240.909] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.909] GetProcessHeap () returned 0x580000 [0240.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60bb98 [0240.909] GetProcessHeap () returned 0x580000 [0240.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60bfe8 [0240.909] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.909] ReadFile (in: hFile=0x418, lpBuffer=0x60bb98, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60bb98*, lpNumberOfBytesRead=0x498ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0240.912] GetProcessHeap () returned 0x580000 [0240.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.912] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.912] WriteFile (in: hFile=0x418, lpBuffer=0x60bfe8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60bfe8*, lpNumberOfBytesWritten=0x498ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0240.912] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.912] WriteFile (in: hFile=0x418, lpBuffer=0x60c1c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x60c1c7*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.912] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.912] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.913] CloseHandle (hObject=0x418) returned 1 [0240.913] GetProcessHeap () returned 0x580000 [0240.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60bfe8 | out: hHeap=0x580000) returned 1 [0240.913] GetProcessHeap () returned 0x580000 [0240.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60bb98 | out: hHeap=0x580000) returned 1 [0240.913] GetProcessHeap () returned 0x580000 [0240.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc71e6e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x498fd28, dwReserved1=0x60bb98, cFileName="SendToOneNote-PipelineConfig.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~2.YOU")) returned 0x5b9630 [0241.850] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.868] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML", len=0x3f | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned 1 [0241.868] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0241.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0245.310] CloseHandle (hObject=0x468) returned 1 [0245.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml.id_1622540890_.your_last_chance")) returned 1 [0245.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa5500, ftCreationTime.dwHighDateTime=0x1ca1b39, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94fa5500, ftLastWriteTime.dwHighDateTime=0x1ca1b39, nFileSizeHigh=0x0, nFileSizeLow=0xe2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN01~2.YOU")) returned 0x5b96f0 [0245.311] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0245.311] GetProcessHeap () returned 0x580000 [0245.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe2e1) returned 0x6fe1d50 [0245.312] GetProcessHeap () returned 0x580000 [0245.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe2e1) returned 0x6ff0040 [0245.312] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.312] ReadFile (in: hFile=0x468, lpBuffer=0x6fe1d50, nNumberOfBytesToRead=0xe2c0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe1d50*, lpNumberOfBytesRead=0x498ff14*=0xe2c0, lpOverlapped=0x0) returned 1 [0248.205] GetProcessHeap () returned 0x580000 [0248.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0248.205] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.205] WriteFile (in: hFile=0x468, lpBuffer=0x6ff0040*, nNumberOfBytesToWrite=0xe2c0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff0040*, lpNumberOfBytesWritten=0x498ff14*=0xe2c0, lpOverlapped=0x0) returned 1 [0248.206] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.206] WriteFile (in: hFile=0x468, lpBuffer=0x6ffe2ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffe2ff*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.206] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.206] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.206] CloseHandle (hObject=0x468) returned 1 [0248.257] GetProcessHeap () returned 0x580000 [0248.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff0040 | out: hHeap=0x580000) returned 1 [0248.257] GetProcessHeap () returned 0x580000 [0248.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe1d50 | out: hHeap=0x580000) returned 1 [0248.257] GetProcessHeap () returned 0x580000 [0248.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0253.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa5500, ftCreationTime.dwHighDateTime=0x1ca1b39, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb761080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe2fc, dwReserved0=0x498fd28, dwReserved1=0x6fe1d50, cFileName="PGMN011.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN01~2.YOU")) returned 0x5b9730 [0253.272] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.369] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV", len=0x3c | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 1 [0253.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0253.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0253.370] CloseHandle (hObject=0x458) returned 1 [0253.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.id_1622540890_.your_last_chance")) returned 1 [0253.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xd2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BANNER~2.YOU")) returned 0x5b9730 [0253.371] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0253.371] GetProcessHeap () returned 0x580000 [0253.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd301) returned 0x7061928 [0253.371] GetProcessHeap () returned 0x580000 [0253.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd301) returned 0x7018958 [0253.371] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.372] ReadFile (in: hFile=0x458, lpBuffer=0x7061928, nNumberOfBytesToRead=0xd2e0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x498ff14*=0xd2e0, lpOverlapped=0x0) returned 1 [0257.225] GetProcessHeap () returned 0x580000 [0257.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0257.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.226] WriteFile (in: hFile=0x458, lpBuffer=0x7018958*, nNumberOfBytesToWrite=0xd2e0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesWritten=0x498ff14*=0xd2e0, lpOverlapped=0x0) returned 1 [0257.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.226] WriteFile (in: hFile=0x458, lpBuffer=0x7025c37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7025c37*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.226] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.227] CloseHandle (hObject=0x458) returned 1 [0257.823] GetProcessHeap () returned 0x580000 [0257.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0257.823] GetProcessHeap () returned 0x580000 [0257.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0257.823] GetProcessHeap () returned 0x580000 [0257.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0259.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fccc | out: lpFindFileData=0x498fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0d5eb40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd307, dwReserved0=0x498fd28, dwReserved1=0x7061928, cFileName="BANNER.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BANNER~2.YOU")) returned 0x5b9630 [0259.218] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.229] SysReAllocStringLen (in: pbstr=0x498ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC", len=0x3e | out: pbstr=0x498ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC") returned 1 [0259.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e4) returned 0x72e5948 [0259.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0261.157] CloseHandle (hObject=0x47c) returned 1 [0261.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0261.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc.id_1622540890_.your_last_chance")) returned 1 [0261.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x498ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0261.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x498fc74 | out: lpFindFileData=0x498fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f71a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43f71a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x2dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPULQT98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPULQT~1.YOU")) returned 0x5b9630 [0261.159] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0261.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0261.159] GetProcessHeap () returned 0x580000 [0261.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2de1) returned 0x7111f48 [0261.159] GetProcessHeap () returned 0x580000 [0261.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2de1) returned 0x679ae0 [0261.159] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.159] ReadFile (in: hFile=0x47c, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x2dc0, lpNumberOfBytesRead=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x498ff14*=0x2dc0, lpOverlapped=0x0) returned 1 [0261.206] GetProcessHeap () returned 0x580000 [0261.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0261.206] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.206] WriteFile (in: hFile=0x47c, lpBuffer=0x679ae0*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x679ae0*, lpNumberOfBytesWritten=0x498ff14*=0x2dc0, lpOverlapped=0x0) returned 1 [0261.206] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.206] WriteFile (in: hFile=0x47c, lpBuffer=0x67c89f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c89f*, lpNumberOfBytesWritten=0x498ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.207] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.207] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x498ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x498ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.207] CloseHandle (hObject=0x47c) returned 1 [0264.703] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x679ae0 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 Thread: id = 36 os_tid = 0xa88 [0039.065] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.409] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.725] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.755] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.054] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.345] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.390] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.829] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.860] Sleep (dwMilliseconds=0x1) [0042.915] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.001] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.139] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.358] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.404] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.482] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.514] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.699] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.043] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.604] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.869] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.916] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.072] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.228] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.337] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.384] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.462] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.540] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.653] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.055] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.133] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.289] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.601] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.679] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.726] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.835] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.913] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.224] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.333] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.458] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.973] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.082] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.441] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.550] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.174] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.330] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.377] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.533] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.642] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.845] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.110] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.193] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.266] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.594] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.921] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.077] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.171] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.746] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.027] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.058] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.526] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.916] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.072] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.384] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.696] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.743] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.977] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.008] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.164] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.211] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.367] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.476] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.788] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.835] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.944] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.256] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.459] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.892] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", len=0x50 | out: pbstr=0x4acff84*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 1 [0055.892] GetProcessHeap () returned 0x580000 [0055.892] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6152d0, Size=0x18) returned 0x5a58e8 [0055.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0056.022] CloseHandle (hObject=0x40c) returned 1 [0056.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.022] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id_1622540890_.your_last_chance")) returned 1 [0056.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.022] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b9630 [0056.022] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0056.023] GetProcessHeap () returned 0x580000 [0056.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c330a8 [0056.023] GetProcessHeap () returned 0x580000 [0056.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c448d8 [0056.024] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.024] ReadFile (in: hFile=0x40c, lpBuffer=0x6c330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c330a8*, lpNumberOfBytesRead=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.133] GetProcessHeap () returned 0x580000 [0058.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0058.134] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.134] WriteFile (in: hFile=0x40c, lpBuffer=0x6c448d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448d8*, lpNumberOfBytesWritten=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.134] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.134] WriteFile (in: hFile=0x40c, lpBuffer=0x6c560d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c560d7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0059.003] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.003] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0059.003] CloseHandle (hObject=0x40c) returned 1 [0059.952] GetProcessHeap () returned 0x580000 [0059.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c448d8 | out: hHeap=0x580000) returned 1 [0059.952] GetProcessHeap () returned 0x580000 [0059.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c330a8 | out: hHeap=0x580000) returned 1 [0059.952] GetProcessHeap () returned 0x580000 [0059.952] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0059.952] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b8989a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x263424, dwReserved0=0x4acfd28, dwReserved1=0x6c330a8, cFileName="PowerPointMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b96b0 [0059.952] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.800] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x4acff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0061.800] GetProcessHeap () returned 0x580000 [0061.800] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x40) returned 0x5b5bc8 [0061.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0066.760] CloseHandle (hObject=0x410) returned 1 [0066.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.760] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance")) returned 1 [0070.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0070.279] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0070.279] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0070.279] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0070.279] GetProcessHeap () returned 0x580000 [0070.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f04bb8 [0070.280] GetProcessHeap () returned 0x580000 [0070.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f05c88 [0070.280] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.280] ReadFile (in: hFile=0x474, lpBuffer=0x6f04bb8, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04bb8*, lpNumberOfBytesRead=0x4acff14*=0x10a0, lpOverlapped=0x0) returned 1 [0070.966] GetProcessHeap () returned 0x580000 [0070.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0070.966] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.966] WriteFile (in: hFile=0x474, lpBuffer=0x6f05c88*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f05c88*, lpNumberOfBytesWritten=0x4acff14*=0x10a0, lpOverlapped=0x0) returned 1 [0070.967] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.967] WriteFile (in: hFile=0x474, lpBuffer=0x6f06d27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06d27*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0070.967] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.967] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0070.967] CloseHandle (hObject=0x474) returned 1 [0072.697] GetProcessHeap () returned 0x580000 [0072.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f05c88 | out: hHeap=0x580000) returned 1 [0072.697] GetProcessHeap () returned 0x580000 [0072.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04bb8 | out: hHeap=0x580000) returned 1 [0072.697] GetProcessHeap () returned 0x580000 [0072.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0072.697] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x62070960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d6, dwReserved0=0x4acfd28, dwReserved1=0x6f04bb8, cFileName="Office32WW.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9770 [0072.697] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0073.539] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 1 [0073.539] GetProcessHeap () returned 0x580000 [0073.539] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x10) returned 0x5b5d08 [0073.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0074.459] CloseHandle (hObject=0x448) returned 1 [0074.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.460] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id_1622540890_.your_last_chance")) returned 1 [0074.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~1.YOU")) returned 0x5b9730 [0074.460] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0074.461] GetProcessHeap () returned 0x580000 [0074.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x624d18 [0074.461] GetProcessHeap () returned 0x580000 [0074.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c21878 [0074.462] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.462] ReadFile (in: hFile=0x448, lpBuffer=0x624d18, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x624d18*, lpNumberOfBytesRead=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.804] GetProcessHeap () returned 0x580000 [0077.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0077.805] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.805] WriteFile (in: hFile=0x448, lpBuffer=0x6c21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21878*, lpNumberOfBytesWritten=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0077.806] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0077.806] WriteFile (in: hFile=0x448, lpBuffer=0x6c33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c33077*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0078.391] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.391] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0078.391] CloseHandle (hObject=0x448) returned 1 [0079.035] GetProcessHeap () returned 0x580000 [0079.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21878 | out: hHeap=0x580000) returned 1 [0079.038] GetProcessHeap () returned 0x580000 [0079.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x624d18 | out: hHeap=0x580000) returned 1 [0079.038] GetProcessHeap () returned 0x580000 [0079.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0079.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66578760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x93f92, dwReserved0=0x580000, dwReserved1=0x6f03890, cFileName="CGMIMP32.FNT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~1.YOU")) returned 0x5b96f0 [0079.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.963] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", len=0x48 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 1 [0085.963] GetProcessHeap () returned 0x580000 [0085.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x9c) returned 0x614a48 [0085.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.963] Sleep (dwMilliseconds=0x1) [0085.979] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 1 [0085.979] GetProcessHeap () returned 0x580000 [0085.979] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x34) returned 0x614a48 [0085.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.485] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", len=0x4c | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 1 [0086.485] GetProcessHeap () returned 0x580000 [0086.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0086.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0086.497] CloseHandle (hObject=0x42c) returned 1 [0086.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0086.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.581] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0086.581] GetProcessHeap () returned 0x580000 [0086.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6f0c4f8 [0086.581] GetProcessHeap () returned 0x580000 [0086.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6c79138 [0086.581] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.581] ReadFile (in: hFile=0x42c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x4acff14*=0x600, lpOverlapped=0x0) returned 1 [0086.600] GetProcessHeap () returned 0x580000 [0086.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0086.600] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.600] WriteFile (in: hFile=0x42c, lpBuffer=0x6c79138*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79138*, lpNumberOfBytesWritten=0x4acff14*=0x600, lpOverlapped=0x0) returned 1 [0086.600] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.600] WriteFile (in: hFile=0x42c, lpBuffer=0x6c79737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79737*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0086.600] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.600] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0086.601] CloseHandle (hObject=0x42c) returned 1 [0087.190] GetProcessHeap () returned 0x580000 [0087.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79138 | out: hHeap=0x580000) returned 1 [0087.190] GetProcessHeap () returned 0x580000 [0087.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0087.190] GetProcessHeap () returned 0x580000 [0087.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0087.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b3b9aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x4acfd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.141] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.152] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", len=0x47 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 1 [0092.152] GetProcessHeap () returned 0x580000 [0092.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9fd0, Size=0x7c) returned 0x5f9d28 [0092.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0099.476] CloseHandle (hObject=0x43c) returned 1 [0099.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id_1622540890_.your_last_chance")) returned 1 [0099.514] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.514] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIXELE~1.YOU")) returned 0x5b9730 [0099.514] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0099.514] GetProcessHeap () returned 0x580000 [0099.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd101) returned 0x6cf3c18 [0099.514] GetProcessHeap () returned 0x580000 [0099.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd101) returned 0x6dfaac0 [0099.514] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.514] ReadFile (in: hFile=0x43c, lpBuffer=0x6cf3c18, nNumberOfBytesToRead=0xd0e0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf3c18*, lpNumberOfBytesRead=0x4acff14*=0xd0e0, lpOverlapped=0x0) returned 1 [0101.344] GetProcessHeap () returned 0x580000 [0101.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.345] WriteFile (in: hFile=0x43c, lpBuffer=0x6dfaac0*, nNumberOfBytesToWrite=0xd0e0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesWritten=0x4acff14*=0xd0e0, lpOverlapped=0x0) returned 1 [0101.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.345] WriteFile (in: hFile=0x43c, lpBuffer=0x6e07b9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6e07b9f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0101.345] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.345] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0101.345] CloseHandle (hObject=0x43c) returned 1 [0101.345] GetProcessHeap () returned 0x580000 [0101.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0101.345] GetProcessHeap () returned 0x580000 [0101.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf3c18 | out: hHeap=0x580000) returned 1 [0101.348] GetProcessHeap () returned 0x580000 [0101.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74050e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd109, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="PIXEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIXELE~1.YOU")) returned 0x5b96b0 [0101.843] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.667] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", len=0x37 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 1 [0109.667] GetProcessHeap () returned 0x580000 [0109.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4020, Size=0x38) returned 0x5b9730 [0109.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.707] Sleep (dwMilliseconds=0x1) [0109.716] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", len=0x33 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 1 [0109.716] GetProcessHeap () returned 0x580000 [0109.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0109.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.719] Sleep (dwMilliseconds=0x1) [0111.108] Sleep (dwMilliseconds=0x1) [0111.120] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.714] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", len=0x38 | out: pbstr=0x4acff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 1 [0111.714] GetProcessHeap () returned 0x580000 [0111.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.717] Sleep (dwMilliseconds=0x1) [0111.887] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", len=0x4e | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 1 [0111.887] GetProcessHeap () returned 0x580000 [0111.887] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.887] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.890] Sleep (dwMilliseconds=0x1) [0111.904] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", len=0x4e | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 1 [0111.904] GetProcessHeap () returned 0x580000 [0111.904] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0111.904] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.907] Sleep (dwMilliseconds=0x1) [0111.932] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", len=0x4d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned 1 [0111.932] GetProcessHeap () returned 0x580000 [0111.932] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.932] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.934] Sleep (dwMilliseconds=0x1) [0111.958] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", len=0x46 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned 1 [0111.958] GetProcessHeap () returned 0x580000 [0111.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b028, Size=0x6c) returned 0x6f1b2f8 [0111.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.958] Sleep (dwMilliseconds=0x1) [0111.968] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", len=0x4d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 1 [0111.968] GetProcessHeap () returned 0x580000 [0111.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1930, Size=0x4c) returned 0x5e1ae8 [0111.968] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.970] Sleep (dwMilliseconds=0x1) [0112.005] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", len=0x49 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 1 [0112.005] GetProcessHeap () returned 0x580000 [0112.005] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.008] Sleep (dwMilliseconds=0x1) [0112.058] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", len=0x44 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 1 [0112.058] GetProcessHeap () returned 0x580000 [0112.058] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.062] Sleep (dwMilliseconds=0x1) [0112.088] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", len=0x4b | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned 1 [0112.088] GetProcessHeap () returned 0x580000 [0112.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.089] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.090] Sleep (dwMilliseconds=0x1) [0112.119] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", len=0x59 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.120] GetProcessHeap () returned 0x580000 [0112.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x74) returned 0x5d6058 [0112.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.120] Sleep (dwMilliseconds=0x1) [0112.151] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", len=0x4a | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned 1 [0112.151] GetProcessHeap () returned 0x580000 [0112.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.152] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.154] Sleep (dwMilliseconds=0x1) [0112.168] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", len=0x57 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 1 [0112.168] GetProcessHeap () returned 0x580000 [0112.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.171] Sleep (dwMilliseconds=0x1) [0112.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.184] Sleep (dwMilliseconds=0x1) [0112.196] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.201] Sleep (dwMilliseconds=0x1) [0112.227] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 1 [0112.227] GetProcessHeap () returned 0x580000 [0112.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.227] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.228] Sleep (dwMilliseconds=0x1) [0112.243] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", len=0x55 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.243] GetProcessHeap () returned 0x580000 [0112.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.243] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.243] Sleep (dwMilliseconds=0x1) [0112.259] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", len=0x4d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned 1 [0112.259] GetProcessHeap () returned 0x580000 [0112.259] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.259] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.259] Sleep (dwMilliseconds=0x1) [0112.274] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", len=0x58 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.274] GetProcessHeap () returned 0x580000 [0112.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.274] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.274] Sleep (dwMilliseconds=0x1) [0112.290] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", len=0x4d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned 1 [0112.290] GetProcessHeap () returned 0x580000 [0112.290] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x4c) returned 0x5e1778 [0112.290] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.294] Sleep (dwMilliseconds=0x1) [0112.306] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", len=0x53 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 1 [0112.306] GetProcessHeap () returned 0x580000 [0112.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x74) returned 0x5d6058 [0112.306] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.309] Sleep (dwMilliseconds=0x1) [0112.321] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", len=0x5d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 1 [0112.321] GetProcessHeap () returned 0x580000 [0112.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.321] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.321] Sleep (dwMilliseconds=0x1) [0112.337] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.337] GetProcessHeap () returned 0x580000 [0112.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x30) returned 0x61f8b8 [0112.337] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.337] Sleep (dwMilliseconds=0x1) [0112.352] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", len=0x49 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png") returned 1 [0112.352] GetProcessHeap () returned 0x580000 [0112.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1afb0, Size=0x6c) returned 0x6f1b0a0 [0112.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.352] Sleep (dwMilliseconds=0x1) [0112.367] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", len=0x46 | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 1 [0112.367] GetProcessHeap () returned 0x580000 [0112.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.370] Sleep (dwMilliseconds=0x1) [0112.384] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", len=0x2d | out: pbstr=0x4acff84*="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned 1 [0112.384] GetProcessHeap () returned 0x580000 [0112.384] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9730 [0112.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.384] Sleep (dwMilliseconds=0x1) [0112.400] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", len=0x4d | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 1 [0112.400] GetProcessHeap () returned 0x580000 [0112.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0112.430] CloseHandle (hObject=0x45c) returned 1 [0112.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id_1622540890_.your_last_chance")) returned 1 [0112.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSJETX~1.YOU")) returned 0x5b9630 [0112.431] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0112.431] GetProcessHeap () returned 0x580000 [0112.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7141) returned 0x6c57108 [0112.432] GetProcessHeap () returned 0x580000 [0112.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7141) returned 0x6c5e258 [0112.432] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.432] ReadFile (in: hFile=0x45c, lpBuffer=0x6c57108, nNumberOfBytesToRead=0x7120, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x4acff14*=0x7120, lpOverlapped=0x0) returned 1 [0112.920] GetProcessHeap () returned 0x580000 [0112.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0112.920] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.920] WriteFile (in: hFile=0x45c, lpBuffer=0x6c5e258*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5e258*, lpNumberOfBytesWritten=0x4acff14*=0x7120, lpOverlapped=0x0) returned 1 [0112.921] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.921] WriteFile (in: hFile=0x45c, lpBuffer=0x6c65377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65377*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0112.921] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.921] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0112.921] CloseHandle (hObject=0x45c) returned 1 [0113.035] GetProcessHeap () returned 0x580000 [0113.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5e258 | out: hHeap=0x580000) returned 1 [0113.035] GetProcessHeap () returned 0x580000 [0113.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0113.035] GetProcessHeap () returned 0x580000 [0113.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0113.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7aeb4a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7152, dwReserved0=0x4acfd28, dwReserved1=0x6c57108, cFileName="msjet.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSJETX~1.YOU")) returned 0x5b9730 [0113.289] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.308] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", len=0x3f | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 1 [0113.308] GetProcessHeap () returned 0x580000 [0113.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x110) returned 0x6f0ceb8 [0113.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.406] CloseHandle (hObject=0x430) returned 1 [0113.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0426~1.YOU")) returned 0x5b9630 [0113.407] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0113.407] GetProcessHeap () returned 0x580000 [0113.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6f40f08 [0113.407] GetProcessHeap () returned 0x580000 [0113.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6e023d0 [0113.407] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.407] ReadFile (in: hFile=0x430, lpBuffer=0x6f40f08, nNumberOfBytesToRead=0x1e60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f40f08*, lpNumberOfBytesRead=0x4acff14*=0x1e60, lpOverlapped=0x0) returned 1 [0113.436] GetProcessHeap () returned 0x580000 [0113.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0113.436] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.436] WriteFile (in: hFile=0x430, lpBuffer=0x6e023d0*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023d0*, lpNumberOfBytesWritten=0x4acff14*=0x1e60, lpOverlapped=0x0) returned 1 [0113.436] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.436] WriteFile (in: hFile=0x430, lpBuffer=0x6e0422f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0422f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0113.436] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.436] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0113.436] CloseHandle (hObject=0x430) returned 1 [0113.436] GetProcessHeap () returned 0x580000 [0113.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023d0 | out: hHeap=0x580000) returned 1 [0113.436] GetProcessHeap () returned 0x580000 [0113.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f40f08 | out: hHeap=0x580000) returned 1 [0113.436] GetProcessHeap () returned 0x580000 [0113.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0113.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b39d7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ea0, dwReserved0=0x4acfd28, dwReserved1=0x6f40f08, cFileName="AN04267_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0426~1.YOU")) returned 0x5b9630 [0113.437] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0115.157] CloseHandle (hObject=0x42c) returned 1 [0115.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DD0103~1.YOU")) returned 0x5b9630 [0115.158] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0115.158] GetProcessHeap () returned 0x580000 [0115.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a01) returned 0x6c4a808 [0115.158] GetProcessHeap () returned 0x580000 [0115.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a01) returned 0x6c4e218 [0115.158] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.158] ReadFile (in: hFile=0x42c, lpBuffer=0x6c4a808, nNumberOfBytesToRead=0x39e0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesRead=0x4acff14*=0x39e0, lpOverlapped=0x0) returned 1 [0116.786] GetProcessHeap () returned 0x580000 [0116.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.786] WriteFile (in: hFile=0x42c, lpBuffer=0x6c4e218*, nNumberOfBytesToWrite=0x39e0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e218*, lpNumberOfBytesWritten=0x4acff14*=0x39e0, lpOverlapped=0x0) returned 1 [0116.786] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.787] WriteFile (in: hFile=0x42c, lpBuffer=0x6c51bf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c51bf7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0116.787] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.787] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0116.787] CloseHandle (hObject=0x42c) returned 1 [0116.787] GetProcessHeap () returned 0x580000 [0116.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e218 | out: hHeap=0x580000) returned 1 [0116.787] GetProcessHeap () returned 0x580000 [0116.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0116.787] GetProcessHeap () returned 0x580000 [0116.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d399f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a08, dwReserved0=0x4acfd28, dwReserved1=0x6c4a808, cFileName="DD01039_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DD0103~1.YOU")) returned 0x5b9630 [0117.996] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.608] CloseHandle (hObject=0x460) returned 1 [0118.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~1.YOU")) returned 0x5b9730 [0118.609] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.609] GetProcessHeap () returned 0x580000 [0118.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x6de0f50 [0118.609] GetProcessHeap () returned 0x580000 [0118.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x6de8ec0 [0118.609] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.610] ReadFile (in: hFile=0x460, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x7f40, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x4acff14*=0x7f40, lpOverlapped=0x0) returned 1 [0119.575] GetProcessHeap () returned 0x580000 [0119.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0119.575] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.575] WriteFile (in: hFile=0x460, lpBuffer=0x6de8ec0*, nNumberOfBytesToWrite=0x7f40, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8ec0*, lpNumberOfBytesWritten=0x4acff14*=0x7f40, lpOverlapped=0x0) returned 1 [0119.575] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.575] WriteFile (in: hFile=0x460, lpBuffer=0x6df0dff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6df0dff*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0119.575] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.575] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0119.575] CloseHandle (hObject=0x460) returned 1 [0119.777] GetProcessHeap () returned 0x580000 [0119.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8ec0 | out: hHeap=0x580000) returned 1 [0119.782] GetProcessHeap () returned 0x580000 [0119.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0119.782] GetProcessHeap () returned 0x580000 [0119.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee3b560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7f72, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="SO02790_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~1.YOU")) returned 0x5b96f0 [0120.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.157] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", len=0x4c | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 1 [0120.158] GetProcessHeap () returned 0x580000 [0120.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1784) returned 0x6d06ca8 [0120.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.766] CloseHandle (hObject=0x460) returned 1 [0120.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.767] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.id_1622540890_.your_last_chance")) returned 1 [0120.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02E00~1.YOU")) returned 0x5b9630 [0120.767] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.767] GetProcessHeap () returned 0x580000 [0120.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x6c65108 [0120.767] GetProcessHeap () returned 0x580000 [0120.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0120.768] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.768] ReadFile (in: hFile=0x460, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x4acff14*=0x420, lpOverlapped=0x0) returned 1 [0120.772] GetProcessHeap () returned 0x580000 [0120.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.773] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.773] WriteFile (in: hFile=0x460, lpBuffer=0x5cf780*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesWritten=0x4acff14*=0x420, lpOverlapped=0x0) returned 1 [0120.773] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.773] WriteFile (in: hFile=0x460, lpBuffer=0x5cfb9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfb9f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0120.773] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.773] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0120.773] CloseHandle (hObject=0x460) returned 1 [0120.773] GetProcessHeap () returned 0x580000 [0120.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0120.773] GetProcessHeap () returned 0x580000 [0120.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0120.773] GetProcessHeap () returned 0x580000 [0120.773] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f989de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x4acfd28, dwReserved1=0x6c65108, cFileName="J0143750.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02E00~1.YOU")) returned 0x5b9630 [0120.773] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.776] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", len=0x4b | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 1 [0120.776] GetProcessHeap () returned 0x580000 [0120.776] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1840) returned 0x6e00ac0 [0120.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.687] CloseHandle (hObject=0x484) returned 1 [0122.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.id_1622540890_.your_last_chance")) returned 1 [0122.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x45, dwReserved1=0x0, cFileName="Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERX~1.YOU")) returned 0x5b9730 [0122.688] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.688] GetProcessHeap () returned 0x580000 [0122.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.688] GetProcessHeap () returned 0x580000 [0122.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.688] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.688] ReadFile (in: hFile=0x484, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x4acff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.693] GetProcessHeap () returned 0x580000 [0122.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.693] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.693] WriteFile (in: hFile=0x484, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x4acff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.693] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.693] WriteFile (in: hFile=0x484, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0122.693] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.693] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0122.693] CloseHandle (hObject=0x484) returned 1 [0122.693] GetProcessHeap () returned 0x580000 [0122.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.693] GetProcessHeap () returned 0x580000 [0122.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.693] GetProcessHeap () returned 0x580000 [0122.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bd6700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x4acfd28, dwReserved1=0x678958, cFileName="Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERX~1.YOU")) returned 0x5b9730 [0124.641] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.693] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", len=0x4b | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned 1 [0124.693] GetProcessHeap () returned 0x580000 [0124.693] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d0) returned 0x6f42f08 [0124.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.716] CloseHandle (hObject=0x470) returned 1 [0124.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.id_1622540890_.your_last_chance")) returned 1 [0124.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x45, dwReserved1=0x0, cFileName="Austin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUSTIN~1.YOU")) returned 0x5b9730 [0124.717] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.717] GetProcessHeap () returned 0x580000 [0124.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.718] GetProcessHeap () returned 0x580000 [0124.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.718] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.718] ReadFile (in: hFile=0x470, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x4acff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.747] GetProcessHeap () returned 0x580000 [0124.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.747] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.747] WriteFile (in: hFile=0x470, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x4acff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.748] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.748] WriteFile (in: hFile=0x470, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0124.748] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.748] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0124.748] CloseHandle (hObject=0x470) returned 1 [0124.762] GetProcessHeap () returned 0x580000 [0124.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.762] GetProcessHeap () returned 0x580000 [0124.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.762] GetProcessHeap () returned 0x580000 [0124.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f79c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3a, dwReserved0=0x4acfd28, dwReserved1=0x6f69420, cFileName="Austin.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUSTIN~1.YOU")) returned 0x5b9730 [0125.341] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.359] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", len=0x3d | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned 1 [0125.359] GetProcessHeap () returned 0x580000 [0125.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c0) returned 0x6f42f08 [0125.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0128.875] CloseHandle (hObject=0x414) returned 1 [0128.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02977~1.YOU")) returned 0x5b9730 [0129.933] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0129.934] GetProcessHeap () returned 0x580000 [0129.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6d98c08 [0129.934] GetProcessHeap () returned 0x580000 [0129.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27c1) returned 0x6ef3008 [0129.934] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.934] ReadFile (in: hFile=0x414, lpBuffer=0x6d98c08, nNumberOfBytesToRead=0x27a0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98c08*, lpNumberOfBytesRead=0x4acff14*=0x27a0, lpOverlapped=0x0) returned 1 [0129.969] GetProcessHeap () returned 0x580000 [0129.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.969] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.969] WriteFile (in: hFile=0x414, lpBuffer=0x6ef3008*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesWritten=0x4acff14*=0x27a0, lpOverlapped=0x0) returned 1 [0129.969] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.969] WriteFile (in: hFile=0x414, lpBuffer=0x6ef57a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef57a7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0129.969] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.969] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0129.969] CloseHandle (hObject=0x414) returned 1 [0129.970] GetProcessHeap () returned 0x580000 [0129.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0129.970] GetProcessHeap () returned 0x580000 [0129.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d98c08 | out: hHeap=0x580000) returned 1 [0129.970] GetProcessHeap () returned 0x580000 [0129.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85150920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27de, dwReserved0=0x4acfd28, dwReserved1=0x6d98c08, cFileName="J0297749.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02977~1.YOU")) returned 0x5b9730 [0129.970] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0131.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0132.851] CloseHandle (hObject=0x438) returned 1 [0132.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0132.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~2.YOU")) returned 0x5b9730 [0132.852] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0132.852] GetProcessHeap () returned 0x580000 [0132.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0132.852] GetProcessHeap () returned 0x580000 [0132.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0132.852] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.853] ReadFile (in: hFile=0x438, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0132.854] GetProcessHeap () returned 0x580000 [0132.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.854] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.854] WriteFile (in: hFile=0x438, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0132.854] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.854] WriteFile (in: hFile=0x438, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0132.854] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.854] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0132.854] CloseHandle (hObject=0x438) returned 1 [0132.854] GetProcessHeap () returned 0x580000 [0132.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0132.854] GetProcessHeap () returned 0x580000 [0132.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0132.854] GetProcessHeap () returned 0x580000 [0132.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86cd6780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4acfd28, dwReserved1=0x61b540, cFileName="EXCEL.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~2.YOU")) returned 0x5b96f0 [0135.291] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.294] Sleep (dwMilliseconds=0x1) [0135.360] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned 1 [0135.360] GetProcessHeap () returned 0x580000 [0135.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0135.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0135.375] CloseHandle (hObject=0x440) returned 1 [0135.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae24200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ae24200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~1.YOU")) returned 0x5b96f0 [0135.376] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0135.376] GetProcessHeap () returned 0x580000 [0135.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6d7aa58 [0135.376] GetProcessHeap () returned 0x580000 [0135.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0135.376] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.376] ReadFile (in: hFile=0x440, lpBuffer=0x6d7aa58, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7aa58*, lpNumberOfBytesRead=0x4acff14*=0x340, lpOverlapped=0x0) returned 1 [0135.380] GetProcessHeap () returned 0x580000 [0135.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.380] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.380] WriteFile (in: hFile=0x440, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x4acff14*=0x340, lpOverlapped=0x0) returned 1 [0135.380] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.380] WriteFile (in: hFile=0x440, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0135.380] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.380] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0135.381] CloseHandle (hObject=0x440) returned 1 [0135.381] GetProcessHeap () returned 0x580000 [0135.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0135.381] GetProcessHeap () returned 0x580000 [0135.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7aa58 | out: hHeap=0x580000) returned 1 [0135.381] GetProcessHeap () returned 0x580000 [0135.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae24200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x884f0640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x4acfd28, dwReserved1=0x6d7aa58, cFileName="BD21338_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~1.YOU")) returned 0x5b96f0 [0135.381] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.393] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", len=0x4e | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned 1 [0135.393] GetProcessHeap () returned 0x580000 [0135.393] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0135.394] CloseHandle (hObject=0x458) returned 1 [0135.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.id_1622540890_.your_last_chance")) returned 1 [0135.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b96b0 [0135.395] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0135.395] GetProcessHeap () returned 0x580000 [0135.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6ef3008 [0135.395] GetProcessHeap () returned 0x580000 [0135.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6ef6c98 [0135.395] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.396] ReadFile (in: hFile=0x458, lpBuffer=0x6ef3008, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesRead=0x4acff14*=0x3c60, lpOverlapped=0x0) returned 1 [0136.776] GetProcessHeap () returned 0x580000 [0136.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0136.777] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.777] WriteFile (in: hFile=0x458, lpBuffer=0x6ef6c98*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef6c98*, lpNumberOfBytesWritten=0x4acff14*=0x3c60, lpOverlapped=0x0) returned 1 [0138.427] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.427] WriteFile (in: hFile=0x458, lpBuffer=0x6efa8f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6efa8f7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0138.437] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.437] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0138.437] CloseHandle (hObject=0x458) returned 1 [0138.437] GetProcessHeap () returned 0x580000 [0138.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef6c98 | out: hHeap=0x580000) returned 1 [0138.437] GetProcessHeap () returned 0x580000 [0138.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0138.437] GetProcessHeap () returned 0x580000 [0138.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0138.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c88, dwReserved0=0x4acfd28, dwReserved1=0x6ef3008, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b96b0 [0138.437] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.454] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned 1 [0138.454] GetProcessHeap () returned 0x580000 [0138.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0138.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.015] CloseHandle (hObject=0x170) returned 1 [0140.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30576c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x30576c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD024A~1.YOU")) returned 0x5b9770 [0140.016] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.016] GetProcessHeap () returned 0x580000 [0140.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60c7d8 [0140.016] GetProcessHeap () returned 0x580000 [0140.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60cba0 [0140.017] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.017] ReadFile (in: hFile=0x170, lpBuffer=0x60c7d8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x60c7d8*, lpNumberOfBytesRead=0x4acff14*=0x380, lpOverlapped=0x0) returned 1 [0140.021] GetProcessHeap () returned 0x580000 [0140.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.021] WriteFile (in: hFile=0x170, lpBuffer=0x60cba0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x60cba0*, lpNumberOfBytesWritten=0x4acff14*=0x380, lpOverlapped=0x0) returned 1 [0140.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.021] WriteFile (in: hFile=0x170, lpBuffer=0x60cf1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x60cf1f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0140.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.021] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0140.022] CloseHandle (hObject=0x170) returned 1 [0140.022] GetProcessHeap () returned 0x580000 [0140.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60cba0 | out: hHeap=0x580000) returned 1 [0140.022] GetProcessHeap () returned 0x580000 [0140.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c7d8 | out: hHeap=0x580000) returned 1 [0140.022] GetProcessHeap () returned 0x580000 [0140.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30576c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b11fea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x4acfd28, dwReserved1=0x60c7d8, cFileName="BD21324_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD024A~1.YOU")) returned 0x5b9770 [0140.407] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.446] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned 1 [0140.447] GetProcessHeap () returned 0x580000 [0140.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0140.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.481] CloseHandle (hObject=0x428) returned 1 [0140.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6d4a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1530~2.YOU")) returned 0x5b9770 [0140.482] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.482] GetProcessHeap () returned 0x580000 [0140.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dd8c38 [0140.482] GetProcessHeap () returned 0x580000 [0140.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0140.482] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.482] ReadFile (in: hFile=0x428, lpBuffer=0x6dd8c38, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8c38*, lpNumberOfBytesRead=0x4acff14*=0x2e0, lpOverlapped=0x0) returned 1 [0140.493] GetProcessHeap () returned 0x580000 [0140.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.493] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.493] WriteFile (in: hFile=0x428, lpBuffer=0x67c940*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesWritten=0x4acff14*=0x2e0, lpOverlapped=0x0) returned 1 [0140.493] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.493] WriteFile (in: hFile=0x428, lpBuffer=0x67cc1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x67cc1f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0140.493] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.493] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0140.493] CloseHandle (hObject=0x428) returned 1 [0140.493] GetProcessHeap () returned 0x580000 [0140.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0140.493] GetProcessHeap () returned 0x580000 [0140.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8c38 | out: hHeap=0x580000) returned 1 [0140.494] GetProcessHeap () returned 0x580000 [0140.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b5967e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x4acfd28, dwReserved1=0x6dd8c38, cFileName="BD15301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1530~2.YOU")) returned 0x5b9730 [0140.791] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.864] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK", len=0x42 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 1 [0140.864] GetProcessHeap () returned 0x580000 [0140.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0140.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.865] CloseHandle (hObject=0x448) returned 1 [0140.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~2.YOU")) returned 0x5b9730 [0140.866] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.866] GetProcessHeap () returned 0x580000 [0140.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.866] GetProcessHeap () returned 0x580000 [0140.866] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.866] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.866] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0140.867] GetProcessHeap () returned 0x580000 [0140.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.867] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.867] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0140.867] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.868] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0140.868] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.868] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0140.868] CloseHandle (hObject=0x448) returned 1 [0140.868] GetProcessHeap () returned 0x580000 [0140.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.868] GetProcessHeap () returned 0x580000 [0140.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.868] GetProcessHeap () returned 0x580000 [0140.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9288e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4acfd28, dwReserved1=0x61b540, cFileName="MSACCESS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~2.YOU")) returned 0x5b9730 [0140.868] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.923] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK", len=0x46 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 1 [0140.923] GetProcessHeap () returned 0x580000 [0140.923] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.924] CloseHandle (hObject=0x488) returned 1 [0140.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSA6F1~1.YOU")) returned 0x5b9730 [0140.925] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.925] GetProcessHeap () returned 0x580000 [0140.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.925] GetProcessHeap () returned 0x580000 [0140.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.925] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.925] ReadFile (in: hFile=0x488, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0140.927] GetProcessHeap () returned 0x580000 [0140.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.927] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.927] WriteFile (in: hFile=0x488, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4acff14*=0x60, lpOverlapped=0x0) returned 1 [0140.927] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.927] WriteFile (in: hFile=0x488, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0140.927] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.927] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0140.927] CloseHandle (hObject=0x488) returned 1 [0140.927] GetProcessHeap () returned 0x580000 [0140.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.927] GetProcessHeap () returned 0x580000 [0140.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.927] GetProcessHeap () returned 0x580000 [0140.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9c0e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4acfd28, dwReserved1=0x61b540, cFileName="MSACCESS.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSA6F1~1.YOU")) returned 0x5b9730 [0140.928] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.970] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD", len=0x38 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 1 [0140.970] GetProcessHeap () returned 0x580000 [0140.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.134] CloseHandle (hObject=0x4a4) returned 1 [0144.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id_1622540890_.your_last_chance")) returned 1 [0144.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b00b00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MOVEVR~1.YOU")) returned 0x5b96f0 [0144.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.135] GetProcessHeap () returned 0x580000 [0144.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x626d30 [0144.136] GetProcessHeap () returned 0x580000 [0144.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6272f8 [0144.136] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.136] ReadFile (in: hFile=0x4a4, lpBuffer=0x626d30, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x4acff14*=0x580, lpOverlapped=0x0) returned 1 [0144.246] GetProcessHeap () returned 0x580000 [0144.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.246] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.246] WriteFile (in: hFile=0x4a4, lpBuffer=0x6272f8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6272f8*, lpNumberOfBytesWritten=0x4acff14*=0x580, lpOverlapped=0x0) returned 1 [0144.246] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.246] WriteFile (in: hFile=0x4a4, lpBuffer=0x627877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x627877*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0144.246] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.246] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0144.247] CloseHandle (hObject=0x4a4) returned 1 [0144.247] GetProcessHeap () returned 0x580000 [0144.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6272f8 | out: hHeap=0x580000) returned 1 [0144.247] GetProcessHeap () returned 0x580000 [0144.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0144.247] GetProcessHeap () returned 0x580000 [0144.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8d971340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x4acfd28, dwReserved1=0x626d30, cFileName="MOVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MOVEVR~1.YOU")) returned 0x5b96f0 [0146.864] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.879] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned 1 [0146.879] GetProcessHeap () returned 0x580000 [0146.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0146.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.538] CloseHandle (hObject=0x448) returned 1 [0152.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR1F~1.YOU")) returned 0x5b9730 [0152.539] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.539] GetProcessHeap () returned 0x580000 [0152.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c29878 [0152.539] GetProcessHeap () returned 0x580000 [0152.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6ce2378 [0152.539] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.539] ReadFile (in: hFile=0x448, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x4acff14*=0xf60, lpOverlapped=0x0) returned 1 [0152.554] GetProcessHeap () returned 0x580000 [0152.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.554] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.554] WriteFile (in: hFile=0x448, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x4acff14*=0xf60, lpOverlapped=0x0) returned 1 [0152.554] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.555] WriteFile (in: hFile=0x448, lpBuffer=0x6ce32d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce32d7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0152.555] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.555] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0152.555] CloseHandle (hObject=0x448) returned 1 [0152.555] GetProcessHeap () returned 0x580000 [0152.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0152.555] GetProcessHeap () returned 0x580000 [0152.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0152.555] GetProcessHeap () returned 0x580000 [0152.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x928bd020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf91, dwReserved0=0x4acfd28, dwReserved1=0x6c29878, cFileName="PDIR1F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR1F~1.YOU")) returned 0x5b9730 [0153.739] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0153.754] CloseHandle (hObject=0x44c) returned 1 [0153.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.id_1622540890_.your_last_chance")) returned 1 [0153.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RPT2HT~1.YOU")) returned 0x5b9630 [0153.756] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0153.756] GetProcessHeap () returned 0x580000 [0153.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x104e1) returned 0x6fe7cd8 [0153.756] GetProcessHeap () returned 0x580000 [0153.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x104e1) returned 0x6ff81c8 [0153.757] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x44c, lpBuffer=0x6fe7cd8, nNumberOfBytesToRead=0x104c0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7cd8*, lpNumberOfBytesRead=0x4acff14*=0x104c0, lpOverlapped=0x0) returned 1 [0157.767] GetProcessHeap () returned 0x580000 [0157.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0157.768] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.768] WriteFile (in: hFile=0x44c, lpBuffer=0x6ff81c8*, nNumberOfBytesToWrite=0x104c0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff81c8*, lpNumberOfBytesWritten=0x4acff14*=0x104c0, lpOverlapped=0x0) returned 1 [0157.768] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.768] WriteFile (in: hFile=0x44c, lpBuffer=0x7008687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7008687*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0157.768] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.768] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0157.768] CloseHandle (hObject=0x44c) returned 1 [0157.768] GetProcessHeap () returned 0x580000 [0157.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff81c8 | out: hHeap=0x580000) returned 1 [0157.768] GetProcessHeap () returned 0x580000 [0157.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe7cd8 | out: hHeap=0x580000) returned 1 [0157.768] GetProcessHeap () returned 0x580000 [0157.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0157.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a6db60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x104ef, dwReserved0=0x4acfd28, dwReserved1=0x6fe7cd8, cFileName="RPT2HTM4.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RPT2HT~1.YOU")) returned 0x5b9630 [0157.769] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.263] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", len=0x44 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL") returned 1 [0159.263] GetProcessHeap () returned 0x580000 [0159.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0159.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0159.326] CloseHandle (hObject=0x440) returned 1 [0159.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GBXSLI~1.YOU")) returned 0x5b9630 [0159.328] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0159.328] GetProcessHeap () returned 0x580000 [0159.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x713f6a8 [0159.328] GetProcessHeap () returned 0x580000 [0159.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7150ed8 [0159.329] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.329] ReadFile (in: hFile=0x440, lpBuffer=0x713f6a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x713f6a8*, lpNumberOfBytesRead=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.016] GetProcessHeap () returned 0x580000 [0165.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0165.016] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.017] WriteFile (in: hFile=0x440, lpBuffer=0x7150ed8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7150ed8*, lpNumberOfBytesWritten=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.017] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.017] WriteFile (in: hFile=0x440, lpBuffer=0x71626d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x71626d7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0165.414] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.415] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0165.415] CloseHandle (hObject=0x440) returned 1 [0165.415] GetProcessHeap () returned 0x580000 [0165.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7150ed8 | out: hHeap=0x580000) returned 1 [0165.415] GetProcessHeap () returned 0x580000 [0165.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x713f6a8 | out: hHeap=0x580000) returned 1 [0165.415] GetProcessHeap () returned 0x580000 [0165.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0169.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a353d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x401ac, dwReserved0=0x4acfd28, dwReserved1=0x713f6a8, cFileName="GB.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GBXSLI~1.YOU")) returned 0x5b9730 [0169.274] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.281] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", len=0x36 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 1 [0169.281] GetProcessHeap () returned 0x580000 [0169.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0169.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.283] CloseHandle (hObject=0x450) returned 1 [0169.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.283] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.id_1622540890_.your_last_chance")) returned 1 [0169.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXLIRM~1.YOU")) returned 0x5b9730 [0169.284] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0169.284] GetProcessHeap () returned 0x580000 [0169.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0169.284] GetProcessHeap () returned 0x580000 [0169.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0169.285] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.285] ReadFile (in: hFile=0x450, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.706] GetProcessHeap () returned 0x580000 [0173.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.707] WriteFile (in: hFile=0x450, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.707] WriteFile (in: hFile=0x450, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0173.707] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.708] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0173.708] CloseHandle (hObject=0x450) returned 1 [0173.708] GetProcessHeap () returned 0x580000 [0173.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0173.708] GetProcessHeap () returned 0x580000 [0173.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0173.708] GetProcessHeap () returned 0x580000 [0173.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0176.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f253740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13598, dwReserved0=0x4acfd28, dwReserved1=0x6e063d0, cFileName="EXLIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXLIRM~1.YOU")) returned 0x5b96f0 [0176.710] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.749] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", len=0x47 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned 1 [0176.749] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0176.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0176.749] CloseHandle (hObject=0x470) returned 1 [0176.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.id_1622540890_.your_last_chance")) returned 1 [0176.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANWAV~1.YOU")) returned 0x5b96f0 [0176.750] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0176.751] GetProcessHeap () returned 0x580000 [0176.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc901) returned 0x6f58108 [0176.751] GetProcessHeap () returned 0x580000 [0176.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc901) returned 0x707ec98 [0176.751] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.751] ReadFile (in: hFile=0x470, lpBuffer=0x6f58108, nNumberOfBytesToRead=0xc8e0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x4acff14*=0xc8e0, lpOverlapped=0x0) returned 1 [0178.441] GetProcessHeap () returned 0x580000 [0178.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0178.442] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.442] WriteFile (in: hFile=0x470, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0xc8e0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x4acff14*=0xc8e0, lpOverlapped=0x0) returned 1 [0178.442] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.442] WriteFile (in: hFile=0x470, lpBuffer=0x708b577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x708b577*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0178.442] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.442] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0178.442] CloseHandle (hObject=0x470) returned 1 [0178.442] GetProcessHeap () returned 0x580000 [0178.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0178.443] GetProcessHeap () returned 0x580000 [0178.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0178.443] GetProcessHeap () returned 0x580000 [0178.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1f8d940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc920, dwReserved0=0x4acfd28, dwReserved1=0x6f58108, cFileName="CAN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANWAV~1.YOU")) returned 0x5b96f0 [0180.036] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.051] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", len=0x51 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned 1 [0180.051] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0180.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.058] CloseHandle (hObject=0x3fc) returned 1 [0180.087] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1995, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~1.YOU")) returned 0x5b96b0 [0180.088] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.088] GetProcessHeap () returned 0x580000 [0180.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x6f42f08 [0180.089] GetProcessHeap () returned 0x580000 [0180.089] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x667250 [0180.089] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.089] ReadFile (in: hFile=0x3fc, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1980, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x4acff14*=0x1980, lpOverlapped=0x0) returned 1 [0180.135] GetProcessHeap () returned 0x580000 [0180.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0180.135] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.135] WriteFile (in: hFile=0x3fc, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x4acff14*=0x1980, lpOverlapped=0x0) returned 1 [0180.136] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.136] WriteFile (in: hFile=0x3fc, lpBuffer=0x668bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x668bcf*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0180.136] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.136] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0180.136] CloseHandle (hObject=0x3fc) returned 1 [0180.136] GetProcessHeap () returned 0x580000 [0180.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0180.136] GetProcessHeap () returned 0x580000 [0180.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0180.136] GetProcessHeap () returned 0x580000 [0180.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2fc4f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19b9, dwReserved0=0x4acfd28, dwReserved1=0x6f42f08, cFileName="WebToolImages16x16.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~1.YOU")) returned 0x5b96b0 [0180.136] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.187] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", len=0x54 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned 1 [0180.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0180.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0180.188] CloseHandle (hObject=0x480) returned 1 [0180.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8862c100, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x1538, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~3.YOU")) returned 0x5b9770 [0180.189] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0180.189] GetProcessHeap () returned 0x580000 [0180.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6efb008 [0180.189] GetProcessHeap () returned 0x580000 [0180.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1541) returned 0x6f19958 [0180.189] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.189] ReadFile (in: hFile=0x480, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1520, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x4acff14*=0x1520, lpOverlapped=0x0) returned 1 [0181.244] GetProcessHeap () returned 0x580000 [0181.244] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.244] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x480, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x4acff14*=0x1520, lpOverlapped=0x0) returned 1 [0181.244] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x480, lpBuffer=0x6f1ae77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ae77*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0181.244] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.244] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0181.244] CloseHandle (hObject=0x480) returned 1 [0181.244] GetProcessHeap () returned 0x580000 [0181.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0181.245] GetProcessHeap () returned 0x580000 [0181.245] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0181.245] GetProcessHeap () returned 0x580000 [0181.245] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a550c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x155c, dwReserved0=0x4acfd28, dwReserved1=0x6efb008, cFileName="WebToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~3.YOU")) returned 0x5b9770 [0182.670] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.689] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", len=0x54 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned 1 [0182.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0182.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.724] CloseHandle (hObject=0x488) returned 1 [0182.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~1.YOU")) returned 0x5b9770 [0182.725] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.725] GetProcessHeap () returned 0x580000 [0182.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x706ecb0 [0182.725] GetProcessHeap () returned 0x580000 [0182.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1641) returned 0x70703b8 [0182.725] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.725] ReadFile (in: hFile=0x488, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x1620, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x4acff14*=0x1620, lpOverlapped=0x0) returned 1 [0182.745] GetProcessHeap () returned 0x580000 [0182.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.746] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.746] WriteFile (in: hFile=0x488, lpBuffer=0x70703b8*, nNumberOfBytesToWrite=0x1620, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x70703b8*, lpNumberOfBytesWritten=0x4acff14*=0x1620, lpOverlapped=0x0) returned 1 [0182.746] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.746] WriteFile (in: hFile=0x488, lpBuffer=0x70719d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x70719d7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0182.746] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.746] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0182.746] CloseHandle (hObject=0x488) returned 1 [0182.746] GetProcessHeap () returned 0x580000 [0182.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70703b8 | out: hHeap=0x580000) returned 1 [0182.746] GetProcessHeap () returned 0x580000 [0182.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0182.746] GetProcessHeap () returned 0x580000 [0182.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa489d4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x165c, dwReserved0=0x4acfd28, dwReserved1=0x706ecb0, cFileName="Shared24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~1.YOU")) returned 0x5b9770 [0183.802] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.815] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", len=0x6c | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned 1 [0183.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0183.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0185.015] CloseHandle (hObject=0x448) returned 1 [0185.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x139a, dwReserved0=0x470050, dwReserved1=0x69002e, cFileName="IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IMAGEJ~1.YOU")) returned 0x5b96b0 [0186.062] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0186.062] GetProcessHeap () returned 0x580000 [0186.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x6c9a390 [0186.062] GetProcessHeap () returned 0x580000 [0186.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x6c9b798 [0186.063] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.063] ReadFile (in: hFile=0x448, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x4acff14*=0x1380, lpOverlapped=0x0) returned 1 [0186.080] GetProcessHeap () returned 0x580000 [0186.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.080] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x448, lpBuffer=0x6c9b798*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b798*, lpNumberOfBytesWritten=0x4acff14*=0x1380, lpOverlapped=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x448, lpBuffer=0x6c9cb17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9cb17*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0186.080] CloseHandle (hObject=0x448) returned 1 [0186.081] GetProcessHeap () returned 0x580000 [0186.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b798 | out: hHeap=0x580000) returned 1 [0186.081] GetProcessHeap () returned 0x580000 [0186.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0186.081] GetProcessHeap () returned 0x580000 [0186.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6873b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13be, dwReserved0=0x4acfd28, dwReserved1=0x6c9a390, cFileName="IMAGE.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IMAGEJ~1.YOU")) returned 0x5b96b0 [0186.081] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.125] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", len=0x69 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js") returned 1 [0186.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0186.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0186.126] CloseHandle (hObject=0x43c) returned 1 [0186.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.id_1622540890_.your_last_chance")) returned 1 [0186.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWSE~1.YOU")) returned 0x5b96b0 [0186.130] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0186.130] GetProcessHeap () returned 0x580000 [0186.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0186.130] GetProcessHeap () returned 0x580000 [0186.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0186.130] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.130] ReadFile (in: hFile=0x43c, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x4acff14*=0xc0, lpOverlapped=0x0) returned 1 [0186.132] GetProcessHeap () returned 0x580000 [0186.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.132] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x43c, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x4acff14*=0xc0, lpOverlapped=0x0) returned 1 [0186.132] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x43c, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0186.132] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.132] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0186.132] CloseHandle (hObject=0x43c) returned 1 [0186.132] GetProcessHeap () returned 0x580000 [0186.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0186.132] GetProcessHeap () returned 0x580000 [0186.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0186.132] GetProcessHeap () returned 0x580000 [0186.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa68e5f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x4acfd28, dwReserved1=0x5ad8a0, cFileName="viewSelectionChanged.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWSE~1.YOU")) returned 0x5b96b0 [0186.132] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.171] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", len=0x67 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned 1 [0186.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0186.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0186.172] CloseHandle (hObject=0x4ac) returned 1 [0186.172] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b96b0 [0186.173] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0186.173] GetProcessHeap () returned 0x580000 [0186.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0186.173] GetProcessHeap () returned 0x580000 [0186.173] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6f668d8 [0186.173] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.173] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4acff14*=0xd60, lpOverlapped=0x0) returned 1 [0186.186] GetProcessHeap () returned 0x580000 [0186.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.186] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x4acff14*=0xd60, lpOverlapped=0x0) returned 1 [0186.186] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f67637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67637*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0186.186] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.186] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0186.186] CloseHandle (hObject=0x4ac) returned 1 [0186.186] GetProcessHeap () returned 0x580000 [0186.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0186.186] GetProcessHeap () returned 0x580000 [0186.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0186.186] GetProcessHeap () returned 0x580000 [0186.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0187.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6958340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x4acfd28, dwReserved1=0x635768, cFileName="ViewHeaderPreview.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWHE~1.YOU")) returned 0x5b9770 [0188.057] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.283] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned 1 [0193.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2064) returned 0x6f14048 [0193.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.284] CloseHandle (hObject=0x438) returned 1 [0193.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.id_1622540890_.your_last_chance")) returned 1 [0193.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9770 [0193.285] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.285] GetProcessHeap () returned 0x580000 [0193.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6dcd1d0 [0193.285] GetProcessHeap () returned 0x580000 [0193.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6c676b8 [0193.285] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.285] ReadFile (in: hFile=0x438, lpBuffer=0x6dcd1d0, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesRead=0x4acff14*=0x840, lpOverlapped=0x0) returned 1 [0193.402] GetProcessHeap () returned 0x580000 [0193.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.402] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.402] WriteFile (in: hFile=0x438, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x4acff14*=0x840, lpOverlapped=0x0) returned 1 [0193.402] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.402] WriteFile (in: hFile=0x438, lpBuffer=0x6c67ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67ef7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0193.402] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.403] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0193.403] CloseHandle (hObject=0x438) returned 1 [0193.403] GetProcessHeap () returned 0x580000 [0193.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0193.403] GetProcessHeap () returned 0x580000 [0193.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0193.403] GetProcessHeap () returned 0x580000 [0193.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaae39fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x874, dwReserved0=0x4acfd28, dwReserved1=0x6dcd1d0, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b97b0 [0193.417] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.448] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", len=0x67 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned 1 [0193.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0193.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.448] CloseHandle (hObject=0x4a4) returned 1 [0193.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.id_1622540890_.your_last_chance")) returned 1 [0193.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU0357~1.YOU")) returned 0x5b97b0 [0193.450] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.450] GetProcessHeap () returned 0x580000 [0193.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0193.450] GetProcessHeap () returned 0x580000 [0193.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0193.450] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.450] ReadFile (in: hFile=0x4a4, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x4acff14*=0x160, lpOverlapped=0x0) returned 1 [0193.452] GetProcessHeap () returned 0x580000 [0193.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.452] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.452] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x4acff14*=0x160, lpOverlapped=0x0) returned 1 [0193.452] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.452] WriteFile (in: hFile=0x4a4, lpBuffer=0x5b8f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f4f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0193.452] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.452] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0193.452] CloseHandle (hObject=0x4a4) returned 1 [0193.452] GetProcessHeap () returned 0x580000 [0193.452] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0193.453] GetProcessHeap () returned 0x580000 [0193.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0193.453] GetProcessHeap () returned 0x580000 [0193.453] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaeac400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x4acfd28, dwReserved1=0x65f0b0, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU0357~1.YOU")) returned 0x5b97b0 [0193.453] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.784] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", len=0x60 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned 1 [0193.784] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0193.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.784] CloseHandle (hObject=0x468) returned 1 [0193.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.784] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.id_1622540890_.your_last_chance")) returned 1 [0193.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b97f0 [0193.785] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.786] GetProcessHeap () returned 0x580000 [0193.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6efb008 [0193.786] GetProcessHeap () returned 0x580000 [0193.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x6f19958 [0193.786] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.786] ReadFile (in: hFile=0x468, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x4acff14*=0x1320, lpOverlapped=0x0) returned 1 [0193.865] GetProcessHeap () returned 0x580000 [0193.865] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.865] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x468, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x4acff14*=0x1320, lpOverlapped=0x0) returned 1 [0193.865] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x468, lpBuffer=0x6f1ac77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ac77*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0193.865] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.865] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0193.865] CloseHandle (hObject=0x468) returned 1 [0193.865] GetProcessHeap () returned 0x580000 [0193.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0193.865] GetProcessHeap () returned 0x580000 [0193.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0193.865] GetProcessHeap () returned 0x580000 [0193.865] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab2b0920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x134e, dwReserved0=0x4acfd28, dwReserved1=0x6efb008, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b97f0 [0193.866] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.919] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", len=0x69 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned 1 [0193.919] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0193.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.920] CloseHandle (hObject=0x4b0) returned 1 [0193.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0193.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b97f0 [0193.921] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.921] GetProcessHeap () returned 0x580000 [0193.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce54c0 [0193.921] GetProcessHeap () returned 0x580000 [0193.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce5e48 [0193.921] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.921] ReadFile (in: hFile=0x4b0, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x4acff14*=0x920, lpOverlapped=0x0) returned 1 [0193.946] GetProcessHeap () returned 0x580000 [0193.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.946] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.946] WriteFile (in: hFile=0x4b0, lpBuffer=0x6ce5e48*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5e48*, lpNumberOfBytesWritten=0x4acff14*=0x920, lpOverlapped=0x0) returned 1 [0193.946] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.946] WriteFile (in: hFile=0x4b0, lpBuffer=0x6ce6767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6767*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0193.946] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.947] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0193.947] CloseHandle (hObject=0x4b0) returned 1 [0193.947] GetProcessHeap () returned 0x580000 [0193.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5e48 | out: hHeap=0x580000) returned 1 [0193.947] GetProcessHeap () returned 0x580000 [0193.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0193.947] GetProcessHeap () returned 0x580000 [0193.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab36f000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x4acfd28, dwReserved1=0x6ce54c0, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~1.YOU")) returned 0x5b97f0 [0193.947] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0195.349] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x76 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0195.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0195.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.581] CloseHandle (hObject=0x4a0) returned 1 [0196.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0196.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x5c0077, dwReserved1=0x450048, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0196.582] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.582] GetProcessHeap () returned 0x580000 [0196.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0196.583] GetProcessHeap () returned 0x580000 [0196.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0196.583] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.583] ReadFile (in: hFile=0x4a0, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x4acff14*=0x160, lpOverlapped=0x0) returned 1 [0196.585] GetProcessHeap () returned 0x580000 [0196.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.585] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.585] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x4acff14*=0x160, lpOverlapped=0x0) returned 1 [0196.585] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.585] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b8f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f4f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0196.585] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.585] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0196.585] CloseHandle (hObject=0x4a0) returned 1 [0196.585] GetProcessHeap () returned 0x580000 [0196.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0196.585] GetProcessHeap () returned 0x580000 [0196.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0196.585] GetProcessHeap () returned 0x580000 [0196.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacc93860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x4acfd28, dwReserved1=0x65f0b0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0199.129] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.139] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", len=0x43 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned 1 [0199.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0199.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0199.263] CloseHandle (hObject=0x3a8) returned 1 [0199.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.264] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4647, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR3F~1.YOU")) returned 0x5b97b0 [0199.264] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0199.264] GetProcessHeap () returned 0x580000 [0199.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4661) returned 0x6d06ca8 [0199.264] GetProcessHeap () returned 0x580000 [0199.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4661) returned 0x715c008 [0199.264] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.264] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x4640, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x4acff14*=0x4640, lpOverlapped=0x0) returned 1 [0199.972] GetProcessHeap () returned 0x580000 [0199.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0199.972] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.972] WriteFile (in: hFile=0x3a8, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x4640, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x4acff14*=0x4640, lpOverlapped=0x0) returned 1 [0199.973] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.973] WriteFile (in: hFile=0x3a8, lpBuffer=0x7160647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7160647*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0199.973] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.973] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0199.973] CloseHandle (hObject=0x3a8) returned 1 [0199.973] GetProcessHeap () returned 0x580000 [0199.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0199.973] GetProcessHeap () returned 0x580000 [0199.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0199.973] GetProcessHeap () returned 0x580000 [0199.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaecdc2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x466b, dwReserved0=0x4acfd28, dwReserved1=0x6d06ca8, cFileName="PDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR3F~1.YOU")) returned 0x5b9770 [0201.042] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.861] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", len=0x6d | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned 1 [0201.862] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0201.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.862] CloseHandle (hObject=0x450) returned 1 [0201.862] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance")) returned 1 [0201.863] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x730063, dwReserved1=0x2e0073, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0201.863] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.863] GetProcessHeap () returned 0x580000 [0201.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6599e8 [0201.864] GetProcessHeap () returned 0x580000 [0201.864] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x659db0 [0201.864] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.864] ReadFile (in: hFile=0x450, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x4acff14*=0x380, lpOverlapped=0x0) returned 1 [0201.868] GetProcessHeap () returned 0x580000 [0201.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.868] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.869] WriteFile (in: hFile=0x450, lpBuffer=0x659db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x659db0*, lpNumberOfBytesWritten=0x4acff14*=0x380, lpOverlapped=0x0) returned 1 [0201.869] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.869] WriteFile (in: hFile=0x450, lpBuffer=0x65a12f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x65a12f*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0201.869] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.869] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0201.869] CloseHandle (hObject=0x450) returned 1 [0201.869] GetProcessHeap () returned 0x580000 [0201.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659db0 | out: hHeap=0x580000) returned 1 [0201.869] GetProcessHeap () returned 0x580000 [0201.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0201.869] GetProcessHeap () returned 0x580000 [0201.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaff02a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x4acfd28, dwReserved1=0x6599e8, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0201.870] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.884] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x6f | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0201.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0201.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0201.887] CloseHandle (hObject=0x43c) returned 1 [0201.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e004e, dwReserved1=0x490047, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.895] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0201.895] GetProcessHeap () returned 0x580000 [0201.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0201.895] GetProcessHeap () returned 0x580000 [0201.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0201.895] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.895] ReadFile (in: hFile=0x43c, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x4acff14*=0x400, lpOverlapped=0x0) returned 1 [0201.901] GetProcessHeap () returned 0x580000 [0201.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.901] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.901] WriteFile (in: hFile=0x43c, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x4acff14*=0x400, lpOverlapped=0x0) returned 1 [0201.901] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.901] WriteFile (in: hFile=0x43c, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0201.901] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.901] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0201.901] CloseHandle (hObject=0x43c) returned 1 [0201.901] GetProcessHeap () returned 0x580000 [0201.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0201.901] GetProcessHeap () returned 0x580000 [0201.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0201.901] GetProcessHeap () returned 0x580000 [0201.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaff4ed40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x4acfd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.902] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.098] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", len=0x5d | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned 1 [0203.098] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0203.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0206.592] CloseHandle (hObject=0x3a8) returned 1 [0206.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0206.592] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.id_1622540890_.your_last_chance")) returned 1 [0209.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b9830 [0209.137] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0209.137] GetProcessHeap () returned 0x580000 [0209.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0209.137] GetProcessHeap () returned 0x580000 [0209.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0209.137] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.138] ReadFile (in: hFile=0x3a8, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x4acff14*=0x260, lpOverlapped=0x0) returned 1 [0209.141] GetProcessHeap () returned 0x580000 [0209.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.141] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.141] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x4acff14*=0x260, lpOverlapped=0x0) returned 1 [0209.141] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.141] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0209.142] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.142] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0209.142] CloseHandle (hObject=0x3a8) returned 1 [0209.142] GetProcessHeap () returned 0x580000 [0209.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0209.142] GetProcessHeap () returned 0x580000 [0209.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0209.142] GetProcessHeap () returned 0x580000 [0209.142] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0210.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4456b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x4acfd28, dwReserved1=0x6c61120, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b97b0 [0210.088] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.122] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", len=0x6c | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned 1 [0210.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0210.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.452] CloseHandle (hObject=0x43c) returned 1 [0215.452] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance")) returned 1 [0215.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x660069, dwReserved1=0x69002e, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b97b0 [0215.453] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.454] GetProcessHeap () returned 0x580000 [0215.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x715fd78 [0215.454] GetProcessHeap () returned 0x580000 [0215.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x7111f48 [0215.454] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.454] ReadFile (in: hFile=0x43c, lpBuffer=0x715fd78, nNumberOfBytesToRead=0x4ea0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x715fd78*, lpNumberOfBytesRead=0x4acff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0216.616] GetProcessHeap () returned 0x580000 [0216.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0216.616] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.616] WriteFile (in: hFile=0x43c, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x4ea0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x4acff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0216.617] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x43c, lpBuffer=0x7116de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7116de7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0216.617] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.617] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0216.617] CloseHandle (hObject=0x43c) returned 1 [0216.872] GetProcessHeap () returned 0x580000 [0216.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0216.872] GetProcessHeap () returned 0x580000 [0216.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715fd78 | out: hHeap=0x580000) returned 1 [0216.872] GetProcessHeap () returned 0x580000 [0216.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0220.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8b99de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4edf, dwReserved0=0x4acfd28, dwReserved1=0x715fd78, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b9770 [0220.936] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0222.766] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", len=0x6e | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned 1 [0222.766] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0222.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.290] CloseHandle (hObject=0x458) returned 1 [0223.290] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0223.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x114c, dwReserved0=0x62002e, dwReserved1=0x70006d, cFileName="CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIRCLE~2.YOU")) returned 0x5b96b0 [0223.292] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0223.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.292] GetProcessHeap () returned 0x580000 [0223.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1161) returned 0x6d430c0 [0223.292] GetProcessHeap () returned 0x580000 [0223.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1161) returned 0x6d442c8 [0223.292] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.292] ReadFile (in: hFile=0x458, lpBuffer=0x6d430c0, nNumberOfBytesToRead=0x1140, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430c0*, lpNumberOfBytesRead=0x4acff14*=0x1140, lpOverlapped=0x0) returned 1 [0223.309] GetProcessHeap () returned 0x580000 [0223.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.309] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.309] WriteFile (in: hFile=0x458, lpBuffer=0x6d442c8*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d442c8*, lpNumberOfBytesWritten=0x4acff14*=0x1140, lpOverlapped=0x0) returned 1 [0223.309] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.309] WriteFile (in: hFile=0x458, lpBuffer=0x6d45407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d45407*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0223.309] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.310] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0223.310] CloseHandle (hObject=0x458) returned 1 [0223.310] GetProcessHeap () returned 0x580000 [0223.310] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d442c8 | out: hHeap=0x580000) returned 1 [0223.310] GetProcessHeap () returned 0x580000 [0223.310] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430c0 | out: hHeap=0x580000) returned 1 [0223.310] GetProcessHeap () returned 0x580000 [0223.310] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb6cbc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1170, dwReserved0=0x4acfd28, dwReserved1=0x6d430c0, cFileName="CircleIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIRCLE~2.YOU")) returned 0x5b9630 [0225.920] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.975] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC", len=0x41 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 1 [0225.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd8) returned 0x6dee6e0 [0225.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.011] CloseHandle (hObject=0x448) returned 1 [0226.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.012] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0226.012] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS6D7B~1.YOU")) returned 0x5b9630 [0226.013] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.013] GetProcessHeap () returned 0x580000 [0226.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4e820 [0226.013] GetProcessHeap () returned 0x580000 [0226.013] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4eae8 [0226.013] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.013] ReadFile (in: hFile=0x448, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x4acff14*=0x280, lpOverlapped=0x0) returned 1 [0226.020] GetProcessHeap () returned 0x580000 [0226.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.020] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.020] WriteFile (in: hFile=0x448, lpBuffer=0x6c4eae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4eae8*, lpNumberOfBytesWritten=0x4acff14*=0x280, lpOverlapped=0x0) returned 1 [0226.020] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.020] WriteFile (in: hFile=0x448, lpBuffer=0x6c4ed67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ed67*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0226.021] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.021] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0226.021] CloseHandle (hObject=0x448) returned 1 [0226.023] GetProcessHeap () returned 0x580000 [0226.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4eae8 | out: hHeap=0x580000) returned 1 [0226.023] GetProcessHeap () returned 0x580000 [0226.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0226.023] GetProcessHeap () returned 0x580000 [0226.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe3d2d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x4acfd28, dwReserved1=0x6c4e820, cFileName="MSPUB.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS6D7B~1.YOU")) returned 0x5b9630 [0226.069] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.545] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", len=0x59 | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned 1 [0226.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d84) returned 0x6dee6e0 [0226.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0234.206] CloseHandle (hObject=0x428) returned 1 [0234.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0234.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0235.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0235.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9730 [0237.526] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0239.281] GetProcessHeap () returned 0x580000 [0239.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x6e063d0 [0239.281] GetProcessHeap () returned 0x580000 [0239.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x715c008 [0239.282] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.282] ReadFile (in: hFile=0x4ac, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6980, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4acff14*=0x6980, lpOverlapped=0x0) returned 1 [0239.438] GetProcessHeap () returned 0x580000 [0239.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0239.438] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.438] WriteFile (in: hFile=0x4ac, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x4acff14*=0x6980, lpOverlapped=0x0) returned 1 [0239.438] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.439] WriteFile (in: hFile=0x4ac, lpBuffer=0x7162987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7162987*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0239.439] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.439] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0239.439] CloseHandle (hObject=0x4ac) returned 1 [0239.439] GetProcessHeap () returned 0x580000 [0239.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0239.439] GetProcessHeap () returned 0x580000 [0239.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0239.439] GetProcessHeap () returned 0x580000 [0239.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0240.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc63c4bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69b7, dwReserved0=0x4acfd28, dwReserved1=0x6e063d0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9730 [0240.658] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.673] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML", len=0x4b | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned 1 [0240.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0240.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.677] CloseHandle (hObject=0x170) returned 1 [0240.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml.id_1622540890_.your_last_chance")) returned 1 [0240.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAC66B~1.YOU")) returned 0x5b9730 [0240.678] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.678] GetProcessHeap () returned 0x580000 [0240.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.678] GetProcessHeap () returned 0x580000 [0240.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.678] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.678] ReadFile (in: hFile=0x170, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x4acff14*=0x320, lpOverlapped=0x0) returned 1 [0240.683] GetProcessHeap () returned 0x580000 [0240.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.683] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.683] WriteFile (in: hFile=0x170, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x4acff14*=0x320, lpOverlapped=0x0) returned 1 [0240.683] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.683] WriteFile (in: hFile=0x170, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0240.683] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.683] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0240.683] CloseHandle (hObject=0x170) returned 1 [0240.683] GetProcessHeap () returned 0x580000 [0240.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.683] GetProcessHeap () returned 0x580000 [0240.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.683] GetProcessHeap () returned 0x580000 [0240.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6fab9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x4acfd28, dwReserved1=0x6d07028, cFileName="YAHOO.CA.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAC66B~1.YOU")) returned 0x5b9630 [0241.780] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.798] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML", len=0x3f | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned 1 [0241.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0241.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0245.389] CloseHandle (hObject=0x39c) returned 1 [0245.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.390] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml.id_1622540890_.your_last_chance")) returned 1 [0248.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2620df00, ftCreationTime.dwHighDateTime=0x1c6a62f, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2620df00, ftLastWriteTime.dwHighDateTime=0x1c6a62f, nFileSizeHigh=0x0, nFileSizeLow=0x2d34, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~3.YOU")) returned 0x5b96f0 [0248.649] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0248.649] GetProcessHeap () returned 0x580000 [0248.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x6faaeb8 [0248.650] GetProcessHeap () returned 0x580000 [0248.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d41) returned 0x6ec04c8 [0248.650] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.650] ReadFile (in: hFile=0x39c, lpBuffer=0x6faaeb8, nNumberOfBytesToRead=0x2d20, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6faaeb8*, lpNumberOfBytesRead=0x4acff14*=0x2d20, lpOverlapped=0x0) returned 1 [0249.729] GetProcessHeap () returned 0x580000 [0249.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0249.729] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.729] WriteFile (in: hFile=0x39c, lpBuffer=0x6ec04c8*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec04c8*, lpNumberOfBytesWritten=0x4acff14*=0x2d20, lpOverlapped=0x0) returned 1 [0249.730] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.730] WriteFile (in: hFile=0x39c, lpBuffer=0x6ec31e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec31e7*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0249.730] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.730] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0249.730] CloseHandle (hObject=0x39c) returned 1 [0249.730] GetProcessHeap () returned 0x580000 [0249.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec04c8 | out: hHeap=0x580000) returned 1 [0249.730] GetProcessHeap () returned 0x580000 [0249.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6faaeb8 | out: hHeap=0x580000) returned 1 [0249.730] GetProcessHeap () returned 0x580000 [0249.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2620df00, ftCreationTime.dwHighDateTime=0x1c6a62f, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc5f5740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d58, dwReserved0=0x4acfd28, dwReserved1=0x6faaeb8, cFileName="PGMN086.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~3.YOU")) returned 0x5b9730 [0253.678] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.432] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC", len=0x3d | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC") returned 1 [0254.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe4) returned 0x72e5948 [0254.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0254.940] CloseHandle (hObject=0x49c) returned 1 [0254.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0254.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc.id_1622540890_.your_last_chance")) returned 1 [0254.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0254.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x4af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENV98S~1.YOU")) returned 0x5b9730 [0254.943] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0254.943] GetProcessHeap () returned 0x580000 [0254.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b01) returned 0x7111f48 [0254.943] GetProcessHeap () returned 0x580000 [0254.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b01) returned 0x6ebe838 [0254.943] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.943] ReadFile (in: hFile=0x49c, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x4ae0, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x4acff14*=0x4ae0, lpOverlapped=0x0) returned 1 [0256.056] GetProcessHeap () returned 0x580000 [0256.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0256.056] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.056] WriteFile (in: hFile=0x49c, lpBuffer=0x6ebe838*, nNumberOfBytesToWrite=0x4ae0, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebe838*, lpNumberOfBytesWritten=0x4acff14*=0x4ae0, lpOverlapped=0x0) returned 1 [0256.057] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.057] WriteFile (in: hFile=0x49c, lpBuffer=0x6ec3317*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec3317*, lpNumberOfBytesWritten=0x4acff14*=0x20, lpOverlapped=0x0) returned 1 [0256.057] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.057] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4acff14*=0x4, lpOverlapped=0x0) returned 1 [0256.057] CloseHandle (hObject=0x49c) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebe838 | out: hHeap=0x580000) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0258.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfccc | out: lpFindFileData=0x4acfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0236420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4b18, dwReserved0=0x4acfd28, dwReserved1=0x7111f48, cFileName="ENV98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENV98S~1.YOU")) returned 0x5b9730 [0258.985] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0258.995] SysReAllocStringLen (in: pbstr=0x4acff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV", len=0x3e | out: pbstr=0x4acff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV") returned 1 [0258.995] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb4) returned 0x72e5948 [0258.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0258.996] CloseHandle (hObject=0x448) returned 1 [0258.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4acef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4acfc74 | out: lpFindFileData=0x4acfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee16600, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ee16600, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x1f89d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LETTHE~2.YOU")) returned 0x5b9730 [0258.997] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0258.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0258.997] GetProcessHeap () returned 0x580000 [0258.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fde770 [0258.998] GetProcessHeap () returned 0x580000 [0258.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6feffa0 [0258.998] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.998] ReadFile (in: hFile=0x448, lpBuffer=0x6fde770, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4acff14, lpOverlapped=0x0 | out: lpBuffer=0x6fde770*, lpNumberOfBytesRead=0x4acff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 37 os_tid = 0xa8c [0039.066] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.538] Sleep (dwMilliseconds=0x1) [0040.553] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.781] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.002] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.099] Sleep (dwMilliseconds=0x1) [0043.115] Sleep (dwMilliseconds=0x1) [0043.139] Sleep (dwMilliseconds=0x1) [0043.195] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.295] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.373] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.405] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.451] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.545] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.576] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.809] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.856] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.887] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.965] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.000] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.062] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.392] Sleep (dwMilliseconds=0x1) [0044.402] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.495] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.542] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.573] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.509] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.102] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.445] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.990] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.037] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.199] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.302] Sleep (dwMilliseconds=0x1) [0047.318] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.692] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.926] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.238] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.597] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.831] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.862] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.018] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.157] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.422] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.479] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.578] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.734] Sleep (dwMilliseconds=0x1) [0050.750] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.958] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.046] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.670] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.292] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.573] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.963] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.228] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.899] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.055] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.133] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.679] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.960] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.592] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.893] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x4c0ff84*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0055.893] GetProcessHeap () returned 0x580000 [0055.893] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0055.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.065] CloseHandle (hObject=0x3f4) returned 1 [0056.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.065] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0056.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.066] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0056.066] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.066] GetProcessHeap () returned 0x580000 [0056.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c56108 [0056.066] GetProcessHeap () returned 0x580000 [0056.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c56a18 [0056.066] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.066] ReadFile (in: hFile=0x3f4, lpBuffer=0x6c56108, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesRead=0x4c0ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0056.122] GetProcessHeap () returned 0x580000 [0056.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0056.122] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.122] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c56a18*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56a18*, lpNumberOfBytesWritten=0x4c0ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0056.122] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.122] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c572f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c572f7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0056.122] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.122] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0056.122] CloseHandle (hObject=0x3f4) returned 1 [0056.123] GetProcessHeap () returned 0x580000 [0056.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56a18 | out: hHeap=0x580000) returned 1 [0056.123] GetProcessHeap () returned 0x580000 [0056.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0056.123] GetProcessHeap () returned 0x580000 [0056.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0056.123] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x593ff760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x4c0fd28, dwReserved1=0x6c56108, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0056.123] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.133] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", len=0x4f | out: pbstr=0x4c0ff84*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 1 [0056.133] GetProcessHeap () returned 0x580000 [0056.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0056.133] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.133] CloseHandle (hObject=0x3f4) returned 1 [0056.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.133] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id_1622540890_.your_last_chance")) returned 1 [0056.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.134] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~2.YOU")) returned 0x5b9630 [0056.134] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.134] GetProcessHeap () returned 0x580000 [0056.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c7a388 [0056.135] GetProcessHeap () returned 0x580000 [0056.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c8bbb8 [0056.136] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.136] ReadFile (in: hFile=0x3f4, lpBuffer=0x6c7a388, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a388*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.450] GetProcessHeap () returned 0x580000 [0058.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0058.450] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.450] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c8bbb8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c8bbb8*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.451] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.451] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c9d3b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3b7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0059.192] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.192] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0059.192] CloseHandle (hObject=0x3f4) returned 1 [0059.998] GetProcessHeap () returned 0x580000 [0059.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c8bbb8 | out: hHeap=0x580000) returned 1 [0059.998] GetProcessHeap () returned 0x580000 [0059.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a388 | out: hHeap=0x580000) returned 1 [0059.998] GetProcessHeap () returned 0x580000 [0059.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0059.998] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5b90adc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x265c24, dwReserved0=0x4c0fd28, dwReserved1=0x6c7a388, cFileName="PublisherMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~2.YOU")) returned 0x5b96b0 [0059.999] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.801] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x4c0ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0061.801] GetProcessHeap () returned 0x580000 [0061.801] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x3c) returned 0x5b5bc8 [0061.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0069.795] CloseHandle (hObject=0x450) returned 1 [0069.795] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0069.796] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance")) returned 1 [0069.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0069.796] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96b0 [0069.796] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0069.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0069.797] GetProcessHeap () returned 0x580000 [0069.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c330a8 [0069.797] GetProcessHeap () returned 0x580000 [0069.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c448d8 [0069.797] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.797] ReadFile (in: hFile=0x450, lpBuffer=0x6c330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c330a8*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0074.373] GetProcessHeap () returned 0x580000 [0074.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0074.374] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.374] WriteFile (in: hFile=0x450, lpBuffer=0x6c448d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448d8*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0074.374] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.374] WriteFile (in: hFile=0x450, lpBuffer=0x6c560d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c560d7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.068] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.068] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.068] CloseHandle (hObject=0x450) returned 1 [0075.069] GetProcessHeap () returned 0x580000 [0075.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c448d8 | out: hHeap=0x580000) returned 1 [0075.069] GetProcessHeap () returned 0x580000 [0075.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c330a8 | out: hHeap=0x580000) returned 1 [0075.069] GetProcessHeap () returned 0x580000 [0075.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0079.339] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x645c8280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6624, dwReserved0=0x4c0fd28, dwReserved1=0x6c330a8, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0079.339] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.356] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", len=0x54 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 1 [0079.356] GetProcessHeap () returned 0x580000 [0079.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x10) returned 0x5f76f0 [0079.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.357] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.959] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", len=0x43 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 1 [0085.960] GetProcessHeap () returned 0x580000 [0085.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xac) returned 0x614a48 [0085.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.961] Sleep (dwMilliseconds=0x1) [0085.976] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", len=0x47 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 1 [0085.976] GetProcessHeap () returned 0x580000 [0085.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x40) returned 0x614a48 [0085.976] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.486] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 1 [0086.486] GetProcessHeap () returned 0x580000 [0086.486] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0086.486] CloseHandle (hObject=0x428) returned 1 [0086.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0087.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0087.065] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0087.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0087.065] GetProcessHeap () returned 0x580000 [0087.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50a1) returned 0x6f39b98 [0087.066] GetProcessHeap () returned 0x580000 [0087.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x50a1) returned 0x6f3ec48 [0087.066] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.066] ReadFile (in: hFile=0x428, lpBuffer=0x6f39b98, nNumberOfBytesToRead=0x5080, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f39b98*, lpNumberOfBytesRead=0x4c0ff14*=0x5080, lpOverlapped=0x0) returned 1 [0087.639] GetProcessHeap () returned 0x580000 [0087.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0087.639] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.639] WriteFile (in: hFile=0x428, lpBuffer=0x6f3ec48*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ec48*, lpNumberOfBytesWritten=0x4c0ff14*=0x5080, lpOverlapped=0x0) returned 1 [0087.639] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.639] WriteFile (in: hFile=0x428, lpBuffer=0x6f43cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f43cc7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0087.639] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.639] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0087.639] CloseHandle (hObject=0x428) returned 1 [0087.640] GetProcessHeap () returned 0x580000 [0087.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ec48 | out: hHeap=0x580000) returned 1 [0087.640] GetProcessHeap () returned 0x580000 [0087.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f39b98 | out: hHeap=0x580000) returned 1 [0087.640] GetProcessHeap () returned 0x580000 [0087.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bd8b560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x50b7, dwReserved0=0x4c0fd28, dwReserved1=0x6f39b98, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0088.151] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.883] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 1 [0091.883] GetProcessHeap () returned 0x580000 [0091.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x668d98, Size=0x4c) returned 0x669420 [0091.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0091.884] CloseHandle (hObject=0x470) returned 1 [0091.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0091.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0091.887] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0091.887] GetProcessHeap () returned 0x580000 [0091.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c21) returned 0x6f16278 [0091.887] GetProcessHeap () returned 0x580000 [0091.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c21) returned 0x6ce54a8 [0091.888] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.888] ReadFile (in: hFile=0x470, lpBuffer=0x6f16278, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f16278*, lpNumberOfBytesRead=0x4c0ff14*=0x4c00, lpOverlapped=0x0) returned 1 [0093.000] GetProcessHeap () returned 0x580000 [0093.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.000] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.000] WriteFile (in: hFile=0x470, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4c00, lpOverlapped=0x0) returned 1 [0093.000] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.001] WriteFile (in: hFile=0x470, lpBuffer=0x6cea0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cea0a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0093.001] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.001] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0093.001] CloseHandle (hObject=0x470) returned 1 [0093.001] GetProcessHeap () returned 0x580000 [0093.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0093.001] GetProcessHeap () returned 0x580000 [0093.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f16278 | out: hHeap=0x580000) returned 1 [0093.001] GetProcessHeap () returned 0x580000 [0093.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f0b8e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c41, dwReserved0=0x4c0fd28, dwReserved1=0x6f16278, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0094.164] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.164] Sleep (dwMilliseconds=0x1) [0094.184] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", len=0x4b | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 1 [0094.184] GetProcessHeap () returned 0x580000 [0094.184] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a468 [0094.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.240] CloseHandle (hObject=0x41c) returned 1 [0094.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id_1622540890_.your_last_chance")) returned 1 [0094.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x45, dwReserved1=0x0, cFileName="REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REFINE~2.YOU")) returned 0x5b96b0 [0094.340] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0094.340] GetProcessHeap () returned 0x580000 [0094.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c4f8 [0094.340] GetProcessHeap () returned 0x580000 [0094.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f0c768 [0094.340] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.340] ReadFile (in: hFile=0x41c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x4c0ff14*=0x240, lpOverlapped=0x0) returned 1 [0094.343] GetProcessHeap () returned 0x580000 [0094.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.343] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.343] WriteFile (in: hFile=0x41c, lpBuffer=0x6f0c768*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c768*, lpNumberOfBytesWritten=0x4c0ff14*=0x240, lpOverlapped=0x0) returned 1 [0094.343] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.343] WriteFile (in: hFile=0x41c, lpBuffer=0x6f0c9a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c9a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0094.344] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.344] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0094.344] CloseHandle (hObject=0x41c) returned 1 [0094.344] GetProcessHeap () returned 0x580000 [0094.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c768 | out: hHeap=0x580000) returned 1 [0094.344] GetProcessHeap () returned 0x580000 [0094.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0094.344] GetProcessHeap () returned 0x580000 [0094.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fd844a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x4c0fd28, dwReserved1=0x6f0c4f8, cFileName="REFINED.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REFINE~2.YOU")) returned 0x5b96b0 [0094.344] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.390] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", len=0x47 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 1 [0094.390] GetProcessHeap () returned 0x580000 [0094.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x58) returned 0x5a4778 [0094.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0094.391] CloseHandle (hObject=0x40c) returned 1 [0094.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id_1622540890_.your_last_chance")) returned 1 [0094.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SATINE~1.YOU")) returned 0x5b96b0 [0094.392] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0094.392] GetProcessHeap () returned 0x580000 [0094.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0094.394] GetProcessHeap () returned 0x580000 [0094.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f58108 [0094.394] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.394] ReadFile (in: hFile=0x40c, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0100.362] GetProcessHeap () returned 0x580000 [0100.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0100.362] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.362] WriteFile (in: hFile=0x40c, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0100.362] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.363] WriteFile (in: hFile=0x40c, lpBuffer=0x6f69907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69907*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.363] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.363] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.363] CloseHandle (hObject=0x40c) returned 1 [0100.363] GetProcessHeap () returned 0x580000 [0100.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0100.527] GetProcessHeap () returned 0x580000 [0100.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0100.527] GetProcessHeap () returned 0x580000 [0100.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x736f1760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19393, dwReserved0=0x4c0fd28, dwReserved1=0x6f468d8, cFileName="SATIN.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SATINE~1.YOU")) returned 0x5b96b0 [0101.840] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.164] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", len=0x46 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 1 [0106.164] GetProcessHeap () returned 0x580000 [0106.164] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x18) returned 0x5a58e8 [0106.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0107.095] CloseHandle (hObject=0x3f8) returned 1 [0107.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id_1622540890_.your_last_chance")) returned 1 [0107.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBLR6C~1.YOU")) returned 0x5b9630 [0107.096] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0107.096] GetProcessHeap () returned 0x580000 [0107.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f1bea8 [0107.097] GetProcessHeap () returned 0x580000 [0107.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f2d6d8 [0107.097] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.097] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f1bea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.824] GetProcessHeap () returned 0x580000 [0110.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0110.824] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.824] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f2d6d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2d6d8*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0110.825] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.825] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f3eed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3eed7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.354] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.354] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.354] CloseHandle (hObject=0x3f8) returned 1 [0111.354] GetProcessHeap () returned 0x580000 [0111.354] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2d6d8 | out: hHeap=0x580000) returned 1 [0111.355] GetProcessHeap () returned 0x580000 [0111.355] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0111.357] GetProcessHeap () returned 0x580000 [0111.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0111.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79fd40c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe6b86, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="VBLR6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBLR6C~1.YOU")) returned 0x5b96f0 [0111.357] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.008] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", len=0x48 | out: pbstr=0x4c0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 1 [0112.008] GetProcessHeap () returned 0x580000 [0112.008] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.008] Sleep (dwMilliseconds=0x1) [0112.158] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", len=0x45 | out: pbstr=0x4c0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 1 [0112.158] GetProcessHeap () returned 0x580000 [0112.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x4c) returned 0x5e1778 [0112.158] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.158] Sleep (dwMilliseconds=0x1) [0112.188] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.205] Sleep (dwMilliseconds=0x1) [0112.265] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", len=0x4e | out: pbstr=0x4c0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 1 [0112.265] GetProcessHeap () returned 0x580000 [0112.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.266] Sleep (dwMilliseconds=0x1) [0112.312] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", len=0x4e | out: pbstr=0x4c0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned 1 [0112.312] GetProcessHeap () returned 0x580000 [0112.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x58) returned 0x5a4778 [0112.312] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.327] Sleep (dwMilliseconds=0x1) [0113.327] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", len=0x3f | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 1 [0113.327] GetProcessHeap () returned 0x580000 [0113.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xb4) returned 0x6f0ceb8 [0113.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.484] CloseHandle (hObject=0x3b8) returned 1 [0113.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0106~1.YOU")) returned 0x5b9630 [0114.649] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.649] GetProcessHeap () returned 0x580000 [0114.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f41) returned 0x65f250 [0114.649] GetProcessHeap () returned 0x580000 [0114.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f41) returned 0x6611a0 [0114.649] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.649] ReadFile (in: hFile=0x3b8, lpBuffer=0x65f250, nNumberOfBytesToRead=0x1f20, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f250*, lpNumberOfBytesRead=0x4c0ff14*=0x1f20, lpOverlapped=0x0) returned 1 [0114.677] GetProcessHeap () returned 0x580000 [0114.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.678] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.678] WriteFile (in: hFile=0x3b8, lpBuffer=0x6611a0*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6611a0*, lpNumberOfBytesWritten=0x4c0ff14*=0x1f20, lpOverlapped=0x0) returned 1 [0114.678] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.678] WriteFile (in: hFile=0x3b8, lpBuffer=0x6630bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6630bf*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.678] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.678] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.678] CloseHandle (hObject=0x3b8) returned 1 [0114.678] GetProcessHeap () returned 0x580000 [0114.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6611a0 | out: hHeap=0x580000) returned 1 [0114.678] GetProcessHeap () returned 0x580000 [0114.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f250 | out: hHeap=0x580000) returned 1 [0114.678] GetProcessHeap () returned 0x580000 [0114.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bf845a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f44, dwReserved0=0x4c0fd28, dwReserved1=0x65f250, cFileName="AN01060_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0106~1.YOU")) returned 0x5b9630 [0115.652] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.778] CloseHandle (hObject=0x4a0) returned 1 [0115.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.780] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO52C2~1.YOU")) returned 0x5b9630 [0115.780] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.780] GetProcessHeap () returned 0x580000 [0115.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x6c78088 [0115.780] GetProcessHeap () returned 0x580000 [0115.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x6c6a0f8 [0115.780] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.780] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c78088, nNumberOfBytesToRead=0x2080, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78088*, lpNumberOfBytesRead=0x4c0ff14*=0x2080, lpOverlapped=0x0) returned 1 [0115.810] GetProcessHeap () returned 0x580000 [0115.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.810] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.810] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x4c0ff14*=0x2080, lpOverlapped=0x0) returned 1 [0115.811] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.811] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6c177*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.811] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.811] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.811] CloseHandle (hObject=0x4a0) returned 1 [0115.811] GetProcessHeap () returned 0x580000 [0115.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0115.811] GetProcessHeap () returned 0x580000 [0115.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c78088 | out: hHeap=0x580000) returned 1 [0115.811] GetProcessHeap () returned 0x580000 [0115.811] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca3a8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20b4, dwReserved0=0x4c0fd28, dwReserved1=0x6c78088, cFileName="SO00191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO52C2~1.YOU")) returned 0x5b9630 [0117.374] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0119.950] CloseHandle (hObject=0x4a0) returned 1 [0119.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TR0009~1.YOU")) returned 0x5b96b0 [0119.952] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0119.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0119.952] GetProcessHeap () returned 0x580000 [0119.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22a1) returned 0x6cfecd8 [0119.953] GetProcessHeap () returned 0x580000 [0119.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22a1) returned 0x6f3bea8 [0119.953] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.953] ReadFile (in: hFile=0x4a0, lpBuffer=0x6cfecd8, nNumberOfBytesToRead=0x2280, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfecd8*, lpNumberOfBytesRead=0x4c0ff14*=0x2280, lpOverlapped=0x0) returned 1 [0119.985] GetProcessHeap () returned 0x580000 [0119.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0119.985] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.985] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3bea8*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bea8*, lpNumberOfBytesWritten=0x4c0ff14*=0x2280, lpOverlapped=0x0) returned 1 [0119.985] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.985] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3e127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3e127*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.986] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.986] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.986] CloseHandle (hObject=0x4a0) returned 1 [0119.986] GetProcessHeap () returned 0x580000 [0119.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bea8 | out: hHeap=0x580000) returned 1 [0119.986] GetProcessHeap () returned 0x580000 [0119.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfecd8 | out: hHeap=0x580000) returned 1 [0119.986] GetProcessHeap () returned 0x580000 [0119.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f219920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x4c0fd28, dwReserved1=0x6cfecd8, cFileName="TR00095_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TR0009~1.YOU")) returned 0x5b96f0 [0120.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.159] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", len=0x4c | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 1 [0120.159] GetProcessHeap () returned 0x580000 [0120.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1778) returned 0x6d06ca8 [0120.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.716] CloseHandle (hObject=0x48c) returned 1 [0120.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.id_1622540890_.your_last_chance")) returned 1 [0120.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~4.YOU")) returned 0x5b9630 [0120.717] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.718] GetProcessHeap () returned 0x580000 [0120.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6c65108 [0120.718] GetProcessHeap () returned 0x580000 [0120.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x626d30 [0120.718] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.718] ReadFile (in: hFile=0x48c, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x4c0ff14*=0x580, lpOverlapped=0x0) returned 1 [0120.724] GetProcessHeap () returned 0x580000 [0120.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.724] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.724] WriteFile (in: hFile=0x48c, lpBuffer=0x626d30*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesWritten=0x4c0ff14*=0x580, lpOverlapped=0x0) returned 1 [0120.724] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.724] WriteFile (in: hFile=0x48c, lpBuffer=0x6272af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6272af*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.724] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.724] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.724] CloseHandle (hObject=0x48c) returned 1 [0120.724] GetProcessHeap () returned 0x580000 [0120.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0120.724] GetProcessHeap () returned 0x580000 [0120.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0120.724] GetProcessHeap () returned 0x580000 [0120.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f9179c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b9, dwReserved0=0x4c0fd28, dwReserved1=0x6c65108, cFileName="J0143746.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~4.YOU")) returned 0x5b9630 [0120.725] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.729] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", len=0x50 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 1 [0120.729] GetProcessHeap () returned 0x580000 [0120.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x184c) returned 0x6e00ac0 [0120.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0121.650] CloseHandle (hObject=0x484) returned 1 [0121.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.id_1622540890_.your_last_chance")) returned 1 [0121.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0121.651] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0121.651] GetProcessHeap () returned 0x580000 [0121.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6c65108 [0121.651] GetProcessHeap () returned 0x580000 [0121.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0121.652] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.652] ReadFile (in: hFile=0x484, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x4c0ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0121.657] GetProcessHeap () returned 0x580000 [0121.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.657] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.657] WriteFile (in: hFile=0x484, lpBuffer=0x678958*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesWritten=0x4c0ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0121.657] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.657] WriteFile (in: hFile=0x484, lpBuffer=0x678d17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d17*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.657] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.657] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.657] CloseHandle (hObject=0x484) returned 1 [0121.657] GetProcessHeap () returned 0x580000 [0121.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0121.657] GetProcessHeap () returned 0x580000 [0121.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0121.657] GetProcessHeap () returned 0x580000 [0121.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80204c40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e9, dwReserved0=0x4c0fd28, dwReserved1=0x6c65108, cFileName="Slipstream.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0122.239] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.636] Sleep (dwMilliseconds=0x1) [0124.803] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", len=0x4f | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned 1 [0124.803] GetProcessHeap () returned 0x580000 [0124.803] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c8) returned 0x6f42f08 [0124.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.803] CloseHandle (hObject=0x484) returned 1 [0124.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.id_1622540890_.your_last_chance")) returned 1 [0124.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APOTHE~1.YOU")) returned 0x5b9730 [0124.804] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.804] GetProcessHeap () returned 0x580000 [0124.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.804] GetProcessHeap () returned 0x580000 [0124.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.804] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.804] ReadFile (in: hFile=0x484, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x4c0ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.818] GetProcessHeap () returned 0x580000 [0124.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.818] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.818] WriteFile (in: hFile=0x484, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x4c0ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.818] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.818] WriteFile (in: hFile=0x484, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.818] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.818] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.818] CloseHandle (hObject=0x484) returned 1 [0124.819] GetProcessHeap () returned 0x580000 [0124.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.819] GetProcessHeap () returned 0x580000 [0124.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.819] GetProcessHeap () returned 0x580000 [0124.819] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0124.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82038360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe43, dwReserved0=0x4c0fd28, dwReserved1=0x6f69420, cFileName="Apothecary.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APOTHE~1.YOU")) returned 0x5b9730 [0124.819] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.853] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", len=0x4e | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned 1 [0124.853] GetProcessHeap () returned 0x580000 [0124.853] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18bc) returned 0x6f42f08 [0124.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.853] CloseHandle (hObject=0x460) returned 1 [0124.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.id_1622540890_.your_last_chance")) returned 1 [0124.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADJACE~1.YOU")) returned 0x5b9730 [0124.854] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0124.854] GetProcessHeap () returned 0x580000 [0124.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.854] GetProcessHeap () returned 0x580000 [0124.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.854] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.854] ReadFile (in: hFile=0x460, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x4c0ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.882] GetProcessHeap () returned 0x580000 [0124.882] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.882] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.882] WriteFile (in: hFile=0x460, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x4c0ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.882] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.882] WriteFile (in: hFile=0x460, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.882] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.882] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.883] CloseHandle (hObject=0x460) returned 1 [0124.883] GetProcessHeap () returned 0x580000 [0124.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.883] GetProcessHeap () returned 0x580000 [0124.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.883] GetProcessHeap () returned 0x580000 [0124.883] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0124.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x820d08e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x4c0fd28, dwReserved1=0x6f69420, cFileName="Adjacency.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADJACE~1.YOU")) returned 0x5b9730 [0124.883] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.361] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", len=0x3d | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned 1 [0125.361] GetProcessHeap () returned 0x580000 [0125.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b4) returned 0x6f42f08 [0125.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0128.873] CloseHandle (hObject=0x448) returned 1 [0128.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02971~1.YOU")) returned 0x5b9730 [0129.840] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0129.840] GetProcessHeap () returned 0x580000 [0129.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcd61) returned 0x6f976f8 [0129.840] GetProcessHeap () returned 0x580000 [0129.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcd61) returned 0x636970 [0129.841] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.841] ReadFile (in: hFile=0x448, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0xcd40, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x4c0ff14*=0xcd40, lpOverlapped=0x0) returned 1 [0133.870] GetProcessHeap () returned 0x580000 [0133.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0133.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.871] WriteFile (in: hFile=0x448, lpBuffer=0x636970*, nNumberOfBytesToWrite=0xcd40, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x4c0ff14*=0xcd40, lpOverlapped=0x0) returned 1 [0133.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.871] WriteFile (in: hFile=0x448, lpBuffer=0x6436af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6436af*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0133.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.871] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0133.871] CloseHandle (hObject=0x448) returned 1 [0134.754] GetProcessHeap () returned 0x580000 [0134.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0134.915] GetProcessHeap () returned 0x580000 [0134.915] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0134.915] GetProcessHeap () returned 0x580000 [0134.915] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0135.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x876820e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcd76, dwReserved0=0x4c0fd28, dwReserved1=0x6f976f8, cFileName="J0297185.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02971~1.YOU")) returned 0x5b96b0 [0135.618] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.627] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x5e | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0135.627] GetProcessHeap () returned 0x580000 [0135.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.628] CloseHandle (hObject=0x48c) returned 1 [0135.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.628] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0135.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0135.690] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.690] GetProcessHeap () returned 0x580000 [0135.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0135.690] GetProcessHeap () returned 0x580000 [0135.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0135.690] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.691] ReadFile (in: hFile=0x48c, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x4c0ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.692] GetProcessHeap () returned 0x580000 [0135.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.692] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.692] WriteFile (in: hFile=0x48c, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x4c0ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.693] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.693] WriteFile (in: hFile=0x48c, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.693] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.693] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.693] CloseHandle (hObject=0x48c) returned 1 [0135.693] GetProcessHeap () returned 0x580000 [0135.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0135.693] GetProcessHeap () returned 0x580000 [0135.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0135.693] GetProcessHeap () returned 0x580000 [0135.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x887ea1c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x4c0fd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0135.693] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.855] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", len=0x53 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css") returned 1 [0135.855] GetProcessHeap () returned 0x580000 [0135.855] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0138.444] CloseHandle (hObject=0x390) returned 1 [0138.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.444] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.id_1622540890_.your_last_chance")) returned 1 [0138.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b96b0 [0138.445] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0138.445] GetProcessHeap () returned 0x580000 [0138.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0138.446] GetProcessHeap () returned 0x580000 [0138.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0138.446] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.446] ReadFile (in: hFile=0x390, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x4c0ff14*=0x760, lpOverlapped=0x0) returned 1 [0138.453] GetProcessHeap () returned 0x580000 [0138.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0138.453] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.453] WriteFile (in: hFile=0x390, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x4c0ff14*=0x760, lpOverlapped=0x0) returned 1 [0138.453] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.453] WriteFile (in: hFile=0x390, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.453] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.454] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.454] CloseHandle (hObject=0x390) returned 1 [0138.454] GetProcessHeap () returned 0x580000 [0138.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0138.454] GetProcessHeap () returned 0x580000 [0138.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0138.454] GetProcessHeap () returned 0x580000 [0138.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0138.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a23f520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x4c0fd28, dwReserved1=0x6ef3020, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b96b0 [0138.454] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.466] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", len=0x43 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned 1 [0138.466] GetProcessHeap () returned 0x580000 [0138.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0138.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.825] CloseHandle (hObject=0x470) returned 1 [0139.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb568300, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbb568300, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~3.YOU")) returned 0x5b97b0 [0139.827] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.827] GetProcessHeap () returned 0x580000 [0139.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0139.827] GetProcessHeap () returned 0x580000 [0139.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0139.827] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.827] ReadFile (in: hFile=0x470, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x4c0ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.829] GetProcessHeap () returned 0x580000 [0139.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.829] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.829] WriteFile (in: hFile=0x470, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x4c0ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.829] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.829] WriteFile (in: hFile=0x470, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.829] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.829] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.829] CloseHandle (hObject=0x470) returned 1 [0139.829] GetProcessHeap () returned 0x580000 [0139.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0139.829] GetProcessHeap () returned 0x580000 [0139.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0139.829] GetProcessHeap () returned 0x580000 [0139.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb568300, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8af56e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x4c0fd28, dwReserved1=0x6f0a9f0, cFileName="BD21318_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~3.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.175] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x59 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0140.175] GetProcessHeap () returned 0x580000 [0140.175] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0140.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.176] CloseHandle (hObject=0x4a0) returned 1 [0140.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0140.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.375] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.375] GetProcessHeap () returned 0x580000 [0140.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0140.375] GetProcessHeap () returned 0x580000 [0140.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0140.375] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.375] ReadFile (in: hFile=0x4a0, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x4c0ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.377] GetProcessHeap () returned 0x580000 [0140.377] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.377] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.377] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x4c0ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.377] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.377] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.378] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.378] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.378] CloseHandle (hObject=0x4a0) returned 1 [0140.378] GetProcessHeap () returned 0x580000 [0140.378] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.378] GetProcessHeap () returned 0x580000 [0140.378] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.378] GetProcessHeap () returned 0x580000 [0140.378] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b48be40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x4c0fd28, dwReserved1=0x5aa990, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.672] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.684] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD", len=0x3c | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 1 [0140.684] GetProcessHeap () returned 0x580000 [0140.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.767] CloseHandle (hObject=0x490) returned 1 [0140.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id_1622540890_.your_last_chance")) returned 1 [0140.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37deba00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INVENT~1.YOU")) returned 0x5b9730 [0140.768] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.769] GetProcessHeap () returned 0x580000 [0140.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0140.769] GetProcessHeap () returned 0x580000 [0140.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0140.769] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.769] ReadFile (in: hFile=0x490, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x4c0ff14*=0x320, lpOverlapped=0x0) returned 1 [0140.773] GetProcessHeap () returned 0x580000 [0140.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0140.773] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.773] WriteFile (in: hFile=0x490, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x4c0ff14*=0x320, lpOverlapped=0x0) returned 1 [0140.774] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.774] WriteFile (in: hFile=0x490, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.774] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.774] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.774] CloseHandle (hObject=0x490) returned 1 [0140.774] GetProcessHeap () returned 0x580000 [0140.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0140.774] GetProcessHeap () returned 0x580000 [0140.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0140.774] GetProcessHeap () returned 0x580000 [0140.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8b8440a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x4c0fd28, dwReserved1=0x6c59120, cFileName="INVENTRY.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INVENT~1.YOU")) returned 0x5b9730 [0141.855] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.935] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK", len=0x42 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 1 [0141.935] GetProcessHeap () returned 0x580000 [0141.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed8) returned 0x6f14048 [0141.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.935] CloseHandle (hObject=0x470) returned 1 [0141.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0141.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~2.YOU")) returned 0x5b9730 [0141.937] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.937] GetProcessHeap () returned 0x580000 [0141.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0141.937] GetProcessHeap () returned 0x580000 [0141.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0141.937] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.937] ReadFile (in: hFile=0x470, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4c0ff14*=0x60, lpOverlapped=0x0) returned 1 [0141.938] GetProcessHeap () returned 0x580000 [0141.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.938] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.938] WriteFile (in: hFile=0x470, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4c0ff14*=0x60, lpOverlapped=0x0) returned 1 [0141.938] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.938] WriteFile (in: hFile=0x470, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.939] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.939] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.939] CloseHandle (hObject=0x470) returned 1 [0141.939] GetProcessHeap () returned 0x580000 [0141.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0141.939] GetProcessHeap () returned 0x580000 [0141.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0141.939] GetProcessHeap () returned 0x580000 [0141.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c36c7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4c0fd28, dwReserved1=0x61b540, cFileName="POWERPNT_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~2.YOU")) returned 0x5b9730 [0141.939] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.026] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI", len=0x3c | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI") returned 1 [0142.026] GetProcessHeap () returned 0x580000 [0142.026] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eac) returned 0x6f14048 [0142.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.027] CloseHandle (hObject=0x410) returned 1 [0142.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0142.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.id_1622540890_.your_last_chance")) returned 1 [0142.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0142.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLPE~1.YOU")) returned 0x5b9730 [0142.028] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0142.028] GetProcessHeap () returned 0x580000 [0142.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x6e063d0 [0142.029] GetProcessHeap () returned 0x580000 [0142.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaa1) returned 0x677cd0 [0142.029] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.029] ReadFile (in: hFile=0x410, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xa80, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4c0ff14*=0xa80, lpOverlapped=0x0) returned 1 [0142.079] GetProcessHeap () returned 0x580000 [0142.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0142.079] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] WriteFile (in: hFile=0x410, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x4c0ff14*=0xa80, lpOverlapped=0x0) returned 1 [0142.079] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] WriteFile (in: hFile=0x410, lpBuffer=0x67874f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67874f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.079] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.079] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.079] CloseHandle (hObject=0x410) returned 1 [0142.080] GetProcessHeap () returned 0x580000 [0142.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0142.080] GetProcessHeap () returned 0x580000 [0142.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0142.080] GetProcessHeap () returned 0x580000 [0142.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0142.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c4c3420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaab, dwReserved0=0x4c0fd28, dwReserved1=0x6e063d0, cFileName="OUTLPERF.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLPE~1.YOU")) returned 0x5b9730 [0144.017] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.866] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", len=0x44 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned 1 [0146.866] GetProcessHeap () returned 0x580000 [0146.866] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0146.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0152.912] CloseHandle (hObject=0x430) returned 1 [0152.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.id_1622540890_.your_last_chance")) returned 1 [0152.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR31~2.YOU")) returned 0x5b9730 [0152.914] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0152.914] GetProcessHeap () returned 0x580000 [0152.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0152.914] GetProcessHeap () returned 0x580000 [0152.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0152.914] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.914] ReadFile (in: hFile=0x430, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x4c0ff14*=0x820, lpOverlapped=0x0) returned 1 [0152.923] GetProcessHeap () returned 0x580000 [0152.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.923] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.923] WriteFile (in: hFile=0x430, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x4c0ff14*=0x820, lpOverlapped=0x0) returned 1 [0152.923] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.923] WriteFile (in: hFile=0x430, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.923] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.923] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.923] CloseHandle (hObject=0x430) returned 1 [0152.924] GetProcessHeap () returned 0x580000 [0152.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0152.924] GetProcessHeap () returned 0x580000 [0152.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0152.924] GetProcessHeap () returned 0x580000 [0152.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92c28fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x4c0fd28, dwReserved1=0x6c79898, cFileName="PDIR31B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR31~2.YOU")) returned 0x5b9630 [0153.752] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0155.468] CloseHandle (hObject=0x3a8) returned 1 [0155.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0155.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea593000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2284ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea593000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x96180, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WWINTL~1.YOU")) returned 0x5b9730 [0155.469] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0155.469] GetProcessHeap () returned 0x580000 [0155.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e17c00 [0155.470] GetProcessHeap () returned 0x580000 [0155.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e29430 [0155.471] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.471] ReadFile (in: hFile=0x3a8, lpBuffer=0x6e17c00, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0160.295] GetProcessHeap () returned 0x580000 [0160.295] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0160.295] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.295] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e29430*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e29430*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0160.295] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.295] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e3ac2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3ac2f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0161.523] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.524] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0161.524] CloseHandle (hObject=0x3a8) returned 1 [0161.524] GetProcessHeap () returned 0x580000 [0161.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e29430 | out: hHeap=0x580000) returned 1 [0161.524] GetProcessHeap () returned 0x580000 [0161.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0161.524] GetProcessHeap () returned 0x580000 [0161.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0164.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea593000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2284ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97e486c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x961a4, dwReserved0=0x4c0fd28, dwReserved1=0x6e17c00, cFileName="WWINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WWINTL~1.YOU")) returned 0x5b9730 [0164.570] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.550] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", len=0x42 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 1 [0166.550] GetProcessHeap () returned 0x580000 [0166.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2234) returned 0x6f14048 [0166.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.555] CloseHandle (hObject=0x41c) returned 1 [0166.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id_1622540890_.your_last_chance")) returned 1 [0166.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLS~1.YOU")) returned 0x5b9730 [0166.561] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0166.561] GetProcessHeap () returned 0x580000 [0166.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0166.561] GetProcessHeap () returned 0x580000 [0166.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0166.561] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.561] ReadFile (in: hFile=0x480, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x4c0ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.573] GetProcessHeap () returned 0x580000 [0166.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.573] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.573] WriteFile (in: hFile=0x480, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x4c0ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.573] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.573] WriteFile (in: hFile=0x480, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.573] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.573] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.573] CloseHandle (hObject=0x480) returned 1 [0166.573] GetProcessHeap () returned 0x580000 [0166.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0166.573] GetProcessHeap () returned 0x580000 [0166.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0166.573] GetProcessHeap () returned 0x580000 [0166.573] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ae562e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x4c0fd28, dwReserved1=0x5cf780, cFileName="DISTLSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLS~1.YOU")) returned 0x5b9730 [0166.574] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.630] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", len=0x40 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 1 [0166.630] GetProcessHeap () returned 0x580000 [0166.630] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0166.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.252] CloseHandle (hObject=0x454) returned 1 [0169.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id_1622540890_.your_last_chance")) returned 1 [0169.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFNOT~2.YOU")) returned 0x5b96b0 [0169.253] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.253] GetProcessHeap () returned 0x580000 [0169.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0169.253] GetProcessHeap () returned 0x580000 [0169.253] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0169.253] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.253] ReadFile (in: hFile=0x454, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x4c0ff14*=0x140, lpOverlapped=0x0) returned 1 [0169.255] GetProcessHeap () returned 0x580000 [0169.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.255] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.255] WriteFile (in: hFile=0x454, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x4c0ff14*=0x140, lpOverlapped=0x0) returned 1 [0169.255] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.255] WriteFile (in: hFile=0x454, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.255] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.255] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.255] CloseHandle (hObject=0x454) returned 1 [0169.255] GetProcessHeap () returned 0x580000 [0169.255] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0169.255] GetProcessHeap () returned 0x580000 [0169.255] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0169.255] GetProcessHeap () returned 0x580000 [0169.255] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c7ecf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x4c0fd28, dwReserved1=0x6f3bec0, cFileName="CNFNOT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFNOT~2.YOU")) returned 0x5b9770 [0172.814] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.862] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", len=0x42 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 1 [0172.863] GetProcessHeap () returned 0x580000 [0172.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2254) returned 0x6f14048 [0172.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0172.934] CloseHandle (hObject=0x3fc) returned 1 [0172.934] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~1.YOU")) returned 0x5b9770 [0172.976] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0172.976] GetProcessHeap () returned 0x580000 [0172.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x67fc68 [0172.976] GetProcessHeap () returned 0x580000 [0172.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6e17c00 [0172.976] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.976] ReadFile (in: hFile=0x3fc, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x4c0ff14*=0x340, lpOverlapped=0x0) returned 1 [0172.986] GetProcessHeap () returned 0x580000 [0172.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.986] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.986] WriteFile (in: hFile=0x3fc, lpBuffer=0x6e17c00*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesWritten=0x4c0ff14*=0x340, lpOverlapped=0x0) returned 1 [0172.987] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.987] WriteFile (in: hFile=0x3fc, lpBuffer=0x6e17f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17f3f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.987] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.987] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.987] CloseHandle (hObject=0x3fc) returned 1 [0172.987] GetProcessHeap () returned 0x580000 [0172.987] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0172.987] GetProcessHeap () returned 0x580000 [0172.987] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0172.987] GetProcessHeap () returned 0x580000 [0172.987] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eb7b800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x4c0fd28, dwReserved1=0x67fc68, cFileName="SCHDREST.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~1.YOU")) returned 0x5b9770 [0172.987] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.007] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", len=0x41 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 1 [0173.007] GetProcessHeap () returned 0x580000 [0173.007] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2248) returned 0x6f14048 [0173.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.022] CloseHandle (hObject=0x46c) returned 1 [0173.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc91200, ftCreationTime.dwHighDateTime=0x1bfc4b1, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabc91200, ftLastWriteTime.dwHighDateTime=0x1bfc4b1, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~4.YOU")) returned 0x5b9770 [0173.038] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.038] GetProcessHeap () returned 0x580000 [0173.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x6dcfb90 [0173.038] GetProcessHeap () returned 0x580000 [0173.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x6c65108 [0173.038] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.038] ReadFile (in: hFile=0x46c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x4c0ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0173.043] GetProcessHeap () returned 0x580000 [0173.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.043] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.043] WriteFile (in: hFile=0x46c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x4c0ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0173.043] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.044] WriteFile (in: hFile=0x46c, lpBuffer=0x6c655a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c655a7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.044] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.044] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.044] CloseHandle (hObject=0x46c) returned 1 [0173.044] GetProcessHeap () returned 0x580000 [0173.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0173.044] GetProcessHeap () returned 0x580000 [0173.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0173.044] GetProcessHeap () returned 0x580000 [0173.044] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc91200, ftCreationTime.dwHighDateTime=0x1bfc4b1, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec13d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x4c0fd28, dwReserved1=0x6dcfb90, cFileName="SCHDREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~4.YOU")) returned 0x5b9770 [0173.283] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.285] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", len=0x3f | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 1 [0173.285] GetProcessHeap () returned 0x580000 [0173.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0173.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.286] CloseHandle (hObject=0x43c) returned 1 [0173.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id_1622540890_.your_last_chance")) returned 1 [0173.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTSI~1.YOU")) returned 0x5b9770 [0173.287] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.287] GetProcessHeap () returned 0x580000 [0173.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0173.287] GetProcessHeap () returned 0x580000 [0173.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0173.287] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.287] ReadFile (in: hFile=0x43c, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x4c0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.298] GetProcessHeap () returned 0x580000 [0173.298] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.298] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.298] WriteFile (in: hFile=0x43c, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x4c0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.298] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.298] WriteFile (in: hFile=0x43c, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.298] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.298] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.299] CloseHandle (hObject=0x43c) returned 1 [0173.299] GetProcessHeap () returned 0x580000 [0173.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0173.299] GetProcessHeap () returned 0x580000 [0173.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0173.299] GetProcessHeap () returned 0x580000 [0173.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ee75380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x4c0fd28, dwReserved1=0x65f268, cFileName="POSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTSI~1.YOU")) returned 0x5b9770 [0173.299] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.301] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", len=0x3f | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 1 [0173.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0173.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.302] CloseHandle (hObject=0x43c) returned 1 [0173.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTLI~1.YOU")) returned 0x5b9770 [0173.303] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.303] GetProcessHeap () returned 0x580000 [0173.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0173.303] GetProcessHeap () returned 0x580000 [0173.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0173.303] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.303] ReadFile (in: hFile=0x43c, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x4c0ff14*=0x420, lpOverlapped=0x0) returned 1 [0174.011] GetProcessHeap () returned 0x580000 [0174.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.011] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.011] WriteFile (in: hFile=0x43c, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x4c0ff14*=0x420, lpOverlapped=0x0) returned 1 [0174.011] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.011] WriteFile (in: hFile=0x43c, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.011] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.011] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.011] CloseHandle (hObject=0x43c) returned 1 [0174.226] GetProcessHeap () returned 0x580000 [0174.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0174.226] GetProcessHeap () returned 0x580000 [0174.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0174.226] GetProcessHeap () returned 0x580000 [0174.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0176.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f54d2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x4c0fd28, dwReserved1=0x5d09a0, cFileName="POSTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTLI~1.YOU")) returned 0x5b96f0 [0176.798] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.842] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", len=0x39 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 1 [0176.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2120) returned 0x6f14048 [0176.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.649] CloseHandle (hObject=0x43c) returned 1 [0179.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id_1622540890_.your_last_chance")) returned 1 [0179.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2700, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xffe2700, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEV~1.YOU")) returned 0x5b96f0 [0179.651] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.651] GetProcessHeap () returned 0x580000 [0179.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x626d30 [0179.651] GetProcessHeap () returned 0x580000 [0179.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6273b8 [0179.651] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.651] ReadFile (in: hFile=0x43c, lpBuffer=0x626d30, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x4c0ff14*=0x640, lpOverlapped=0x0) returned 1 [0179.696] GetProcessHeap () returned 0x580000 [0179.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.696] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.696] WriteFile (in: hFile=0x43c, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x4c0ff14*=0x640, lpOverlapped=0x0) returned 1 [0179.696] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.697] WriteFile (in: hFile=0x43c, lpBuffer=0x6279f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279f7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.697] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.697] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.697] CloseHandle (hObject=0x43c) returned 1 [0179.697] GetProcessHeap () returned 0x580000 [0179.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0179.697] GetProcessHeap () returned 0x580000 [0179.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0179.697] GetProcessHeap () returned 0x580000 [0179.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2700, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa2b9a8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x668, dwReserved0=0x4c0fd28, dwReserved1=0x626d30, cFileName="SPACE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACEV~1.YOU")) returned 0x5b9770 [0181.349] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.359] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", len=0x68 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned 1 [0181.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0181.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.554] CloseHandle (hObject=0x430) returned 1 [0182.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.id_1622540890_.your_last_chance")) returned 1 [0182.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc125fc00, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL6B43~1.YOU")) returned 0x5b9770 [0182.556] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.556] GetProcessHeap () returned 0x580000 [0182.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4821) returned 0x7058838 [0182.556] GetProcessHeap () returned 0x580000 [0182.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4821) returned 0x705d068 [0182.556] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.556] ReadFile (in: hFile=0x430, lpBuffer=0x7058838, nNumberOfBytesToRead=0x4800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7058838*, lpNumberOfBytesRead=0x4c0ff14*=0x4800, lpOverlapped=0x0) returned 1 [0182.934] GetProcessHeap () returned 0x580000 [0182.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0182.934] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.934] WriteFile (in: hFile=0x430, lpBuffer=0x705d068*, nNumberOfBytesToWrite=0x4800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x705d068*, lpNumberOfBytesWritten=0x4c0ff14*=0x4800, lpOverlapped=0x0) returned 1 [0182.934] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.934] WriteFile (in: hFile=0x430, lpBuffer=0x7061867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061867*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.934] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.934] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.934] CloseHandle (hObject=0x430) returned 1 [0183.026] GetProcessHeap () returned 0x580000 [0183.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705d068 | out: hHeap=0x580000) returned 1 [0183.026] GetProcessHeap () returned 0x580000 [0183.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7058838 | out: hHeap=0x580000) returned 1 [0183.027] GetProcessHeap () returned 0x580000 [0183.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4a66540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4831, dwReserved0=0x4c0fd28, dwReserved1=0x7058838, cFileName="AlertImage_FileHigh.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL6B43~1.YOU")) returned 0x5b9770 [0183.805] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.819] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", len=0x6c | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned 1 [0183.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0183.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.479] CloseHandle (hObject=0x478) returned 1 [0185.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a68, dwReserved0=0x470050, dwReserved1=0x69002e, cFileName="BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREAKJ~1.YOU")) returned 0x5b9770 [0185.480] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.481] GetProcessHeap () returned 0x580000 [0185.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a81) returned 0x6fc0e98 [0185.481] GetProcessHeap () returned 0x580000 [0185.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a81) returned 0x6e063d0 [0185.481] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.481] ReadFile (in: hFile=0x478, lpBuffer=0x6fc0e98, nNumberOfBytesToRead=0x3a60, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc0e98*, lpNumberOfBytesRead=0x4c0ff14*=0x3a60, lpOverlapped=0x0) returned 1 [0186.696] GetProcessHeap () returned 0x580000 [0186.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.696] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.696] WriteFile (in: hFile=0x478, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x3a60, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x4c0ff14*=0x3a60, lpOverlapped=0x0) returned 1 [0186.696] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.696] WriteFile (in: hFile=0x478, lpBuffer=0x6e09e2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e09e2f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.697] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.697] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.697] CloseHandle (hObject=0x478) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc0e98 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0188.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e410a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a8c, dwReserved0=0x4c0fd28, dwReserved1=0x6fc0e98, cFileName="BREAK.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREAKJ~1.YOU")) returned 0x5b9770 [0188.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.074] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", len=0x45 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned 1 [0188.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2090) returned 0x6f14048 [0188.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0188.917] CloseHandle (hObject=0x49c) returned 1 [0188.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.id_1622540890_.your_last_chance")) returned 1 [0188.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x117f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~4.YOU")) returned 0x5b9770 [0188.918] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0188.918] GetProcessHeap () returned 0x580000 [0188.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6efb008 [0188.918] GetProcessHeap () returned 0x580000 [0188.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6f19958 [0188.918] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.918] ReadFile (in: hFile=0x49c, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x4c0ff14*=0x1160, lpOverlapped=0x0) returned 1 [0188.934] GetProcessHeap () returned 0x580000 [0188.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.934] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.934] WriteFile (in: hFile=0x49c, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x4c0ff14*=0x1160, lpOverlapped=0x0) returned 1 [0188.934] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.934] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1aab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aab7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.934] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.934] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.934] CloseHandle (hObject=0x49c) returned 1 [0188.934] GetProcessHeap () returned 0x580000 [0188.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0188.934] GetProcessHeap () returned 0x580000 [0188.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0188.934] GetProcessHeap () returned 0x580000 [0188.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa83ad6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x4c0fd28, dwReserved1=0x6efb008, cFileName="ZPDIR50F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~4.YOU")) returned 0x5b9770 [0191.715] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.394] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", len=0x5c | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned 1 [0193.394] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x205c) returned 0x6f14048 [0193.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.408] CloseHandle (hObject=0x3b8) returned 1 [0193.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.id_1622540890_.your_last_chance")) returned 1 [0193.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60975c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b97b0 [0193.409] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.410] GetProcessHeap () returned 0x580000 [0193.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0193.410] GetProcessHeap () returned 0x580000 [0193.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0193.410] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.410] ReadFile (in: hFile=0x3b8, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x4c0ff14*=0x360, lpOverlapped=0x0) returned 1 [0193.414] GetProcessHeap () returned 0x580000 [0193.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.414] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.415] WriteFile (in: hFile=0x3b8, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x4c0ff14*=0x360, lpOverlapped=0x0) returned 1 [0193.415] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.415] WriteFile (in: hFile=0x3b8, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.415] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.415] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.415] CloseHandle (hObject=0x3b8) returned 1 [0193.415] GetProcessHeap () returned 0x580000 [0193.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0193.415] GetProcessHeap () returned 0x580000 [0193.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0193.415] GetProcessHeap () returned 0x580000 [0193.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60975c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaae60140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x4c0fd28, dwReserved1=0x6eef020, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b97b0 [0193.448] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.745] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", len=0x67 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned 1 [0193.745] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0193.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.746] CloseHandle (hObject=0x39c) returned 1 [0193.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.746] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.id_1622540890_.your_last_chance")) returned 1 [0193.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~3.YOU")) returned 0x5b97f0 [0193.747] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.747] GetProcessHeap () returned 0x580000 [0193.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0193.747] GetProcessHeap () returned 0x580000 [0193.747] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0193.747] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.747] ReadFile (in: hFile=0x39c, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0197.265] GetProcessHeap () returned 0x580000 [0197.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0197.265] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.265] WriteFile (in: hFile=0x39c, lpBuffer=0x6e21520*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0197.265] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.265] WriteFile (in: hFile=0x39c, lpBuffer=0x6e32d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d1f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.266] CloseHandle (hObject=0x39c) returned 1 [0197.266] GetProcessHeap () returned 0x580000 [0197.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0197.266] GetProcessHeap () returned 0x580000 [0197.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0197.266] GetProcessHeap () returned 0x580000 [0197.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0199.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31f4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167e1, dwReserved0=0x4c0fd28, dwReserved1=0x6e0fcf0, cFileName="bg_FormsHomePage.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~3.YOU")) returned 0x5b97b0 [0199.306] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.448] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", len=0x6e | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned 1 [0199.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0199.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.472] CloseHandle (hObject=0x450) returned 1 [0199.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance")) returned 1 [0199.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x63002e, dwReserved1=0x730073, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b96b0 [0199.474] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.474] GetProcessHeap () returned 0x580000 [0199.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x677cd0 [0199.474] GetProcessHeap () returned 0x580000 [0199.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x635768 [0199.474] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.474] ReadFile (in: hFile=0x450, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4c0ff14*=0xc20, lpOverlapped=0x0) returned 1 [0199.493] GetProcessHeap () returned 0x580000 [0199.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0199.493] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.493] WriteFile (in: hFile=0x450, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x4c0ff14*=0xc20, lpOverlapped=0x0) returned 1 [0199.493] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.493] WriteFile (in: hFile=0x450, lpBuffer=0x636387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636387*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.493] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.493] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.493] CloseHandle (hObject=0x450) returned 1 [0199.493] GetProcessHeap () returned 0x580000 [0199.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0199.493] GetProcessHeap () returned 0x580000 [0199.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0199.493] GetProcessHeap () returned 0x580000 [0199.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0199.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae865980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x4c0fd28, dwReserved1=0x677cd0, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b96b0 [0199.494] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.562] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", len=0x66 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned 1 [0199.562] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0199.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.563] CloseHandle (hObject=0x450) returned 1 [0199.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0199.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e57, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b96b0 [0199.564] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.564] GetProcessHeap () returned 0x580000 [0199.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e61) returned 0x6d6e8d8 [0199.564] GetProcessHeap () returned 0x580000 [0199.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e61) returned 0x707ec98 [0199.565] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.565] ReadFile (in: hFile=0x450, lpBuffer=0x6d6e8d8, nNumberOfBytesToRead=0x6e40, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6e8d8*, lpNumberOfBytesRead=0x4c0ff14*=0x6e40, lpOverlapped=0x0) returned 1 [0200.416] GetProcessHeap () returned 0x580000 [0200.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0200.416] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.416] WriteFile (in: hFile=0x450, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x4c0ff14*=0x6e40, lpOverlapped=0x0) returned 1 [0200.416] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.416] WriteFile (in: hFile=0x450, lpBuffer=0x7085ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7085ad7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.416] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.416] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.416] CloseHandle (hObject=0x450) returned 1 [0200.921] GetProcessHeap () returned 0x580000 [0200.921] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0200.925] GetProcessHeap () returned 0x580000 [0200.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6e8d8 | out: hHeap=0x580000) returned 1 [0200.931] GetProcessHeap () returned 0x580000 [0200.931] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0201.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf12caa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6e7b, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="utilityfunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UTILIT~1.YOU")) returned 0x5b9770 [0201.397] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.429] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0201.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0201.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.455] CloseHandle (hObject=0x488) returned 1 [0201.455] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0201.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x460046, dwReserved1=0x47002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0201.496] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.496] GetProcessHeap () returned 0x580000 [0201.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0201.496] GetProcessHeap () returned 0x580000 [0201.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0201.496] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.496] ReadFile (in: hFile=0x488, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x4c0ff14*=0x160, lpOverlapped=0x0) returned 1 [0201.498] GetProcessHeap () returned 0x580000 [0201.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.498] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.498] WriteFile (in: hFile=0x488, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x4c0ff14*=0x160, lpOverlapped=0x0) returned 1 [0201.498] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.498] WriteFile (in: hFile=0x488, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.498] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.498] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.498] CloseHandle (hObject=0x488) returned 1 [0201.499] GetProcessHeap () returned 0x580000 [0201.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0201.499] GetProcessHeap () returned 0x580000 [0201.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0201.499] GetProcessHeap () returned 0x580000 [0201.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafb70980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x4c0fd28, dwReserved1=0x5b8df0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0202.189] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.305] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS", len=0x45 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS") returned 1 [0202.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0202.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0202.306] CloseHandle (hObject=0x454) returned 1 [0202.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css.id_1622540890_.your_last_chance")) returned 1 [0202.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cda8700, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cda8700, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5914~1.YOU")) returned 0x5b9770 [0202.308] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0202.308] GetProcessHeap () returned 0x580000 [0202.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0202.309] GetProcessHeap () returned 0x580000 [0202.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0202.309] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.309] ReadFile (in: hFile=0x454, lpBuffer=0x7007128, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.777] GetProcessHeap () returned 0x580000 [0208.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.777] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.777] WriteFile (in: hFile=0x454, lpBuffer=0x7018958*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.777] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.778] WriteFile (in: hFile=0x454, lpBuffer=0x702a157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a157*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.778] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.778] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.778] CloseHandle (hObject=0x454) returned 1 [0208.778] GetProcessHeap () returned 0x580000 [0208.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0208.778] GetProcessHeap () returned 0x580000 [0208.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0208.778] GetProcessHeap () returned 0x580000 [0208.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cda8700, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb40eaba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6e, dwReserved0=0x4c0fd28, dwReserved1=0x7007128, cFileName="SCHEME40.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC5914~1.YOU")) returned 0x5b97b0 [0210.087] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.121] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", len=0x65 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned 1 [0210.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0210.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0215.577] CloseHandle (hObject=0x490) returned 1 [0215.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.577] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.id_1622540890_.your_last_chance")) returned 1 [0215.578] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b97b0 [0215.578] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0215.579] GetProcessHeap () returned 0x580000 [0215.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c0730 [0215.579] GetProcessHeap () returned 0x580000 [0215.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c2938 [0215.579] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.579] ReadFile (in: hFile=0x490, lpBuffer=0x70c0730, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0730*, lpNumberOfBytesRead=0x4c0ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0216.653] GetProcessHeap () returned 0x580000 [0216.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0216.654] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.654] WriteFile (in: hFile=0x490, lpBuffer=0x70c2938*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c2938*, lpNumberOfBytesWritten=0x4c0ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0216.654] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.654] WriteFile (in: hFile=0x490, lpBuffer=0x70c4ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4ad7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0216.654] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.654] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0216.654] CloseHandle (hObject=0x490) returned 1 [0218.154] GetProcessHeap () returned 0x580000 [0218.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c2938 | out: hHeap=0x580000) returned 1 [0218.154] GetProcessHeap () returned 0x580000 [0218.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0730 | out: hHeap=0x580000) returned 1 [0218.154] GetProcessHeap () returned 0x580000 [0218.154] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8c0c200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21ca, dwReserved0=0x4c0fd28, dwReserved1=0x70c0730, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b9770 [0221.324] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0223.743] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", len=0x49 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned 1 [0223.743] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0223.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0223.744] CloseHandle (hObject=0x3e4) returned 1 [0223.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd.id_1622540890_.your_last_chance")) returned 1 [0223.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRVSCH~1.YOU")) returned 0x5b96b0 [0223.745] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0223.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0223.745] GetProcessHeap () returned 0x580000 [0223.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e1) returned 0x6f04558 [0223.745] GetProcessHeap () returned 0x580000 [0223.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e1) returned 0x6d045f8 [0223.745] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.745] ReadFile (in: hFile=0x3e4, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x4c0ff14*=0x5c0, lpOverlapped=0x0) returned 1 [0223.797] GetProcessHeap () returned 0x580000 [0223.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.797] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.797] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x4c0ff14*=0x5c0, lpOverlapped=0x0) returned 1 [0223.797] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.798] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d04bb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04bb7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.798] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.798] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.798] CloseHandle (hObject=0x3e4) returned 1 [0223.798] GetProcessHeap () returned 0x580000 [0223.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0223.798] GetProcessHeap () returned 0x580000 [0223.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0223.799] GetProcessHeap () returned 0x580000 [0223.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.799] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd009660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5f9, dwReserved0=0x4c0fd28, dwReserved1=0x6f04558, cFileName="grvschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRVSCH~1.YOU")) returned 0x5b96f0 [0223.799] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.814] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", len=0x35 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 1 [0223.814] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0223.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0223.815] CloseHandle (hObject=0x470) returned 1 [0223.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.id_1622540890_.your_last_chance")) returned 1 [0223.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXSSRV~1.YOU")) returned 0x5b9630 [0223.816] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0223.816] GetProcessHeap () returned 0x580000 [0223.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0223.817] GetProcessHeap () returned 0x580000 [0223.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0223.817] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.817] ReadFile (in: hFile=0x470, lpBuffer=0x7007128, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.346] GetProcessHeap () returned 0x580000 [0228.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0228.346] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.346] WriteFile (in: hFile=0x470, lpBuffer=0x7018958*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.347] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.347] WriteFile (in: hFile=0x470, lpBuffer=0x702a157*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a157*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0228.347] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.347] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0228.347] CloseHandle (hObject=0x470) returned 1 [0228.347] GetProcessHeap () returned 0x580000 [0228.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0228.347] GetProcessHeap () returned 0x580000 [0228.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0228.347] GetProcessHeap () returned 0x580000 [0228.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbf9fda20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fdcc, dwReserved0=0x4c0fd28, dwReserved1=0x7007128, cFileName="IXSSRV.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXSSRV~1.YOU")) returned 0x5b9630 [0230.726] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.740] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", len=0x36 | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 1 [0230.740] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0230.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0230.741] CloseHandle (hObject=0x45c) returned 1 [0230.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id_1622540890_.your_last_chance")) returned 1 [0230.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7J~1.YOU")) returned 0x5b9630 [0230.742] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0230.742] GetProcessHeap () returned 0x580000 [0230.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7545e18 [0230.743] GetProcessHeap () returned 0x580000 [0230.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7557648 [0230.744] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.744] ReadFile (in: hFile=0x45c, lpBuffer=0x7545e18, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7545e18*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.954] GetProcessHeap () returned 0x580000 [0237.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0237.954] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.955] WriteFile (in: hFile=0x45c, lpBuffer=0x7557648*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7557648*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.271] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.271] WriteFile (in: hFile=0x45c, lpBuffer=0x7568e47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7568e47*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.343] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.343] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.343] CloseHandle (hObject=0x45c) returned 1 [0239.472] GetProcessHeap () returned 0x580000 [0239.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7557648 | out: hHeap=0x580000) returned 1 [0239.472] GetProcessHeap () returned 0x580000 [0239.472] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7545e18 | out: hHeap=0x580000) returned 1 [0239.473] GetProcessHeap () returned 0x580000 [0239.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0241.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1da5c0, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="mset7jp.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7J~1.YOU")) returned 0x5b9730 [0241.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.423] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML", len=0x3f | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned 1 [0241.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0241.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0241.424] CloseHandle (hObject=0x478) returned 1 [0241.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml.id_1622540890_.your_last_chance")) returned 1 [0241.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6900a600, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6900a600, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x45792, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN11~1.YOU")) returned 0x5b9630 [0241.425] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0241.425] GetProcessHeap () returned 0x580000 [0241.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0241.425] GetProcessHeap () returned 0x580000 [0241.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0241.425] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.425] ReadFile (in: hFile=0x478, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.435] GetProcessHeap () returned 0x580000 [0244.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0244.435] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.435] WriteFile (in: hFile=0x478, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x4c0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.435] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.435] WriteFile (in: hFile=0x478, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.544] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.544] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.545] CloseHandle (hObject=0x478) returned 1 [0244.559] GetProcessHeap () returned 0x580000 [0244.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0244.559] GetProcessHeap () returned 0x580000 [0244.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0244.564] GetProcessHeap () returned 0x580000 [0244.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6900a600, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc946ad60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x457b6, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PGMN111.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN11~1.YOU")) returned 0x5b9730 [0249.275] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.385] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC", len=0x3e | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 1 [0249.385] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0249.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0249.386] CloseHandle (hObject=0x264) returned 1 [0249.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.id_1622540890_.your_last_chance")) returned 1 [0249.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS53BO~1.YOU")) returned 0x5b9730 [0249.387] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0249.387] GetProcessHeap () returned 0x580000 [0249.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c21890 [0249.387] GetProcessHeap () returned 0x580000 [0249.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c21cd8 [0249.387] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.388] ReadFile (in: hFile=0x264, lpBuffer=0x6c21890, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesRead=0x4c0ff14*=0x400, lpOverlapped=0x0) returned 1 [0249.542] GetProcessHeap () returned 0x580000 [0249.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0249.542] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.542] WriteFile (in: hFile=0x264, lpBuffer=0x6c21cd8*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21cd8*, lpNumberOfBytesWritten=0x4c0ff14*=0x400, lpOverlapped=0x0) returned 1 [0249.542] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.542] WriteFile (in: hFile=0x264, lpBuffer=0x6c220d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c220d7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0249.542] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.542] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0249.542] CloseHandle (hObject=0x264) returned 1 [0249.543] GetProcessHeap () returned 0x580000 [0249.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21cd8 | out: hHeap=0x580000) returned 1 [0249.544] GetProcessHeap () returned 0x580000 [0249.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0249.544] GetProcessHeap () returned 0x580000 [0249.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0249.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc42c6c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x4c0fd28, dwReserved1=0x6c21890, cFileName="BS53BOXS.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS53BO~1.YOU")) returned 0x5b9730 [0252.898] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.370] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC", len=0x3d | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC") returned 1 [0255.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f78) returned 0x72e5948 [0255.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.805] CloseHandle (hObject=0x4a8) returned 1 [0258.805] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.805] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc.id_1622540890_.your_last_chance")) returned 1 [0258.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMCT~1.YOU")) returned 0x5b96f0 [0258.806] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.807] GetProcessHeap () returned 0x580000 [0258.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0258.807] GetProcessHeap () returned 0x580000 [0258.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0258.807] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.807] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x4c0ff14*=0x820, lpOverlapped=0x0) returned 1 [0258.816] GetProcessHeap () returned 0x580000 [0258.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.816] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.816] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x4c0ff14*=0x820, lpOverlapped=0x0) returned 1 [0258.816] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.816] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.816] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.816] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.816] CloseHandle (hObject=0x4a8) returned 1 [0258.816] GetProcessHeap () returned 0x580000 [0258.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0258.816] GetProcessHeap () returned 0x580000 [0258.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0258.816] GetProcessHeap () returned 0x580000 [0258.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fccc | out: lpFindFileData=0x4c0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1c8b780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x4c0fd28, dwReserved1=0x6c79898, cFileName="FORMCTL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMCT~1.YOU")) returned 0x5b9630 [0259.224] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.237] SysReAllocStringLen (in: pbstr=0x4c0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML", len=0x3a | out: pbstr=0x4c0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML") returned 1 [0259.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2084) returned 0x72e5948 [0259.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0259.326] CloseHandle (hObject=0x478) returned 1 [0259.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml.id_1622540890_.your_last_chance")) returned 1 [0259.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4c0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4c0fc74 | out: lpFindFileData=0x4c0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa373d00, ftCreationTime.dwHighDateTime=0x1ca1adc, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa373d00, ftLastWriteTime.dwHighDateTime=0x1ca1adc, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNXM~1.YOU")) returned 0x5b9630 [0259.328] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0259.328] GetProcessHeap () returned 0x580000 [0259.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ac1) returned 0x72bb898 [0259.328] GetProcessHeap () returned 0x580000 [0259.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ac1) returned 0x72dded8 [0259.328] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.328] ReadFile (in: hFile=0x478, lpBuffer=0x72bb898, nNumberOfBytesToRead=0x2aa0, lpNumberOfBytesRead=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bb898*, lpNumberOfBytesRead=0x4c0ff14*=0x2aa0, lpOverlapped=0x0) returned 1 [0261.307] GetProcessHeap () returned 0x580000 [0261.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0261.307] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.307] WriteFile (in: hFile=0x478, lpBuffer=0x72dded8*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72dded8*, lpNumberOfBytesWritten=0x4c0ff14*=0x2aa0, lpOverlapped=0x0) returned 1 [0261.307] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.307] WriteFile (in: hFile=0x478, lpBuffer=0x72e0977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e0977*, lpNumberOfBytesWritten=0x4c0ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.307] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.307] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4c0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4c0ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.308] CloseHandle (hObject=0x478) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72dded8 | out: hHeap=0x580000) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72bb898 | out: hHeap=0x580000) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 Thread: id = 38 os_tid = 0xa90 [0039.066] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.111] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.283] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.745] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.782] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.002] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.100] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.139] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.344] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.405] Sleep (dwMilliseconds=0x1) [0043.420] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.763] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.651] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.807] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.885] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.478] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.853] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.946] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.993] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.024] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.211] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.276] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.345] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.367] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.396] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.599] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.197] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.706] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.753] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.909] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.299] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.502] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.596] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.767] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.923] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.001] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.625] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.890] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.202] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.249] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.358] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.483] Sleep (dwMilliseconds=0x1) [0051.499] Sleep (dwMilliseconds=0x1) [0051.514] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.608] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.657] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.793] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.980] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.152] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.448] Sleep (dwMilliseconds=0x1) [0052.464] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.760] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.010] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.041] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.275] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.665] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.821] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.868] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.289] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.414] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.445] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.601] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.726] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.757] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.804] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.913] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.991] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.303] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.381] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.893] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", len=0x4b | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 1 [0055.893] GetProcessHeap () returned 0x580000 [0055.893] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0055.893] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.123] CloseHandle (hObject=0x3f4) returned 1 [0056.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0056.124] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id_1622540890_.your_last_chance")) returned 1 [0056.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0056.124] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x45, dwReserved1=0x0, cFileName="ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~2.YOU")) returned 0x5b9630 [0056.124] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.124] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0056.124] GetProcessHeap () returned 0x580000 [0056.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x5f3908 [0056.124] GetProcessHeap () returned 0x580000 [0056.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x6c56108 [0056.125] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.125] ReadFile (in: hFile=0x3f4, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x4d4ff14*=0x600, lpOverlapped=0x0) returned 1 [0056.131] GetProcessHeap () returned 0x580000 [0056.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0056.131] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.131] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x4d4ff14*=0x600, lpOverlapped=0x0) returned 1 [0056.132] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.132] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c56707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56707*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0056.132] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.132] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0056.132] CloseHandle (hObject=0x3f4) returned 1 [0056.133] GetProcessHeap () returned 0x580000 [0056.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0056.133] GetProcessHeap () returned 0x580000 [0056.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0056.133] GetProcessHeap () returned 0x580000 [0056.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0056.133] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x594258c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x641, dwReserved0=0x4d4fd28, dwReserved1=0x5f3908, cFileName="ExcelMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~2.YOU")) returned 0x5b9630 [0056.133] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.691] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", len=0x4d | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 1 [0056.691] GetProcessHeap () returned 0x580000 [0056.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0056.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.288] CloseHandle (hObject=0x41c) returned 1 [0057.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.331] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id_1622540890_.your_last_chance")) returned 1 [0057.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.351] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~2.YOU")) returned 0x5b9630 [0057.352] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.352] GetProcessHeap () returned 0x580000 [0057.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x6c56108 [0057.352] GetProcessHeap () returned 0x580000 [0057.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x6ce34a8 [0057.352] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.352] ReadFile (in: hFile=0x41c, lpBuffer=0x6c56108, nNumberOfBytesToRead=0xc60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesRead=0x4d4ff14*=0xc60, lpOverlapped=0x0) returned 1 [0057.365] GetProcessHeap () returned 0x580000 [0057.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0057.365] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.365] WriteFile (in: hFile=0x41c, lpBuffer=0x6ce34a8*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce34a8*, lpNumberOfBytesWritten=0x4d4ff14*=0xc60, lpOverlapped=0x0) returned 1 [0057.365] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.365] WriteFile (in: hFile=0x41c, lpBuffer=0x6ce4107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce4107*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0057.365] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.365] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0057.365] CloseHandle (hObject=0x41c) returned 1 [0057.366] GetProcessHeap () returned 0x580000 [0057.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce34a8 | out: hHeap=0x580000) returned 1 [0057.366] GetProcessHeap () returned 0x580000 [0057.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0057.366] GetProcessHeap () returned 0x580000 [0057.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0057.366] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x59fe6560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x4d4fd28, dwReserved1=0x6c56108, cFileName="OutlookMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~2.YOU")) returned 0x5b9630 [0057.367] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.298] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0058.298] GetProcessHeap () returned 0x580000 [0058.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f730, Size=0x28) returned 0x5dc340 [0058.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.298] CloseHandle (hObject=0x424) returned 1 [0058.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.298] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0058.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.299] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0058.299] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.299] GetProcessHeap () returned 0x580000 [0058.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x6d57110 [0058.299] GetProcessHeap () returned 0x580000 [0058.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x66bcd0 [0058.299] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.299] ReadFile (in: hFile=0x424, lpBuffer=0x6d57110, nNumberOfBytesToRead=0x16e0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d57110*, lpNumberOfBytesRead=0x4d4ff14*=0x16e0, lpOverlapped=0x0) returned 1 [0058.325] GetProcessHeap () returned 0x580000 [0058.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0058.325] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.325] WriteFile (in: hFile=0x424, lpBuffer=0x66bcd0*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x66bcd0*, lpNumberOfBytesWritten=0x4d4ff14*=0x16e0, lpOverlapped=0x0) returned 1 [0058.325] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.326] WriteFile (in: hFile=0x424, lpBuffer=0x66d3af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x66d3af*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0058.326] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.326] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0058.326] CloseHandle (hObject=0x424) returned 1 [0058.327] GetProcessHeap () returned 0x580000 [0058.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x66bcd0 | out: hHeap=0x580000) returned 1 [0058.327] GetProcessHeap () returned 0x580000 [0058.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d57110 | out: hHeap=0x580000) returned 1 [0058.327] GetProcessHeap () returned 0x580000 [0058.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0058.327] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5a8f9940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x4d4fd28, dwReserved1=0x6d57110, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0058.327] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.329] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", len=0x4b | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 1 [0058.329] GetProcessHeap () returned 0x580000 [0058.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x24) returned 0x5dc550 [0058.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.329] CloseHandle (hObject=0x424) returned 1 [0058.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.330] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id_1622540890_.your_last_chance")) returned 1 [0058.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.331] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x45, dwReserved1=0x0, cFileName="Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~1.YOU")) returned 0x5b9630 [0058.331] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.331] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.331] GetProcessHeap () returned 0x580000 [0058.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f7360 [0058.331] GetProcessHeap () returned 0x580000 [0058.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d33678 [0058.331] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.331] ReadFile (in: hFile=0x424, lpBuffer=0x5f7360, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f7360*, lpNumberOfBytesRead=0x4d4ff14*=0x320, lpOverlapped=0x0) returned 1 [0058.335] GetProcessHeap () returned 0x580000 [0058.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0058.335] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.335] WriteFile (in: hFile=0x424, lpBuffer=0x6d33678*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33678*, lpNumberOfBytesWritten=0x4d4ff14*=0x320, lpOverlapped=0x0) returned 1 [0058.336] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.336] WriteFile (in: hFile=0x424, lpBuffer=0x6d33997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33997*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0058.336] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.336] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0058.336] CloseHandle (hObject=0x424) returned 1 [0058.337] GetProcessHeap () returned 0x580000 [0058.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33678 | out: hHeap=0x580000) returned 1 [0058.337] GetProcessHeap () returned 0x580000 [0058.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f7360 | out: hHeap=0x580000) returned 1 [0058.337] GetProcessHeap () returned 0x580000 [0058.337] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0058.337] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5a91faa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x4d4fd28, dwReserved1=0x5f7360, cFileName="Proofing.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~1.YOU")) returned 0x5b9630 [0058.337] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.483] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.483] GetProcessHeap () returned 0x580000 [0059.483] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x607848, Size=0x64) returned 0x6077d8 [0059.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.840] CloseHandle (hObject=0x434) returned 1 [0061.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.840] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0061.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.841] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9670 [0061.841] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.841] GetProcessHeap () returned 0x580000 [0061.841] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0061.841] GetProcessHeap () returned 0x580000 [0061.841] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x67eff0 [0061.841] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.841] ReadFile (in: hFile=0x434, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x4d4ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0061.847] GetProcessHeap () returned 0x580000 [0061.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0061.847] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.847] WriteFile (in: hFile=0x434, lpBuffer=0x67eff0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67eff0*, lpNumberOfBytesWritten=0x4d4ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0061.848] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x434, lpBuffer=0x67f58f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f58f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.848] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.848] CloseHandle (hObject=0x434) returned 1 [0061.849] GetProcessHeap () returned 0x580000 [0061.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67eff0 | out: hHeap=0x580000) returned 1 [0061.849] GetProcessHeap () returned 0x580000 [0061.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0061.849] GetProcessHeap () returned 0x580000 [0061.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0061.849] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5ca99000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x4d4fd28, dwReserved1=0x5f3908, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9670 [0061.849] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.854] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.855] GetProcessHeap () returned 0x580000 [0061.855] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x38) returned 0x5b5bc8 [0061.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.855] CloseHandle (hObject=0x434) returned 1 [0061.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.855] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0061.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.856] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9670 [0061.856] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.856] GetProcessHeap () returned 0x580000 [0061.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x67eff0 [0061.856] GetProcessHeap () returned 0x580000 [0061.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6d330a8 [0061.856] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.856] ReadFile (in: hFile=0x434, lpBuffer=0x67eff0, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67eff0*, lpNumberOfBytesRead=0x4d4ff14*=0xa40, lpOverlapped=0x0) returned 1 [0061.867] GetProcessHeap () returned 0x580000 [0061.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0061.868] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x434, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x4d4ff14*=0xa40, lpOverlapped=0x0) returned 1 [0061.868] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x434, lpBuffer=0x6d33ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33ae7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.868] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.868] CloseHandle (hObject=0x434) returned 1 [0061.869] GetProcessHeap () returned 0x580000 [0061.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0061.869] GetProcessHeap () returned 0x580000 [0061.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67eff0 | out: hHeap=0x580000) returned 1 [0061.869] GetProcessHeap () returned 0x580000 [0061.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0061.869] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5cabf160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa64, dwReserved0=0x4d4fd28, dwReserved1=0x67eff0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9670 [0061.869] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.870] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", len=0x4f | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 1 [0061.870] GetProcessHeap () returned 0x580000 [0061.870] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x34) returned 0x5b5bc8 [0061.870] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.870] CloseHandle (hObject=0x434) returned 1 [0061.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.871] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id_1622540890_.your_last_chance")) returned 1 [0061.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.871] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b9670 [0061.871] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.871] GetProcessHeap () returned 0x580000 [0061.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f7360 [0061.871] GetProcessHeap () returned 0x580000 [0061.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f3908 [0061.872] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.872] ReadFile (in: hFile=0x434, lpBuffer=0x5f7360, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f7360*, lpNumberOfBytesRead=0x4d4ff14*=0x320, lpOverlapped=0x0) returned 1 [0061.876] GetProcessHeap () returned 0x580000 [0061.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0061.876] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.876] WriteFile (in: hFile=0x434, lpBuffer=0x5f3908*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesWritten=0x4d4ff14*=0x320, lpOverlapped=0x0) returned 1 [0061.876] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.876] WriteFile (in: hFile=0x434, lpBuffer=0x5f3c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3c27*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.876] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.876] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.876] CloseHandle (hObject=0x434) returned 1 [0061.877] GetProcessHeap () returned 0x580000 [0061.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0061.877] GetProcessHeap () returned 0x580000 [0061.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f7360 | out: hHeap=0x580000) returned 1 [0061.877] GetProcessHeap () returned 0x580000 [0061.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0061.877] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5cae52c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x4d4fd28, dwReserved1=0x5f7360, cFileName="AccessMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b9670 [0061.877] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.886] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", len=0x4f | out: pbstr=0x4d4ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 1 [0061.886] GetProcessHeap () returned 0x580000 [0061.886] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x30) returned 0x5b5bc8 [0061.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.886] CloseHandle (hObject=0x434) returned 1 [0061.886] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.886] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id_1622540890_.your_last_chance")) returned 1 [0061.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.887] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b9670 [0061.887] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0061.887] GetProcessHeap () returned 0x580000 [0061.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f21878 [0061.888] GetProcessHeap () returned 0x580000 [0061.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f330a8 [0061.889] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.889] ReadFile (in: hFile=0x434, lpBuffer=0x6f21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21878*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0067.002] GetProcessHeap () returned 0x580000 [0067.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0067.002] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.002] WriteFile (in: hFile=0x434, lpBuffer=0x6f330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f330a8*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0067.721] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.721] WriteFile (in: hFile=0x434, lpBuffer=0x6f448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f448a7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.936] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.936] WriteFile (in: hFile=0x434, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.936] CloseHandle (hObject=0x434) returned 1 [0068.041] GetProcessHeap () returned 0x580000 [0068.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f330a8 | out: hHeap=0x580000) returned 1 [0068.041] GetProcessHeap () returned 0x580000 [0068.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f21878 | out: hHeap=0x580000) returned 1 [0068.041] GetProcessHeap () returned 0x580000 [0068.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0068.832] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x604c49a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd4224, dwReserved0=0x4d4fd28, dwReserved1=0x6f21878, cFileName="AccessMUISet.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b96b0 [0068.832] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.848] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", len=0x40 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 1 [0068.848] GetProcessHeap () returned 0x580000 [0068.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a8a0, Size=0x3c) returned 0x61aa50 [0068.851] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.858] CloseHandle (hObject=0x458) returned 1 [0068.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id_1622540890_.your_last_chance")) returned 1 [0068.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PNG32F~1.YOU")) returned 0x5b96f0 [0068.891] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0068.891] GetProcessHeap () returned 0x580000 [0068.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0068.892] GetProcessHeap () returned 0x580000 [0068.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d458e0 [0068.892] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.893] ReadFile (in: hFile=0x458, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.456] GetProcessHeap () returned 0x580000 [0073.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0073.457] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x458, lpBuffer=0x6d458e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.457] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.457] WriteFile (in: hFile=0x458, lpBuffer=0x6d570df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d570df*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.934] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.934] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.934] CloseHandle (hObject=0x458) returned 1 [0073.934] GetProcessHeap () returned 0x580000 [0073.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0073.935] GetProcessHeap () returned 0x580000 [0073.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0073.935] GetProcessHeap () returned 0x580000 [0073.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0074.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63bd0660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x49fa4, dwReserved0=0x4d4fd28, dwReserved1=0x6d340b0, cFileName="PNG32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PNG32F~1.YOU")) returned 0x5b9730 [0074.647] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.329] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", len=0x3d | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 1 [0079.329] GetProcessHeap () returned 0x580000 [0079.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x94) returned 0x5f76f0 [0079.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.330] Sleep (dwMilliseconds=0x1) [0079.342] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", len=0x3c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 1 [0079.342] GetProcessHeap () returned 0x580000 [0079.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x60) returned 0x5f76f0 [0079.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.342] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.494] Sleep (dwMilliseconds=0x1) [0085.955] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", len=0x4c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 1 [0085.955] GetProcessHeap () returned 0x580000 [0085.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc4) returned 0x614a48 [0085.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.957] Sleep (dwMilliseconds=0x1) [0085.973] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", len=0x4c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 1 [0085.973] GetProcessHeap () returned 0x580000 [0085.973] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x58) returned 0x614a48 [0085.973] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.987] Sleep (dwMilliseconds=0x1) [0088.365] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", len=0x4b | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 1 [0088.365] GetProcessHeap () returned 0x580000 [0088.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0088.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0088.365] CloseHandle (hObject=0x414) returned 1 [0088.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id_1622540890_.your_last_chance")) returned 1 [0088.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x45, dwReserved1=0x0, cFileName="COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPAS~1.YOU")) returned 0x5b96b0 [0088.366] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.366] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0088.367] GetProcessHeap () returned 0x580000 [0088.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60aa58 [0088.367] GetProcessHeap () returned 0x580000 [0088.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60ac80 [0088.367] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.367] ReadFile (in: hFile=0x414, lpBuffer=0x60aa58, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60aa58*, lpNumberOfBytesRead=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0088.369] GetProcessHeap () returned 0x580000 [0088.369] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.369] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.370] WriteFile (in: hFile=0x414, lpBuffer=0x60ac80*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ac80*, lpNumberOfBytesWritten=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0088.370] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.370] WriteFile (in: hFile=0x414, lpBuffer=0x60ae5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ae5f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.370] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.370] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.370] CloseHandle (hObject=0x414) returned 1 [0088.370] GetProcessHeap () returned 0x580000 [0088.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ac80 | out: hHeap=0x580000) returned 1 [0088.370] GetProcessHeap () returned 0x580000 [0088.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60aa58 | out: hHeap=0x580000) returned 1 [0088.370] GetProcessHeap () returned 0x580000 [0088.370] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c489600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20a, dwReserved0=0x4d4fd28, dwReserved1=0x60aa58, cFileName="COMPASS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPAS~1.YOU")) returned 0x5b96b0 [0088.370] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.674] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", len=0x45 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 1 [0091.674] GetProcessHeap () returned 0x580000 [0091.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0091.674] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.688] CloseHandle (hObject=0x3f4) returned 1 [0091.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id_1622540890_.your_last_chance")) returned 1 [0091.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECHOIN~1.YOU")) returned 0x5b96f0 [0091.689] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.689] GetProcessHeap () returned 0x580000 [0091.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60b520 [0091.690] GetProcessHeap () returned 0x580000 [0091.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60b0d0 [0091.690] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.690] ReadFile (in: hFile=0x3f4, lpBuffer=0x60b520, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b520*, lpNumberOfBytesRead=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0091.692] GetProcessHeap () returned 0x580000 [0091.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.692] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.692] WriteFile (in: hFile=0x3f4, lpBuffer=0x60b0d0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b0d0*, lpNumberOfBytesWritten=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0091.692] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.692] WriteFile (in: hFile=0x3f4, lpBuffer=0x60b2af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b2af*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.692] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.693] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.693] CloseHandle (hObject=0x3f4) returned 1 [0091.693] GetProcessHeap () returned 0x580000 [0091.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60b0d0 | out: hHeap=0x580000) returned 1 [0091.693] GetProcessHeap () returned 0x580000 [0091.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60b520 | out: hHeap=0x580000) returned 1 [0091.693] GetProcessHeap () returned 0x580000 [0091.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e439ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x4d4fd28, dwReserved1=0x60b520, cFileName="ECHO.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECHOIN~1.YOU")) returned 0x5b96b0 [0091.702] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.713] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 1 [0091.713] GetProcessHeap () returned 0x580000 [0091.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0091.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0091.713] CloseHandle (hObject=0x498) returned 1 [0091.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0091.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.715] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0091.716] GetProcessHeap () returned 0x580000 [0091.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6741) returned 0x6de5be0 [0091.716] GetProcessHeap () returned 0x580000 [0091.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6741) returned 0x6dec330 [0091.716] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.716] ReadFile (in: hFile=0x498, lpBuffer=0x6de5be0, nNumberOfBytesToRead=0x6720, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5be0*, lpNumberOfBytesRead=0x4d4ff14*=0x6720, lpOverlapped=0x0) returned 1 [0093.838] GetProcessHeap () returned 0x580000 [0093.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.838] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.838] WriteFile (in: hFile=0x498, lpBuffer=0x6dec330*, nNumberOfBytesToWrite=0x6720, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec330*, lpNumberOfBytesWritten=0x4d4ff14*=0x6720, lpOverlapped=0x0) returned 1 [0093.839] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.839] WriteFile (in: hFile=0x498, lpBuffer=0x6df2a4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a4f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0093.839] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.839] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0093.839] CloseHandle (hObject=0x498) returned 1 [0093.840] GetProcessHeap () returned 0x580000 [0093.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec330 | out: hHeap=0x580000) returned 1 [0093.840] GetProcessHeap () returned 0x580000 [0093.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5be0 | out: hHeap=0x580000) returned 1 [0093.840] GetProcessHeap () returned 0x580000 [0093.840] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f8c18a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6746, dwReserved0=0x4d4fd28, dwReserved1=0x6de5be0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0094.390] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.440] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", len=0x4b | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 1 [0094.440] GetProcessHeap () returned 0x580000 [0094.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x48) returned 0x596c88 [0094.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0094.448] CloseHandle (hObject=0x4a8) returned 1 [0094.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.448] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id_1622540890_.your_last_chance")) returned 1 [0094.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x45, dwReserved1=0x0, cFileName="RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RMNSQU~2.YOU")) returned 0x5b96b0 [0094.449] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0094.449] GetProcessHeap () returned 0x580000 [0094.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f81018 [0094.449] GetProcessHeap () returned 0x580000 [0094.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f92848 [0094.449] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.449] ReadFile (in: hFile=0x4a8, lpBuffer=0x6f81018, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f81018*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.952] GetProcessHeap () returned 0x580000 [0099.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0099.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f92848*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f92848*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x6fa4047*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa4047*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.954] CloseHandle (hObject=0x4a8) returned 1 [0099.954] GetProcessHeap () returned 0x580000 [0099.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f92848 | out: hHeap=0x580000) returned 1 [0099.957] GetProcessHeap () returned 0x580000 [0099.957] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f81018 | out: hHeap=0x580000) returned 1 [0099.958] GetProcessHeap () returned 0x580000 [0099.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x733133a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11e5b, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="RMNSQUE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RMNSQU~2.YOU")) returned 0x5b96b0 [0101.437] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.620] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", len=0x4d | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 1 [0101.620] GetProcessHeap () returned 0x580000 [0101.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f420 [0101.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0101.620] CloseHandle (hObject=0x3f4) returned 1 [0101.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id_1622540890_.your_last_chance")) returned 1 [0104.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERM~1.YOU")) returned 0x5b9630 [0104.656] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0104.656] GetProcessHeap () returned 0x580000 [0104.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x67c940 [0104.656] GetProcessHeap () returned 0x580000 [0104.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673ce8 [0104.657] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.657] ReadFile (in: hFile=0x3e4, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x4d4ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0104.661] GetProcessHeap () returned 0x580000 [0104.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0104.661] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.661] WriteFile (in: hFile=0x3e4, lpBuffer=0x673ce8*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x673ce8*, lpNumberOfBytesWritten=0x4d4ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0104.661] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.661] WriteFile (in: hFile=0x3e4, lpBuffer=0x673f87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x673f87*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0104.661] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.661] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0104.661] CloseHandle (hObject=0x3e4) returned 1 [0104.661] GetProcessHeap () returned 0x580000 [0104.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673ce8 | out: hHeap=0x580000) returned 1 [0104.661] GetProcessHeap () returned 0x580000 [0104.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0104.661] GetProcessHeap () returned 0x580000 [0104.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0104.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75fdb180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2cf, dwReserved0=0x4d4fd28, dwReserved1=0x67c940, cFileName="WATERMAR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERM~1.YOU")) returned 0x5b9630 [0104.662] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.671] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", len=0x34 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 1 [0109.672] GetProcessHeap () returned 0x580000 [0109.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0109.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.709] Sleep (dwMilliseconds=0x1) [0111.108] Sleep (dwMilliseconds=0x1) [0111.119] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.712] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", len=0x38 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 1 [0111.713] GetProcessHeap () returned 0x580000 [0111.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0111.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.716] Sleep (dwMilliseconds=0x1) [0111.885] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", len=0x4b | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 1 [0111.886] GetProcessHeap () returned 0x580000 [0111.886] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0111.886] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.890] Sleep (dwMilliseconds=0x1) [0111.902] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", len=0x4f | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 1 [0111.902] GetProcessHeap () returned 0x580000 [0111.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f928, Size=0x2c) returned 0x61f8f0 [0111.902] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.907] Sleep (dwMilliseconds=0x1) [0111.931] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", len=0x41 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 1 [0111.931] GetProcessHeap () returned 0x580000 [0111.931] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.934] Sleep (dwMilliseconds=0x1) [0111.957] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", len=0x46 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 1 [0111.957] GetProcessHeap () returned 0x580000 [0111.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x74) returned 0x5d6058 [0111.957] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.957] Sleep (dwMilliseconds=0x1) [0111.966] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", len=0x45 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 1 [0111.966] GetProcessHeap () returned 0x580000 [0111.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c564c8, Size=0x58) returned 0x5a4778 [0111.966] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.969] Sleep (dwMilliseconds=0x1) [0112.003] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", len=0x4b | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 1 [0112.003] GetProcessHeap () returned 0x580000 [0112.003] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f848 [0112.003] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.007] Sleep (dwMilliseconds=0x1) [0112.011] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", len=0x4e | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 1 [0112.011] GetProcessHeap () returned 0x580000 [0112.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.011] Sleep (dwMilliseconds=0x1) [0112.056] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", len=0x51 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.056] GetProcessHeap () returned 0x580000 [0112.056] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.056] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.061] Sleep (dwMilliseconds=0x1) [0112.087] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", len=0x44 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 1 [0112.087] GetProcessHeap () returned 0x580000 [0112.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.087] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.087] Sleep (dwMilliseconds=0x1) [0112.102] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", len=0x4e | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned 1 [0112.102] GetProcessHeap () returned 0x580000 [0112.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.102] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.103] Sleep (dwMilliseconds=0x1) [0112.120] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", len=0x53 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.120] GetProcessHeap () returned 0x580000 [0112.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x70) returned 0x6f1b0a0 [0112.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.120] Sleep (dwMilliseconds=0x1) [0112.152] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", len=0x46 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned 1 [0112.152] GetProcessHeap () returned 0x580000 [0112.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.152] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.155] Sleep (dwMilliseconds=0x1) [0112.168] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", len=0x4e | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned 1 [0112.168] GetProcessHeap () returned 0x580000 [0112.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.171] Sleep (dwMilliseconds=0x1) [0112.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.184] Sleep (dwMilliseconds=0x1) [0112.197] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.201] Sleep (dwMilliseconds=0x1) [0112.228] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", len=0x49 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned 1 [0112.228] GetProcessHeap () returned 0x580000 [0112.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.228] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.228] Sleep (dwMilliseconds=0x1) [0112.243] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", len=0x5e | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.243] GetProcessHeap () returned 0x580000 [0112.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.244] Sleep (dwMilliseconds=0x1) [0112.259] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", len=0x54 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned 1 [0112.259] GetProcessHeap () returned 0x580000 [0112.259] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b96b0 [0112.259] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.259] Sleep (dwMilliseconds=0x1) [0112.275] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", len=0x52 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned 1 [0112.275] GetProcessHeap () returned 0x580000 [0112.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.275] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.275] Sleep (dwMilliseconds=0x1) [0112.291] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", len=0x4f | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned 1 [0112.291] GetProcessHeap () returned 0x580000 [0112.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x48) returned 0x596cd8 [0112.291] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.294] Sleep (dwMilliseconds=0x1) [0112.307] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", len=0x56 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 1 [0112.307] GetProcessHeap () returned 0x580000 [0112.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x70) returned 0x6f1afb0 [0112.307] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.309] Sleep (dwMilliseconds=0x1) [0112.321] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", len=0x62 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.321] GetProcessHeap () returned 0x580000 [0112.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.321] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.321] Sleep (dwMilliseconds=0x1) [0112.337] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 1 [0112.337] GetProcessHeap () returned 0x580000 [0112.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8b8, Size=0x2c) returned 0x61f880 [0112.337] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.337] Sleep (dwMilliseconds=0x1) [0112.352] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv", len=0x4c | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv") returned 1 [0112.352] GetProcessHeap () returned 0x580000 [0112.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x68) returned 0x6f09508 [0112.352] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.354] Sleep (dwMilliseconds=0x1) [0112.368] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", len=0x46 | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 1 [0112.368] GetProcessHeap () returned 0x580000 [0112.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.370] Sleep (dwMilliseconds=0x1) [0112.383] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", len=0x2e | out: pbstr=0x4d4ff84*="C:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned 1 [0112.383] GetProcessHeap () returned 0x580000 [0112.383] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.383] Sleep (dwMilliseconds=0x1) [0112.398] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", len=0x4d | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 1 [0112.399] GetProcessHeap () returned 0x580000 [0112.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0112.433] CloseHandle (hObject=0x430) returned 1 [0112.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.433] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id_1622540890_.your_last_chance")) returned 1 [0112.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL90X~1.YOU")) returned 0x5b9630 [0112.434] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0112.434] GetProcessHeap () returned 0x580000 [0112.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a61) returned 0x626d18 [0112.435] GetProcessHeap () returned 0x580000 [0112.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a61) returned 0x6c6a0f8 [0112.435] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.435] ReadFile (in: hFile=0x430, lpBuffer=0x626d18, nNumberOfBytesToRead=0x9a40, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x4d4ff14*=0x9a40, lpOverlapped=0x0) returned 1 [0113.033] GetProcessHeap () returned 0x580000 [0113.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.033] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.033] WriteFile (in: hFile=0x430, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0x9a40, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x4d4ff14*=0x9a40, lpOverlapped=0x0) returned 1 [0113.033] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.033] WriteFile (in: hFile=0x430, lpBuffer=0x6c73b37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c73b37*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.033] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.033] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.033] CloseHandle (hObject=0x430) returned 1 [0113.087] GetProcessHeap () returned 0x580000 [0113.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0113.088] GetProcessHeap () returned 0x580000 [0113.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0113.088] GetProcessHeap () returned 0x580000 [0113.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.289] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7afbf3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9a7f, dwReserved0=0x4d4fd28, dwReserved1=0x626d18, cFileName="sql90.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL90X~1.YOU")) returned 0x5b9730 [0113.289] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.310] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", len=0x3f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 1 [0113.310] GetProcessHeap () returned 0x580000 [0113.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x108) returned 0x6f0ceb8 [0113.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0113.497] CloseHandle (hObject=0x42c) returned 1 [0113.498] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.498] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0422~1.YOU")) returned 0x5b9630 [0115.125] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0115.125] GetProcessHeap () returned 0x580000 [0115.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2141) returned 0x6c4a808 [0115.125] GetProcessHeap () returned 0x580000 [0115.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2141) returned 0x6c4c958 [0115.126] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.126] ReadFile (in: hFile=0x42c, lpBuffer=0x6c4a808, nNumberOfBytesToRead=0x2120, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesRead=0x4d4ff14*=0x2120, lpOverlapped=0x0) returned 1 [0115.156] GetProcessHeap () returned 0x580000 [0115.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.156] WriteFile (in: hFile=0x42c, lpBuffer=0x6c4c958*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4c958*, lpNumberOfBytesWritten=0x4d4ff14*=0x2120, lpOverlapped=0x0) returned 1 [0115.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.156] WriteFile (in: hFile=0x42c, lpBuffer=0x6c4ea77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ea77*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.156] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.156] CloseHandle (hObject=0x42c) returned 1 [0115.156] GetProcessHeap () returned 0x580000 [0115.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4c958 | out: hHeap=0x580000) returned 1 [0115.156] GetProcessHeap () returned 0x580000 [0115.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0115.156] GetProcessHeap () returned 0x580000 [0115.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c3faee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2150, dwReserved0=0x4d4fd28, dwReserved1=0x6c4a808, cFileName="AN04225_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0422~1.YOU")) returned 0x5b9630 [0116.320] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.361] CloseHandle (hObject=0x410) returned 1 [0116.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0034~1.YOU")) returned 0x5b9730 [0116.362] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0116.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.362] GetProcessHeap () returned 0x580000 [0116.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0116.362] GetProcessHeap () returned 0x580000 [0116.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x635768 [0116.363] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.363] ReadFile (in: hFile=0x410, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4d4ff14*=0xae0, lpOverlapped=0x0) returned 1 [0116.402] GetProcessHeap () returned 0x580000 [0116.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.402] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.402] WriteFile (in: hFile=0x410, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x4d4ff14*=0xae0, lpOverlapped=0x0) returned 1 [0116.402] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.402] WriteFile (in: hFile=0x410, lpBuffer=0x636247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x636247*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.402] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.402] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.402] CloseHandle (hObject=0x410) returned 1 [0116.402] GetProcessHeap () returned 0x580000 [0116.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0116.402] GetProcessHeap () returned 0x580000 [0116.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0116.402] GetProcessHeap () returned 0x580000 [0116.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cfe1ce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb08, dwReserved0=0x4d4fd28, dwReserved1=0x677cd0, cFileName="SL00345_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0034~1.YOU")) returned 0x5b9630 [0116.403] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0116.467] CloseHandle (hObject=0x49c) returned 1 [0116.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0025~1.YOU")) returned 0x5b9630 [0116.468] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0116.468] GetProcessHeap () returned 0x580000 [0116.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x6df26c0 [0116.469] GetProcessHeap () returned 0x580000 [0116.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x6cba378 [0116.469] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.469] ReadFile (in: hFile=0x49c, lpBuffer=0x6df26c0, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df26c0*, lpNumberOfBytesRead=0x4d4ff14*=0x2a00, lpOverlapped=0x0) returned 1 [0117.317] GetProcessHeap () returned 0x580000 [0117.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.317] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.317] WriteFile (in: hFile=0x49c, lpBuffer=0x6cba378*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba378*, lpNumberOfBytesWritten=0x4d4ff14*=0x2a00, lpOverlapped=0x0) returned 1 [0117.317] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.318] WriteFile (in: hFile=0x49c, lpBuffer=0x6cbcd77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbcd77*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.318] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.318] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.318] CloseHandle (hObject=0x49c) returned 1 [0117.318] GetProcessHeap () returned 0x580000 [0117.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba378 | out: hHeap=0x580000) returned 1 [0117.318] GetProcessHeap () returned 0x580000 [0117.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df26c0 | out: hHeap=0x580000) returned 1 [0117.324] GetProcessHeap () returned 0x580000 [0117.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0120.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d8a8e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a2e, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SL00256_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0025~1.YOU")) returned 0x5b96f0 [0120.125] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.153] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", len=0x4c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 1 [0120.153] GetProcessHeap () returned 0x580000 [0120.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b8) returned 0x6d06ca8 [0120.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.124] CloseHandle (hObject=0x440) returned 1 [0122.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0205~1.YOU")) returned 0x5b9730 [0122.125] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.126] GetProcessHeap () returned 0x580000 [0122.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6c676b8 [0122.126] GetProcessHeap () returned 0x580000 [0122.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x62ed18 [0122.126] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.126] ReadFile (in: hFile=0x440, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x4d4ff14*=0x980, lpOverlapped=0x0) returned 1 [0122.135] GetProcessHeap () returned 0x580000 [0122.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.136] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.136] WriteFile (in: hFile=0x440, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x4d4ff14*=0x980, lpOverlapped=0x0) returned 1 [0122.136] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.136] WriteFile (in: hFile=0x440, lpBuffer=0x62f697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f697*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.136] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.136] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.136] CloseHandle (hObject=0x440) returned 1 [0122.136] GetProcessHeap () returned 0x580000 [0122.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0122.136] GetProcessHeap () returned 0x580000 [0122.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0122.136] GetProcessHeap () returned 0x580000 [0122.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x806a16e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ab, dwReserved0=0x4d4fd28, dwReserved1=0x6c676b8, cFileName="WB02055_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0205~1.YOU")) returned 0x5b9730 [0124.420] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.082] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", len=0x4e | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 1 [0125.083] GetProcessHeap () returned 0x580000 [0125.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1898) returned 0x6f42f08 [0125.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0125.088] CloseHandle (hObject=0x43c) returned 1 [0125.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0125.089] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0125.090] GetProcessHeap () returned 0x580000 [0125.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa001) returned 0x64ee50 [0125.090] GetProcessHeap () returned 0x580000 [0125.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa001) returned 0x6dc0a00 [0125.090] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.090] ReadFile (in: hFile=0x43c, lpBuffer=0x64ee50, nNumberOfBytesToRead=0x9fe0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x64ee50*, lpNumberOfBytesRead=0x4d4ff14*=0x9fe0, lpOverlapped=0x0) returned 1 [0126.728] GetProcessHeap () returned 0x580000 [0126.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0126.728] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.728] WriteFile (in: hFile=0x43c, lpBuffer=0x6dc0a00*, nNumberOfBytesToWrite=0x9fe0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesWritten=0x4d4ff14*=0x9fe0, lpOverlapped=0x0) returned 1 [0126.728] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.728] WriteFile (in: hFile=0x43c, lpBuffer=0x6dca9df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dca9df*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.728] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.729] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.729] CloseHandle (hObject=0x43c) returned 1 [0126.729] GetProcessHeap () returned 0x580000 [0126.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0126.729] GetProcessHeap () returned 0x580000 [0126.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64ee50 | out: hHeap=0x580000) returned 1 [0126.729] GetProcessHeap () returned 0x580000 [0126.729] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0126.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8325eb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa011, dwReserved0=0x4d4fd28, dwReserved1=0x64ee50, cFileName="Origin.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIGIN~1.YOU")) returned 0x5b9730 [0126.729] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.190] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", len=0x3d | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned 1 [0127.190] GetProcessHeap () returned 0x580000 [0127.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19cc) returned 0x667250 [0127.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0128.870] CloseHandle (hObject=0x4a0) returned 1 [0128.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.id_1622540890_.your_last_chance")) returned 1 [0129.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03005~1.YOU")) returned 0x5b96f0 [0129.154] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.154] GetProcessHeap () returned 0x580000 [0129.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3481) returned 0x6f14048 [0129.154] GetProcessHeap () returned 0x580000 [0129.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3481) returned 0x6dd20d0 [0129.154] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.154] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x3460, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x4d4ff14*=0x3460, lpOverlapped=0x0) returned 1 [0129.316] GetProcessHeap () returned 0x580000 [0129.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0129.316] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.316] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dd20d0*, nNumberOfBytesToWrite=0x3460, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesWritten=0x4d4ff14*=0x3460, lpOverlapped=0x0) returned 1 [0129.316] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.316] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dd552f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd552f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.316] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.316] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.316] CloseHandle (hObject=0x4a0) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0129.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84b10f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3489, dwReserved0=0x4d4fd28, dwReserved1=0x6f14048, cFileName="J0300520.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03005~1.YOU")) returned 0x5b9730 [0129.581] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.639] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD", len=0x3c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 1 [0129.639] GetProcessHeap () returned 0x580000 [0129.639] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0129.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.655] CloseHandle (hObject=0x428) returned 1 [0132.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id_1622540890_.your_last_chance")) returned 1 [0132.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEVE~1.YOU")) returned 0x5b9730 [0132.656] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.656] GetProcessHeap () returned 0x580000 [0132.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6c79898 [0132.656] GetProcessHeap () returned 0x580000 [0132.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6d00cd8 [0132.656] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.656] ReadFile (in: hFile=0x428, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x4d4ff14*=0x860, lpOverlapped=0x0) returned 1 [0132.665] GetProcessHeap () returned 0x580000 [0132.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.665] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.665] WriteFile (in: hFile=0x428, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x4d4ff14*=0x860, lpOverlapped=0x0) returned 1 [0132.665] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.665] WriteFile (in: hFile=0x428, lpBuffer=0x6d01537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01537*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.665] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.665] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.665] CloseHandle (hObject=0x428) returned 1 [0132.665] GetProcessHeap () returned 0x580000 [0132.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0132.665] GetProcessHeap () returned 0x580000 [0132.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0132.665] GetProcessHeap () returned 0x580000 [0132.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.252] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86b0d700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x4d4fd28, dwReserved1=0x6c79898, cFileName="CALEVENT.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEVE~1.YOU")) returned 0x5b96f0 [0135.253] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.253] Sleep (dwMilliseconds=0x1) [0135.274] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", len=0x48 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI") returned 1 [0135.274] GetProcessHeap () returned 0x580000 [0135.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0135.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.275] CloseHandle (hObject=0x4ac) returned 1 [0135.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini.id_1622540890_.your_last_chance")) returned 1 [0135.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKTO~1.YOU")) returned 0x5b96f0 [0135.276] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.276] GetProcessHeap () returned 0x580000 [0135.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6f09508 [0135.276] GetProcessHeap () returned 0x580000 [0135.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x61) returned 0x6f09578 [0135.276] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.276] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f09508, nNumberOfBytesToRead=0x40, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09508*, lpNumberOfBytesRead=0x4d4ff14*=0x40, lpOverlapped=0x0) returned 1 [0135.277] GetProcessHeap () returned 0x580000 [0135.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.277] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.277] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f09578*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09578*, lpNumberOfBytesWritten=0x4d4ff14*=0x40, lpOverlapped=0x0) returned 1 [0135.277] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.277] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f095b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f095b7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.278] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.278] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.278] CloseHandle (hObject=0x4ac) returned 1 [0135.278] GetProcessHeap () returned 0x580000 [0135.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09578 | out: hHeap=0x580000) returned 1 [0135.278] GetProcessHeap () returned 0x580000 [0135.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0135.278] GetProcessHeap () returned 0x580000 [0135.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x883e5ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x4d4fd28, dwReserved1=0x6f09508, cFileName="DESKTOP.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESKTO~1.YOU")) returned 0x5b96f0 [0135.278] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.278] Sleep (dwMilliseconds=0x1) [0135.356] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", len=0x43 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned 1 [0135.357] GetProcessHeap () returned 0x580000 [0135.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.385] CloseHandle (hObject=0x45c) returned 1 [0135.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b3c00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d9b3c00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2139~1.YOU")) returned 0x5b96b0 [0135.385] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.386] GetProcessHeap () returned 0x580000 [0135.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0135.386] GetProcessHeap () returned 0x580000 [0135.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0135.386] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.386] ReadFile (in: hFile=0x45c, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x4d4ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.388] GetProcessHeap () returned 0x580000 [0135.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.388] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.388] WriteFile (in: hFile=0x45c, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x4d4ff14*=0x140, lpOverlapped=0x0) returned 1 [0135.388] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.388] WriteFile (in: hFile=0x45c, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.388] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.388] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.388] CloseHandle (hObject=0x45c) returned 1 [0135.388] GetProcessHeap () returned 0x580000 [0135.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0135.388] GetProcessHeap () returned 0x580000 [0135.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0135.388] GetProcessHeap () returned 0x580000 [0135.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b3c00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x884f0640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x4d4fd28, dwReserved1=0x6f3bec0, cFileName="BD21390_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2139~1.YOU")) returned 0x5b96b0 [0135.389] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.452] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", len=0x4b | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned 1 [0135.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0135.551] CloseHandle (hObject=0x41c) returned 1 [0135.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.id_1622540890_.your_last_chance")) returned 1 [0135.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x45, dwReserved1=0x0, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b96b0 [0135.552] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0135.552] GetProcessHeap () returned 0x580000 [0135.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x65d440 [0135.552] GetProcessHeap () returned 0x580000 [0135.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6c9a390 [0135.552] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.552] ReadFile (in: hFile=0x41c, lpBuffer=0x65d440, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65d440*, lpNumberOfBytesRead=0x4d4ff14*=0x1840, lpOverlapped=0x0) returned 1 [0136.846] GetProcessHeap () returned 0x580000 [0136.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0136.846] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.846] WriteFile (in: hFile=0x41c, lpBuffer=0x6c9a390*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesWritten=0x4d4ff14*=0x1840, lpOverlapped=0x0) returned 1 [0138.434] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.434] WriteFile (in: hFile=0x41c, lpBuffer=0x6c9bbcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9bbcf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.439] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.439] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.442] CloseHandle (hObject=0x41c) returned 1 [0138.442] GetProcessHeap () returned 0x580000 [0138.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0138.442] GetProcessHeap () returned 0x580000 [0138.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d440 | out: hHeap=0x580000) returned 1 [0138.442] GetProcessHeap () returned 0x580000 [0138.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0138.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1869, dwReserved0=0x4d4fd28, dwReserved1=0x65d440, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b96b0 [0138.442] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.455] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", len=0x43 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned 1 [0138.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0138.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.989] CloseHandle (hObject=0x170) returned 1 [0139.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b19a00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b19a00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD58B0~1.YOU")) returned 0x5b9770 [0139.990] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.990] GetProcessHeap () returned 0x580000 [0139.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6c676b8 [0139.990] GetProcessHeap () returned 0x580000 [0139.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6c10060 [0139.990] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.990] ReadFile (in: hFile=0x170, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x9c0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x4d4ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0140.000] GetProcessHeap () returned 0x580000 [0140.000] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.000] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.000] WriteFile (in: hFile=0x170, lpBuffer=0x6c10060*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesWritten=0x4d4ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0140.000] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.000] WriteFile (in: hFile=0x170, lpBuffer=0x6c10a1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10a1f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.000] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.001] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.001] CloseHandle (hObject=0x170) returned 1 [0140.001] GetProcessHeap () returned 0x580000 [0140.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0140.001] GetProcessHeap () returned 0x580000 [0140.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0140.001] GetProcessHeap () returned 0x580000 [0140.001] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b19a00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b0f9d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9e9, dwReserved0=0x4d4fd28, dwReserved1=0x6c676b8, cFileName="BD21321_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD58B0~1.YOU")) returned 0x5b9770 [0140.406] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.438] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", len=0x59 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned 1 [0140.438] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.438] CloseHandle (hObject=0x3a8) returned 1 [0140.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0140.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.439] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.439] GetProcessHeap () returned 0x580000 [0140.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0140.439] GetProcessHeap () returned 0x580000 [0140.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0140.439] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.439] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x4d4ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0140.442] GetProcessHeap () returned 0x580000 [0140.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.442] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.442] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x4d4ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0140.442] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.442] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.442] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.442] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.443] CloseHandle (hObject=0x3a8) returned 1 [0140.443] GetProcessHeap () returned 0x580000 [0140.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0140.443] GetProcessHeap () returned 0x580000 [0140.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0140.443] GetProcessHeap () returned 0x580000 [0140.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b5243c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x4d4fd28, dwReserved1=0x6f3ef20, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.443] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.695] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK", len=0x3f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 1 [0140.695] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0140.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.698] CloseHandle (hObject=0x490) returned 1 [0140.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~1.YOU")) returned 0x5b9730 [0140.699] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.699] GetProcessHeap () returned 0x580000 [0140.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.699] GetProcessHeap () returned 0x580000 [0140.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.699] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.699] ReadFile (in: hFile=0x490, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.701] GetProcessHeap () returned 0x580000 [0140.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0140.701] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.701] WriteFile (in: hFile=0x490, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.701] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.701] WriteFile (in: hFile=0x490, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.701] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.701] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.701] CloseHandle (hObject=0x490) returned 1 [0140.701] GetProcessHeap () returned 0x580000 [0140.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.701] GetProcessHeap () returned 0x580000 [0140.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.701] GetProcessHeap () returned 0x580000 [0140.701] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0141.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b7abb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4d4fd28, dwReserved1=0x61b540, cFileName="MSOUC_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUC_~1.YOU")) returned 0x5b9730 [0141.527] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.423] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK", len=0x41 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 1 [0146.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0146.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.424] CloseHandle (hObject=0x454) returned 1 [0146.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0146.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b9730 [0146.426] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.426] GetProcessHeap () returned 0x580000 [0146.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0146.426] GetProcessHeap () returned 0x580000 [0146.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0146.426] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.426] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0146.427] GetProcessHeap () returned 0x580000 [0146.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0146.427] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.427] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0146.427] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.427] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0146.427] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.427] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0146.427] CloseHandle (hObject=0x454) returned 1 [0146.428] GetProcessHeap () returned 0x580000 [0146.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0146.428] GetProcessHeap () returned 0x580000 [0146.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0146.428] GetProcessHeap () returned 0x580000 [0146.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ee453c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x4d4fd28, dwReserved1=0x61b540, cFileName="ONENOTE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~1.YOU")) returned 0x5b9730 [0146.428] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.439] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT", len=0x3f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 1 [0146.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0146.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.440] CloseHandle (hObject=0x454) returned 1 [0146.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0146.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~3.YOU")) returned 0x5b9730 [0146.441] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0146.441] GetProcessHeap () returned 0x580000 [0146.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0146.441] GetProcessHeap () returned 0x580000 [0146.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0146.441] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.441] ReadFile (in: hFile=0x454, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x4d4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0146.443] GetProcessHeap () returned 0x580000 [0146.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0146.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.443] WriteFile (in: hFile=0x454, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x4d4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0146.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.443] WriteFile (in: hFile=0x454, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0146.443] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.443] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0146.443] CloseHandle (hObject=0x454) returned 1 [0146.443] GetProcessHeap () returned 0x580000 [0146.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0146.443] GetProcessHeap () returned 0x580000 [0146.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0146.444] GetProcessHeap () returned 0x580000 [0146.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ee6b520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x4d4fd28, dwReserved1=0x5ad8a0, cFileName="ONENOTE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~3.YOU")) returned 0x5b9730 [0146.444] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.454] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", len=0x3c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT") returned 1 [0146.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0146.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0146.538] CloseHandle (hObject=0x3b8) returned 1 [0146.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.538] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.id_1622540890_.your_last_chance")) returned 1 [0146.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHP~1.YOU")) returned 0x5b96f0 [0146.544] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0146.544] GetProcessHeap () returned 0x580000 [0146.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0146.544] GetProcessHeap () returned 0x580000 [0146.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6c29878 [0146.544] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.544] ReadFile (in: hFile=0x3b8, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4d4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0146.683] GetProcessHeap () returned 0x580000 [0146.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0146.683] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.683] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x4d4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0146.683] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.683] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c2a577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a577*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0146.683] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.683] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0146.684] CloseHandle (hObject=0x3b8) returned 1 [0146.684] GetProcessHeap () returned 0x580000 [0146.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0146.684] GetProcessHeap () returned 0x580000 [0146.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0146.684] GetProcessHeap () returned 0x580000 [0146.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f0a69c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x4d4fd28, dwReserved1=0x635768, cFileName="PSRCHPHN.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHP~1.YOU")) returned 0x5b9730 [0146.684] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0147.436] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", len=0x44 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned 1 [0147.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0147.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.401] CloseHandle (hObject=0x3a8) returned 1 [0150.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR11~1.YOU")) returned 0x5b96f0 [0150.403] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0150.403] GetProcessHeap () returned 0x580000 [0150.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1441) returned 0x6efb008 [0150.403] GetProcessHeap () returned 0x580000 [0150.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1441) returned 0x6f1bec0 [0150.403] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.403] ReadFile (in: hFile=0x3a8, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1420, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x4d4ff14*=0x1420, lpOverlapped=0x0) returned 1 [0150.422] GetProcessHeap () returned 0x580000 [0150.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0150.422] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.422] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x4d4ff14*=0x1420, lpOverlapped=0x0) returned 1 [0150.422] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.422] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f1d2df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1d2df*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.422] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.422] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.423] CloseHandle (hObject=0x3a8) returned 1 [0150.423] GetProcessHeap () returned 0x580000 [0150.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0150.423] GetProcessHeap () returned 0x580000 [0150.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0150.423] GetProcessHeap () returned 0x580000 [0150.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0150.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9145b3c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1453, dwReserved0=0x4d4fd28, dwReserved1=0x6efb008, cFileName="PDIR11F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR11~1.YOU")) returned 0x5b96f0 [0150.784] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.790] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", len=0x44 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned 1 [0150.790] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0150.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0150.791] CloseHandle (hObject=0x170) returned 1 [0150.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.791] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.id_1622540890_.your_last_chance")) returned 1 [0150.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR9~2.YOU")) returned 0x5b96f0 [0150.793] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0150.793] GetProcessHeap () returned 0x580000 [0150.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e41) returned 0x707ec98 [0150.794] GetProcessHeap () returned 0x580000 [0150.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e41) returned 0x7082ae8 [0150.794] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.794] ReadFile (in: hFile=0x170, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x3e20, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x4d4ff14*=0x3e20, lpOverlapped=0x0) returned 1 [0151.328] GetProcessHeap () returned 0x580000 [0151.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0151.328] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.328] WriteFile (in: hFile=0x170, lpBuffer=0x7082ae8*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7082ae8*, lpNumberOfBytesWritten=0x4d4ff14*=0x3e20, lpOverlapped=0x0) returned 1 [0151.329] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.329] WriteFile (in: hFile=0x170, lpBuffer=0x7086907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7086907*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.329] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.329] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.329] CloseHandle (hObject=0x170) returned 1 [0151.928] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7082ae8 | out: hHeap=0x580000) returned 1 [0151.928] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0151.928] GetProcessHeap () returned 0x580000 [0151.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0152.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91cfc380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x4d4fd28, dwReserved1=0x707ec98, cFileName="ZPDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR9~2.YOU")) returned 0x5b9730 [0152.050] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.080] CloseHandle (hObject=0x3a8) returned 1 [0152.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.080] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0152.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~2.YOU")) returned 0x5b9730 [0152.082] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.082] GetProcessHeap () returned 0x580000 [0152.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b5d0 [0152.082] GetProcessHeap () returned 0x580000 [0152.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b660 [0152.082] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.082] ReadFile (in: hFile=0x3a8, lpBuffer=0x61b5d0, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b5d0*, lpNumberOfBytesRead=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.083] GetProcessHeap () returned 0x580000 [0152.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.083] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.083] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b660*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b660*, lpNumberOfBytesWritten=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0152.083] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.083] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b6bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b6bf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.084] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.084] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.084] CloseHandle (hObject=0x3a8) returned 1 [0152.084] GetProcessHeap () returned 0x580000 [0152.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b660 | out: hHeap=0x580000) returned 1 [0152.084] GetProcessHeap () returned 0x580000 [0152.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b5d0 | out: hHeap=0x580000) returned 1 [0152.084] GetProcessHeap () returned 0x580000 [0152.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x92420580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4d4fd28, dwReserved1=0x61b5d0, cFileName="VISIO.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~2.YOU")) returned 0x5b9730 [0152.084] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.443] CloseHandle (hObject=0x460) returned 1 [0153.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id_1622540890_.your_last_chance")) returned 1 [0153.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960df00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x960df00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALVEV~1.YOU")) returned 0x5b9730 [0153.445] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0153.445] GetProcessHeap () returned 0x580000 [0153.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cda390 [0153.445] GetProcessHeap () returned 0x580000 [0153.445] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cdab18 [0153.445] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.445] ReadFile (in: hFile=0x460, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x4d4ff14*=0x740, lpOverlapped=0x0) returned 1 [0153.525] GetProcessHeap () returned 0x580000 [0153.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.525] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.525] WriteFile (in: hFile=0x460, lpBuffer=0x6cdab18*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab18*, lpNumberOfBytesWritten=0x4d4ff14*=0x740, lpOverlapped=0x0) returned 1 [0153.525] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x460, lpBuffer=0x6cdb257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb257*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.526] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.526] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.526] CloseHandle (hObject=0x460) returned 1 [0153.526] GetProcessHeap () returned 0x580000 [0153.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab18 | out: hHeap=0x580000) returned 1 [0153.526] GetProcessHeap () returned 0x580000 [0153.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0153.526] GetProcessHeap () returned 0x580000 [0153.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960df00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x931f6560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0x4d4fd28, dwReserved1=0x6cda390, cFileName="VALVE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALVEV~1.YOU")) returned 0x5b9730 [0153.526] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0155.299] CloseHandle (hObject=0x3b8) returned 1 [0155.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.299] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0155.300] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97366800, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97366800, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x718092, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~2.YOU")) returned 0x5b9730 [0155.300] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0155.300] GetProcessHeap () returned 0x580000 [0155.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703c008 [0155.300] GetProcessHeap () returned 0x580000 [0155.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x704d838 [0155.300] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.300] ReadFile (in: hFile=0x3b8, lpBuffer=0x703c008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x703c008*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.815] GetProcessHeap () returned 0x580000 [0159.815] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0159.815] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.815] WriteFile (in: hFile=0x3b8, lpBuffer=0x704d838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x704d838*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0159.816] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.816] WriteFile (in: hFile=0x3b8, lpBuffer=0x705f037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f037*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0161.247] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.247] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0161.247] CloseHandle (hObject=0x3b8) returned 1 [0161.247] GetProcessHeap () returned 0x580000 [0161.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704d838 | out: hHeap=0x580000) returned 1 [0161.247] GetProcessHeap () returned 0x580000 [0161.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703c008 | out: hHeap=0x580000) returned 1 [0161.247] GetProcessHeap () returned 0x580000 [0161.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0164.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97366800, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97b9ae00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7180b6, dwReserved0=0x4d4fd28, dwReserved1=0x703c008, cFileName="WINWORD.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~2.YOU")) returned 0x5b9730 [0164.570] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.550] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", len=0x42 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 1 [0166.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2238) returned 0x6f14048 [0166.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.138] CloseHandle (hObject=0x448) returned 1 [0169.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id_1622540890_.your_last_chance")) returned 1 [0169.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLS~2.YOU")) returned 0x5b96b0 [0169.140] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.140] GetProcessHeap () returned 0x580000 [0169.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0169.140] GetProcessHeap () returned 0x580000 [0169.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0169.140] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.140] ReadFile (in: hFile=0x448, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x4d4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.151] GetProcessHeap () returned 0x580000 [0169.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0169.151] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.151] WriteFile (in: hFile=0x448, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x4d4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.151] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.151] WriteFile (in: hFile=0x448, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.152] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.152] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.152] CloseHandle (hObject=0x448) returned 1 [0169.152] GetProcessHeap () returned 0x580000 [0169.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0169.152] GetProcessHeap () returned 0x580000 [0169.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0169.152] GetProcessHeap () returned 0x580000 [0169.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0172.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c708720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x4d4fd28, dwReserved1=0x65f268, cFileName="DISTLSTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISTLS~2.YOU")) returned 0x5b9770 [0172.812] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.859] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", len=0x3f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 1 [0172.859] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x227c) returned 0x6f14048 [0172.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.879] CloseHandle (hObject=0x490) returned 1 [0172.879] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id_1622540890_.your_last_chance")) returned 1 [0172.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNSI~1.YOU")) returned 0x5b9770 [0172.880] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.881] GetProcessHeap () returned 0x580000 [0172.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0172.881] GetProcessHeap () returned 0x580000 [0172.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0172.881] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.881] ReadFile (in: hFile=0x490, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x4d4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0172.892] GetProcessHeap () returned 0x580000 [0172.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.892] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.892] WriteFile (in: hFile=0x490, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x4d4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0172.892] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.892] WriteFile (in: hFile=0x490, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.892] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.892] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.892] CloseHandle (hObject=0x490) returned 1 [0172.892] GetProcessHeap () returned 0x580000 [0172.892] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0172.892] GetProcessHeap () returned 0x580000 [0172.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0172.893] GetProcessHeap () returned 0x580000 [0172.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ea96fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x4d4fd28, dwReserved1=0x660a78, cFileName="SIGNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNSI~1.YOU")) returned 0x5b9770 [0173.188] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.210] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", len=0x41 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 1 [0173.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0173.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.223] CloseHandle (hObject=0x490) returned 1 [0173.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~2.YOU")) returned 0x5b9770 [0173.224] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.224] GetProcessHeap () returned 0x580000 [0173.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.224] GetProcessHeap () returned 0x580000 [0173.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.224] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.224] ReadFile (in: hFile=0x490, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x4d4ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.229] GetProcessHeap () returned 0x580000 [0173.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.229] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.229] WriteFile (in: hFile=0x490, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x4d4ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.229] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.229] WriteFile (in: hFile=0x490, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.229] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.229] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.229] CloseHandle (hObject=0x490) returned 1 [0173.229] GetProcessHeap () returned 0x580000 [0173.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.229] GetProcessHeap () returned 0x580000 [0173.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.229] GetProcessHeap () returned 0x580000 [0173.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eddce00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x4d4fd28, dwReserved1=0x5d0090, cFileName="REPORTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~2.YOU")) returned 0x5b9770 [0174.344] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.354] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML", len=0x3c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML") returned 1 [0174.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0174.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.359] CloseHandle (hObject=0x484) returned 1 [0174.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.id_1622540890_.your_last_chance")) returned 1 [0174.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9b00, ftCreationTime.dwHighDateTime=0x1c2a020, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd43d9b00, ftLastWriteTime.dwHighDateTime=0x1c2a020, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDCMPV~1.YOU")) returned 0x5b9770 [0174.361] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdcmpvrd.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.361] GetProcessHeap () returned 0x580000 [0174.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6dbf1e8 [0174.394] GetProcessHeap () returned 0x580000 [0174.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6dbf7b0 [0174.394] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.394] ReadFile (in: hFile=0x484, lpBuffer=0x6dbf1e8, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1e8*, lpNumberOfBytesRead=0x4d4ff14*=0x560, lpOverlapped=0x0) returned 1 [0174.400] GetProcessHeap () returned 0x580000 [0174.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.400] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.400] WriteFile (in: hFile=0x484, lpBuffer=0x6dbf7b0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf7b0*, lpNumberOfBytesWritten=0x4d4ff14*=0x560, lpOverlapped=0x0) returned 1 [0174.400] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.400] WriteFile (in: hFile=0x484, lpBuffer=0x6dbfd0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbfd0f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.400] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.400] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.400] CloseHandle (hObject=0x484) returned 1 [0174.400] GetProcessHeap () returned 0x580000 [0174.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf7b0 | out: hHeap=0x580000) returned 1 [0174.400] GetProcessHeap () returned 0x580000 [0174.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1e8 | out: hHeap=0x580000) returned 1 [0174.400] GetProcessHeap () returned 0x580000 [0174.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9b00, ftCreationTime.dwHighDateTime=0x1c2a020, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f905520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x4d4fd28, dwReserved1=0x6dbf1e8, cFileName="WDCMPVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDCMPV~1.YOU")) returned 0x5b9770 [0174.401] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0176.814] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC", len=0x41 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 1 [0176.814] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0176.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.815] CloseHandle (hObject=0x49c) returned 1 [0176.815] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.815] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0176.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65709000, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x65709000, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI877D~1.YOU")) returned 0x5b96f0 [0176.816] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.816] GetProcessHeap () returned 0x580000 [0176.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0176.816] GetProcessHeap () returned 0x580000 [0176.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0176.816] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.816] ReadFile (in: hFile=0x49c, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x4d4ff14*=0x280, lpOverlapped=0x0) returned 1 [0176.848] GetProcessHeap () returned 0x580000 [0176.848] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.848] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.849] WriteFile (in: hFile=0x49c, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x4d4ff14*=0x280, lpOverlapped=0x0) returned 1 [0176.849] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.849] WriteFile (in: hFile=0x49c, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.849] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.849] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.849] CloseHandle (hObject=0x49c) returned 1 [0177.374] GetProcessHeap () returned 0x580000 [0177.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0177.374] GetProcessHeap () returned 0x580000 [0177.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0177.374] GetProcessHeap () returned 0x580000 [0177.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65709000, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa1060d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x4d4fd28, dwReserved1=0x6c4a820, cFileName="VISIO_PRM_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI877D~1.YOU")) returned 0x5b96f0 [0179.168] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0181.353] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", len=0x68 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned 1 [0181.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0181.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0181.354] CloseHandle (hObject=0x428) returned 1 [0181.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0181.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3177400, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x1, dwReserved1=0x360031, cFileName="AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALA189~1.YOU")) returned 0x5b9770 [0181.355] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0181.355] GetProcessHeap () returned 0x580000 [0181.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cba390 [0181.355] GetProcessHeap () returned 0x580000 [0181.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbfaa8 [0181.355] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.355] ReadFile (in: hFile=0x428, lpBuffer=0x6cba390, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesRead=0x4d4ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0181.422] GetProcessHeap () returned 0x580000 [0181.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.422] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.422] WriteFile (in: hFile=0x428, lpBuffer=0x6cbfaa8*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbfaa8*, lpNumberOfBytesWritten=0x4d4ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0181.422] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.422] WriteFile (in: hFile=0x428, lpBuffer=0x6cc1707*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc1707*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.422] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.422] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.422] CloseHandle (hObject=0x428) returned 1 [0181.423] GetProcessHeap () returned 0x580000 [0181.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbfaa8 | out: hHeap=0x580000) returned 1 [0181.423] GetProcessHeap () returned 0x580000 [0181.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0181.423] GetProcessHeap () returned 0x580000 [0181.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3bf7fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x4d4fd28, dwReserved1=0x6cba390, cFileName="AlertImage_HighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALA189~1.YOU")) returned 0x5b9770 [0182.118] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.130] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", len=0x64 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned 1 [0182.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0182.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.131] CloseHandle (hObject=0x3fc) returned 1 [0182.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.132] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.id_1622540890_.your_last_chance")) returned 1 [0182.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL17E0~1.YOU")) returned 0x5b9770 [0182.133] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0182.133] GetProcessHeap () returned 0x580000 [0182.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x44e1) returned 0x6d76a08 [0182.133] GetProcessHeap () returned 0x580000 [0182.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x44e1) returned 0x6fa8f28 [0182.133] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.133] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d76a08, nNumberOfBytesToRead=0x44c0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d76a08*, lpNumberOfBytesRead=0x4d4ff14*=0x44c0, lpOverlapped=0x0) returned 1 [0182.669] GetProcessHeap () returned 0x580000 [0182.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0182.669] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x4d4ff14*=0x44c0, lpOverlapped=0x0) returned 1 [0182.669] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x3fc, lpBuffer=0x6fad3e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad3e7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.669] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.669] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.669] CloseHandle (hObject=0x3fc) returned 1 [0183.066] GetProcessHeap () returned 0x580000 [0183.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0183.067] GetProcessHeap () returned 0x580000 [0183.067] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d76a08 | out: hHeap=0x580000) returned 1 [0183.067] GetProcessHeap () returned 0x580000 [0183.067] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.805] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47dede0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x44ed, dwReserved0=0x4d4fd28, dwReserved1=0x6d76a08, cFileName="AlertImage_Auto.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL17E0~1.YOU")) returned 0x5b9770 [0183.805] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.820] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", len=0x6a | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned 1 [0183.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0183.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.839] CloseHandle (hObject=0x450) returned 1 [0183.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.839] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.id_1622540890_.your_last_chance")) returned 1 [0183.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b9770 [0183.840] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.840] GetProcessHeap () returned 0x580000 [0183.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09b98 [0183.840] GetProcessHeap () returned 0x580000 [0183.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09dc8 [0183.840] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.840] ReadFile (in: hFile=0x450, lpBuffer=0x6f09b98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b98*, lpNumberOfBytesRead=0x4d4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0183.842] GetProcessHeap () returned 0x580000 [0183.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0183.842] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.842] WriteFile (in: hFile=0x450, lpBuffer=0x6f09dc8*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09dc8*, lpNumberOfBytesWritten=0x4d4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0183.842] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.842] WriteFile (in: hFile=0x450, lpBuffer=0x6f09ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09ea7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.842] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.842] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.842] CloseHandle (hObject=0x450) returned 1 [0183.842] GetProcessHeap () returned 0x580000 [0183.842] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.842] GetProcessHeap () returned 0x580000 [0183.842] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.842] GetProcessHeap () returned 0x580000 [0183.842] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5307500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x4d4fd28, dwReserved1=0x6f09b98, cFileName="button_right_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b9770 [0183.843] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.861] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", len=0x65 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned 1 [0183.861] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0183.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0183.899] CloseHandle (hObject=0x478) returned 1 [0183.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.id_1622540890_.your_last_chance")) returned 1 [0183.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b9770 [0183.900] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0183.900] GetProcessHeap () returned 0x580000 [0183.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6d0e508 [0183.900] GetProcessHeap () returned 0x580000 [0183.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6dd40d0 [0183.901] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.901] ReadFile (in: hFile=0x478, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1920, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x4d4ff14*=0x1920, lpOverlapped=0x0) returned 1 [0184.042] GetProcessHeap () returned 0x580000 [0184.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.042] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.042] WriteFile (in: hFile=0x478, lpBuffer=0x6dd40d0*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesWritten=0x4d4ff14*=0x1920, lpOverlapped=0x0) returned 1 [0184.042] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.042] WriteFile (in: hFile=0x478, lpBuffer=0x6dd59ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd59ef*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.042] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.042] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.042] CloseHandle (hObject=0x478) returned 1 [0184.042] GetProcessHeap () returned 0x580000 [0184.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0184.042] GetProcessHeap () returned 0x580000 [0184.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0184.042] GetProcessHeap () returned 0x580000 [0184.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa54f66e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x4d4fd28, dwReserved1=0x6d0e508, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b9770 [0184.043] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.102] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", len=0x6b | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned 1 [0184.102] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0184.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0184.171] CloseHandle (hObject=0x478) returned 1 [0184.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance")) returned 1 [0185.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x2e0066, dwReserved1=0x640069, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b9770 [0185.202] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0185.203] GetProcessHeap () returned 0x580000 [0185.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x6e063d0 [0185.203] GetProcessHeap () returned 0x580000 [0185.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x6e0b2a0 [0185.203] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.203] ReadFile (in: hFile=0x478, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x4ea0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4d4ff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0185.476] GetProcessHeap () returned 0x580000 [0185.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.476] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.476] WriteFile (in: hFile=0x478, lpBuffer=0x6e0b2a0*, nNumberOfBytesToWrite=0x4ea0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0b2a0*, lpNumberOfBytesWritten=0x4d4ff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0185.477] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] WriteFile (in: hFile=0x478, lpBuffer=0x6e1013f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1013f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.477] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.477] CloseHandle (hObject=0x478) returned 1 [0185.477] GetProcessHeap () returned 0x580000 [0185.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0b2a0 | out: hHeap=0x580000) returned 1 [0185.477] GetProcessHeap () returned 0x580000 [0185.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0185.477] GetProcessHeap () returned 0x580000 [0185.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa62a6560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4edf, dwReserved0=0x4d4fd28, dwReserved1=0x6e063d0, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b9770 [0185.537] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.589] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", len=0x44 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned 1 [0185.589] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ac) returned 0x6f14048 [0185.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.641] CloseHandle (hObject=0x484) returned 1 [0185.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.id_1622540890_.your_last_chance")) returned 1 [0185.642] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5559, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR7~2.YOU")) returned 0x5b9770 [0185.642] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.643] GetProcessHeap () returned 0x580000 [0185.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5561) returned 0x6d630a8 [0185.643] GetProcessHeap () returned 0x580000 [0185.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5561) returned 0x6d68618 [0185.643] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.643] ReadFile (in: hFile=0x484, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x5540, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x4d4ff14*=0x5540, lpOverlapped=0x0) returned 1 [0187.721] GetProcessHeap () returned 0x580000 [0187.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0e050 [0187.722] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.722] WriteFile (in: hFile=0x484, lpBuffer=0x6d68618*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d68618*, lpNumberOfBytesWritten=0x4d4ff14*=0x5540, lpOverlapped=0x0) returned 1 [0187.722] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.722] WriteFile (in: hFile=0x484, lpBuffer=0x6d6db57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6db57*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.722] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.722] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.722] CloseHandle (hObject=0x484) returned 1 [0187.722] GetProcessHeap () returned 0x580000 [0187.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d68618 | out: hHeap=0x580000) returned 1 [0187.722] GetProcessHeap () returned 0x580000 [0187.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0187.722] GetProcessHeap () returned 0x580000 [0187.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0e050 | out: hHeap=0x580000) returned 1 [0188.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7812b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x557d, dwReserved0=0x4d4fd28, dwReserved1=0x6d630a8, cFileName="ZPDIR7B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR7~2.YOU")) returned 0x5b9770 [0188.057] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.066] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", len=0x75 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 1 [0188.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a0) returned 0x6f14048 [0188.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0188.125] CloseHandle (hObject=0x3b4) returned 1 [0188.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20b43, dwReserved0=0x720054, dwReserved1=0x630061, cFileName="Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDWA~1.YOU")) returned 0x5b9770 [0188.169] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0188.169] GetProcessHeap () returned 0x580000 [0188.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0188.169] GetProcessHeap () returned 0x580000 [0188.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0188.169] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.169] ReadFile (in: hFile=0x3b4, lpBuffer=0x6fc4768, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.961] GetProcessHeap () returned 0x580000 [0190.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0190.962] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.962] WriteFile (in: hFile=0x3b4, lpBuffer=0x6fd5f98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.965] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.965] WriteFile (in: hFile=0x3b4, lpBuffer=0x6fe7797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7797*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0190.965] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.965] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0190.965] CloseHandle (hObject=0x3b4) returned 1 [0190.965] GetProcessHeap () returned 0x580000 [0190.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0190.971] GetProcessHeap () returned 0x580000 [0190.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0190.972] GetProcessHeap () returned 0x580000 [0190.972] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9704960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20b67, dwReserved0=0x580000, dwReserved1=0x658968, cFileName="Hardware Tracker.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HARDWA~1.YOU")) returned 0x5b9770 [0193.195] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.274] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned 1 [0193.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x206c) returned 0x6f14048 [0193.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0193.274] CloseHandle (hObject=0x170) returned 1 [0193.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0193.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc94, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b9770 [0193.275] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0193.276] GetProcessHeap () returned 0x580000 [0193.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x6c29878 [0193.276] GetProcessHeap () returned 0x580000 [0193.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x658970 [0193.276] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.276] ReadFile (in: hFile=0x170, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xc80, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x4d4ff14*=0xc80, lpOverlapped=0x0) returned 1 [0193.362] GetProcessHeap () returned 0x580000 [0193.362] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.362] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.362] WriteFile (in: hFile=0x170, lpBuffer=0x658970*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesWritten=0x4d4ff14*=0xc80, lpOverlapped=0x0) returned 1 [0193.362] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.362] WriteFile (in: hFile=0x170, lpBuffer=0x6595ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6595ef*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.362] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.362] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.362] CloseHandle (hObject=0x170) returned 1 [0193.363] GetProcessHeap () returned 0x580000 [0193.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0193.363] GetProcessHeap () returned 0x580000 [0193.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0193.363] GetProcessHeap () returned 0x580000 [0193.363] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaadedd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x4d4fd28, dwReserved1=0x6c29878, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b97b0 [0193.363] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.423] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", len=0x66 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned 1 [0193.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0193.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.429] CloseHandle (hObject=0x438) returned 1 [0193.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.id_1622540890_.your_last_chance")) returned 1 [0193.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b97b0 [0193.430] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.431] GetProcessHeap () returned 0x580000 [0193.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0193.431] GetProcessHeap () returned 0x580000 [0193.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0193.431] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.431] ReadFile (in: hFile=0x438, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x4d4ff14*=0xa0, lpOverlapped=0x0) returned 1 [0193.432] GetProcessHeap () returned 0x580000 [0193.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.432] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.432] WriteFile (in: hFile=0x438, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x4d4ff14*=0xa0, lpOverlapped=0x0) returned 1 [0193.432] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.432] WriteFile (in: hFile=0x438, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.433] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.433] CloseHandle (hObject=0x438) returned 1 [0193.433] GetProcessHeap () returned 0x580000 [0193.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0193.433] GetProcessHeap () returned 0x580000 [0193.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0193.433] GetProcessHeap () returned 0x580000 [0193.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.635] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaae862a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x4d4fd28, dwReserved1=0x60e8a8, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~2.YOU")) returned 0x5b97f0 [0193.636] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.737] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", len=0x6c | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned 1 [0193.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0193.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0193.738] CloseHandle (hObject=0x418) returned 1 [0193.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.738] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance")) returned 1 [0193.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x660069, dwReserved1=0x69002e, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b97f0 [0193.739] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0193.739] GetProcessHeap () returned 0x580000 [0193.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x6ff5e48 [0193.739] GetProcessHeap () returned 0x580000 [0193.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ec1) returned 0x6ffad18 [0193.740] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.740] ReadFile (in: hFile=0x418, lpBuffer=0x6ff5e48, nNumberOfBytesToRead=0x4ea0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff5e48*, lpNumberOfBytesRead=0x4d4ff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0195.264] GetProcessHeap () returned 0x580000 [0195.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.264] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] WriteFile (in: hFile=0x418, lpBuffer=0x6ffad18*, nNumberOfBytesToWrite=0x4ea0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ffad18*, lpNumberOfBytesWritten=0x4d4ff14*=0x4ea0, lpOverlapped=0x0) returned 1 [0195.265] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.265] WriteFile (in: hFile=0x418, lpBuffer=0x6fffbb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fffbb7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.265] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.265] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.265] CloseHandle (hObject=0x418) returned 1 [0195.265] GetProcessHeap () returned 0x580000 [0195.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ffad18 | out: hHeap=0x580000) returned 1 [0195.265] GetProcessHeap () returned 0x580000 [0195.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff5e48 | out: hHeap=0x580000) returned 1 [0195.265] GetProcessHeap () returned 0x580000 [0195.265] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfee380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4edf, dwReserved0=0x4d4fd28, dwReserved1=0x6ff5e48, cFileName="bg_FormsHomePageBlank.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~2.YOU")) returned 0x5b97b0 [0195.265] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0198.013] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", len=0x44 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned 1 [0198.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0198.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0198.058] CloseHandle (hObject=0x414) returned 1 [0198.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR47~1.YOU")) returned 0x5b97f0 [0198.059] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0198.059] GetProcessHeap () returned 0x580000 [0198.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b01) returned 0x6d06ca8 [0198.059] GetProcessHeap () returned 0x580000 [0198.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b01) returned 0x710e3f8 [0198.060] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.060] ReadFile (in: hFile=0x414, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x3ae0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x4d4ff14*=0x3ae0, lpOverlapped=0x0) returned 1 [0198.485] GetProcessHeap () returned 0x580000 [0198.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0198.485] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.485] WriteFile (in: hFile=0x414, lpBuffer=0x710e3f8*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x710e3f8*, lpNumberOfBytesWritten=0x4d4ff14*=0x3ae0, lpOverlapped=0x0) returned 1 [0198.486] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.486] WriteFile (in: hFile=0x414, lpBuffer=0x7111ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111ed7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.486] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.486] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.486] CloseHandle (hObject=0x414) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710e3f8 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0198.799] GetProcessHeap () returned 0x580000 [0198.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0199.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadeba020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b0c, dwReserved0=0x4d4fd28, dwReserved1=0x6d06ca8, cFileName="PDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR47~1.YOU")) returned 0x5b96b0 [0199.653] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.962] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", len=0x6b | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned 1 [0200.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb8) returned 0x6f14048 [0200.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0200.966] CloseHandle (hObject=0x170) returned 1 [0200.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.id_1622540890_.your_last_chance")) returned 1 [0200.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x2e006d, dwReserved1=0x640069, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9770 [0200.967] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0200.967] GetProcessHeap () returned 0x580000 [0200.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6ce54c0 [0200.967] GetProcessHeap () returned 0x580000 [0200.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6ce5e48 [0200.968] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.968] ReadFile (in: hFile=0x170, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x4d4ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0200.977] GetProcessHeap () returned 0x580000 [0200.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0200.977] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.977] WriteFile (in: hFile=0x170, lpBuffer=0x6ce5e48*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5e48*, lpNumberOfBytesWritten=0x4d4ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0200.977] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.977] WriteFile (in: hFile=0x170, lpBuffer=0x6ce6727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6727*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.977] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.977] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.977] CloseHandle (hObject=0x170) returned 1 [0200.977] GetProcessHeap () returned 0x580000 [0200.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5e48 | out: hHeap=0x580000) returned 1 [0200.977] GetProcessHeap () returned 0x580000 [0200.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0200.977] GetProcessHeap () returned 0x580000 [0200.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0200.977] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf687c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91a, dwReserved0=0x4d4fd28, dwReserved1=0x6ce54c0, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9770 [0200.977] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.991] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", len=0x6f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned 1 [0200.991] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0200.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0200.992] CloseHandle (hObject=0x428) returned 1 [0200.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2e006e, dwReserved1=0x690067, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.202] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0201.202] GetProcessHeap () returned 0x580000 [0201.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0201.202] GetProcessHeap () returned 0x580000 [0201.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0201.202] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.203] ReadFile (in: hFile=0x428, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x4d4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.204] GetProcessHeap () returned 0x580000 [0201.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0201.204] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x428, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x4d4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.204] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x428, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.204] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.204] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.204] CloseHandle (hObject=0x428) returned 1 [0201.205] GetProcessHeap () returned 0x580000 [0201.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0201.205] GetProcessHeap () returned 0x580000 [0201.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0201.205] GetProcessHeap () returned 0x580000 [0201.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0201.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf89cf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x4d4fd28, dwReserved1=0x5ae2f0, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.020] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0204.740] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0204.740] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0204.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0208.971] CloseHandle (hObject=0x490) returned 1 [0208.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0208.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0208.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0208.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x46004f, dwReserved1=0x2e0046, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9830 [0208.973] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0208.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0208.973] GetProcessHeap () returned 0x580000 [0208.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x6096f0 [0208.973] GetProcessHeap () returned 0x580000 [0208.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x608a00 [0208.973] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.973] ReadFile (in: hFile=0x490, lpBuffer=0x6096f0, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6096f0*, lpNumberOfBytesRead=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0208.976] GetProcessHeap () returned 0x580000 [0208.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0208.976] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.976] WriteFile (in: hFile=0x490, lpBuffer=0x608a00*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x608a00*, lpNumberOfBytesWritten=0x4d4ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0208.976] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.976] WriteFile (in: hFile=0x490, lpBuffer=0x608bdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x608bdf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.976] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.976] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.976] CloseHandle (hObject=0x490) returned 1 [0208.976] GetProcessHeap () returned 0x580000 [0208.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x608a00 | out: hHeap=0x580000) returned 1 [0208.976] GetProcessHeap () returned 0x580000 [0208.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6096f0 | out: hHeap=0x580000) returned 1 [0208.976] GetProcessHeap () returned 0x580000 [0208.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0210.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb42b3c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x4d4fd28, dwReserved1=0x6096f0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.087] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.122] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", len=0x60 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned 1 [0210.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0210.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0211.494] CloseHandle (hObject=0x46c) returned 1 [0211.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0211.495] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.id_1622540890_.your_last_chance")) returned 1 [0212.646] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0212.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b9830 [0214.407] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0214.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.408] GetProcessHeap () returned 0x580000 [0214.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0214.408] GetProcessHeap () returned 0x580000 [0214.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0214.408] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.408] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0214.409] GetProcessHeap () returned 0x580000 [0214.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.409] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.409] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4d4ff14*=0x60, lpOverlapped=0x0) returned 1 [0214.409] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.409] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.409] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.409] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.409] CloseHandle (hObject=0x448) returned 1 [0214.410] GetProcessHeap () returned 0x580000 [0214.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0214.410] GetProcessHeap () returned 0x580000 [0214.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0214.410] GetProcessHeap () returned 0x580000 [0214.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0217.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb769fc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x4d4fd28, dwReserved1=0x61b540, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b97f0 [0217.213] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.272] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", len=0x6f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned 1 [0217.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0217.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.273] CloseHandle (hObject=0x490) returned 1 [0217.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.id_1622540890_.your_last_chance")) returned 1 [0217.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x797dd200, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x4709, dwReserved0=0x68002e, dwReserved1=0x6d0074, cFileName="FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~3.YOU")) returned 0x5b9770 [0217.274] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.274] GetProcessHeap () returned 0x580000 [0217.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4721) returned 0x7111f48 [0217.274] GetProcessHeap () returned 0x580000 [0217.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4721) returned 0x6ebeed0 [0217.274] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.274] ReadFile (in: hFile=0x490, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x4700, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x4d4ff14*=0x4700, lpOverlapped=0x0) returned 1 [0218.567] GetProcessHeap () returned 0x580000 [0218.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.568] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.568] WriteFile (in: hFile=0x490, lpBuffer=0x6ebeed0*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebeed0*, lpNumberOfBytesWritten=0x4d4ff14*=0x4700, lpOverlapped=0x0) returned 1 [0218.568] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.568] WriteFile (in: hFile=0x490, lpBuffer=0x6ec35cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec35cf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0218.568] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.568] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0218.568] CloseHandle (hObject=0x490) returned 1 [0218.568] GetProcessHeap () returned 0x580000 [0218.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebeed0 | out: hHeap=0x580000) returned 1 [0218.568] GetProcessHeap () returned 0x580000 [0218.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0218.568] GetProcessHeap () returned 0x580000 [0218.568] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9e329c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x472d, dwReserved0=0x4d4fd28, dwReserved1=0x7111f48, cFileName="FormsPreviewTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~3.YOU")) returned 0x5b9770 [0221.380] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.441] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", len=0x4a | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 1 [0221.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f5c) returned 0x6dee6e0 [0221.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.442] CloseHandle (hObject=0x460) returned 1 [0221.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.442] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id_1622540890_.your_last_chance")) returned 1 [0221.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSS_DO~1.YOU")) returned 0x5b9730 [0221.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.477] GetProcessHeap () returned 0x580000 [0221.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x677cd0 [0221.477] GetProcessHeap () returned 0x580000 [0221.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d330c0 [0221.478] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.478] ReadFile (in: hFile=0x460, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4d4ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.577] GetProcessHeap () returned 0x580000 [0221.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.577] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.577] WriteFile (in: hFile=0x460, lpBuffer=0x6d330c0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330c0*, lpNumberOfBytesWritten=0x4d4ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.577] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.577] WriteFile (in: hFile=0x460, lpBuffer=0x6d33bdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33bdf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.578] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.578] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.578] CloseHandle (hObject=0x460) returned 1 [0221.578] GetProcessHeap () returned 0x580000 [0221.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330c0 | out: hHeap=0x580000) returned 1 [0221.578] GetProcessHeap () returned 0x580000 [0221.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0221.578] GetProcessHeap () returned 0x580000 [0221.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.578] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbae9320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x4d4fd28, dwReserved1=0x677cd0, cFileName="WSS_DocLib.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSS_DO~1.YOU")) returned 0x5b9730 [0221.578] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.628] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", len=0x4f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 1 [0221.628] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f38) returned 0x6dee6e0 [0221.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.654] CloseHandle (hObject=0x458) returned 1 [0221.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id_1622540890_.your_last_chance")) returned 1 [0221.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSON~1.YOU")) returned 0x5b9730 [0221.655] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.655] GetProcessHeap () returned 0x580000 [0221.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0221.655] GetProcessHeap () returned 0x580000 [0221.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0221.655] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.656] ReadFile (in: hFile=0x458, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x4d4ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.663] GetProcessHeap () returned 0x580000 [0221.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.663] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.663] WriteFile (in: hFile=0x458, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x4d4ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.663] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.663] WriteFile (in: hFile=0x458, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.663] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.663] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.664] CloseHandle (hObject=0x458) returned 1 [0221.664] GetProcessHeap () returned 0x580000 [0221.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0221.664] GetProcessHeap () returned 0x580000 [0221.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0221.664] GetProcessHeap () returned 0x580000 [0221.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0223.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbbcdb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6da, dwReserved0=0x4d4fd28, dwReserved1=0x6c79898, cFileName="PersonalContact.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSON~1.YOU")) returned 0x5b96f0 [0223.407] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.412] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", len=0x64 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned 1 [0223.412] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0223.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.413] CloseHandle (hObject=0x47c) returned 1 [0223.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.id_1622540890_.your_last_chance")) returned 1 [0223.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_HY~1.YOU")) returned 0x5b96f0 [0223.414] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0223.414] GetProcessHeap () returned 0x580000 [0223.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09738 [0223.414] GetProcessHeap () returned 0x580000 [0223.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09ee0 [0223.414] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.414] ReadFile (in: hFile=0x47c, lpBuffer=0x6f09738, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09738*, lpNumberOfBytesRead=0x4d4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0223.416] GetProcessHeap () returned 0x580000 [0223.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0223.416] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.416] WriteFile (in: hFile=0x47c, lpBuffer=0x6f09ee0*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09ee0*, lpNumberOfBytesWritten=0x4d4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0223.416] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.416] WriteFile (in: hFile=0x47c, lpBuffer=0x6f09fbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09fbf*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.417] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.417] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.417] CloseHandle (hObject=0x47c) returned 1 [0223.417] GetProcessHeap () returned 0x580000 [0223.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0223.417] GetProcessHeap () returned 0x580000 [0223.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.417] GetProcessHeap () returned 0x580000 [0223.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0223.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc77560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x4d4fd28, dwReserved1=0x6f09738, cFileName="rtf_hyperlink.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_HY~1.YOU")) returned 0x5b96f0 [0223.417] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.424] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", len=0x61 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned 1 [0223.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0223.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0223.424] CloseHandle (hObject=0x3fc) returned 1 [0223.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.id_1622540890_.your_last_chance")) returned 1 [0223.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b96f0 [0223.426] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0223.426] GetProcessHeap () returned 0x580000 [0223.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6d00cd8 [0223.426] GetProcessHeap () returned 0x580000 [0223.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6d01048 [0223.426] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.426] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d00cd8, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesRead=0x4d4ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.992] GetProcessHeap () returned 0x580000 [0223.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.992] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.992] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d01048*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01048*, lpNumberOfBytesWritten=0x4d4ff14*=0x340, lpOverlapped=0x0) returned 1 [0223.992] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.992] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d01387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01387*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.993] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.993] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.993] CloseHandle (hObject=0x3fc) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d01048 | out: hHeap=0x580000) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0224.423] GetProcessHeap () returned 0x580000 [0224.423] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0226.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd1f8840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x4d4fd28, dwReserved1=0x6d00cd8, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b9630 [0226.267] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.312] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", len=0x48 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned 1 [0226.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da8) returned 0x6dee6e0 [0226.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.419] CloseHandle (hObject=0x450) returned 1 [0226.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam.id_1622540890_.your_last_chance")) returned 1 [0226.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FUNCRE~1.YOU")) returned 0x5b9630 [0226.420] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0226.420] GetProcessHeap () returned 0x580000 [0226.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b81) returned 0x725df98 [0226.420] GetProcessHeap () returned 0x580000 [0226.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b81) returned 0x6ff8ff8 [0226.420] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.420] ReadFile (in: hFile=0x450, lpBuffer=0x725df98, nNumberOfBytesToRead=0x6b60, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x725df98*, lpNumberOfBytesRead=0x4d4ff14*=0x6b60, lpOverlapped=0x0) returned 1 [0229.387] GetProcessHeap () returned 0x580000 [0229.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0229.387] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.387] WriteFile (in: hFile=0x450, lpBuffer=0x6ff8ff8*, nNumberOfBytesToWrite=0x6b60, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesWritten=0x4d4ff14*=0x6b60, lpOverlapped=0x0) returned 1 [0229.387] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.387] WriteFile (in: hFile=0x450, lpBuffer=0x6fffb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fffb57*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0229.387] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.387] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0229.387] CloseHandle (hObject=0x450) returned 1 [0229.387] GetProcessHeap () returned 0x580000 [0229.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0229.388] GetProcessHeap () returned 0x580000 [0229.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x725df98 | out: hHeap=0x580000) returned 1 [0229.388] GetProcessHeap () returned 0x580000 [0229.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc03f5640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b86, dwReserved0=0x4d4fd28, dwReserved1=0x725df98, cFileName="FUNCRES.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FUNCRE~1.YOU")) returned 0x5b9630 [0230.807] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.857] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", len=0x36 | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 1 [0230.857] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0230.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0230.897] CloseHandle (hObject=0x390) returned 1 [0230.897] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id_1622540890_.your_last_chance")) returned 1 [0230.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7E~1.YOU")) returned 0x5b9630 [0230.898] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0230.898] GetProcessHeap () returned 0x580000 [0230.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75aef38 [0230.899] GetProcessHeap () returned 0x580000 [0230.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75c0768 [0230.900] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.900] ReadFile (in: hFile=0x390, lpBuffer=0x75aef38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x75aef38*, lpNumberOfBytesRead=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.027] GetProcessHeap () returned 0x580000 [0238.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0238.027] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.027] WriteFile (in: hFile=0x390, lpBuffer=0x75c0768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x75c0768*, lpNumberOfBytesWritten=0x4d4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.276] WriteFile (in: hFile=0x390, lpBuffer=0x75d1f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x75d1f67*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.344] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.344] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.345] CloseHandle (hObject=0x390) returned 1 [0239.465] GetProcessHeap () returned 0x580000 [0239.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75c0768 | out: hHeap=0x580000) returned 1 [0239.468] GetProcessHeap () returned 0x580000 [0239.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75aef38 | out: hHeap=0x580000) returned 1 [0239.468] GetProcessHeap () returned 0x580000 [0239.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0240.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b62, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="mset7en.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7E~1.YOU")) returned 0x5b9730 [0240.829] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.849] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML", len=0x3f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned 1 [0241.849] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0241.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0245.387] CloseHandle (hObject=0x170) returned 1 [0245.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.388] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml.id_1622540890_.your_last_chance")) returned 1 [0248.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x662faf00, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x662faf00, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x8250, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN05~2.YOU")) returned 0x5b96f0 [0248.555] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0248.556] GetProcessHeap () returned 0x580000 [0248.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8261) returned 0x6fa2c48 [0248.556] GetProcessHeap () returned 0x580000 [0248.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8261) returned 0x72f0208 [0248.556] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.556] ReadFile (in: hFile=0x170, lpBuffer=0x6fa2c48, nNumberOfBytesToRead=0x8240, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa2c48*, lpNumberOfBytesRead=0x4d4ff14*=0x8240, lpOverlapped=0x0) returned 1 [0250.560] GetProcessHeap () returned 0x580000 [0250.560] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0250.560] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.560] WriteFile (in: hFile=0x170, lpBuffer=0x72f0208*, nNumberOfBytesToWrite=0x8240, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesWritten=0x4d4ff14*=0x8240, lpOverlapped=0x0) returned 1 [0250.560] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.560] WriteFile (in: hFile=0x170, lpBuffer=0x72f8447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f8447*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0250.560] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.560] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0250.560] CloseHandle (hObject=0x170) returned 1 [0250.561] GetProcessHeap () returned 0x580000 [0250.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0250.561] GetProcessHeap () returned 0x580000 [0250.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa2c48 | out: hHeap=0x580000) returned 1 [0250.561] GetProcessHeap () returned 0x580000 [0250.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0254.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x662faf00, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccdd8020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8274, dwReserved0=0x4d4fd28, dwReserved1=0x6fa2c48, cFileName="PGMN054.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN05~2.YOU")) returned 0x5b9730 [0254.421] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.155] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV", len=0x3e | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 1 [0255.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa8) returned 0x72e5948 [0255.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0255.155] CloseHandle (hObject=0x4a0) returned 1 [0255.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.id_1622540890_.your_last_chance")) returned 1 [0255.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438bc800, ftCreationTime.dwHighDateTime=0x1c6157c, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x438bc800, ftLastWriteTime.dwHighDateTime=0x1c6157c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBP~2.YOU")) returned 0x5b9730 [0255.157] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0255.157] GetProcessHeap () returned 0x580000 [0255.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5021) returned 0x703a4c8 [0255.157] GetProcessHeap () returned 0x580000 [0255.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5021) returned 0x6fa8f28 [0255.157] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.157] ReadFile (in: hFile=0x4a0, lpBuffer=0x703a4c8, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x703a4c8*, lpNumberOfBytesRead=0x4d4ff14*=0x5000, lpOverlapped=0x0) returned 1 [0256.239] GetProcessHeap () returned 0x580000 [0256.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0256.240] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.240] WriteFile (in: hFile=0x4a0, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x4d4ff14*=0x5000, lpOverlapped=0x0) returned 1 [0256.240] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.240] WriteFile (in: hFile=0x4a0, lpBuffer=0x6fadf27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fadf27*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0256.240] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.241] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0256.241] CloseHandle (hObject=0x4a0) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703a4c8 | out: hHeap=0x580000) returned 1 [0256.744] GetProcessHeap () returned 0x580000 [0256.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0258.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438bc800, ftCreationTime.dwHighDateTime=0x1c6157c, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd03ff4a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5024, dwReserved0=0x4d4fd28, dwReserved1=0x703a4c8, cFileName="DGWEBPQT.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBP~2.YOU")) returned 0x5b9730 [0258.985] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.000] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC", len=0x3d | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC") returned 1 [0259.000] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb0) returned 0x72e5948 [0259.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0259.001] CloseHandle (hObject=0x41c) returned 1 [0259.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc.id_1622540890_.your_last_chance")) returned 1 [0259.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fc74 | out: lpFindFileData=0x4d4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3464, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LABELH~1.YOU")) returned 0x5b9730 [0259.002] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0259.002] GetProcessHeap () returned 0x580000 [0259.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3481) returned 0x70017d0 [0259.002] GetProcessHeap () returned 0x580000 [0259.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3481) returned 0x6ebad68 [0259.002] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.002] ReadFile (in: hFile=0x41c, lpBuffer=0x70017d0, nNumberOfBytesToRead=0x3460, lpNumberOfBytesRead=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x70017d0*, lpNumberOfBytesRead=0x4d4ff14*=0x3460, lpOverlapped=0x0) returned 1 [0261.069] GetProcessHeap () returned 0x580000 [0261.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0261.069] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.069] WriteFile (in: hFile=0x41c, lpBuffer=0x6ebad68*, nNumberOfBytesToWrite=0x3460, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebad68*, lpNumberOfBytesWritten=0x4d4ff14*=0x3460, lpOverlapped=0x0) returned 1 [0261.069] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.069] WriteFile (in: hFile=0x41c, lpBuffer=0x6ebe1c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebe1c7*, lpNumberOfBytesWritten=0x4d4ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.069] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.069] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4d4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4d4ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.069] CloseHandle (hObject=0x41c) returned 1 [0261.069] GetProcessHeap () returned 0x580000 [0261.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebad68 | out: hHeap=0x580000) returned 1 [0261.069] GetProcessHeap () returned 0x580000 [0261.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70017d0 | out: hHeap=0x580000) returned 1 [0261.069] GetProcessHeap () returned 0x580000 [0261.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0261.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4d4fccc | out: lpFindFileData=0x4d4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd321dee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3488, dwReserved0=0x4d4fd28, dwReserved1=0x70017d0, cFileName="LABELHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LABELH~1.YOU")) returned 0x5b9630 [0261.070] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.830] SysReAllocStringLen (in: pbstr=0x4d4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy", len=0x5f | out: pbstr=0x4d4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy") returned 1 [0262.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x205c) returned 0x72e5948 [0262.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0262.905] CloseHandle (hObject=0x438) returned 1 [0262.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4d4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0262.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy.id_1622540890_.your_last_chance")) Thread: id = 39 os_tid = 0xa94 [0039.066] Sleep (dwMilliseconds=0x1) [0039.090] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.576] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.467] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.782] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.924] Sleep (dwMilliseconds=0x1) [0043.002] Sleep (dwMilliseconds=0x1) [0043.016] Sleep (dwMilliseconds=0x1) [0043.100] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.139] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.205] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.405] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.825] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.511] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.620] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.698] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.010] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.041] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.119] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.166] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.275] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.322] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.353] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.416] Sleep (dwMilliseconds=0x1) [0045.431] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.868] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.962] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.071] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.180] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.258] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.305] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.492] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.570] Sleep (dwMilliseconds=0x1) [0046.587] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.617] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.648] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.804] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.851] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.882] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.960] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.115] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.162] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.817] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.129] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.285] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.519] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.675] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.987] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.065] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.221] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.268] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.970] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.079] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.126] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.282] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.313] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.391] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.438] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.672] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.703] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.781] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.193] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.561] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.715] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.339] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.651] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.807] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.088] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.119] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.509] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.541] Sleep (dwMilliseconds=0x1) [0053.556] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.946] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.024] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.570] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.882] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.225] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.350] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.894] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", len=0x4b | out: pbstr=0x4e8ff84*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 1 [0055.894] GetProcessHeap () returned 0x580000 [0055.894] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0055.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0055.899] CloseHandle (hObject=0x404) returned 1 [0055.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.899] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id_1622540890_.your_last_chance")) returned 1 [0055.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.899] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x45, dwReserved1=0x0, cFileName="ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~1.YOU")) returned 0x5b9630 [0055.900] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.900] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x404 [0055.900] GetProcessHeap () returned 0x580000 [0055.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x622c10 [0055.900] GetProcessHeap () returned 0x580000 [0055.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x634440 [0055.900] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.900] ReadFile (in: hFile=0x404, lpBuffer=0x622c10, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x622c10*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0057.582] GetProcessHeap () returned 0x580000 [0057.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0057.583] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x404, lpBuffer=0x634440*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x634440*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0057.583] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.583] WriteFile (in: hFile=0x404, lpBuffer=0x645c3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x645c3f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0058.018] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.018] WriteFile (in: hFile=0x404, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0058.019] CloseHandle (hObject=0x404) returned 1 [0058.517] GetProcessHeap () returned 0x580000 [0058.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x634440 | out: hHeap=0x580000) returned 1 [0058.517] GetProcessHeap () returned 0x580000 [0058.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x622c10 | out: hHeap=0x580000) returned 1 [0058.517] GetProcessHeap () returned 0x580000 [0058.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0058.517] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5aae8b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x263e24, dwReserved0=0x4e8fd28, dwReserved1=0x622c10, cFileName="ExcelMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELM~1.YOU")) returned 0x5b9630 [0058.517] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.800] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x4e8ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0061.800] GetProcessHeap () returned 0x580000 [0061.800] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x44) returned 0x5b5bc8 [0061.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0063.369] CloseHandle (hObject=0x47c) returned 1 [0063.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0063.369] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance")) returned 1 [0066.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.357] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x45, dwReserved1=0x0, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96b0 [0066.357] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.357] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0066.358] GetProcessHeap () returned 0x580000 [0066.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0066.358] GetProcessHeap () returned 0x580000 [0066.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0066.358] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.358] ReadFile (in: hFile=0x47c, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0071.480] GetProcessHeap () returned 0x580000 [0071.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0071.481] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.481] WriteFile (in: hFile=0x47c, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0071.481] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.481] WriteFile (in: hFile=0x47c, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.915] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.915] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.915] CloseHandle (hObject=0x47c) returned 1 [0074.922] GetProcessHeap () returned 0x580000 [0074.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0074.924] GetProcessHeap () returned 0x580000 [0074.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0074.924] GetProcessHeap () returned 0x580000 [0074.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0079.335] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x228df80, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96f0 [0079.335] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.351] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 1 [0079.352] GetProcessHeap () returned 0x580000 [0079.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x2c) returned 0x5f76f0 [0079.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.361] Sleep (dwMilliseconds=0x1) [0084.367] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", len=0x4c | out: pbstr=0x4e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 1 [0084.367] GetProcessHeap () returned 0x580000 [0084.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x18) returned 0x5a58e8 [0084.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0084.367] CloseHandle (hObject=0x498) returned 1 [0084.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id_1622540890_.your_last_chance")) returned 1 [0084.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x450043, dwReserved1=0x0, cFileName="TIME.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIMEXM~1.YOU")) returned 0x5b9630 [0084.804] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0084.804] GetProcessHeap () returned 0x580000 [0084.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x67dc48 [0084.804] GetProcessHeap () returned 0x580000 [0084.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x633b38 [0084.804] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.804] ReadFile (in: hFile=0x498, lpBuffer=0x67dc48, nNumberOfBytesToRead=0x2160, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67dc48*, lpNumberOfBytesRead=0x4e8ff14*=0x2160, lpOverlapped=0x0) returned 1 [0084.835] GetProcessHeap () returned 0x580000 [0084.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.835] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.835] WriteFile (in: hFile=0x498, lpBuffer=0x633b38*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x633b38*, lpNumberOfBytesWritten=0x4e8ff14*=0x2160, lpOverlapped=0x0) returned 1 [0084.835] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.835] WriteFile (in: hFile=0x498, lpBuffer=0x635c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635c97*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0084.836] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.836] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0084.836] CloseHandle (hObject=0x498) returned 1 [0084.836] GetProcessHeap () returned 0x580000 [0084.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x633b38 | out: hHeap=0x580000) returned 1 [0084.836] GetProcessHeap () returned 0x580000 [0084.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67dc48 | out: hHeap=0x580000) returned 1 [0084.836] GetProcessHeap () returned 0x580000 [0084.836] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.836] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a2e9f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2198, dwReserved0=0x4e8fd28, dwReserved1=0x67dc48, cFileName="TIME.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIMEXM~1.YOU")) returned 0x5b9630 [0084.836] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.359] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x4e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 1 [0088.359] GetProcessHeap () returned 0x580000 [0088.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x2c) returned 0x61f6c0 [0088.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0094.162] CloseHandle (hObject=0x408) returned 1 [0094.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.163] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0097.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0097.486] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0097.486] GetProcessHeap () returned 0x580000 [0097.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x67ec60 [0097.486] GetProcessHeap () returned 0x580000 [0097.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6d035f8 [0097.487] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.487] ReadFile (in: hFile=0x408, lpBuffer=0x67ec60, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x4e8ff14*=0xf60, lpOverlapped=0x0) returned 1 [0097.509] GetProcessHeap () returned 0x580000 [0097.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.509] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.509] WriteFile (in: hFile=0x408, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x4e8ff14*=0xf60, lpOverlapped=0x0) returned 1 [0097.510] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.510] WriteFile (in: hFile=0x408, lpBuffer=0x6d04557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04557*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.510] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.510] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.510] CloseHandle (hObject=0x408) returned 1 [0097.511] GetProcessHeap () returned 0x580000 [0097.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0097.511] GetProcessHeap () returned 0x580000 [0097.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0097.511] GetProcessHeap () returned 0x580000 [0097.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71bb7bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf99, dwReserved0=0x4e8fd28, dwReserved1=0x67ec60, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0097.511] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.516] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", len=0x43 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 1 [0097.516] GetProcessHeap () returned 0x580000 [0097.516] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0097.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0097.517] CloseHandle (hObject=0x408) returned 1 [0097.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0097.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id_1622540890_.your_last_chance")) returned 1 [0097.518] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYELM~1.YOU")) returned 0x5b96f0 [0097.518] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0097.518] GetProcessHeap () returned 0x580000 [0097.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0097.518] GetProcessHeap () returned 0x580000 [0097.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0c2f0 [0097.518] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.518] ReadFile (in: hFile=0x408, lpBuffer=0x6d9f1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0101.103] GetProcessHeap () returned 0x580000 [0101.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0101.103] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.103] WriteFile (in: hFile=0x408, lpBuffer=0x6e0c2f0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c2f0*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0101.104] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.104] WriteFile (in: hFile=0x408, lpBuffer=0x6e1daef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1daef*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.104] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.104] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.104] CloseHandle (hObject=0x408) returned 1 [0101.104] GetProcessHeap () returned 0x580000 [0101.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c2f0 | out: hHeap=0x580000) returned 1 [0101.105] GetProcessHeap () returned 0x580000 [0101.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0101.106] GetProcessHeap () returned 0x580000 [0101.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73e15960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14161, dwReserved0=0x4e8fd28, dwReserved1=0x6d9f1d0, cFileName="SKY.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYELM~1.YOU")) returned 0x5b96b0 [0101.842] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.884] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", len=0x4d | out: pbstr=0x4e8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 1 [0106.884] GetProcessHeap () returned 0x580000 [0106.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92e8 | out: hHeap=0x580000) returned 1 [0106.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0107.925] CloseHandle (hObject=0x484) returned 1 [0107.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id_1622540890_.your_last_chance")) returned 1 [0107.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIGFON~1.YOU")) returned 0x5b9730 [0107.926] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0107.926] GetProcessHeap () returned 0x580000 [0107.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c9d3d8 [0107.926] GetProcessHeap () returned 0x580000 [0107.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6caec08 [0107.926] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.926] ReadFile (in: hFile=0x484, lpBuffer=0x6c9d3d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3d8*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.572] GetProcessHeap () returned 0x580000 [0111.572] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0111.573] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.573] WriteFile (in: hFile=0x484, lpBuffer=0x6caec08*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6caec08*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.573] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.573] WriteFile (in: hFile=0x484, lpBuffer=0x6cc0407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0407*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.699] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.699] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.699] CloseHandle (hObject=0x484) returned 1 [0111.699] GetProcessHeap () returned 0x580000 [0111.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6caec08 | out: hHeap=0x580000) returned 1 [0111.699] GetProcessHeap () returned 0x580000 [0111.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9d3d8 | out: hHeap=0x580000) returned 1 [0111.699] GetProcessHeap () returned 0x580000 [0111.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0111.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a319f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f30e, dwReserved0=0x4e8fd28, dwReserved1=0x6c9d3d8, cFileName="BIGFONT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIGFON~1.YOU")) returned 0x5b9730 [0111.699] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.081] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", len=0x46 | out: pbstr=0x4e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 1 [0112.081] GetProcessHeap () returned 0x580000 [0112.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.081] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.081] Sleep (dwMilliseconds=0x1) [0112.122] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", len=0x53 | out: pbstr=0x4e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.123] GetProcessHeap () returned 0x580000 [0112.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x58) returned 0x5a4778 [0112.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.141] Sleep (dwMilliseconds=0x1) [0112.265] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", len=0x48 | out: pbstr=0x4e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned 1 [0112.265] GetProcessHeap () returned 0x580000 [0112.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.265] Sleep (dwMilliseconds=0x1) [0112.310] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", len=0x4e | out: pbstr=0x4e8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned 1 [0112.310] GetProcessHeap () returned 0x580000 [0112.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c562c0, Size=0x5c) returned 0x6c561f0 [0112.310] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.326] Sleep (dwMilliseconds=0x1) [0113.326] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 1 [0113.326] GetProcessHeap () returned 0x580000 [0113.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xb8) returned 0x6f0ceb8 [0113.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.484] CloseHandle (hObject=0x3b4) returned 1 [0113.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0108~1.YOU")) returned 0x5b9630 [0114.679] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.679] GetProcessHeap () returned 0x580000 [0114.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6d00d78 [0114.679] GetProcessHeap () returned 0x580000 [0114.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x65f268 [0114.679] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.679] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d00d78, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00d78*, lpNumberOfBytesRead=0x4e8ff14*=0x720, lpOverlapped=0x0) returned 1 [0114.687] GetProcessHeap () returned 0x580000 [0114.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.687] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.687] WriteFile (in: hFile=0x3b4, lpBuffer=0x65f268*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesWritten=0x4e8ff14*=0x720, lpOverlapped=0x0) returned 1 [0114.687] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.687] WriteFile (in: hFile=0x3b4, lpBuffer=0x65f987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f987*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.687] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.687] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.687] CloseHandle (hObject=0x3b4) returned 1 [0114.687] GetProcessHeap () returned 0x580000 [0114.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0114.687] GetProcessHeap () returned 0x580000 [0114.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00d78 | out: hHeap=0x580000) returned 1 [0114.687] GetProcessHeap () returned 0x580000 [0114.687] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bf845a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x4e8fd28, dwReserved1=0x6d00d78, cFileName="AN01084_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0108~1.YOU")) returned 0x5b9630 [0115.690] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0117.406] CloseHandle (hObject=0x428) returned 1 [0117.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.406] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0078~1.YOU")) returned 0x5b9630 [0117.407] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0117.407] GetProcessHeap () returned 0x580000 [0117.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x6ef7f38 [0117.408] GetProcessHeap () returned 0x580000 [0117.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x6f151b8 [0117.408] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.408] ReadFile (in: hFile=0x428, lpBuffer=0x6ef7f38, nNumberOfBytesToRead=0x2080, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7f38*, lpNumberOfBytesRead=0x4e8ff14*=0x2080, lpOverlapped=0x0) returned 1 [0117.444] GetProcessHeap () returned 0x580000 [0117.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0117.444] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.445] WriteFile (in: hFile=0x428, lpBuffer=0x6f151b8*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f151b8*, lpNumberOfBytesWritten=0x4e8ff14*=0x2080, lpOverlapped=0x0) returned 1 [0117.445] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.445] WriteFile (in: hFile=0x428, lpBuffer=0x6f17237*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f17237*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.445] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.445] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.445] CloseHandle (hObject=0x428) returned 1 [0117.445] GetProcessHeap () returned 0x580000 [0117.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f151b8 | out: hHeap=0x580000) returned 1 [0117.445] GetProcessHeap () returned 0x580000 [0117.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef7f38 | out: hHeap=0x580000) returned 1 [0117.446] GetProcessHeap () returned 0x580000 [0117.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0119.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d9d9900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20b8, dwReserved0=0x4e8fd28, dwReserved1=0x6ef7f38, cFileName="SY00788_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0078~1.YOU")) returned 0x5b96f0 [0119.873] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0121.701] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", len=0x4b | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned 1 [0121.701] GetProcessHeap () returned 0x580000 [0121.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1838) returned 0x6e00ac0 [0121.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.068] CloseHandle (hObject=0x440) returned 1 [0122.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.id_1622540890_.your_last_chance")) returned 1 [0122.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x45, dwReserved1=0x0, cFileName="Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELX~1.YOU")) returned 0x5b9730 [0122.069] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.069] GetProcessHeap () returned 0x580000 [0122.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.069] GetProcessHeap () returned 0x580000 [0122.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.069] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.069] ReadFile (in: hFile=0x440, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x4e8ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.074] GetProcessHeap () returned 0x580000 [0122.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.074] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.074] WriteFile (in: hFile=0x440, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x4e8ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.074] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.074] WriteFile (in: hFile=0x440, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.074] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.074] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.074] CloseHandle (hObject=0x440) returned 1 [0122.074] GetProcessHeap () returned 0x580000 [0122.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.074] GetProcessHeap () returned 0x580000 [0122.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.074] GetProcessHeap () returned 0x580000 [0122.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80609160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e4, dwReserved0=0x4e8fd28, dwReserved1=0x678958, cFileName="Oriel.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELX~1.YOU")) returned 0x5b9730 [0124.352] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.380] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", len=0x4b | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned 1 [0124.380] GetProcessHeap () returned 0x580000 [0124.380] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1910) returned 0x6f42f08 [0124.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0125.372] CloseHandle (hObject=0x4b0) returned 1 [0125.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.id_1622540890_.your_last_chance")) returned 1 [0125.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x45, dwReserved1=0x0, cFileName="Median.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEDIAN~1.YOU")) returned 0x5b9730 [0125.373] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0125.373] GetProcessHeap () returned 0x580000 [0125.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0125.373] GetProcessHeap () returned 0x580000 [0125.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0125.373] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.373] ReadFile (in: hFile=0x4b0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x4e8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0125.387] GetProcessHeap () returned 0x580000 [0125.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.388] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.388] WriteFile (in: hFile=0x4b0, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x4e8ff14*=0xee0, lpOverlapped=0x0) returned 1 [0125.388] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.388] WriteFile (in: hFile=0x4b0, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.388] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.388] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.388] CloseHandle (hObject=0x4b0) returned 1 [0125.388] GetProcessHeap () returned 0x580000 [0125.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0125.388] GetProcessHeap () returned 0x580000 [0125.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.388] GetProcessHeap () returned 0x580000 [0125.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x825934e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf11, dwReserved0=0x4e8fd28, dwReserved1=0x6c29878, cFileName="Median.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEDIAN~1.YOU")) returned 0x5b9730 [0125.388] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.393] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", len=0x3d | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned 1 [0125.393] GetProcessHeap () returned 0x580000 [0125.393] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a08) returned 0x667250 [0125.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0128.883] CloseHandle (hObject=0x3a8) returned 1 [0128.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03351~1.YOU")) returned 0x5b9730 [0130.373] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0130.373] GetProcessHeap () returned 0x580000 [0130.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f81) returned 0x6d78248 [0130.373] GetProcessHeap () returned 0x580000 [0130.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1f81) returned 0x6ef9658 [0130.373] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.373] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d78248, nNumberOfBytesToRead=0x1f60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d78248*, lpNumberOfBytesRead=0x4e8ff14*=0x1f60, lpOverlapped=0x0) returned 1 [0130.401] GetProcessHeap () returned 0x580000 [0130.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.402] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.402] WriteFile (in: hFile=0x3a8, lpBuffer=0x6ef9658*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef9658*, lpNumberOfBytesWritten=0x4e8ff14*=0x1f60, lpOverlapped=0x0) returned 1 [0130.402] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.402] WriteFile (in: hFile=0x3a8, lpBuffer=0x6efb5b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb5b7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0130.402] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.402] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0130.402] CloseHandle (hObject=0x3a8) returned 1 [0130.402] GetProcessHeap () returned 0x580000 [0130.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef9658 | out: hHeap=0x580000) returned 1 [0130.402] GetProcessHeap () returned 0x580000 [0130.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d78248 | out: hHeap=0x580000) returned 1 [0130.402] GetProcessHeap () returned 0x580000 [0130.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8557afa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f88, dwReserved0=0x4e8fd28, dwReserved1=0x6d78248, cFileName="J0335112.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03351~1.YOU")) returned 0x5b9730 [0130.403] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.715] CloseHandle (hObject=0x430) returned 1 [0132.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.716] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.id_1622540890_.your_last_chance")) returned 1 [0132.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOREST~1.YOU")) returned 0x5b9730 [0132.717] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\forest.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.717] GetProcessHeap () returned 0x580000 [0132.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0132.717] GetProcessHeap () returned 0x580000 [0132.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0132.717] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.717] ReadFile (in: hFile=0x430, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4e8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.730] GetProcessHeap () returned 0x580000 [0132.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.730] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.730] WriteFile (in: hFile=0x430, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x4e8ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.730] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.730] WriteFile (in: hFile=0x430, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.730] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.731] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.731] CloseHandle (hObject=0x430) returned 1 [0132.731] GetProcessHeap () returned 0x580000 [0132.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0132.731] GetProcessHeap () returned 0x580000 [0132.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0132.731] GetProcessHeap () returned 0x580000 [0132.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86ba5c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x4e8fd28, dwReserved1=0x635768, cFileName="FOREST.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOREST~1.YOU")) returned 0x5b96f0 [0135.274] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.274] Sleep (dwMilliseconds=0x1) [0135.299] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD", len=0x39 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 1 [0135.299] GetProcessHeap () returned 0x580000 [0135.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0135.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0135.354] CloseHandle (hObject=0x478) returned 1 [0135.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id_1622540890_.your_last_chance")) returned 1 [0135.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASSETV~1.YOU")) returned 0x5b96f0 [0135.355] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0135.355] GetProcessHeap () returned 0x580000 [0135.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6cf6cf0 [0135.355] GetProcessHeap () returned 0x580000 [0135.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6cf73b8 [0135.356] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.356] ReadFile (in: hFile=0x478, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x4e8ff14*=0x680, lpOverlapped=0x0) returned 1 [0135.368] GetProcessHeap () returned 0x580000 [0135.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.368] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.368] WriteFile (in: hFile=0x478, lpBuffer=0x6cf73b8*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf73b8*, lpNumberOfBytesWritten=0x4e8ff14*=0x680, lpOverlapped=0x0) returned 1 [0135.368] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.368] WriteFile (in: hFile=0x478, lpBuffer=0x6cf7a37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7a37*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.368] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.368] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.368] CloseHandle (hObject=0x478) returned 1 [0135.368] GetProcessHeap () returned 0x580000 [0135.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf73b8 | out: hHeap=0x580000) returned 1 [0135.368] GetProcessHeap () returned 0x580000 [0135.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0135.368] GetProcessHeap () returned 0x580000 [0135.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x884ca4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6c2, dwReserved0=0x4e8fd28, dwReserved1=0x6cf6cf0, cFileName="ASSET.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ASSETV~1.YOU")) returned 0x5b96f0 [0135.369] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.369] Sleep (dwMilliseconds=0x1) [0135.429] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", len=0x50 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned 1 [0135.429] GetProcessHeap () returned 0x580000 [0135.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.430] CloseHandle (hObject=0x488) returned 1 [0135.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.id_1622540890_.your_last_chance")) returned 1 [0135.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b96b0 [0135.431] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.431] GetProcessHeap () returned 0x580000 [0135.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6f42f08 [0135.431] GetProcessHeap () returned 0x580000 [0135.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1941) returned 0x6d9b7c8 [0135.431] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.431] ReadFile (in: hFile=0x488, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1920, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x4e8ff14*=0x1920, lpOverlapped=0x0) returned 1 [0135.479] GetProcessHeap () returned 0x580000 [0135.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.479] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.480] WriteFile (in: hFile=0x488, lpBuffer=0x6d9b7c8*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9b7c8*, lpNumberOfBytesWritten=0x4e8ff14*=0x1920, lpOverlapped=0x0) returned 1 [0135.480] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.480] WriteFile (in: hFile=0x488, lpBuffer=0x6d9d0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9d0e7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.480] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.480] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.480] CloseHandle (hObject=0x488) returned 1 [0135.480] GetProcessHeap () returned 0x580000 [0135.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9b7c8 | out: hHeap=0x580000) returned 1 [0135.480] GetProcessHeap () returned 0x580000 [0135.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0135.480] GetProcessHeap () returned 0x580000 [0135.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x885d4e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x4e8fd28, dwReserved1=0x6f42f08, cFileName="bg_TexturedBlue.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_TEX~1.YOU")) returned 0x5b96b0 [0135.550] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.564] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", len=0x4c | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned 1 [0135.565] GetProcessHeap () returned 0x580000 [0135.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0135.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0135.565] CloseHandle (hObject=0x49c) returned 1 [0135.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.id_1622540890_.your_last_chance")) returned 1 [0135.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x450043, dwReserved1=0x0, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b96b0 [0135.566] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0135.567] GetProcessHeap () returned 0x580000 [0135.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x6dc84e0 [0135.567] GetProcessHeap () returned 0x580000 [0135.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x6e4b350 [0135.567] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.567] ReadFile (in: hFile=0x49c, lpBuffer=0x6dc84e0, nNumberOfBytesToRead=0x5680, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc84e0*, lpNumberOfBytesRead=0x4e8ff14*=0x5680, lpOverlapped=0x0) returned 1 [0136.844] GetProcessHeap () returned 0x580000 [0136.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616c28 [0136.844] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.844] WriteFile (in: hFile=0x49c, lpBuffer=0x6e4b350*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4b350*, lpNumberOfBytesWritten=0x4e8ff14*=0x5680, lpOverlapped=0x0) returned 1 [0138.432] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.432] WriteFile (in: hFile=0x49c, lpBuffer=0x6e509cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e509cf*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.438] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.438] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.438] CloseHandle (hObject=0x49c) returned 1 [0138.438] GetProcessHeap () returned 0x580000 [0138.438] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e4b350 | out: hHeap=0x580000) returned 1 [0138.438] GetProcessHeap () returned 0x580000 [0138.438] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc84e0 | out: hHeap=0x580000) returned 1 [0138.438] GetProcessHeap () returned 0x580000 [0138.438] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616c28 | out: hHeap=0x580000) returned 1 [0138.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x56b4, dwReserved0=0x4e8fd28, dwReserved1=0x6dc84e0, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b96b0 [0138.438] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.454] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", len=0x43 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned 1 [0138.454] GetProcessHeap () returned 0x580000 [0138.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0138.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.022] CloseHandle (hObject=0x3b4) returned 1 [0140.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b9c600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32b9c600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2E4F~1.YOU")) returned 0x5b9770 [0140.023] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.023] GetProcessHeap () returned 0x580000 [0140.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c61120 [0140.023] GetProcessHeap () returned 0x580000 [0140.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c614e8 [0140.023] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.023] ReadFile (in: hFile=0x3b4, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x4e8ff14*=0x380, lpOverlapped=0x0) returned 1 [0140.028] GetProcessHeap () returned 0x580000 [0140.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c614e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c614e8*, lpNumberOfBytesWritten=0x4e8ff14*=0x380, lpOverlapped=0x0) returned 1 [0140.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c61867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61867*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.028] CloseHandle (hObject=0x3b4) returned 1 [0140.028] GetProcessHeap () returned 0x580000 [0140.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c614e8 | out: hHeap=0x580000) returned 1 [0140.028] GetProcessHeap () returned 0x580000 [0140.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0140.028] GetProcessHeap () returned 0x580000 [0140.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b9c600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b146000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x4e8fd28, dwReserved1=0x6c61120, cFileName="BD21323_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2E4F~1.YOU")) returned 0x5b9770 [0140.407] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.448] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", len=0x43 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned 1 [0140.448] GetProcessHeap () returned 0x580000 [0140.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd4) returned 0x6f14048 [0140.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.547] CloseHandle (hObject=0x454) returned 1 [0140.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1518~2.YOU")) returned 0x5b9770 [0140.552] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.552] GetProcessHeap () returned 0x580000 [0140.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6dcfb90 [0140.552] GetProcessHeap () returned 0x580000 [0140.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6c65108 [0140.552] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.552] ReadFile (in: hFile=0x3a8, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x4e8ff14*=0x480, lpOverlapped=0x0) returned 1 [0140.579] GetProcessHeap () returned 0x580000 [0140.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.579] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.579] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x4e8ff14*=0x480, lpOverlapped=0x0) returned 1 [0140.579] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.580] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c65587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65587*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.580] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.580] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.580] CloseHandle (hObject=0x3a8) returned 1 [0140.582] GetProcessHeap () returned 0x580000 [0140.582] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0140.585] GetProcessHeap () returned 0x580000 [0140.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0140.585] GetProcessHeap () returned 0x580000 [0140.585] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0141.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b67b020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4a6, dwReserved0=0x4e8fd28, dwReserved1=0x6dcfb90, cFileName="BD15184_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1518~2.YOU")) returned 0x5b9730 [0141.010] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.079] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 1 [0142.080] GetProcessHeap () returned 0x580000 [0142.080] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0142.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.131] CloseHandle (hObject=0x484) returned 1 [0144.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0144.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~3.YOU")) returned 0x5b96f0 [0144.132] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0144.133] GetProcessHeap () returned 0x580000 [0144.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0144.133] GetProcessHeap () returned 0x580000 [0144.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0144.133] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.133] ReadFile (in: hFile=0x484, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x4e8ff14*=0x260, lpOverlapped=0x0) returned 1 [0144.240] GetProcessHeap () returned 0x580000 [0144.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.240] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.241] WriteFile (in: hFile=0x484, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x4e8ff14*=0x260, lpOverlapped=0x0) returned 1 [0144.241] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.241] WriteFile (in: hFile=0x484, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.241] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.241] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.241] CloseHandle (hObject=0x484) returned 1 [0144.241] GetProcessHeap () returned 0x580000 [0144.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0144.241] GetProcessHeap () returned 0x580000 [0144.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0144.241] GetProcessHeap () returned 0x580000 [0144.241] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d971340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x4e8fd28, dwReserved1=0x6d08520, cFileName="OUTLOOK_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~3.YOU")) returned 0x5b96f0 [0146.864] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.878] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", len=0x44 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned 1 [0146.878] GetProcessHeap () returned 0x580000 [0146.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0146.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.162] CloseHandle (hObject=0x4a0) returned 1 [0153.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.id_1622540890_.your_last_chance")) returned 1 [0153.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR20~1.YOU")) returned 0x5b9730 [0153.163] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.163] GetProcessHeap () returned 0x580000 [0153.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3421) returned 0x709ec18 [0153.163] GetProcessHeap () returned 0x580000 [0153.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3421) returned 0x6d21878 [0153.164] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.164] ReadFile (in: hFile=0x4a0, lpBuffer=0x709ec18, nNumberOfBytesToRead=0x3400, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x709ec18*, lpNumberOfBytesRead=0x4e8ff14*=0x3400, lpOverlapped=0x0) returned 1 [0154.156] GetProcessHeap () returned 0x580000 [0154.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.156] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x3400, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x4e8ff14*=0x3400, lpOverlapped=0x0) returned 1 [0154.156] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d24c77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d24c77*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.156] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.156] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.156] CloseHandle (hObject=0x4a0) returned 1 [0154.156] GetProcessHeap () returned 0x580000 [0154.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0154.156] GetProcessHeap () returned 0x580000 [0154.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709ec18 | out: hHeap=0x580000) returned 1 [0154.156] GetProcessHeap () returned 0x580000 [0154.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937e9c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x342c, dwReserved0=0x4e8fd28, dwReserved1=0x709ec18, cFileName="PDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR20~1.YOU")) returned 0x5b9630 [0154.157] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.685] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 1 [0154.685] GetProcessHeap () returned 0x580000 [0154.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0154.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0158.183] CloseHandle (hObject=0x48c) returned 1 [0158.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0158.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4b425a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI7C60~1.YOU")) returned 0x5b9630 [0158.184] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0158.184] GetProcessHeap () returned 0x580000 [0158.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0158.185] GetProcessHeap () returned 0x580000 [0158.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f9e228 [0158.185] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.185] ReadFile (in: hFile=0x48c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.052] GetProcessHeap () returned 0x580000 [0165.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.052] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.052] WriteFile (in: hFile=0x48c, lpBuffer=0x6f9e228*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9e228*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.053] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.053] WriteFile (in: hFile=0x48c, lpBuffer=0x6fafa27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fafa27*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.416] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.416] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.416] CloseHandle (hObject=0x48c) returned 1 [0165.416] GetProcessHeap () returned 0x580000 [0165.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9e228 | out: hHeap=0x580000) returned 1 [0165.417] GetProcessHeap () returned 0x580000 [0165.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0165.420] GetProcessHeap () returned 0x580000 [0165.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a353d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4b427e, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="WINPROJ.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI7C60~1.YOU")) returned 0x5b9730 [0169.282] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.381] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", len=0x35 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 1 [0169.381] GetProcessHeap () returned 0x580000 [0169.381] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0169.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.464] CloseHandle (hObject=0x454) returned 1 [0169.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.464] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.id_1622540890_.your_last_chance")) returned 1 [0169.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGIDX~1.YOU")) returned 0x5b9730 [0169.465] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0169.465] GetProcessHeap () returned 0x580000 [0169.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8581) returned 0x6d8e818 [0169.465] GetProcessHeap () returned 0x580000 [0169.465] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8581) returned 0x6dbf1d0 [0169.466] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.466] ReadFile (in: hFile=0x454, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0x8560, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x4e8ff14*=0x8560, lpOverlapped=0x0) returned 1 [0171.397] GetProcessHeap () returned 0x580000 [0171.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0171.397] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.397] WriteFile (in: hFile=0x454, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0x8560, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x4e8ff14*=0x8560, lpOverlapped=0x0) returned 1 [0171.397] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.397] WriteFile (in: hFile=0x454, lpBuffer=0x6dc772f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc772f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.397] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.397] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.397] CloseHandle (hObject=0x454) returned 1 [0171.397] GetProcessHeap () returned 0x580000 [0171.397] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0171.397] GetProcessHeap () returned 0x580000 [0171.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0171.398] GetProcessHeap () returned 0x580000 [0171.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dc4ebc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x859c, dwReserved0=0x4e8fd28, dwReserved1=0x6d8e818, cFileName="ENGIDX.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGIDX~1.YOU")) returned 0x5b9770 [0173.177] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.442] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", len=0x60 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned 1 [0174.442] GetProcessHeap () returned 0x580000 [0174.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.442] CloseHandle (hObject=0x484) returned 1 [0174.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.443] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.id_1622540890_.your_last_chance")) returned 1 [0174.443] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="Management.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANAGE~1.YOU")) returned 0x5b9730 [0174.444] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.444] GetProcessHeap () returned 0x580000 [0174.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc79b8 [0174.444] GetProcessHeap () returned 0x580000 [0174.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc7da0 [0174.444] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.444] ReadFile (in: hFile=0x484, lpBuffer=0x6dc79b8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc79b8*, lpNumberOfBytesRead=0x4e8ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0174.476] GetProcessHeap () returned 0x580000 [0174.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.476] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x484, lpBuffer=0x6dc7da0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7da0*, lpNumberOfBytesWritten=0x4e8ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0174.476] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.476] WriteFile (in: hFile=0x484, lpBuffer=0x6dc813f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc813f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.476] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.477] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.477] CloseHandle (hObject=0x484) returned 1 [0174.477] GetProcessHeap () returned 0x580000 [0174.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7da0 | out: hHeap=0x580000) returned 1 [0174.477] GetProcessHeap () returned 0x580000 [0174.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc79b8 | out: hHeap=0x580000) returned 1 [0174.477] GetProcessHeap () returned 0x580000 [0174.477] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f9c3c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x4e8fd28, dwReserved1=0x6dc79b8, cFileName="Management.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANAGE~1.YOU")) returned 0x5b9730 [0174.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.550] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", len=0x49 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned 1 [0174.550] GetProcessHeap () returned 0x580000 [0174.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0174.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0175.549] CloseHandle (hObject=0x428) returned 1 [0175.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.id_1622540890_.your_last_chance")) returned 1 [0175.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMHMMW~1.YOU")) returned 0x5b96f0 [0175.563] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0175.563] GetProcessHeap () returned 0x580000 [0175.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b21) returned 0x654550 [0175.563] GetProcessHeap () returned 0x580000 [0175.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b21) returned 0x6d75a48 [0175.564] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.564] ReadFile (in: hFile=0x428, lpBuffer=0x654550, nNumberOfBytesToRead=0x3b00, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x654550*, lpNumberOfBytesRead=0x4e8ff14*=0x3b00, lpOverlapped=0x0) returned 1 [0176.289] GetProcessHeap () returned 0x580000 [0176.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.289] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.289] WriteFile (in: hFile=0x428, lpBuffer=0x6d75a48*, nNumberOfBytesToWrite=0x3b00, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75a48*, lpNumberOfBytesWritten=0x4e8ff14*=0x3b00, lpOverlapped=0x0) returned 1 [0176.289] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.289] WriteFile (in: hFile=0x428, lpBuffer=0x6d79547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d79547*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.289] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.290] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.290] CloseHandle (hObject=0x428) returned 1 [0176.290] GetProcessHeap () returned 0x580000 [0176.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d75a48 | out: hHeap=0x580000) returned 1 [0176.290] GetProcessHeap () returned 0x580000 [0176.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x654550 | out: hHeap=0x580000) returned 1 [0176.290] GetProcessHeap () returned 0x580000 [0176.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.053] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0b05b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b24, dwReserved0=0x4e8fd28, dwReserved1=0x654550, cFileName="MMHMM.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMHMMW~1.YOU")) returned 0x5b96f0 [0179.053] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.068] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", len=0x4a | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx") returned 1 [0179.068] GetProcessHeap () returned 0x580000 [0179.068] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0179.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.105] CloseHandle (hObject=0x440) returned 1 [0181.105] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.id_1622540890_.your_last_chance")) returned 1 [0181.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x8ce63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b96b0 [0181.109] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0181.109] GetProcessHeap () returned 0x580000 [0181.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0181.109] GetProcessHeap () returned 0x580000 [0181.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0181.109] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.109] ReadFile (in: hFile=0x440, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0183.014] GetProcessHeap () returned 0x580000 [0183.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0183.014] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.015] WriteFile (in: hFile=0x440, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0183.015] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.015] WriteFile (in: hFile=0x440, lpBuffer=0x6d748a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748a7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.025] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.025] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.025] CloseHandle (hObject=0x440) returned 1 [0183.025] GetProcessHeap () returned 0x580000 [0183.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0183.026] GetProcessHeap () returned 0x580000 [0183.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0183.026] GetProcessHeap () returned 0x580000 [0183.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0183.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4b4ad80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8ce87, dwReserved0=0x4e8fd28, dwReserved1=0x6e063d0, cFileName="Newsprint.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9770 [0183.805] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.819] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", len=0x6d | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned 1 [0183.819] GetProcessHeap () returned 0x580000 [0183.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0183.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.506] CloseHandle (hObject=0x4a4) returned 1 [0186.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x50004a, dwReserved1=0x2e0047, cFileName="BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b96b0 [0186.511] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0186.511] GetProcessHeap () returned 0x580000 [0186.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6fe9778 [0186.511] GetProcessHeap () returned 0x580000 [0186.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6fec7a8 [0186.511] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.511] ReadFile (in: hFile=0x494, lpBuffer=0x6fe9778, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe9778*, lpNumberOfBytesRead=0x4e8ff14*=0x3000, lpOverlapped=0x0) returned 1 [0187.662] GetProcessHeap () returned 0x580000 [0187.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0187.662] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.662] WriteFile (in: hFile=0x494, lpBuffer=0x6fec7a8*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fec7a8*, lpNumberOfBytesWritten=0x4e8ff14*=0x3000, lpOverlapped=0x0) returned 1 [0187.662] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.663] WriteFile (in: hFile=0x494, lpBuffer=0x6fef7a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fef7a7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.663] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.663] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.663] CloseHandle (hObject=0x494) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fec7a8 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe9778 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0188.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa777a5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3028, dwReserved0=0x4e8fd28, dwReserved1=0x6fe9778, cFileName="BUTTON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0188.061] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.082] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", len=0x45 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned 1 [0188.082] GetProcessHeap () returned 0x580000 [0188.082] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2060) returned 0x6f14048 [0188.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0191.911] CloseHandle (hObject=0x484) returned 1 [0191.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.911] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPC1AA~1.YOU")) returned 0x5b97b0 [0194.516] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0194.517] GetProcessHeap () returned 0x580000 [0194.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x6c6e0f8 [0194.517] GetProcessHeap () returned 0x580000 [0194.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x6c2a820 [0194.517] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.517] ReadFile (in: hFile=0x484, lpBuffer=0x6c6e0f8, nNumberOfBytesToRead=0x16e0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesRead=0x4e8ff14*=0x16e0, lpOverlapped=0x0) returned 1 [0194.538] GetProcessHeap () returned 0x580000 [0194.538] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.538] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.538] WriteFile (in: hFile=0x484, lpBuffer=0x6c2a820*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesWritten=0x4e8ff14*=0x16e0, lpOverlapped=0x0) returned 1 [0194.538] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.538] WriteFile (in: hFile=0x484, lpBuffer=0x6c2beff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2beff*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.539] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.539] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.539] CloseHandle (hObject=0x484) returned 1 [0194.539] GetProcessHeap () returned 0x580000 [0194.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0194.539] GetProcessHeap () returned 0x580000 [0194.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0194.539] GetProcessHeap () returned 0x580000 [0194.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab916440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x170f, dwReserved0=0x4e8fd28, dwReserved1=0x6c6e0f8, cFileName="ZPDIR45F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPC1AA~1.YOU")) returned 0x5b97b0 [0194.539] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.563] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", len=0x6c | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned 1 [0194.563] GetProcessHeap () returned 0x580000 [0194.563] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0194.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0195.595] CloseHandle (hObject=0x490) returned 1 [0195.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance")) returned 1 [0195.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0195.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf2, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b97b0 [0195.609] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0195.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0195.610] GetProcessHeap () returned 0x580000 [0195.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0195.610] GetProcessHeap () returned 0x580000 [0195.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x635768 [0195.610] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.610] ReadFile (in: hFile=0x454, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4e8ff14*=0xae0, lpOverlapped=0x0) returned 1 [0195.621] GetProcessHeap () returned 0x580000 [0195.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.621] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.621] WriteFile (in: hFile=0x454, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x4e8ff14*=0xae0, lpOverlapped=0x0) returned 1 [0195.621] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.621] WriteFile (in: hFile=0x454, lpBuffer=0x636247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636247*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.621] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.621] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.621] CloseHandle (hObject=0x454) returned 1 [0195.621] GetProcessHeap () returned 0x580000 [0195.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0195.621] GetProcessHeap () returned 0x580000 [0195.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0195.622] GetProcessHeap () returned 0x580000 [0195.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac35a320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb16, dwReserved0=0x4e8fd28, dwReserved1=0x677cd0, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b97b0 [0196.951] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.014] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", len=0x45 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned 1 [0197.014] GetProcessHeap () returned 0x580000 [0197.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb0) returned 0x6f14048 [0197.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.015] CloseHandle (hObject=0x450) returned 1 [0197.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1FEA~1.YOU")) returned 0x5b97b0 [0197.017] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.017] GetProcessHeap () returned 0x580000 [0197.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13c1) returned 0x6efb008 [0197.017] GetProcessHeap () returned 0x580000 [0197.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13c1) returned 0x7115a98 [0197.017] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.017] ReadFile (in: hFile=0x450, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x13a0, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x4e8ff14*=0x13a0, lpOverlapped=0x0) returned 1 [0197.079] GetProcessHeap () returned 0x580000 [0197.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0197.079] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.079] WriteFile (in: hFile=0x450, lpBuffer=0x7115a98*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7115a98*, lpNumberOfBytesWritten=0x4e8ff14*=0x13a0, lpOverlapped=0x0) returned 1 [0197.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.080] WriteFile (in: hFile=0x450, lpBuffer=0x7116e37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7116e37*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.080] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.080] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.080] CloseHandle (hObject=0x450) returned 1 [0197.080] GetProcessHeap () returned 0x580000 [0197.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7115a98 | out: hHeap=0x580000) returned 1 [0197.080] GetProcessHeap () returned 0x580000 [0197.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0197.080] GetProcessHeap () returned 0x580000 [0197.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0197.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad156460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13d1, dwReserved0=0x4e8fd28, dwReserved1=0x6efb008, cFileName="ZPDIR10F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1FEA~1.YOU")) returned 0x5b97b0 [0197.081] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.156] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", len=0x43 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned 1 [0197.157] GetProcessHeap () returned 0x580000 [0197.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0197.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0197.157] CloseHandle (hObject=0x454) returned 1 [0197.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.158] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.id_1622540890_.your_last_chance")) returned 1 [0197.158] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR8B~1.YOU")) returned 0x5b97b0 [0197.158] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0197.159] GetProcessHeap () returned 0x580000 [0197.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x635768 [0197.159] GetProcessHeap () returned 0x580000 [0197.159] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x6f668d8 [0197.159] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.159] ReadFile (in: hFile=0x454, lpBuffer=0x635768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4e8ff14*=0xd20, lpOverlapped=0x0) returned 1 [0197.226] GetProcessHeap () returned 0x580000 [0197.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0197.226] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.226] WriteFile (in: hFile=0x454, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x4e8ff14*=0xd20, lpOverlapped=0x0) returned 1 [0197.226] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.226] WriteFile (in: hFile=0x454, lpBuffer=0x6f675f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675f7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.226] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.226] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.226] CloseHandle (hObject=0x454) returned 1 [0197.623] GetProcessHeap () returned 0x580000 [0197.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0197.623] GetProcessHeap () returned 0x580000 [0197.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0197.623] GetProcessHeap () returned 0x580000 [0197.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad2ad0c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd52, dwReserved0=0x4e8fd28, dwReserved1=0x635768, cFileName="PDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR8B~1.YOU")) returned 0x5b96b0 [0199.482] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.506] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", len=0x60 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned 1 [0199.506] GetProcessHeap () returned 0x580000 [0199.506] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0199.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0199.507] CloseHandle (hObject=0x428) returned 1 [0199.507] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.id_1622540890_.your_last_chance")) returned 1 [0199.508] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6427, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b96b0 [0199.509] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0199.509] GetProcessHeap () returned 0x580000 [0199.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6441) returned 0x6fa5688 [0199.509] GetProcessHeap () returned 0x580000 [0199.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6441) returned 0x6e31b50 [0199.516] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.516] ReadFile (in: hFile=0x428, lpBuffer=0x6fa5688, nNumberOfBytesToRead=0x6420, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5688*, lpNumberOfBytesRead=0x4e8ff14*=0x6420, lpOverlapped=0x0) returned 1 [0200.038] GetProcessHeap () returned 0x580000 [0200.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.038] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.039] WriteFile (in: hFile=0x428, lpBuffer=0x6e31b50*, nNumberOfBytesToWrite=0x6420, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e31b50*, lpNumberOfBytesWritten=0x4e8ff14*=0x6420, lpOverlapped=0x0) returned 1 [0200.039] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.039] WriteFile (in: hFile=0x428, lpBuffer=0x6e37f6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e37f6f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.039] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.039] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.039] CloseHandle (hObject=0x428) returned 1 [0200.460] GetProcessHeap () returned 0x580000 [0200.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e31b50 | out: hHeap=0x580000) returned 1 [0200.461] GetProcessHeap () returned 0x580000 [0200.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa5688 | out: hHeap=0x580000) returned 1 [0200.461] GetProcessHeap () returned 0x580000 [0200.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed74840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x644b, dwReserved0=0x4e8fd28, dwReserved1=0x6fa5688, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b9770 [0201.395] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.397] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x76 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0201.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0201.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.407] CloseHandle (hObject=0x488) returned 1 [0201.407] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.407] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0201.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x54005c, dwReserved1=0x420041, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0201.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.409] GetProcessHeap () returned 0x580000 [0201.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0201.409] GetProcessHeap () returned 0x580000 [0201.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0201.409] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.409] ReadFile (in: hFile=0x488, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x4e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0201.411] GetProcessHeap () returned 0x580000 [0201.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.411] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.411] WriteFile (in: hFile=0x488, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x4e8ff14*=0x140, lpOverlapped=0x0) returned 1 [0201.411] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.411] WriteFile (in: hFile=0x488, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.411] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.411] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.411] CloseHandle (hObject=0x488) returned 1 [0201.411] GetProcessHeap () returned 0x580000 [0201.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0201.411] GetProcessHeap () returned 0x580000 [0201.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0201.411] GetProcessHeap () returned 0x580000 [0201.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafa8c140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x4e8fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0201.412] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.412] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", len=0x68 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned 1 [0201.412] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0201.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.492] CloseHandle (hObject=0x480) returned 1 [0201.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.492] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.id_1622540890_.your_last_chance")) returned 1 [0201.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b97b0 [0201.493] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.493] GetProcessHeap () returned 0x580000 [0201.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x635768 [0201.493] GetProcessHeap () returned 0x580000 [0201.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x6f668d8 [0201.493] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.493] ReadFile (in: hFile=0x480, lpBuffer=0x635768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4e8ff14*=0xd40, lpOverlapped=0x0) returned 1 [0201.541] GetProcessHeap () returned 0x580000 [0201.541] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.541] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.541] WriteFile (in: hFile=0x480, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x4e8ff14*=0xd40, lpOverlapped=0x0) returned 1 [0201.541] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.542] WriteFile (in: hFile=0x480, lpBuffer=0x6f67617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67617*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.542] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.542] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.542] CloseHandle (hObject=0x480) returned 1 [0201.542] GetProcessHeap () returned 0x580000 [0201.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0201.542] GetProcessHeap () returned 0x580000 [0201.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.542] GetProcessHeap () returned 0x580000 [0201.542] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafbe2da0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd65, dwReserved0=0x4e8fd28, dwReserved1=0x635768, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b9770 [0202.348] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.458] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS", len=0x45 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS") returned 1 [0202.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eec) returned 0x6f14048 [0202.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.490] CloseHandle (hObject=0x438) returned 1 [0202.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css.id_1622540890_.your_last_chance")) returned 1 [0202.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8380de00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8380de00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f07c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3404~1.YOU")) returned 0x5b9770 [0202.493] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.493] GetProcessHeap () returned 0x580000 [0202.493] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0202.494] GetProcessHeap () returned 0x580000 [0202.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e44580 [0202.494] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.494] ReadFile (in: hFile=0x438, lpBuffer=0x6e32d50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.505] GetProcessHeap () returned 0x580000 [0209.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0209.506] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.506] WriteFile (in: hFile=0x438, lpBuffer=0x6e44580*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.506] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.506] WriteFile (in: hFile=0x438, lpBuffer=0x6e55d7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55d7f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.506] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.506] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.506] CloseHandle (hObject=0x438) returned 1 [0209.506] GetProcessHeap () returned 0x580000 [0209.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e44580 | out: hHeap=0x580000) returned 1 [0209.934] GetProcessHeap () returned 0x580000 [0209.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0209.935] GetProcessHeap () returned 0x580000 [0209.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0210.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8380de00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb47c2ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a0, dwReserved0=0x4e8fd28, dwReserved1=0x580000, cFileName="SCHEME38.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3404~1.YOU")) returned 0x5b97b0 [0210.105] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.158] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS", len=0x45 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS") returned 1 [0210.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0210.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0210.159] CloseHandle (hObject=0x480) returned 1 [0210.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css.id_1622540890_.your_last_chance")) returned 1 [0210.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d488b00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d488b00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f822, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7017~1.YOU")) returned 0x5b97b0 [0210.160] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0210.160] GetProcessHeap () returned 0x580000 [0210.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0210.160] GetProcessHeap () returned 0x580000 [0210.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0210.161] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.161] ReadFile (in: hFile=0x480, lpBuffer=0x70a1cf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.059] GetProcessHeap () returned 0x580000 [0214.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0214.059] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.060] WriteFile (in: hFile=0x480, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.060] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.060] WriteFile (in: hFile=0x480, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.060] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.060] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.060] CloseHandle (hObject=0x480) returned 1 [0214.060] GetProcessHeap () returned 0x580000 [0214.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0214.250] GetProcessHeap () returned 0x580000 [0214.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0214.250] GetProcessHeap () returned 0x580000 [0214.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0215.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d488b00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7333c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f846, dwReserved0=0x4e8fd28, dwReserved1=0x70a1cf8, cFileName="SCHEME16.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC7017~1.YOU")) returned 0x5b97b0 [0215.008] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.036] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK", len=0x3d | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 1 [0215.036] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0215.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.036] CloseHandle (hObject=0x458) returned 1 [0215.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.038] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_F_~1.YOU")) returned 0x5b97b0 [0215.038] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.038] GetProcessHeap () returned 0x580000 [0215.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.038] GetProcessHeap () returned 0x580000 [0215.038] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.038] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.038] ReadFile (in: hFile=0x458, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.039] GetProcessHeap () returned 0x580000 [0215.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0215.039] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.039] WriteFile (in: hFile=0x458, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.040] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.040] WriteFile (in: hFile=0x458, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.040] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.040] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.040] CloseHandle (hObject=0x458) returned 1 [0215.040] GetProcessHeap () returned 0x580000 [0215.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.040] GetProcessHeap () returned 0x580000 [0215.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.040] GetProcessHeap () returned 0x580000 [0215.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0215.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7c93300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4e8fd28, dwReserved1=0x61b540, cFileName="OIS_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_F_~1.YOU")) returned 0x5b97b0 [0215.040] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.049] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML", len=0x3c | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML") returned 1 [0215.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.061] CloseHandle (hObject=0x46c) returned 1 [0215.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.id_1622540890_.your_last_chance")) returned 1 [0215.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4b675400, ftLastWriteTime.dwHighDateTime=0x1c2c0e2, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCMODV~1.YOU")) returned 0x5b97b0 [0215.062] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.066] GetProcessHeap () returned 0x580000 [0215.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0215.066] GetProcessHeap () returned 0x580000 [0215.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0215.066] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.066] ReadFile (in: hFile=0x46c, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x4e8ff14*=0x420, lpOverlapped=0x0) returned 1 [0215.128] GetProcessHeap () returned 0x580000 [0215.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.128] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.128] WriteFile (in: hFile=0x46c, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x4e8ff14*=0x420, lpOverlapped=0x0) returned 1 [0215.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.129] WriteFile (in: hFile=0x46c, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.129] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.129] CloseHandle (hObject=0x46c) returned 1 [0215.129] GetProcessHeap () returned 0x580000 [0215.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0215.129] GetProcessHeap () returned 0x580000 [0215.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0215.129] GetProcessHeap () returned 0x580000 [0215.129] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb7d77b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x4e8fd28, dwReserved1=0x5d09a0, cFileName="OCMODVRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCMODV~1.YOU")) returned 0x5b97b0 [0215.129] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.191] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 1 [0215.191] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0215.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.274] CloseHandle (hObject=0x46c) returned 1 [0215.274] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.274] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~4.YOU")) returned 0x5b97b0 [0215.275] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.275] GetProcessHeap () returned 0x580000 [0215.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.275] GetProcessHeap () returned 0x580000 [0215.275] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.275] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.275] ReadFile (in: hFile=0x46c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.276] GetProcessHeap () returned 0x580000 [0215.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.277] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.277] WriteFile (in: hFile=0x46c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4e8ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.277] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.277] WriteFile (in: hFile=0x46c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.277] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.277] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.277] CloseHandle (hObject=0x46c) returned 1 [0215.277] GetProcessHeap () returned 0x580000 [0215.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.277] GetProcessHeap () returned 0x580000 [0215.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.277] GetProcessHeap () returned 0x580000 [0215.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ece7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4e8fd28, dwReserved1=0x61b540, cFileName="MSPUB_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~4.YOU")) returned 0x5b9770 [0217.428] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.444] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", len=0x5a | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned 1 [0217.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0217.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.445] CloseHandle (hObject=0x414) returned 1 [0217.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js.id_1622540890_.your_last_chance")) returned 1 [0217.446] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77e3c400, ftLastWriteTime.dwHighDateTime=0x1ca5dc0, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b9770 [0217.446] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.446] GetProcessHeap () returned 0x580000 [0217.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7166de8 [0217.447] GetProcessHeap () returned 0x580000 [0217.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7178618 [0217.448] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.448] ReadFile (in: hFile=0x414, lpBuffer=0x7166de8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7166de8*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.948] GetProcessHeap () returned 0x580000 [0220.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0220.948] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.948] WriteFile (in: hFile=0x414, lpBuffer=0x7178618*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7178618*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.948] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.948] WriteFile (in: hFile=0x414, lpBuffer=0x7189e17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e17*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.949] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.949] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.949] CloseHandle (hObject=0x414) returned 1 [0220.949] GetProcessHeap () returned 0x580000 [0220.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7178618 | out: hHeap=0x580000) returned 1 [0220.949] GetProcessHeap () returned 0x580000 [0220.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7166de8 | out: hHeap=0x580000) returned 1 [0220.949] GetProcessHeap () returned 0x580000 [0220.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb4f5c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x144a8, dwReserved0=0x4e8fd28, dwReserved1=0x7166de8, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b9730 [0221.901] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.956] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", len=0x7b | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned 1 [0221.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0221.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.621] CloseHandle (hObject=0x480) returned 1 [0222.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0222.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2338, dwReserved0=0x6f0063, dwReserved1=0x49006e, cFileName="ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~2.YOU")) returned 0x5b96f0 [0222.623] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.623] GetProcessHeap () returned 0x580000 [0222.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2341) returned 0x6d630a8 [0222.623] GetProcessHeap () returned 0x580000 [0222.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2341) returned 0x6f976f8 [0222.623] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.623] ReadFile (in: hFile=0x480, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x2320, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x4e8ff14*=0x2320, lpOverlapped=0x0) returned 1 [0222.655] GetProcessHeap () returned 0x580000 [0222.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.655] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.655] WriteFile (in: hFile=0x480, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x2320, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x4e8ff14*=0x2320, lpOverlapped=0x0) returned 1 [0222.655] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.655] WriteFile (in: hFile=0x480, lpBuffer=0x6f99a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f99a17*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.655] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.656] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.656] CloseHandle (hObject=0x480) returned 1 [0222.656] GetProcessHeap () returned 0x580000 [0222.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0222.656] GetProcessHeap () returned 0x580000 [0222.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0222.656] GetProcessHeap () returned 0x580000 [0222.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0225.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc52d200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x4e8fd28, dwReserved1=0x6d630a8, cFileName="ProjectToolsetIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~2.YOU")) returned 0x5b9630 [0225.414] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.451] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", len=0x44 | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 1 [0225.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0225.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.280] CloseHandle (hObject=0x458) returned 1 [0227.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0227.280] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id_1622540890_.your_last_chance")) returned 1 [0227.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0227.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTAL~1.YOU")) returned 0x5b9730 [0227.282] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0227.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0227.282] GetProcessHeap () returned 0x580000 [0227.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0227.282] GetProcessHeap () returned 0x580000 [0227.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0227.282] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.282] ReadFile (in: hFile=0x458, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.738] GetProcessHeap () returned 0x580000 [0236.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0236.739] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.739] WriteFile (in: hFile=0x458, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.104] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.105] WriteFile (in: hFile=0x458, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.145] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.145] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.145] CloseHandle (hObject=0x458) returned 1 [0239.406] GetProcessHeap () returned 0x580000 [0239.406] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0239.407] GetProcessHeap () returned 0x580000 [0239.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0239.407] GetProcessHeap () returned 0x580000 [0239.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0240.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc60f11a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac024, dwReserved0=0x4e8fd28, dwReserved1=0x72f0208, cFileName="Installed_resources14.xss.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTAL~1.YOU")) returned 0x5b9730 [0240.646] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.657] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML", len=0x4e | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned 1 [0240.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0240.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0240.692] CloseHandle (hObject=0x470) returned 1 [0240.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml.id_1622540890_.your_last_chance")) returned 1 [0240.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA200A~1.YOU")) returned 0x5b9730 [0240.694] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0240.694] GetProcessHeap () returned 0x580000 [0240.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08130 [0240.694] GetProcessHeap () returned 0x580000 [0240.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08498 [0240.694] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.694] ReadFile (in: hFile=0x470, lpBuffer=0x6d08130, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08130*, lpNumberOfBytesRead=0x4e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.746] GetProcessHeap () returned 0x580000 [0240.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.746] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.746] WriteFile (in: hFile=0x470, lpBuffer=0x6d08498*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08498*, lpNumberOfBytesWritten=0x4e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.747] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.747] WriteFile (in: hFile=0x470, lpBuffer=0x6d087b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087b7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.747] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.747] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.747] CloseHandle (hObject=0x470) returned 1 [0240.747] GetProcessHeap () returned 0x580000 [0240.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08498 | out: hHeap=0x580000) returned 1 [0240.747] GetProcessHeap () returned 0x580000 [0240.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08130 | out: hHeap=0x580000) returned 1 [0240.747] GetProcessHeap () returned 0x580000 [0240.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7043f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x4e8fd28, dwReserved1=0x6d08130, cFileName="YAHOO.CO.IN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA200A~1.YOU")) returned 0x5b9730 [0240.747] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.805] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML", len=0x4e | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned 1 [0240.805] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0240.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0240.806] CloseHandle (hObject=0x478) returned 1 [0240.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml.id_1622540890_.your_last_chance")) returned 1 [0241.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRODIG~1.YOU")) returned 0x5b9730 [0241.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0241.319] GetProcessHeap () returned 0x580000 [0241.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.319] GetProcessHeap () returned 0x580000 [0241.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.319] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.319] ReadFile (in: hFile=0x478, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x4e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.324] GetProcessHeap () returned 0x580000 [0241.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.324] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.324] WriteFile (in: hFile=0x478, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x4e8ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.324] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.324] WriteFile (in: hFile=0x478, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.324] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.324] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.324] CloseHandle (hObject=0x478) returned 1 [0241.324] GetProcessHeap () returned 0x580000 [0241.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.324] GetProcessHeap () returned 0x580000 [0241.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.324] GetProcessHeap () returned 0x580000 [0241.324] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc75c5220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x4e8fd28, dwReserved1=0x6d0a340, cFileName="PRODIGY.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRODIG~1.YOU")) returned 0x5b9630 [0241.851] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.869] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML", len=0x3f | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned 1 [0241.869] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0241.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0245.201] CloseHandle (hObject=0x480) returned 1 [0245.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.202] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml.id_1622540890_.your_last_chance")) returned 1 [0245.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07a0100, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07a0100, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x2247e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN00~1.YOU")) returned 0x5b96f0 [0245.203] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0245.203] GetProcessHeap () returned 0x580000 [0245.203] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0245.203] GetProcessHeap () returned 0x580000 [0245.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2e00 [0245.205] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.205] ReadFile (in: hFile=0x480, lpBuffer=0x703b9b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.199] GetProcessHeap () returned 0x580000 [0248.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0248.200] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.200] WriteFile (in: hFile=0x480, lpBuffer=0x6fb2e00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2e00*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.200] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.200] WriteFile (in: hFile=0x480, lpBuffer=0x6fc45ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc45ff*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.200] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.200] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.201] CloseHandle (hObject=0x480) returned 1 [0248.213] GetProcessHeap () returned 0x580000 [0248.213] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2e00 | out: hHeap=0x580000) returned 1 [0248.213] GetProcessHeap () returned 0x580000 [0248.213] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0248.213] GetProcessHeap () returned 0x580000 [0248.213] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0249.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07a0100, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb761080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x224a2, dwReserved0=0x4e8fd28, dwReserved1=0x703b9b8, cFileName="PGMN001.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN00~1.YOU")) returned 0x5b9730 [0249.543] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.665] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML", len=0x3b | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML") returned 1 [0253.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0253.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.715] CloseHandle (hObject=0x48c) returned 1 [0253.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml.id_1622540890_.your_last_chance")) returned 1 [0253.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75d00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba75d00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCALX~1.YOU")) returned 0x5b9730 [0253.716] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.716] GetProcessHeap () returned 0x580000 [0253.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6dee6e0 [0253.716] GetProcessHeap () returned 0x580000 [0253.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e81) returned 0x6fbe788 [0253.717] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.717] ReadFile (in: hFile=0x48c, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1e60, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x4e8ff14*=0x1e60, lpOverlapped=0x0) returned 1 [0253.746] GetProcessHeap () returned 0x580000 [0253.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.747] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.747] WriteFile (in: hFile=0x48c, lpBuffer=0x6fbe788*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbe788*, lpNumberOfBytesWritten=0x4e8ff14*=0x1e60, lpOverlapped=0x0) returned 1 [0253.747] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.747] WriteFile (in: hFile=0x48c, lpBuffer=0x6fc05e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc05e7*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0253.747] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.747] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0253.747] CloseHandle (hObject=0x48c) returned 1 [0253.747] GetProcessHeap () returned 0x580000 [0253.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbe788 | out: hHeap=0x580000) returned 1 [0253.747] GetProcessHeap () returned 0x580000 [0253.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0253.747] GetProcessHeap () returned 0x580000 [0253.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75d00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec318a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e8a, dwReserved0=0x4e8fd28, dwReserved1=0x6dee6e0, cFileName="DGCAL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCALX~1.YOU")) returned 0x5b9730 [0254.945] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.014] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV", len=0x3b | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV") returned 1 [0255.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fcc) returned 0x72e5948 [0255.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0255.015] CloseHandle (hObject=0x170) returned 1 [0255.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv.id_1622540890_.your_last_chance")) returned 1 [0255.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x7dc55, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILD~1.YOU")) returned 0x5b9730 [0255.016] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0255.016] GetProcessHeap () returned 0x580000 [0255.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e5e6a0 [0255.016] GetProcessHeap () returned 0x580000 [0255.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e6fed0 [0255.017] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.017] ReadFile (in: hFile=0x170, lpBuffer=0x6e5e6a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5e6a0*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.217] GetProcessHeap () returned 0x580000 [0258.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0258.218] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.218] WriteFile (in: hFile=0x170, lpBuffer=0x6e6fed0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6fed0*, lpNumberOfBytesWritten=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.218] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.219] WriteFile (in: hFile=0x170, lpBuffer=0x6e816cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e816cf*, lpNumberOfBytesWritten=0x4e8ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.349] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.349] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4e8ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.349] CloseHandle (hObject=0x170) returned 1 [0258.439] GetProcessHeap () returned 0x580000 [0258.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e6fed0 | out: hHeap=0x580000) returned 1 [0258.439] GetProcessHeap () returned 0x580000 [0258.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e5e6a0 | out: hHeap=0x580000) returned 1 [0258.439] GetProcessHeap () returned 0x580000 [0258.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0259.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fccc | out: lpFindFileData=0x4e8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1814e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7dc79, dwReserved0=0x4e8fd28, dwReserved1=0x6e5e6a0, cFileName="EMAIL.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILD~1.YOU")) returned 0x5b9630 [0259.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.234] SysReAllocStringLen (in: pbstr=0x4e8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC", len=0x3d | out: pbstr=0x4e8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC") returned 1 [0259.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b0) returned 0x72e5948 [0259.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0259.366] CloseHandle (hObject=0x414) returned 1 [0259.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4e8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4e8fc74 | out: lpFindFileData=0x4e8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2033d400, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2033d400, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1eab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCOMP98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WCOMP9~1.YOU")) returned 0x5b9630 [0259.367] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0259.367] GetProcessHeap () returned 0x580000 [0259.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e44580 [0259.368] GetProcessHeap () returned 0x580000 [0259.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e55db0 [0259.369] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.369] ReadFile (in: hFile=0x414, lpBuffer=0x6e44580, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4e8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesRead=0x4e8ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 40 os_tid = 0xa98 [0039.066] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.148] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.678] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.838] Sleep (dwMilliseconds=0x1) [0039.868] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.510] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.314] Sleep (dwMilliseconds=0x1) [0042.344] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.697] Sleep (dwMilliseconds=0x1) [0042.782] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.846] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.010] Sleep (dwMilliseconds=0x1) [0043.081] Sleep (dwMilliseconds=0x1) [0043.100] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.282] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.311] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.405] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.498] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.715] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.747] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.779] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.934] Sleep (dwMilliseconds=0x1) [0043.950] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.029] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.433] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.464] Sleep (dwMilliseconds=0x1) [0044.480] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.589] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.963] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.104] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.204] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.244] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.556] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.676] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.806] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.915] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.118] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.227] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.430] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.664] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.742] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.898] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.427] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.942] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.207] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.363] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.878] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.034] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.159] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.424] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.658] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.814] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.235] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.969] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.015] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.405] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.452] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.593] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.871] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.949] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.105] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.417] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.729] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.322] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.400] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.087] Sleep (dwMilliseconds=0x1) [0054.102] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.180] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.258] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.305] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.337] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.492] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.085] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.116] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.272] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.397] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.650] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0055.895] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", len=0x4a | out: pbstr=0x4fcff84*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 1 [0055.895] GetProcessHeap () returned 0x580000 [0055.895] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0055.895] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0055.942] CloseHandle (hObject=0x3f8) returned 1 [0055.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.943] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id_1622540890_.your_last_chance")) returned 1 [0055.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0055.943] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELL~1.YOU")) returned 0x5b9630 [0055.943] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.943] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0055.943] GetProcessHeap () returned 0x580000 [0055.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x645c70 [0055.944] GetProcessHeap () returned 0x580000 [0055.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6574a0 [0055.945] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.945] ReadFile (in: hFile=0x3f8, lpBuffer=0x645c70, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x645c70*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.090] GetProcessHeap () returned 0x580000 [0058.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0058.090] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.090] WriteFile (in: hFile=0x3f8, lpBuffer=0x6574a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6574a0*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0058.091] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.091] WriteFile (in: hFile=0x3f8, lpBuffer=0x668c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x668c9f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0058.518] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.518] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0058.518] CloseHandle (hObject=0x3f8) returned 1 [0065.848] GetProcessHeap () returned 0x580000 [0065.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6574a0 | out: hHeap=0x580000) returned 1 [0065.848] GetProcessHeap () returned 0x580000 [0065.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x645c70 | out: hHeap=0x580000) returned 1 [0065.848] GetProcessHeap () returned 0x580000 [0065.848] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0066.491] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5e8a65c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102fcdf, dwReserved0=0x4fcfd28, dwReserved1=0x645c70, cFileName="ExcelLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELL~1.YOU")) returned 0x5b96b0 [0066.491] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.504] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x4fcff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0066.504] GetProcessHeap () returned 0x580000 [0066.504] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x2c) returned 0x5e9710 [0066.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0073.758] CloseHandle (hObject=0x42c) returned 1 [0073.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.758] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance")) returned 1 [0075.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.416] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x1, dwReserved1=0x0, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96f0 [0075.416] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0075.416] GetProcessHeap () returned 0x580000 [0075.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f58108 [0075.416] GetProcessHeap () returned 0x580000 [0075.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ecf008 [0075.417] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.417] ReadFile (in: hFile=0x42c, lpBuffer=0x6f58108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.713] GetProcessHeap () returned 0x580000 [0078.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0078.714] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.714] WriteFile (in: hFile=0x42c, lpBuffer=0x6ecf008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf008*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.714] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.714] WriteFile (in: hFile=0x42c, lpBuffer=0x6ee0807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ee0807*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0079.038] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.038] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0079.038] CloseHandle (hObject=0x42c) returned 1 [0079.039] GetProcessHeap () returned 0x580000 [0079.039] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf008 | out: hHeap=0x580000) returned 1 [0079.039] GetProcessHeap () returned 0x580000 [0079.039] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0079.039] GetProcessHeap () returned 0x580000 [0079.039] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0079.438] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x66b91fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x228df80, dwReserved0=0x4fcfd28, dwReserved1=0x6f58108, cFileName="OWOW32WW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OWOW32~1.YOU")) returned 0x5b96f0 [0079.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.963] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", len=0x47 | out: pbstr=0x4fcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 1 [0085.963] GetProcessHeap () returned 0x580000 [0085.963] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x98) returned 0x614a48 [0085.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.964] Sleep (dwMilliseconds=0x1) [0085.980] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", len=0x45 | out: pbstr=0x4fcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 1 [0085.980] GetProcessHeap () returned 0x580000 [0085.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x2c) returned 0x614a48 [0085.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.986] Sleep (dwMilliseconds=0x1) [0086.425] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", len=0x48 | out: pbstr=0x4fcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 1 [0086.425] GetProcessHeap () returned 0x580000 [0086.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0087.987] CloseHandle (hObject=0x48c) returned 1 [0087.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0087.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.036] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.036] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0088.036] GetProcessHeap () returned 0x580000 [0088.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6f03bc8 [0088.036] GetProcessHeap () returned 0x580000 [0088.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x67ec60 [0088.036] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.036] ReadFile (in: hFile=0x48c, lpBuffer=0x6f03bc8, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bc8*, lpNumberOfBytesRead=0x4fcff14*=0xb20, lpOverlapped=0x0) returned 1 [0088.049] GetProcessHeap () returned 0x580000 [0088.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.049] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.049] WriteFile (in: hFile=0x48c, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x4fcff14*=0xb20, lpOverlapped=0x0) returned 1 [0088.050] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.050] WriteFile (in: hFile=0x48c, lpBuffer=0x67f77f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x67f77f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0088.050] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.050] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0088.050] CloseHandle (hObject=0x48c) returned 1 [0088.051] GetProcessHeap () returned 0x580000 [0088.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0088.051] GetProcessHeap () returned 0x580000 [0088.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bc8 | out: hHeap=0x580000) returned 1 [0088.051] GetProcessHeap () returned 0x580000 [0088.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c18fa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb44, dwReserved0=0x4fcfd28, dwReserved1=0x6f03bc8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.238] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.358] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x4fcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 1 [0088.358] GetProcessHeap () returned 0x580000 [0088.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f7a0 [0088.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0092.728] CloseHandle (hObject=0x440) returned 1 [0092.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0093.102] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0093.103] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0093.103] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0093.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0093.103] GetProcessHeap () returned 0x580000 [0093.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8201) returned 0x6f1bea8 [0093.103] GetProcessHeap () returned 0x580000 [0093.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8201) returned 0x6e15560 [0093.103] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.103] ReadFile (in: hFile=0x440, lpBuffer=0x6f1bea8, nNumberOfBytesToRead=0x81e0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesRead=0x4fcff14*=0x81e0, lpOverlapped=0x0) returned 1 [0096.163] GetProcessHeap () returned 0x580000 [0096.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0096.163] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.163] WriteFile (in: hFile=0x440, lpBuffer=0x6e15560*, nNumberOfBytesToWrite=0x81e0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e15560*, lpNumberOfBytesWritten=0x4fcff14*=0x81e0, lpOverlapped=0x0) returned 1 [0096.164] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.164] WriteFile (in: hFile=0x440, lpBuffer=0x6e1d73f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1d73f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0096.164] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.164] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0096.164] CloseHandle (hObject=0x440) returned 1 [0097.485] GetProcessHeap () returned 0x580000 [0097.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e15560 | out: hHeap=0x580000) returned 1 [0097.485] GetProcessHeap () returned 0x580000 [0097.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0097.485] GetProcessHeap () returned 0x580000 [0097.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70eec580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8221, dwReserved0=0x4fcfd28, dwReserved1=0x6f1bea8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.485] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.622] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", len=0x4d | out: pbstr=0x4fcff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 1 [0101.622] GetProcessHeap () returned 0x580000 [0101.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f420, Size=0x2c) returned 0x61f7d8 [0101.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0103.395] CloseHandle (hObject=0x4a8) returned 1 [0103.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0103.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id_1622540890_.your_last_chance")) returned 1 [0104.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERM~2.YOU")) returned 0x5b9630 [0104.476] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0104.476] GetProcessHeap () returned 0x580000 [0104.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbfe1) returned 0x6dfaac0 [0104.476] GetProcessHeap () returned 0x580000 [0104.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbfe1) returned 0x626d18 [0104.476] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.476] ReadFile (in: hFile=0x4a8, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0xbfc0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x4fcff14*=0xbfc0, lpOverlapped=0x0) returned 1 [0106.384] GetProcessHeap () returned 0x580000 [0106.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0106.384] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.384] WriteFile (in: hFile=0x4a8, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0xbfc0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x4fcff14*=0xbfc0, lpOverlapped=0x0) returned 1 [0106.384] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.385] WriteFile (in: hFile=0x4a8, lpBuffer=0x632cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x632cd7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0106.385] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.385] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0106.385] CloseHandle (hObject=0x4a8) returned 1 [0106.385] GetProcessHeap () returned 0x580000 [0106.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0106.387] GetProcessHeap () returned 0x580000 [0106.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0106.387] GetProcessHeap () returned 0x580000 [0106.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0106.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7705ea20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbfea, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="WATERMAR.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WATERM~2.YOU")) returned 0x5b96f0 [0106.387] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.843] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\offset.ax", len=0x24 | out: pbstr=0x4fcff84*="C:\\Program Files\\DVD Maker\\offset.ax") returned 1 [0111.843] GetProcessHeap () returned 0x580000 [0111.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.865] Sleep (dwMilliseconds=0x1) [0111.912] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", len=0x45 | out: pbstr=0x4fcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 1 [0111.912] GetProcessHeap () returned 0x580000 [0111.912] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0111.913] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.945] Sleep (dwMilliseconds=0x1) [0112.022] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.047] Sleep (dwMilliseconds=0x1) [0112.162] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", len=0x53 | out: pbstr=0x4fcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 1 [0112.162] GetProcessHeap () returned 0x580000 [0112.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x2c) returned 0x61f848 [0112.162] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.187] Sleep (dwMilliseconds=0x1) [0112.340] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", len=0x4b | out: pbstr=0x4fcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 1 [0112.340] GetProcessHeap () returned 0x580000 [0112.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.340] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.340] Sleep (dwMilliseconds=0x1) [0112.358] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", len=0x46 | out: pbstr=0x4fcff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png") returned 1 [0112.358] GetProcessHeap () returned 0x580000 [0112.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1828 [0112.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.382] Sleep (dwMilliseconds=0x1) [0113.340] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", len=0x3f | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 1 [0113.340] GetProcessHeap () returned 0x580000 [0113.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x6c) returned 0x6f0ceb8 [0113.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0113.473] CloseHandle (hObject=0x454) returned 1 [0113.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~3.YOU")) returned 0x5b9630 [0114.042] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0114.042] GetProcessHeap () returned 0x580000 [0114.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21a1) returned 0x633768 [0114.042] GetProcessHeap () returned 0x580000 [0114.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21a1) returned 0x6c6a0f8 [0114.043] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.043] ReadFile (in: hFile=0x454, lpBuffer=0x633768, nNumberOfBytesToRead=0x2180, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x633768*, lpNumberOfBytesRead=0x4fcff14*=0x2180, lpOverlapped=0x0) returned 1 [0114.073] GetProcessHeap () returned 0x580000 [0114.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.074] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.074] WriteFile (in: hFile=0x454, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x4fcff14*=0x2180, lpOverlapped=0x0) returned 1 [0114.074] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.074] WriteFile (in: hFile=0x454, lpBuffer=0x6c6c277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6c277*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0114.074] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.074] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0114.074] CloseHandle (hObject=0x454) returned 1 [0114.074] GetProcessHeap () returned 0x580000 [0114.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0114.074] GetProcessHeap () returned 0x580000 [0114.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x633768 | out: hHeap=0x580000) returned 1 [0114.074] GetProcessHeap () returned 0x580000 [0114.074] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b9b7000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21aa, dwReserved0=0x4fcfd28, dwReserved1=0x633768, cFileName="AG00165_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0016~3.YOU")) returned 0x5b9630 [0114.075] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.470] CloseHandle (hObject=0x438) returned 1 [0116.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id_1622540890_.your_last_chance")) returned 1 [0116.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOW_0~1.YOU")) returned 0x5b9630 [0116.472] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.472] GetProcessHeap () returned 0x580000 [0116.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1901) returned 0x6e00ac0 [0116.472] GetProcessHeap () returned 0x580000 [0116.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1901) returned 0x6df50f0 [0116.473] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.473] ReadFile (in: hFile=0x438, lpBuffer=0x6e00ac0, nNumberOfBytesToRead=0x18e0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesRead=0x4fcff14*=0x18e0, lpOverlapped=0x0) returned 1 [0116.555] GetProcessHeap () returned 0x580000 [0116.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.555] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.555] WriteFile (in: hFile=0x438, lpBuffer=0x6df50f0*, nNumberOfBytesToWrite=0x18e0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6df50f0*, lpNumberOfBytesWritten=0x4fcff14*=0x18e0, lpOverlapped=0x0) returned 1 [0116.555] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.555] WriteFile (in: hFile=0x438, lpBuffer=0x6df69cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6df69cf*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0116.555] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.555] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0116.555] CloseHandle (hObject=0x438) returned 1 [0116.559] GetProcessHeap () returned 0x580000 [0116.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df50f0 | out: hHeap=0x580000) returned 1 [0116.580] GetProcessHeap () returned 0x580000 [0116.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0116.580] GetProcessHeap () returned 0x580000 [0116.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d15eaa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x191c, dwReserved0=0x4fcfd28, dwReserved1=0x6e00ac0, cFileName="SHOW_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOW_0~1.YOU")) returned 0x5b9630 [0117.934] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0117.939] CloseHandle (hObject=0x48c) returned 1 [0117.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id_1622540890_.your_last_chance")) returned 1 [0117.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACE_~1.YOU")) returned 0x5b9630 [0117.940] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0117.940] GetProcessHeap () returned 0x580000 [0117.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6f19958 [0117.940] GetProcessHeap () returned 0x580000 [0117.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6cba390 [0117.942] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.942] ReadFile (in: hFile=0x48c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x4fcff14*=0x1060, lpOverlapped=0x0) returned 1 [0117.981] GetProcessHeap () returned 0x580000 [0117.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0117.982] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.982] WriteFile (in: hFile=0x48c, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x4fcff14*=0x1060, lpOverlapped=0x0) returned 1 [0117.982] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.982] WriteFile (in: hFile=0x48c, lpBuffer=0x6cbb3ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbb3ef*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0117.982] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.982] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0117.982] CloseHandle (hObject=0x48c) returned 1 [0117.982] GetProcessHeap () returned 0x580000 [0117.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0117.982] GetProcessHeap () returned 0x580000 [0117.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0117.982] GetProcessHeap () returned 0x580000 [0117.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0117.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dee87c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x109f, dwReserved0=0x4fcfd28, dwReserved1=0x6f19958, cFileName="SPACE_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACE_~1.YOU")) returned 0x5b9630 [0117.982] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.014] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", len=0x3c | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF") returned 1 [0120.014] GetProcessHeap () returned 0x580000 [0120.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b0) returned 0x6d06ca8 [0120.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.015] CloseHandle (hObject=0x460) returned 1 [0120.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.id_1622540890_.your_last_chance")) returned 1 [0120.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WING1W~1.YOU")) returned 0x5b96f0 [0120.016] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.016] GetProcessHeap () returned 0x580000 [0120.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x62ed18 [0120.016] GetProcessHeap () returned 0x580000 [0120.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa21) returned 0x677cd0 [0120.016] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.016] ReadFile (in: hFile=0x460, lpBuffer=0x62ed18, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesRead=0x4fcff14*=0xa00, lpOverlapped=0x0) returned 1 [0120.026] GetProcessHeap () returned 0x580000 [0120.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0120.026] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.026] WriteFile (in: hFile=0x460, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x4fcff14*=0xa00, lpOverlapped=0x0) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.027] WriteFile (in: hFile=0x460, lpBuffer=0x6786cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6786cf*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.466] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0120.466] CloseHandle (hObject=0x460) returned 1 [0121.011] GetProcessHeap () returned 0x580000 [0121.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0121.011] GetProcessHeap () returned 0x580000 [0121.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0121.011] GetProcessHeap () returned 0x580000 [0121.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f6b63c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x4fcfd28, dwReserved1=0x62ed18, cFileName="WING1.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WING1W~1.YOU")) returned 0x5b9730 [0121.911] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.353] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", len=0x3e | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned 1 [0122.353] GetProcessHeap () returned 0x580000 [0122.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0122.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0122.398] CloseHandle (hObject=0x48c) returned 1 [0122.398] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.398] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.id_1622540890_.your_last_chance")) returned 1 [0122.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.399] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKTH~1.YOU")) returned 0x5b9730 [0122.399] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0122.399] GetProcessHeap () returned 0x580000 [0122.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0122.399] GetProcessHeap () returned 0x580000 [0122.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0122.400] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.400] ReadFile (in: hFile=0x48c, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.454] GetProcessHeap () returned 0x580000 [0124.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0124.454] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.454] WriteFile (in: hFile=0x48c, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.454] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.454] WriteFile (in: hFile=0x48c, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0124.454] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.455] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0124.455] CloseHandle (hObject=0x48c) returned 1 [0124.455] GetProcessHeap () returned 0x580000 [0124.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0124.455] GetProcessHeap () returned 0x580000 [0124.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0124.455] GetProcessHeap () returned 0x580000 [0124.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0125.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ca6260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a260, dwReserved0=0x4fcfd28, dwReserved1=0x636970, cFileName="Trek.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKTH~1.YOU")) returned 0x5b9730 [0125.087] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.152] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", len=0x4e | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 1 [0125.152] GetProcessHeap () returned 0x580000 [0125.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1880) returned 0x6f42f08 [0125.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0127.187] CloseHandle (hObject=0x49c) returned 1 [0127.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0127.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id_1622540890_.your_last_chance")) returned 1 [0127.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Median.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEDIAN~1.YOU")) returned 0x5b9730 [0127.188] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0127.189] GetProcessHeap () returned 0x580000 [0127.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a81) returned 0x6f58108 [0127.189] GetProcessHeap () returned 0x580000 [0127.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a81) returned 0x6d8e818 [0127.189] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.189] ReadFile (in: hFile=0x49c, lpBuffer=0x6f58108, nNumberOfBytesToRead=0x9a60, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x4fcff14*=0x9a60, lpOverlapped=0x0) returned 1 [0128.014] GetProcessHeap () returned 0x580000 [0128.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0128.014] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.014] WriteFile (in: hFile=0x49c, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x4fcff14*=0x9a60, lpOverlapped=0x0) returned 1 [0128.228] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.230] WriteFile (in: hFile=0x49c, lpBuffer=0x6d98277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98277*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0128.232] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.243] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0128.243] CloseHandle (hObject=0x49c) returned 1 [0128.243] GetProcessHeap () returned 0x580000 [0128.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0128.244] GetProcessHeap () returned 0x580000 [0128.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0128.244] GetProcessHeap () returned 0x580000 [0128.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0128.244] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x840cd080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9a9e, dwReserved0=0x4fcfd28, dwReserved1=0x6f58108, cFileName="Median.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEDIAN~1.YOU")) returned 0x5b96f0 [0128.244] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.408] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", len=0x45 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned 1 [0128.408] GetProcessHeap () returned 0x580000 [0128.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b4c) returned 0x6e063d0 [0128.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.971] CloseHandle (hObject=0x41c) returned 1 [0128.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.id_1622540890_.your_last_chance")) returned 1 [0128.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1458~1.YOU")) returned 0x5b96f0 [0128.972] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.972] GetProcessHeap () returned 0x580000 [0128.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0128.972] GetProcessHeap () returned 0x580000 [0128.972] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0128.972] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.972] ReadFile (in: hFile=0x41c, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0128.973] GetProcessHeap () returned 0x580000 [0128.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0128.974] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.974] WriteFile (in: hFile=0x41c, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0128.974] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.974] WriteFile (in: hFile=0x41c, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0128.974] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.974] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0128.974] CloseHandle (hObject=0x41c) returned 1 [0128.974] GetProcessHeap () returned 0x580000 [0128.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0128.974] GetProcessHeap () returned 0x580000 [0128.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0128.974] GetProcessHeap () returned 0x580000 [0128.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0129.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x847cb120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x4fcfd28, dwReserved1=0x5ad8a0, cFileName="BD14581_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1458~1.YOU")) returned 0x5b9730 [0129.447] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.472] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", len=0x43 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned 1 [0129.472] GetProcessHeap () returned 0x580000 [0129.472] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0129.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.476] CloseHandle (hObject=0x458) returned 1 [0129.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.id_1622540890_.your_last_chance")) returned 1 [0129.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~1.YOU")) returned 0x5b9630 [0129.492] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.492] GetProcessHeap () returned 0x580000 [0129.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0129.492] GetProcessHeap () returned 0x580000 [0129.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0129.492] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.492] ReadFile (in: hFile=0x458, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x4fcff14*=0x100, lpOverlapped=0x0) returned 1 [0129.494] GetProcessHeap () returned 0x580000 [0129.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.494] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.494] WriteFile (in: hFile=0x458, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x4fcff14*=0x100, lpOverlapped=0x0) returned 1 [0129.494] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.494] WriteFile (in: hFile=0x458, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0129.494] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.494] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0129.494] CloseHandle (hObject=0x458) returned 1 [0129.494] GetProcessHeap () returned 0x580000 [0129.494] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0129.494] GetProcessHeap () returned 0x580000 [0129.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0129.495] GetProcessHeap () returned 0x580000 [0129.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84cb3e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x4fcfd28, dwReserved1=0x6f0a9f0, cFileName="J0115856.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~1.YOU")) returned 0x5b9630 [0129.495] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.701] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", len=0x3b | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned 1 [0129.701] GetProcessHeap () returned 0x580000 [0129.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0129.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.421] CloseHandle (hObject=0x3e4) returned 1 [0132.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.id_1622540890_.your_last_chance")) returned 1 [0132.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.425] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b9730 [0132.425] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0132.425] GetProcessHeap () returned 0x580000 [0132.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0132.425] GetProcessHeap () returned 0x580000 [0132.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0132.425] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.425] ReadFile (in: hFile=0x3e4, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x4fcff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.438] GetProcessHeap () returned 0x580000 [0132.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.438] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.438] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x4fcff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.438] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.438] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0132.438] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.438] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0132.438] CloseHandle (hObject=0x3e4) returned 1 [0132.439] GetProcessHeap () returned 0x580000 [0132.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0132.439] GetProcessHeap () returned 0x580000 [0132.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0132.439] GetProcessHeap () returned 0x580000 [0132.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x868d2260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x4fcfd28, dwReserved1=0x635768, cFileName="DEFAULT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b96f0 [0134.939] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.939] Sleep (dwMilliseconds=0x1) [0134.999] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", len=0x4d | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned 1 [0134.999] GetProcessHeap () returned 0x580000 [0134.999] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e9c) returned 0x6f14048 [0134.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.013] CloseHandle (hObject=0x3b8) returned 1 [0135.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.id_1622540890_.your_last_chance")) returned 1 [0135.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EADOCU~1.YOU")) returned 0x5b96f0 [0135.014] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0135.015] GetProcessHeap () returned 0x580000 [0135.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d81) returned 0x7062118 [0135.015] GetProcessHeap () returned 0x580000 [0135.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d81) returned 0x6fa8f28 [0135.015] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.015] ReadFile (in: hFile=0x3b8, lpBuffer=0x7062118, nNumberOfBytesToRead=0x4d60, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x7062118*, lpNumberOfBytesRead=0x4fcff14*=0x4d60, lpOverlapped=0x0) returned 1 [0136.352] GetProcessHeap () returned 0x580000 [0136.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0136.352] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.352] WriteFile (in: hFile=0x3b8, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x4d60, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x4fcff14*=0x4d60, lpOverlapped=0x0) returned 1 [0136.353] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.353] WriteFile (in: hFile=0x3b8, lpBuffer=0x6fadc87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fadc87*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0136.353] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.353] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0136.353] CloseHandle (hObject=0x3b8) returned 1 [0136.353] GetProcessHeap () returned 0x580000 [0136.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0136.353] GetProcessHeap () returned 0x580000 [0136.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062118 | out: hHeap=0x580000) returned 1 [0136.353] GetProcessHeap () returned 0x580000 [0136.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0136.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e29b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4da2, dwReserved0=0x4fcfd28, dwReserved1=0x7062118, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EADOCU~1.YOU")) returned 0x5b96b0 [0136.393] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.416] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", len=0x43 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned 1 [0136.416] GetProcessHeap () returned 0x580000 [0136.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0136.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0136.499] CloseHandle (hObject=0x4a4) returned 1 [0136.499] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.499] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.id_1622540890_.your_last_chance")) returned 1 [0136.500] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ff3100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x27ff3100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~4.YOU")) returned 0x5b96b0 [0136.500] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0136.549] GetProcessHeap () returned 0x580000 [0136.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0136.549] GetProcessHeap () returned 0x580000 [0136.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0136.549] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.549] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x4fcff14*=0x1c0, lpOverlapped=0x0) returned 1 [0138.341] GetProcessHeap () returned 0x580000 [0138.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdef0 [0138.341] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.341] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x4fcff14*=0x1c0, lpOverlapped=0x0) returned 1 [0138.517] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.517] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0138.517] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.518] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0138.518] CloseHandle (hObject=0x4a4) returned 1 [0138.757] GetProcessHeap () returned 0x580000 [0138.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0138.757] GetProcessHeap () returned 0x580000 [0138.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0138.757] GetProcessHeap () returned 0x580000 [0138.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdef0 | out: hHeap=0x580000) returned 1 [0140.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ff3100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a2d7aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x4fcfd28, dwReserved1=0x6f3ef20, cFileName="BD21330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~4.YOU")) returned 0x5b9770 [0140.123] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.168] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x60 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0140.168] GetProcessHeap () returned 0x580000 [0140.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0140.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.199] CloseHandle (hObject=0x428) returned 1 [0140.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0140.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.263] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.263] GetProcessHeap () returned 0x580000 [0140.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0140.263] GetProcessHeap () returned 0x580000 [0140.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0140.263] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.263] ReadFile (in: hFile=0x428, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x4fcff14*=0x140, lpOverlapped=0x0) returned 1 [0140.265] GetProcessHeap () returned 0x580000 [0140.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.265] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.265] WriteFile (in: hFile=0x428, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x4fcff14*=0x140, lpOverlapped=0x0) returned 1 [0140.265] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.265] WriteFile (in: hFile=0x428, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0140.266] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.266] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0140.266] CloseHandle (hObject=0x428) returned 1 [0140.266] GetProcessHeap () returned 0x580000 [0140.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0140.266] GetProcessHeap () returned 0x580000 [0140.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0140.266] GetProcessHeap () returned 0x580000 [0140.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3814a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x4fcfd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.662] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.672] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", len=0x43 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned 1 [0140.672] GetProcessHeap () returned 0x580000 [0140.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d9c) returned 0x6f14048 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.022] CloseHandle (hObject=0x4a0) returned 1 [0141.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1480~1.YOU")) returned 0x5b9730 [0141.023] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.023] GetProcessHeap () returned 0x580000 [0141.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5ef978 [0141.023] GetProcessHeap () returned 0x580000 [0141.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x5f1130 [0141.023] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.023] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ef978, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ef978*, lpNumberOfBytesRead=0x4fcff14*=0x1e0, lpOverlapped=0x0) returned 1 [0141.026] GetProcessHeap () returned 0x580000 [0141.026] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.026] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.026] WriteFile (in: hFile=0x4a0, lpBuffer=0x5f1130*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5f1130*, lpNumberOfBytesWritten=0x4fcff14*=0x1e0, lpOverlapped=0x0) returned 1 [0141.026] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.026] WriteFile (in: hFile=0x4a0, lpBuffer=0x5f130f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5f130f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0141.026] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.026] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0141.027] CloseHandle (hObject=0x4a0) returned 1 [0141.027] GetProcessHeap () returned 0x580000 [0141.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f1130 | out: hHeap=0x580000) returned 1 [0141.027] GetProcessHeap () returned 0x580000 [0141.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ef978 | out: hHeap=0x580000) returned 1 [0141.027] GetProcessHeap () returned 0x580000 [0141.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0144.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8bacb800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x217, dwReserved0=0x4fcfd28, dwReserved1=0x5ef978, cFileName="BD14800_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1480~1.YOU")) returned 0x5b9730 [0144.543] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.593] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL", len=0x43 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 1 [0144.594] GetProcessHeap () returned 0x580000 [0144.594] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0144.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0144.594] CloseHandle (hObject=0x410) returned 1 [0144.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.595] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0144.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONINTL~1.YOU")) returned 0x5b9730 [0144.596] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0144.596] GetProcessHeap () returned 0x580000 [0144.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d528a8 [0144.596] GetProcessHeap () returned 0x580000 [0144.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d640d8 [0144.596] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.596] ReadFile (in: hFile=0x410, lpBuffer=0x6d528a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d528a8*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.712] GetProcessHeap () returned 0x580000 [0147.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0147.712] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.712] WriteFile (in: hFile=0x410, lpBuffer=0x6d640d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d640d8*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.712] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.712] WriteFile (in: hFile=0x410, lpBuffer=0x6d758d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d758d7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0147.713] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.713] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0147.713] CloseHandle (hObject=0x410) returned 1 [0147.713] GetProcessHeap () returned 0x580000 [0147.713] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d640d8 | out: hHeap=0x580000) returned 1 [0147.713] GetProcessHeap () returned 0x580000 [0147.713] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d528a8 | out: hHeap=0x580000) returned 1 [0147.713] GetProcessHeap () returned 0x580000 [0147.713] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0147.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fa78480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bfa4, dwReserved0=0x4fcfd28, dwReserved1=0x6d528a8, cFileName="ONINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONINTL~1.YOU")) returned 0x5b96f0 [0147.713] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.337] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS", len=0x45 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS") returned 1 [0148.337] GetProcessHeap () returned 0x580000 [0148.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0148.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0148.423] CloseHandle (hObject=0x428) returned 1 [0148.423] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.423] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css.id_1622540890_.your_last_chance")) returned 1 [0148.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e03f00, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0e03f00, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1f018, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCCC62~1.YOU")) returned 0x5b96f0 [0148.424] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0148.424] GetProcessHeap () returned 0x580000 [0148.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0148.424] GetProcessHeap () returned 0x580000 [0148.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d330a8 [0148.424] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.424] ReadFile (in: hFile=0x428, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.862] GetProcessHeap () returned 0x580000 [0151.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.863] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.863] WriteFile (in: hFile=0x428, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.863] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.863] WriteFile (in: hFile=0x428, lpBuffer=0x6d448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d448a7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0151.863] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.863] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0151.864] CloseHandle (hObject=0x428) returned 1 [0151.864] GetProcessHeap () returned 0x580000 [0151.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0151.864] GetProcessHeap () returned 0x580000 [0151.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0151.864] GetProcessHeap () returned 0x580000 [0151.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e03f00, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9220b240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f03c, dwReserved0=0x4fcfd28, dwReserved1=0x6d21878, cFileName="SCHEME50.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCCC62~1.YOU")) returned 0x5b9730 [0152.049] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.286] CloseHandle (hObject=0x488) returned 1 [0155.286] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.286] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.287] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~3.YOU")) returned 0x5b9730 [0155.287] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.287] GetProcessHeap () returned 0x580000 [0155.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.287] GetProcessHeap () returned 0x580000 [0155.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.287] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.287] ReadFile (in: hFile=0x488, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4fcff14*=0x60, lpOverlapped=0x0) returned 1 [0155.289] GetProcessHeap () returned 0x580000 [0155.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.289] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.289] WriteFile (in: hFile=0x488, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4fcff14*=0x60, lpOverlapped=0x0) returned 1 [0155.289] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.289] WriteFile (in: hFile=0x488, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0155.289] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.289] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0155.289] CloseHandle (hObject=0x488) returned 1 [0155.289] GetProcessHeap () returned 0x580000 [0155.289] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.289] GetProcessHeap () returned 0x580000 [0155.289] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.289] GetProcessHeap () returned 0x580000 [0155.289] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x942c60c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x4fcfd28, dwReserved1=0x61b540, cFileName="WINPROJ_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~3.YOU")) returned 0x5b9630 [0155.903] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.938] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", len=0x37 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 1 [0155.938] GetProcessHeap () returned 0x580000 [0155.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0155.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0159.032] CloseHandle (hObject=0x484) returned 1 [0159.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id_1622540890_.your_last_chance")) returned 1 [0159.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~1.YOU")) returned 0x5b9630 [0159.033] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0159.033] GetProcessHeap () returned 0x580000 [0159.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7b21) returned 0x6d3c818 [0159.034] GetProcessHeap () returned 0x580000 [0159.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7b21) returned 0x6d44348 [0159.034] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.034] ReadFile (in: hFile=0x484, lpBuffer=0x6d3c818, nNumberOfBytesToRead=0x7b00, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3c818*, lpNumberOfBytesRead=0x4fcff14*=0x7b00, lpOverlapped=0x0) returned 1 [0161.556] GetProcessHeap () returned 0x580000 [0161.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0161.556] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.556] WriteFile (in: hFile=0x484, lpBuffer=0x6d44348*, nNumberOfBytesToWrite=0x7b00, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d44348*, lpNumberOfBytesWritten=0x4fcff14*=0x7b00, lpOverlapped=0x0) returned 1 [0161.556] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.556] WriteFile (in: hFile=0x484, lpBuffer=0x6d4be47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4be47*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0161.556] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.556] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0161.556] CloseHandle (hObject=0x484) returned 1 [0161.556] GetProcessHeap () returned 0x580000 [0161.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d44348 | out: hHeap=0x580000) returned 1 [0161.556] GetProcessHeap () returned 0x580000 [0161.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d3c818 | out: hHeap=0x580000) returned 1 [0161.556] GetProcessHeap () returned 0x580000 [0161.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0164.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x97e94980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7b2d, dwReserved0=0x4fcfd28, dwReserved1=0x6d3c818, cFileName="CGMIMP32.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~1.YOU")) returned 0x5b9730 [0166.129] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.050] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", len=0x3f | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 1 [0170.051] GetProcessHeap () returned 0x580000 [0170.051] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0170.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.129] CloseHandle (hObject=0x480) returned 1 [0170.129] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.129] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id_1622540890_.your_last_chance")) returned 1 [0170.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTESI~1.YOU")) returned 0x5b9730 [0170.130] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.130] GetProcessHeap () returned 0x580000 [0170.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0170.130] GetProcessHeap () returned 0x580000 [0170.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0170.130] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.130] ReadFile (in: hFile=0x480, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x4fcff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.142] GetProcessHeap () returned 0x580000 [0170.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.142] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.142] WriteFile (in: hFile=0x480, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x4fcff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.142] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.142] WriteFile (in: hFile=0x480, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0170.142] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.142] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0170.143] CloseHandle (hObject=0x480) returned 1 [0170.143] GetProcessHeap () returned 0x580000 [0170.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0170.143] GetProcessHeap () returned 0x580000 [0170.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0170.143] GetProcessHeap () returned 0x580000 [0170.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d067dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x4fcfd28, dwReserved1=0x65f268, cFileName="NOTES.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTESI~1.YOU")) returned 0x5b9730 [0170.143] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.150] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", len=0x41 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 1 [0170.150] GetProcessHeap () returned 0x580000 [0170.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2294) returned 0x6f14048 [0170.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.151] CloseHandle (hObject=0x480) returned 1 [0170.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id_1622540890_.your_last_chance")) returned 1 [0170.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~1.YOU")) returned 0x5b9730 [0170.152] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.152] GetProcessHeap () returned 0x580000 [0170.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0170.152] GetProcessHeap () returned 0x580000 [0170.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0170.152] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.152] ReadFile (in: hFile=0x480, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x4fcff14*=0x320, lpOverlapped=0x0) returned 1 [0170.156] GetProcessHeap () returned 0x580000 [0170.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.156] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.156] WriteFile (in: hFile=0x480, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x4fcff14*=0x320, lpOverlapped=0x0) returned 1 [0170.156] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.156] WriteFile (in: hFile=0x480, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0170.156] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.156] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0170.157] CloseHandle (hObject=0x480) returned 1 [0170.157] GetProcessHeap () returned 0x580000 [0170.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0170.157] GetProcessHeap () returned 0x580000 [0170.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0170.157] GetProcessHeap () returned 0x580000 [0170.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d08df20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x4fcfd28, dwReserved1=0x6c59120, cFileName="TASKACC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~1.YOU")) returned 0x5b9730 [0170.157] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.165] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", len=0x35 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 1 [0170.165] GetProcessHeap () returned 0x580000 [0170.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22c0) returned 0x6f14048 [0170.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.166] CloseHandle (hObject=0x480) returned 1 [0170.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id_1622540890_.your_last_chance")) returned 1 [0170.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FRENCH~1.YOU")) returned 0x5b9630 [0170.167] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0170.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.167] GetProcessHeap () returned 0x580000 [0170.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x704b778 [0170.168] GetProcessHeap () returned 0x580000 [0170.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0170.168] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.168] ReadFile (in: hFile=0x480, lpBuffer=0x704b778, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x704b778*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.219] GetProcessHeap () returned 0x580000 [0174.219] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.219] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.219] WriteFile (in: hFile=0x480, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.220] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.220] WriteFile (in: hFile=0x480, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0174.815] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.815] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0174.815] CloseHandle (hObject=0x480) returned 1 [0174.815] GetProcessHeap () returned 0x580000 [0174.815] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0174.815] GetProcessHeap () returned 0x580000 [0174.815] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704b778 | out: hHeap=0x580000) returned 1 [0174.815] GetProcessHeap () returned 0x580000 [0174.815] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd09a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x88957, dwReserved0=0x4fcfd28, dwReserved1=0x704b778, cFileName="FRENCH.LNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FRENCH~1.YOU")) returned 0x5b96f0 [0176.808] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.844] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", len=0x3f | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 1 [0176.844] GetProcessHeap () returned 0x580000 [0176.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x210c) returned 0x6f14048 [0176.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.440] CloseHandle (hObject=0x470) returned 1 [0179.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0179.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~3.YOU")) returned 0x5b96f0 [0179.442] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.442] GetProcessHeap () returned 0x580000 [0179.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0179.442] GetProcessHeap () returned 0x580000 [0179.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0179.442] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.442] ReadFile (in: hFile=0x470, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0179.443] GetProcessHeap () returned 0x580000 [0179.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.443] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.443] WriteFile (in: hFile=0x470, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0179.444] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.444] WriteFile (in: hFile=0x470, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0179.444] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.444] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0179.444] CloseHandle (hObject=0x470) returned 1 [0179.444] GetProcessHeap () returned 0x580000 [0179.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0179.444] GetProcessHeap () returned 0x580000 [0179.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0179.444] GetProcessHeap () returned 0x580000 [0179.444] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2913140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x4fcfd28, dwReserved1=0x5ad8a0, cFileName="SETLANG_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~3.YOU")) returned 0x5b96b0 [0180.471] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.559] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", len=0x67 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned 1 [0180.559] GetProcessHeap () returned 0x580000 [0180.559] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0180.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.559] CloseHandle (hObject=0x450) returned 1 [0180.559] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbb75100, ftLastWriteTime.dwHighDateTime=0x1c9bcb4, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~4.YOU")) returned 0x5b96b0 [0180.561] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.561] GetProcessHeap () returned 0x580000 [0180.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x6d29f58 [0180.561] GetProcessHeap () returned 0x580000 [0180.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x711c020 [0180.561] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.561] ReadFile (in: hFile=0x450, lpBuffer=0x6d29f58, nNumberOfBytesToRead=0x2240, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29f58*, lpNumberOfBytesRead=0x4fcff14*=0x2240, lpOverlapped=0x0) returned 1 [0180.603] GetProcessHeap () returned 0x580000 [0180.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.603] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.603] WriteFile (in: hFile=0x450, lpBuffer=0x711c020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x711c020*, lpNumberOfBytesWritten=0x4fcff14*=0x2240, lpOverlapped=0x0) returned 1 [0180.603] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.603] WriteFile (in: hFile=0x450, lpBuffer=0x711e25f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x711e25f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0180.603] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.604] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0180.604] CloseHandle (hObject=0x450) returned 1 [0180.604] GetProcessHeap () returned 0x580000 [0180.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c020 | out: hHeap=0x580000) returned 1 [0180.604] GetProcessHeap () returned 0x580000 [0180.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d29f58 | out: hHeap=0x580000) returned 1 [0180.604] GetProcessHeap () returned 0x580000 [0180.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa343b860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x4fcfd28, dwReserved1=0x6d29f58, cFileName="CommsIncomingImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~4.YOU")) returned 0x5b9770 [0181.348] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.401] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", len=0x54 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned 1 [0183.402] GetProcessHeap () returned 0x580000 [0183.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0183.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.403] CloseHandle (hObject=0x488) returned 1 [0183.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.404] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.404] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7689a500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e35, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLIN~2.YOU")) returned 0x5b9770 [0183.404] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.404] GetProcessHeap () returned 0x580000 [0183.404] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e41) returned 0x6dcb1d0 [0183.405] GetProcessHeap () returned 0x580000 [0183.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e41) returned 0x656970 [0183.405] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.405] ReadFile (in: hFile=0x488, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x1e20, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x4fcff14*=0x1e20, lpOverlapped=0x0) returned 1 [0183.450] GetProcessHeap () returned 0x580000 [0183.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.450] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.450] WriteFile (in: hFile=0x488, lpBuffer=0x656970*, nNumberOfBytesToWrite=0x1e20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesWritten=0x4fcff14*=0x1e20, lpOverlapped=0x0) returned 1 [0183.450] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.450] WriteFile (in: hFile=0x488, lpBuffer=0x65878f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x65878f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0183.450] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.450] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0183.450] CloseHandle (hObject=0x488) returned 1 [0183.450] GetProcessHeap () returned 0x580000 [0183.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0183.451] GetProcessHeap () returned 0x580000 [0183.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0183.451] GetProcessHeap () returned 0x580000 [0183.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4f4f2a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e59, dwReserved0=0x4fcfd28, dwReserved1=0x6dcb1d0, cFileName="OutlineToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLIN~2.YOU")) returned 0x5b96b0 [0183.451] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.471] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", len=0x73 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned 1 [0183.471] GetProcessHeap () returned 0x580000 [0183.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0183.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.580] CloseHandle (hObject=0x428) returned 1 [0184.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0184.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x4d0073, dwReserved1=0x730061, cFileName="MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MARKUP~1.YOU")) returned 0x5b9770 [0184.582] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.582] GetProcessHeap () returned 0x580000 [0184.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0184.582] GetProcessHeap () returned 0x580000 [0184.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0184.582] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.582] ReadFile (in: hFile=0x428, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x4fcff14*=0x60, lpOverlapped=0x0) returned 1 [0184.583] GetProcessHeap () returned 0x580000 [0184.583] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x705f940 [0184.583] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.583] WriteFile (in: hFile=0x428, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x4fcff14*=0x60, lpOverlapped=0x0) returned 1 [0184.583] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.583] WriteFile (in: hFile=0x428, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0184.584] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.584] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0184.584] CloseHandle (hObject=0x428) returned 1 [0184.584] GetProcessHeap () returned 0x580000 [0184.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0184.584] GetProcessHeap () returned 0x580000 [0184.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0184.584] GetProcessHeap () returned 0x580000 [0184.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f940 | out: hHeap=0x580000) returned 1 [0184.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5a2b700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x98, dwReserved0=0x4fcfd28, dwReserved1=0x61b540, cFileName="MarkupIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MARKUP~1.YOU")) returned 0x5b9770 [0184.584] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.815] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", len=0x5b | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned 1 [0184.816] GetProcessHeap () returned 0x580000 [0184.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2118) returned 0x6f14048 [0184.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0185.082] CloseHandle (hObject=0x4a8) returned 1 [0185.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0185.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b9770 [0185.083] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0185.083] GetProcessHeap () returned 0x580000 [0185.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0185.083] GetProcessHeap () returned 0x580000 [0185.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0185.083] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.083] ReadFile (in: hFile=0x4a8, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x4fcff14*=0x140, lpOverlapped=0x0) returned 1 [0185.085] GetProcessHeap () returned 0x580000 [0185.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0185.085] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x4fcff14*=0x140, lpOverlapped=0x0) returned 1 [0185.085] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.085] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0185.085] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.086] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0185.086] CloseHandle (hObject=0x4a8) returned 1 [0185.086] GetProcessHeap () returned 0x580000 [0185.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0185.086] GetProcessHeap () returned 0x580000 [0185.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0185.086] GetProcessHeap () returned 0x580000 [0185.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0185.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eee300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x4fcfd28, dwReserved1=0x6f3bec0, cFileName="MessageHistoryIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b9770 [0185.533] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.581] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", len=0x47 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned 1 [0185.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0187.107] CloseHandle (hObject=0x3a8) returned 1 [0187.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0187.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIPMA~1.YOU")) returned 0x5b96b0 [0187.108] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0187.108] GetProcessHeap () returned 0x580000 [0187.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x677cd0 [0187.108] GetProcessHeap () returned 0x580000 [0187.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x635768 [0187.108] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.109] ReadFile (in: hFile=0x3a8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4fcff14*=0xc20, lpOverlapped=0x0) returned 1 [0187.120] GetProcessHeap () returned 0x580000 [0187.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.120] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x3a8, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x4fcff14*=0xc20, lpOverlapped=0x0) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x3a8, lpBuffer=0x636387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x636387*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0187.120] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.120] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0187.120] CloseHandle (hObject=0x3a8) returned 1 [0187.121] GetProcessHeap () returned 0x580000 [0187.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0187.121] GetProcessHeap () returned 0x580000 [0187.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0187.121] GetProcessHeap () returned 0x580000 [0187.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0187.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa72455c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5c, dwReserved0=0x4fcfd28, dwReserved1=0x677cd0, cFileName="GRIPMASK.BMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIPMA~1.YOU")) returned 0x5b96b0 [0187.121] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.122] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", len=0x71 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 1 [0187.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0187.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0187.123] CloseHandle (hObject=0x3a8) returned 1 [0187.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x650075, dwReserved1=0x2e0073, cFileName="Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TRACKI~1.YOU")) returned 0x5b9770 [0188.324] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0188.324] GetProcessHeap () returned 0x580000 [0188.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fe77c8 [0188.324] GetProcessHeap () returned 0x580000 [0188.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0188.325] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.325] ReadFile (in: hFile=0x3a8, lpBuffer=0x6fe77c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.981] GetProcessHeap () returned 0x580000 [0190.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0190.982] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] WriteFile (in: hFile=0x3a8, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.982] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] WriteFile (in: hFile=0x3a8, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0190.982] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.982] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0190.982] CloseHandle (hObject=0x3a8) returned 1 [0190.982] GetProcessHeap () returned 0x580000 [0190.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0190.982] GetProcessHeap () returned 0x580000 [0190.982] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0190.983] GetProcessHeap () returned 0x580000 [0190.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa972aac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e68a, dwReserved0=0x4fcfd28, dwReserved1=0x6fe77c8, cFileName="Track Issues.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TRACKI~1.YOU")) returned 0x5b9770 [0193.204] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.277] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", len=0x67 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned 1 [0193.277] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0193.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.278] CloseHandle (hObject=0x3b8) returned 1 [0193.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.id_1622540890_.your_last_chance")) returned 1 [0193.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b9770 [0193.279] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.279] GetProcessHeap () returned 0x580000 [0193.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6df6780 [0193.279] GetProcessHeap () returned 0x580000 [0193.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6f0c8f8 [0193.279] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.279] ReadFile (in: hFile=0x3b8, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x4fcff14*=0x2e0, lpOverlapped=0x0) returned 1 [0193.366] GetProcessHeap () returned 0x580000 [0193.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.366] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.366] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x4fcff14*=0x2e0, lpOverlapped=0x0) returned 1 [0193.366] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.366] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f0cbd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbd7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0193.366] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.366] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0193.367] CloseHandle (hObject=0x3b8) returned 1 [0193.367] GetProcessHeap () returned 0x580000 [0193.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0193.367] GetProcessHeap () returned 0x580000 [0193.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0193.367] GetProcessHeap () returned 0x580000 [0193.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaadedd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x4fcfd28, dwReserved1=0x6df6780, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b97b0 [0193.367] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.424] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", len=0x61 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned 1 [0193.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0193.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.425] CloseHandle (hObject=0x438) returned 1 [0193.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.id_1622540890_.your_last_chance")) returned 1 [0193.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97b0 [0193.426] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.427] GetProcessHeap () returned 0x580000 [0193.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0193.427] GetProcessHeap () returned 0x580000 [0193.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0193.427] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.427] ReadFile (in: hFile=0x438, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x4fcff14*=0xa0, lpOverlapped=0x0) returned 1 [0193.428] GetProcessHeap () returned 0x580000 [0193.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.428] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.428] WriteFile (in: hFile=0x438, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x4fcff14*=0xa0, lpOverlapped=0x0) returned 1 [0193.428] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.428] WriteFile (in: hFile=0x438, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0193.428] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.429] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0193.429] CloseHandle (hObject=0x438) returned 1 [0193.429] GetProcessHeap () returned 0x580000 [0193.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0193.429] GetProcessHeap () returned 0x580000 [0193.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0193.429] GetProcessHeap () returned 0x580000 [0193.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaae862a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x4fcfd28, dwReserved1=0x60e8a8, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97f0 [0193.562] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.675] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", len=0x6c | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned 1 [0193.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0193.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.675] CloseHandle (hObject=0x39c) returned 1 [0193.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.id_1622540890_.your_last_chance")) returned 1 [0193.676] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x660069, dwReserved1=0x69002e, cFileName="bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b97f0 [0193.677] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.677] GetProcessHeap () returned 0x580000 [0193.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0193.677] GetProcessHeap () returned 0x580000 [0193.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0193.677] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.677] ReadFile (in: hFile=0x39c, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x4fcff14*=0x400, lpOverlapped=0x0) returned 1 [0193.744] GetProcessHeap () returned 0x580000 [0193.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.744] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.744] WriteFile (in: hFile=0x39c, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x4fcff14*=0x400, lpOverlapped=0x0) returned 1 [0193.744] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.745] WriteFile (in: hFile=0x39c, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0193.745] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.745] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0193.745] CloseHandle (hObject=0x39c) returned 1 [0193.745] GetProcessHeap () returned 0x580000 [0193.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0193.745] GetProcessHeap () returned 0x580000 [0193.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0193.745] GetProcessHeap () returned 0x580000 [0193.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab17fe20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x433, dwReserved0=0x4fcfd28, dwReserved1=0x6c6a110, cFileName="bg_FormsHomePageSlice.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_FOR~1.YOU")) returned 0x5b97f0 [0193.745] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.841] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", len=0x60 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned 1 [0193.841] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0193.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0193.842] CloseHandle (hObject=0x42c) returned 1 [0193.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.id_1622540890_.your_last_chance")) returned 1 [0193.843] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b97f0 [0193.843] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0193.843] GetProcessHeap () returned 0x580000 [0193.843] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6d035f8 [0193.843] GetProcessHeap () returned 0x580000 [0193.843] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6de8f50 [0193.843] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.844] ReadFile (in: hFile=0x42c, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x4fcff14*=0x1600, lpOverlapped=0x0) returned 1 [0195.347] GetProcessHeap () returned 0x580000 [0195.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.347] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.347] WriteFile (in: hFile=0x42c, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x4fcff14*=0x1600, lpOverlapped=0x0) returned 1 [0195.348] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.348] WriteFile (in: hFile=0x42c, lpBuffer=0x6dea54f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea54f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0195.348] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.348] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0195.348] CloseHandle (hObject=0x42c) returned 1 [0195.348] GetProcessHeap () returned 0x580000 [0195.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0195.348] GetProcessHeap () returned 0x580000 [0195.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0195.348] GetProcessHeap () returned 0x580000 [0195.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac0d2bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1641, dwReserved0=0x4fcfd28, dwReserved1=0x6d035f8, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b97b0 [0195.348] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0198.014] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", len=0x44 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned 1 [0198.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0198.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0198.061] CloseHandle (hObject=0x4ac) returned 1 [0198.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.id_1622540890_.your_last_chance")) returned 1 [0198.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x80d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR47~2.YOU")) returned 0x5b97f0 [0198.062] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0198.062] GetProcessHeap () returned 0x580000 [0198.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80e1) returned 0x6fa4588 [0198.062] GetProcessHeap () returned 0x580000 [0198.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x80e1) returned 0x6d6ff38 [0198.062] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.062] ReadFile (in: hFile=0x4ac, lpBuffer=0x6fa4588, nNumberOfBytesToRead=0x80c0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa4588*, lpNumberOfBytesRead=0x4fcff14*=0x80c0, lpOverlapped=0x0) returned 1 [0198.797] GetProcessHeap () returned 0x580000 [0198.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0198.798] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.798] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d6ff38*, nNumberOfBytesToWrite=0x80c0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff38*, lpNumberOfBytesWritten=0x4fcff14*=0x80c0, lpOverlapped=0x0) returned 1 [0198.798] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.798] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d77ff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77ff7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0198.798] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.798] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0198.798] CloseHandle (hObject=0x4ac) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6ff38 | out: hHeap=0x580000) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa4588 | out: hHeap=0x580000) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0199.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae1b3ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x80fd, dwReserved0=0x4fcfd28, dwReserved1=0x6fa4588, cFileName="PDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR47~2.YOU")) returned 0x5b96b0 [0199.654] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.982] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", len=0x68 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned 1 [0200.982] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa8) returned 0x6f14048 [0200.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.824] CloseHandle (hObject=0x450) returned 1 [0201.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.id_1622540890_.your_last_chance")) returned 1 [0201.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc23, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b97b0 [0201.825] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.825] GetProcessHeap () returned 0x580000 [0201.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x677cd0 [0201.825] GetProcessHeap () returned 0x580000 [0201.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc41) returned 0x635768 [0201.825] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.825] ReadFile (in: hFile=0x450, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc20, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x4fcff14*=0xc20, lpOverlapped=0x0) returned 1 [0201.838] GetProcessHeap () returned 0x580000 [0201.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.838] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.838] WriteFile (in: hFile=0x450, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x4fcff14*=0xc20, lpOverlapped=0x0) returned 1 [0201.839] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.839] WriteFile (in: hFile=0x450, lpBuffer=0x636387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x636387*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0201.839] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.839] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0201.839] CloseHandle (hObject=0x450) returned 1 [0201.839] GetProcessHeap () returned 0x580000 [0201.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.839] GetProcessHeap () returned 0x580000 [0201.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0201.839] GetProcessHeap () returned 0x580000 [0201.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafeb67c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x4fcfd28, dwReserved1=0x677cd0, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b9770 [0202.801] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.961] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS", len=0x45 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS") returned 1 [0202.961] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0202.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0203.005] CloseHandle (hObject=0x478) returned 1 [0203.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css.id_1622540890_.your_last_chance")) returned 1 [0203.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128df600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x128df600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCD2CB~1.YOU")) returned 0x5b9770 [0203.006] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0203.006] GetProcessHeap () returned 0x580000 [0203.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72a2148 [0203.007] GetProcessHeap () returned 0x580000 [0203.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72b3978 [0203.007] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.007] ReadFile (in: hFile=0x478, lpBuffer=0x72a2148, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x72a2148*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.272] GetProcessHeap () returned 0x580000 [0209.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0209.272] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.272] WriteFile (in: hFile=0x478, lpBuffer=0x72b3978*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x72b3978*, lpNumberOfBytesWritten=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.273] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x478, lpBuffer=0x72c5177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5177*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0209.273] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.273] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0209.273] CloseHandle (hObject=0x478) returned 1 [0209.273] GetProcessHeap () returned 0x580000 [0209.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72b3978 | out: hHeap=0x580000) returned 1 [0209.655] GetProcessHeap () returned 0x580000 [0209.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72a2148 | out: hHeap=0x580000) returned 1 [0209.655] GetProcessHeap () returned 0x580000 [0209.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0209.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128df600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4587640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ee5c, dwReserved0=0x4fcfd28, dwReserved1=0x72a2148, cFileName="SCHEME24.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCD2CB~1.YOU")) returned 0x5b97f0 [0209.656] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.684] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0209.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0209.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0209.685] CloseHandle (hObject=0x3a8) returned 1 [0209.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0210.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0042, dwReserved1=0x4e004f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9830 [0210.080] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0210.080] GetProcessHeap () returned 0x580000 [0210.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0210.080] GetProcessHeap () returned 0x580000 [0210.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0210.080] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.080] ReadFile (in: hFile=0x3a8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0210.081] GetProcessHeap () returned 0x580000 [0210.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.081] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.081] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x4fcff14*=0xc0, lpOverlapped=0x0) returned 1 [0210.082] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.082] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0210.082] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.082] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0210.082] CloseHandle (hObject=0x3a8) returned 1 [0210.082] GetProcessHeap () returned 0x580000 [0210.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0210.082] GetProcessHeap () returned 0x580000 [0210.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0210.082] GetProcessHeap () returned 0x580000 [0210.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4d43dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x4fcfd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0214.552] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0216.358] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG", len=0x39 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 1 [0216.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0216.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0216.359] CloseHandle (hObject=0x450) returned 1 [0216.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0216.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id_1622540890_.your_last_chance")) returned 1 [0216.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0216.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe30400, ftCreationTime.dwHighDateTime=0x1c2a1b4, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fe30400, ftLastWriteTime.dwHighDateTime=0x1c2a1b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBO~1.YOU")) returned 0x5b97b0 [0216.360] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0216.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0216.361] GetProcessHeap () returned 0x580000 [0216.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f01) returned 0x6e0a140 [0216.361] GetProcessHeap () returned 0x580000 [0216.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2f01) returned 0x73070e8 [0216.361] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.361] ReadFile (in: hFile=0x450, lpBuffer=0x6e0a140, nNumberOfBytesToRead=0x2ee0, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0a140*, lpNumberOfBytesRead=0x4fcff14*=0x2ee0, lpOverlapped=0x0) returned 1 [0217.844] GetProcessHeap () returned 0x580000 [0217.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.844] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.844] WriteFile (in: hFile=0x450, lpBuffer=0x73070e8*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x73070e8*, lpNumberOfBytesWritten=0x4fcff14*=0x2ee0, lpOverlapped=0x0) returned 1 [0217.844] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.844] WriteFile (in: hFile=0x450, lpBuffer=0x7309fc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x7309fc7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0217.844] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.844] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0217.845] CloseHandle (hObject=0x450) returned 1 [0217.845] GetProcessHeap () returned 0x580000 [0217.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x73070e8 | out: hHeap=0x580000) returned 1 [0217.845] GetProcessHeap () returned 0x580000 [0217.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0a140 | out: hHeap=0x580000) returned 1 [0217.845] GetProcessHeap () returned 0x580000 [0217.845] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe30400, ftCreationTime.dwHighDateTime=0x1c2a1b4, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb975aa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f1c, dwReserved0=0x4fcfd28, dwReserved1=0x6e0a140, cFileName="MSPUB.OPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBO~1.YOU")) returned 0x5b9770 [0221.062] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.135] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", len=0x5d | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned 1 [0221.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0221.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.111] CloseHandle (hObject=0x440) returned 1 [0222.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.id_1622540890_.your_last_chance")) returned 1 [0222.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b96f0 [0222.363] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0222.363] GetProcessHeap () returned 0x580000 [0222.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0222.364] GetProcessHeap () returned 0x580000 [0222.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0222.364] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.364] ReadFile (in: hFile=0x440, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x4fcff14*=0x260, lpOverlapped=0x0) returned 1 [0222.368] GetProcessHeap () returned 0x580000 [0222.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0222.368] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.368] WriteFile (in: hFile=0x440, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x4fcff14*=0x260, lpOverlapped=0x0) returned 1 [0222.369] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.369] WriteFile (in: hFile=0x440, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0222.369] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.369] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0222.369] CloseHandle (hObject=0x440) returned 1 [0222.369] GetProcessHeap () returned 0x580000 [0222.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0222.369] GetProcessHeap () returned 0x580000 [0222.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0222.369] GetProcessHeap () returned 0x580000 [0222.369] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0223.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc27f940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x4fcfd28, dwReserved1=0x6c61120, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b96f0 [0223.792] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0226.361] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", len=0x59 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css") returned 1 [0226.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d98) returned 0x6dee6e0 [0226.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.369] CloseHandle (hObject=0x484) returned 1 [0226.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance")) returned 1 [0226.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x727, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9630 [0226.371] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.371] GetProcessHeap () returned 0x580000 [0226.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd9e78 [0226.371] GetProcessHeap () returned 0x580000 [0226.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dda600 [0226.371] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.371] ReadFile (in: hFile=0x484, lpBuffer=0x6dd9e78, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e78*, lpNumberOfBytesRead=0x4fcff14*=0x720, lpOverlapped=0x0) returned 1 [0226.433] GetProcessHeap () returned 0x580000 [0226.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.433] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.433] WriteFile (in: hFile=0x484, lpBuffer=0x6dda600*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6dda600*, lpNumberOfBytesWritten=0x4fcff14*=0x720, lpOverlapped=0x0) returned 1 [0226.433] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.433] WriteFile (in: hFile=0x484, lpBuffer=0x6ddad1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ddad1f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0226.433] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.433] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0226.433] CloseHandle (hObject=0x484) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dda600 | out: hHeap=0x580000) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd9e78 | out: hHeap=0x580000) returned 1 [0227.059] GetProcessHeap () returned 0x580000 [0227.059] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0230.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe7b1100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x4fcfd28, dwReserved1=0x6dd9e78, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9630 [0230.351] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.366] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", len=0x34 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned 1 [0230.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0230.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0230.366] CloseHandle (hObject=0x450) returned 1 [0230.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.367] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.id_1622540890_.your_last_chance")) returned 1 [0230.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.368] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCRVCD~1.YOU")) returned 0x5b9630 [0230.368] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ocrvc.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0230.368] GetProcessHeap () returned 0x580000 [0230.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa021) returned 0x6ff8ff8 [0230.368] GetProcessHeap () returned 0x580000 [0230.368] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa021) returned 0x70904c8 [0230.368] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.368] ReadFile (in: hFile=0x450, lpBuffer=0x6ff8ff8, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesRead=0x4fcff14*=0xa000, lpOverlapped=0x0) returned 1 [0235.751] GetProcessHeap () returned 0x580000 [0235.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0235.752] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x450, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0xa000, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x4fcff14*=0xa000, lpOverlapped=0x0) returned 1 [0235.752] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x450, lpBuffer=0x709a4c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x709a4c7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0235.752] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.752] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0235.753] CloseHandle (hObject=0x450) returned 1 [0235.753] GetProcessHeap () returned 0x580000 [0235.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0235.753] GetProcessHeap () returned 0x580000 [0235.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0235.754] GetProcessHeap () returned 0x580000 [0235.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0240.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc40a8740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa030, dwReserved0=0x4fcfd28, dwReserved1=0x6ff8ff8, cFileName="OCRVC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OCRVCD~1.YOU")) returned 0x5b9730 [0240.540] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.562] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML", len=0x4b | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned 1 [0240.563] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0240.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.589] CloseHandle (hObject=0x45c) returned 1 [0240.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml.id_1622540890_.your_last_chance")) returned 1 [0240.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOI~2.YOU")) returned 0x5b9730 [0240.590] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.590] GetProcessHeap () returned 0x580000 [0240.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08130 [0240.590] GetProcessHeap () returned 0x580000 [0240.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08498 [0240.591] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.591] ReadFile (in: hFile=0x45c, lpBuffer=0x6d08130, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08130*, lpNumberOfBytesRead=0x4fcff14*=0x320, lpOverlapped=0x0) returned 1 [0240.612] GetProcessHeap () returned 0x580000 [0240.612] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0240.612] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.612] WriteFile (in: hFile=0x45c, lpBuffer=0x6d08498*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08498*, lpNumberOfBytesWritten=0x4fcff14*=0x320, lpOverlapped=0x0) returned 1 [0240.612] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.612] WriteFile (in: hFile=0x45c, lpBuffer=0x6d087b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087b7*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0240.612] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.613] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0240.613] CloseHandle (hObject=0x45c) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08498 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08130 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0241.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6eed2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x4fcfd28, dwReserved1=0x6d08130, cFileName="YAHOO.IE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOI~2.YOU")) returned 0x5b9630 [0241.671] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.686] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML", len=0x3f | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned 1 [0241.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0241.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0241.722] CloseHandle (hObject=0x420) returned 1 [0241.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml.id_1622540890_.your_last_chance")) returned 1 [0241.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6daa00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6daa00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~2.YOU")) returned 0x5b9630 [0241.724] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0241.724] GetProcessHeap () returned 0x580000 [0241.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0241.724] GetProcessHeap () returned 0x580000 [0241.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0241.724] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.724] ReadFile (in: hFile=0x420, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x4fcff14*=0x760, lpOverlapped=0x0) returned 1 [0241.738] GetProcessHeap () returned 0x580000 [0241.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.738] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.738] WriteFile (in: hFile=0x420, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x4fcff14*=0x760, lpOverlapped=0x0) returned 1 [0241.738] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.738] WriteFile (in: hFile=0x420, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0241.738] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.738] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0241.738] CloseHandle (hObject=0x420) returned 1 [0241.739] GetProcessHeap () returned 0x580000 [0241.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0241.739] GetProcessHeap () returned 0x580000 [0241.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0241.739] GetProcessHeap () returned 0x580000 [0241.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6daa00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc79c9740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7a0, dwReserved0=0x4fcfd28, dwReserved1=0x6ef3020, cFileName="PGMN096.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~2.YOU")) returned 0x5b9630 [0241.739] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.779] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML", len=0x3f | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned 1 [0241.779] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0241.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0241.816] CloseHandle (hObject=0x420) returned 1 [0241.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.817] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml.id_1622540890_.your_last_chance")) returned 1 [0241.817] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc44d00, ftCreationTime.dwHighDateTime=0x1c6b4fb, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fc44d00, ftLastWriteTime.dwHighDateTime=0x1c6b4fb, nFileSizeHigh=0x0, nFileSizeLow=0xa246, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG480D~1.YOU")) returned 0x5b9630 [0241.818] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0241.818] GetProcessHeap () returned 0x580000 [0241.818] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa261) returned 0x6e21520 [0241.819] GetProcessHeap () returned 0x580000 [0241.819] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa261) returned 0x6e2b790 [0241.819] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.819] ReadFile (in: hFile=0x420, lpBuffer=0x6e21520, nNumberOfBytesToRead=0xa240, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x4fcff14*=0xa240, lpOverlapped=0x0) returned 1 [0243.843] GetProcessHeap () returned 0x580000 [0243.843] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0243.843] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.843] WriteFile (in: hFile=0x420, lpBuffer=0x6e2b790*, nNumberOfBytesToWrite=0xa240, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2b790*, lpNumberOfBytesWritten=0x4fcff14*=0xa240, lpOverlapped=0x0) returned 1 [0243.843] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.843] WriteFile (in: hFile=0x420, lpBuffer=0x6e359cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6e359cf*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0243.843] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.844] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0243.844] CloseHandle (hObject=0x420) returned 1 [0244.228] GetProcessHeap () returned 0x580000 [0244.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e2b790 | out: hHeap=0x580000) returned 1 [0244.228] GetProcessHeap () returned 0x580000 [0244.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0244.229] GetProcessHeap () returned 0x580000 [0244.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0248.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc44d00, ftCreationTime.dwHighDateTime=0x1c6b4fb, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8db8f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa26a, dwReserved0=0x4fcfd28, dwReserved1=0x6e21520, cFileName="PGMN090.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG480D~1.YOU")) returned 0x5b9630 [0248.294] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.353] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR", len=0x3b | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 1 [0248.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0248.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.387] CloseHandle (hObject=0x3b4) returned 1 [0248.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.id_1622540890_.your_last_chance")) returned 1 [0248.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x7f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB6~1.YOU")) returned 0x5b9730 [0248.388] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0248.388] GetProcessHeap () returned 0x580000 [0248.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x71080c8 [0248.388] GetProcessHeap () returned 0x580000 [0248.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x6ead008 [0248.389] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.389] ReadFile (in: hFile=0x3b4, lpBuffer=0x71080c8, nNumberOfBytesToRead=0x7f40, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x71080c8*, lpNumberOfBytesRead=0x4fcff14*=0x7f40, lpOverlapped=0x0) returned 1 [0250.216] GetProcessHeap () returned 0x580000 [0250.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0250.216] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.216] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ead008*, nNumberOfBytesToWrite=0x7f40, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead008*, lpNumberOfBytesWritten=0x4fcff14*=0x7f40, lpOverlapped=0x0) returned 1 [0250.216] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.216] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eb4f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb4f47*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0250.216] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.217] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0250.217] CloseHandle (hObject=0x3b4) returned 1 [0250.217] GetProcessHeap () returned 0x580000 [0250.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead008 | out: hHeap=0x580000) returned 1 [0250.217] GetProcessHeap () returned 0x580000 [0250.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71080c8 | out: hHeap=0x580000) returned 1 [0250.217] GetProcessHeap () returned 0x580000 [0250.217] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca921e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7f6a, dwReserved0=0x4fcfd28, dwReserved1=0x71080c8, cFileName="MSPUB6.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB6~1.YOU")) returned 0x5b9730 [0253.680] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.434] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC", len=0x3e | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC") returned 1 [0254.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd8) returned 0x72e5948 [0254.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0260.524] CloseHandle (hObject=0x43c) returned 1 [0260.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc.id_1622540890_.your_last_chance")) returned 1 [0260.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdd400, ftCreationTime.dwHighDateTime=0x1c513d0, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadcdd400, ftLastWriteTime.dwHighDateTime=0x1c513d0, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILM~1.YOU")) returned 0x5b9630 [0260.554] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0260.554] GetProcessHeap () returned 0x580000 [0260.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x704a698 [0260.555] GetProcessHeap () returned 0x580000 [0260.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x679ae0 [0260.555] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.555] ReadFile (in: hFile=0x43c, lpBuffer=0x704a698, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x704a698*, lpNumberOfBytesRead=0x4fcff14*=0x2a40, lpOverlapped=0x0) returned 1 [0260.593] GetProcessHeap () returned 0x580000 [0260.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.593] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.593] WriteFile (in: hFile=0x43c, lpBuffer=0x679ae0*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x679ae0*, lpNumberOfBytesWritten=0x4fcff14*=0x2a40, lpOverlapped=0x0) returned 1 [0260.593] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.593] WriteFile (in: hFile=0x43c, lpBuffer=0x67c51f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x67c51f*, lpNumberOfBytesWritten=0x4fcff14*=0x20, lpOverlapped=0x0) returned 1 [0260.593] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.593] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x4fcff14*=0x4, lpOverlapped=0x0) returned 1 [0260.593] CloseHandle (hObject=0x43c) returned 1 [0260.593] GetProcessHeap () returned 0x580000 [0260.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x679ae0 | out: hHeap=0x580000) returned 1 [0260.593] GetProcessHeap () returned 0x580000 [0260.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704a698 | out: hHeap=0x580000) returned 1 [0260.593] GetProcessHeap () returned 0x580000 [0260.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfccc | out: lpFindFileData=0x4fcfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdd400, ftCreationTime.dwHighDateTime=0x1c513d0, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2d81440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a66, dwReserved0=0x4fcfd28, dwReserved1=0x704a698, cFileName="EMAILMOD.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILM~1.YOU")) returned 0x5b9630 [0260.594] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.424] SysReAllocStringLen (in: pbstr=0x4fcff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", len=0x34 | out: pbstr=0x4fcff84*="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM") returned 1 [0262.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0262.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0266.061] CloseHandle (hObject=0x4a0) returned 1 [0266.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0266.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.id_1622540890_.your_last_chance")) returned 1 [0266.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x4fcef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0266.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x4fcfc74 | out: lpFindFileData=0x4fcfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b753100, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b753100, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x353f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWOP.ICM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSWOPI~1.YOU")) returned 0x5b96f0 [0266.064] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0266.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\rswop.icm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0266.064] GetProcessHeap () returned 0x580000 [0266.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70963f8 [0266.065] GetProcessHeap () returned 0x580000 [0266.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72bb898 [0266.065] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0266.065] ReadFile (in: hFile=0x4a0, lpBuffer=0x70963f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x4fcff14, lpOverlapped=0x0 | out: lpBuffer=0x70963f8*, lpNumberOfBytesRead=0x4fcff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 41 os_tid = 0xa9c [0039.067] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.612] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.839] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.923] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.510] Sleep (dwMilliseconds=0x1) [0042.547] Sleep (dwMilliseconds=0x1) [0042.645] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.814] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.010] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.100] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.389] Sleep (dwMilliseconds=0x1) [0043.405] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.467] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.794] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.527] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.636] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.683] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.776] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.932] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.088] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.260] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.400] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.525] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.728] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.837] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.886] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.040] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.149] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.202] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.383] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.461] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.695] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.773] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.053] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.084] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.209] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.240] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.271] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.365] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.505] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.739] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.051] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.254] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.410] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.785] Sleep (dwMilliseconds=0x1) [0048.800] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.956] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.580] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.736] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.017] Sleep (dwMilliseconds=0x1) [0050.033] Sleep (dwMilliseconds=0x1) [0050.048] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.222] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.563] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.657] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.859] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.062] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.421] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.809] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.918] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.091] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.433] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.698] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.854] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.901] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.932] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.214] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.244] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.634] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.712] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.759] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.790] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.200] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.322] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.562] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.586] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.851] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0061.799] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x510ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0061.800] GetProcessHeap () returned 0x580000 [0061.800] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x48) returned 0x5b5bc8 [0061.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0070.281] CloseHandle (hObject=0x46c) returned 1 [0070.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0070.282] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance")) returned 1 [0071.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0071.951] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b9770 [0071.951] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0071.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0071.952] GetProcessHeap () returned 0x580000 [0071.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c57108 [0071.953] GetProcessHeap () returned 0x580000 [0071.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c68938 [0071.953] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0071.953] ReadFile (in: hFile=0x46c, lpBuffer=0x6c57108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0075.371] GetProcessHeap () returned 0x580000 [0075.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0075.371] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.371] WriteFile (in: hFile=0x46c, lpBuffer=0x6c68938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68938*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0075.372] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.372] WriteFile (in: hFile=0x46c, lpBuffer=0x6c7a137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a137*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0075.973] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.973] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0075.973] CloseHandle (hObject=0x46c) returned 1 [0075.973] GetProcessHeap () returned 0x580000 [0075.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c68938 | out: hHeap=0x580000) returned 1 [0075.973] GetProcessHeap () returned 0x580000 [0075.973] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0075.976] GetProcessHeap () returned 0x580000 [0075.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0079.341] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x64e69240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaec5e, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="pkeyconfig-office.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PKEYCO~1.YOU")) returned 0x5b96f0 [0079.341] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.534] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", len=0x6a | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 1 [0079.534] GetProcessHeap () returned 0x580000 [0079.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0079.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0079.551] CloseHandle (hObject=0x170) returned 1 [0079.551] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.551] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id_1622540890_.your_last_chance")) returned 1 [0079.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b96f0 [0079.552] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.552] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0079.552] GetProcessHeap () returned 0x580000 [0079.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6f0a090 [0079.552] GetProcessHeap () returned 0x580000 [0079.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x5f3a40 [0079.552] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.552] ReadFile (in: hFile=0x170, lpBuffer=0x6f0a090, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a090*, lpNumberOfBytesRead=0x510ff14*=0x380, lpOverlapped=0x0) returned 1 [0079.557] GetProcessHeap () returned 0x580000 [0079.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.557] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x170, lpBuffer=0x5f3a40*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3a40*, lpNumberOfBytesWritten=0x510ff14*=0x380, lpOverlapped=0x0) returned 1 [0079.557] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x170, lpBuffer=0x5f3dbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3dbf*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.557] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.557] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.557] CloseHandle (hObject=0x170) returned 1 [0079.558] GetProcessHeap () returned 0x580000 [0079.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3a40 | out: hHeap=0x580000) returned 1 [0079.558] GetProcessHeap () returned 0x580000 [0079.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a090 | out: hHeap=0x580000) returned 1 [0079.558] GetProcessHeap () returned 0x580000 [0079.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6707ad20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x510fd28, dwReserved1=0x6f0a090, cFileName="GrooveMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b96f0 [0079.558] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.717] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", len=0x69 | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 1 [0080.717] GetProcessHeap () returned 0x580000 [0080.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x18) returned 0x5a58e8 [0080.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0080.738] CloseHandle (hObject=0x478) returned 1 [0080.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.739] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id_1622540890_.your_last_chance")) returned 1 [0080.739] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSCONF~1.YOU")) returned 0x5b96f0 [0080.740] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0080.740] GetProcessHeap () returned 0x580000 [0080.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9341) returned 0x6d1d4e8 [0080.740] GetProcessHeap () returned 0x580000 [0080.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9341) returned 0x6d26838 [0080.740] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.740] ReadFile (in: hFile=0x478, lpBuffer=0x6d1d4e8, nNumberOfBytesToRead=0x9320, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1d4e8*, lpNumberOfBytesRead=0x510ff14*=0x9320, lpOverlapped=0x0) returned 1 [0081.523] GetProcessHeap () returned 0x580000 [0081.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0081.523] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] WriteFile (in: hFile=0x478, lpBuffer=0x6d26838*, nNumberOfBytesToWrite=0x9320, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d26838*, lpNumberOfBytesWritten=0x510ff14*=0x9320, lpOverlapped=0x0) returned 1 [0081.523] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] WriteFile (in: hFile=0x478, lpBuffer=0x6d2fb57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2fb57*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.523] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.523] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.523] CloseHandle (hObject=0x478) returned 1 [0081.556] GetProcessHeap () returned 0x580000 [0081.556] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d26838 | out: hHeap=0x580000) returned 1 [0081.557] GetProcessHeap () returned 0x580000 [0081.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1d4e8 | out: hHeap=0x580000) returned 1 [0081.557] GetProcessHeap () returned 0x580000 [0081.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0081.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x68339a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x935d, dwReserved0=0x510fd28, dwReserved1=0x6d1d4e8, cFileName="PSCONFIG.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSCONF~1.YOU")) returned 0x5b96f0 [0081.628] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.351] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", len=0x70 | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 1 [0083.351] GetProcessHeap () returned 0x580000 [0083.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0083.352] CloseHandle (hObject=0x490) returned 1 [0083.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id_1622540890_.your_last_chance")) returned 1 [0083.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x490055, dwReserved1=0x58002e, cFileName="PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~1.YOU")) returned 0x5b96f0 [0083.353] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0083.353] GetProcessHeap () returned 0x580000 [0083.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f09b60 [0083.353] GetProcessHeap () returned 0x580000 [0083.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c78e08 [0083.353] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.353] ReadFile (in: hFile=0x490, lpBuffer=0x6f09b60, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b60*, lpNumberOfBytesRead=0x510ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0083.361] GetProcessHeap () returned 0x580000 [0083.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0083.361] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.361] WriteFile (in: hFile=0x490, lpBuffer=0x6c78e08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78e08*, lpNumberOfBytesWritten=0x510ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0083.361] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.361] WriteFile (in: hFile=0x490, lpBuffer=0x6c793a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c793a7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.361] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.361] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.361] CloseHandle (hObject=0x490) returned 1 [0083.361] GetProcessHeap () returned 0x580000 [0083.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c78e08 | out: hHeap=0x580000) returned 1 [0083.361] GetProcessHeap () returned 0x580000 [0083.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b60 | out: hHeap=0x580000) returned 1 [0083.361] GetProcessHeap () returned 0x580000 [0083.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0083.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x694c7ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0x510fd28, dwReserved1=0x6f09b60, cFileName="PublisherMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIS~1.YOU")) returned 0x5b96f0 [0083.362] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.971] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", len=0x4c | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 1 [0085.971] GetProcessHeap () returned 0x580000 [0085.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x64) returned 0x614a48 [0085.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.972] Sleep (dwMilliseconds=0x1) [0086.368] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", len=0x49 | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 1 [0086.368] GetProcessHeap () returned 0x580000 [0086.368] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0086.377] CloseHandle (hObject=0x480) returned 1 [0086.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id_1622540890_.your_last_chance")) returned 1 [0086.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARCTIC~2.YOU")) returned 0x5b96f0 [0086.378] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0086.378] GetProcessHeap () returned 0x580000 [0086.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10fe1) returned 0x656170 [0086.378] GetProcessHeap () returned 0x580000 [0086.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10fe1) returned 0x6c57108 [0086.379] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.379] ReadFile (in: hFile=0x480, lpBuffer=0x656170, nNumberOfBytesToRead=0x10fc0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x656170*, lpNumberOfBytesRead=0x510ff14*=0x10fc0, lpOverlapped=0x0) returned 1 [0089.693] GetProcessHeap () returned 0x580000 [0089.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0089.693] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.693] WriteFile (in: hFile=0x480, lpBuffer=0x6c57108*, nNumberOfBytesToWrite=0x10fc0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesWritten=0x510ff14*=0x10fc0, lpOverlapped=0x0) returned 1 [0089.694] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.694] WriteFile (in: hFile=0x480, lpBuffer=0x6c680c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c680c7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0089.694] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.694] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0089.694] CloseHandle (hObject=0x480) returned 1 [0089.695] GetProcessHeap () returned 0x580000 [0089.695] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0089.695] GetProcessHeap () returned 0x580000 [0089.695] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656170 | out: hHeap=0x580000) returned 1 [0089.695] GetProcessHeap () returned 0x580000 [0089.695] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0089.695] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d12eae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10feb, dwReserved0=0x510fd28, dwReserved1=0x656170, cFileName="ARCTIC.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ARCTIC~2.YOU")) returned 0x5b96b0 [0089.695] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.183] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", len=0x4b | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 1 [0092.183] GetProcessHeap () returned 0x580000 [0092.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x70) returned 0x6f1af38 [0092.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.195] CloseHandle (hObject=0x448) returned 1 [0092.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.195] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id_1622540890_.your_last_chance")) returned 1 [0092.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x45, dwReserved1=0x0, cFileName="PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPYRU~1.YOU")) returned 0x5b96b0 [0092.196] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0092.196] GetProcessHeap () returned 0x580000 [0092.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60c210 [0092.196] GetProcessHeap () returned 0x580000 [0092.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60b970 [0092.196] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.196] ReadFile (in: hFile=0x448, lpBuffer=0x60c210, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x60c210*, lpNumberOfBytesRead=0x510ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0092.199] GetProcessHeap () returned 0x580000 [0092.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.199] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.199] WriteFile (in: hFile=0x448, lpBuffer=0x60b970*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x60b970*, lpNumberOfBytesWritten=0x510ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0092.199] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.199] WriteFile (in: hFile=0x448, lpBuffer=0x60bb4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x60bb4f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.199] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.199] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.199] CloseHandle (hObject=0x448) returned 1 [0092.200] GetProcessHeap () returned 0x580000 [0092.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60b970 | out: hHeap=0x580000) returned 1 [0092.200] GetProcessHeap () returned 0x580000 [0092.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c210 | out: hHeap=0x580000) returned 1 [0092.200] GetProcessHeap () returned 0x580000 [0092.200] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e922840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x510fd28, dwReserved1=0x60c210, cFileName="PAPYRUS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPYRU~1.YOU")) returned 0x5b96f0 [0092.412] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.417] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 1 [0092.417] GetProcessHeap () returned 0x580000 [0092.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0092.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0092.417] CloseHandle (hObject=0x418) returned 1 [0092.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0092.432] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0092.432] GetProcessHeap () returned 0x580000 [0092.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xed41) returned 0x6edf9f8 [0092.432] GetProcessHeap () returned 0x580000 [0092.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xed41) returned 0x6eee748 [0092.432] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.432] ReadFile (in: hFile=0x418, lpBuffer=0x6edf9f8, nNumberOfBytesToRead=0xed20, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6edf9f8*, lpNumberOfBytesRead=0x510ff14*=0xed20, lpOverlapped=0x0) returned 1 [0098.695] GetProcessHeap () returned 0x580000 [0098.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.696] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.696] WriteFile (in: hFile=0x418, lpBuffer=0x6eee748*, nNumberOfBytesToWrite=0xed20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eee748*, lpNumberOfBytesWritten=0x510ff14*=0xed20, lpOverlapped=0x0) returned 1 [0098.696] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.696] WriteFile (in: hFile=0x418, lpBuffer=0x6efd467*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efd467*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.696] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.696] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.696] CloseHandle (hObject=0x418) returned 1 [0098.696] GetProcessHeap () returned 0x580000 [0098.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eee748 | out: hHeap=0x580000) returned 1 [0098.696] GetProcessHeap () returned 0x580000 [0098.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6edf9f8 | out: hHeap=0x580000) returned 1 [0098.697] GetProcessHeap () returned 0x580000 [0098.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72706440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xed58, dwReserved0=0x510fd28, dwReserved1=0x6edf9f8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0098.697] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.806] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", len=0x4a | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 1 [0101.806] GetProcessHeap () returned 0x580000 [0101.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0101.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0101.807] CloseHandle (hObject=0x4b0) returned 1 [0101.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0101.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.808] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0101.808] GetProcessHeap () returned 0x580000 [0101.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6c676b8 [0101.808] GetProcessHeap () returned 0x580000 [0101.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6d32388 [0101.808] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.808] ReadFile (in: hFile=0x4b0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x9c0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x510ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0101.838] GetProcessHeap () returned 0x580000 [0101.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.838] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x4b0, lpBuffer=0x6d32388*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d32388*, lpNumberOfBytesWritten=0x510ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0101.838] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.838] WriteFile (in: hFile=0x4b0, lpBuffer=0x6d32d47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d32d47*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.838] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.839] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.839] CloseHandle (hObject=0x4b0) returned 1 [0101.839] GetProcessHeap () returned 0x580000 [0101.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d32388 | out: hHeap=0x580000) returned 1 [0101.839] GetProcessHeap () returned 0x580000 [0101.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0101.839] GetProcessHeap () returned 0x580000 [0101.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74513a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa03, dwReserved0=0x510fd28, dwReserved1=0x6c676b8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.839] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0102.330] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", len=0x49 | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 1 [0102.330] GetProcessHeap () returned 0x580000 [0102.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0102.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0102.331] CloseHandle (hObject=0x41c) returned 1 [0102.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id_1622540890_.your_last_chance")) returned 1 [0102.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1EN~1.YOU")) returned 0x5b9630 [0102.332] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0102.332] GetProcessHeap () returned 0x580000 [0102.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dd3a60 [0102.332] GetProcessHeap () returned 0x580000 [0102.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de5290 [0102.332] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.332] ReadFile (in: hFile=0x41c, lpBuffer=0x6dd3a60, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a60*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.713] GetProcessHeap () returned 0x580000 [0105.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0105.714] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.714] WriteFile (in: hFile=0x41c, lpBuffer=0x6de5290*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5290*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.714] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.714] WriteFile (in: hFile=0x41c, lpBuffer=0x6df6a8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a8f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.064] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.065] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.066] CloseHandle (hObject=0x41c) returned 1 [0106.066] GetProcessHeap () returned 0x580000 [0106.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5290 | out: hHeap=0x580000) returned 1 [0106.066] GetProcessHeap () returned 0x580000 [0106.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd3a60 | out: hHeap=0x580000) returned 1 [0106.066] GetProcessHeap () returned 0x580000 [0106.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0106.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76d64ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe64fe, dwReserved0=0x510fd28, dwReserved1=0x6dd3a60, cFileName="MSB1ENFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1EN~1.YOU")) returned 0x5b96b0 [0106.066] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.874] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", len=0x4d | out: pbstr=0x510ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 1 [0106.874] GetProcessHeap () returned 0x580000 [0106.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f420, Size=0x28) returned 0x5dc550 [0106.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0107.724] CloseHandle (hObject=0x45c) returned 1 [0107.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.724] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id_1622540890_.your_last_chance")) returned 1 [0107.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHTGTX~1.YOU")) returned 0x5b9730 [0107.725] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0107.725] GetProcessHeap () returned 0x580000 [0107.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0107.727] GetProcessHeap () returned 0x580000 [0107.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d458e0 [0107.727] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.727] ReadFile (in: hFile=0x45c, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.675] GetProcessHeap () returned 0x580000 [0111.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0111.676] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.676] WriteFile (in: hFile=0x45c, lpBuffer=0x6d458e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.676] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.676] WriteFile (in: hFile=0x45c, lpBuffer=0x6d570df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d570df*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.763] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.763] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.764] CloseHandle (hObject=0x45c) returned 1 [0111.764] GetProcessHeap () returned 0x580000 [0111.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0111.764] GetProcessHeap () returned 0x580000 [0111.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0111.765] GetProcessHeap () returned 0x580000 [0111.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0111.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a3b2480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9e437, dwReserved0=0x510fd28, dwReserved1=0x6d340b0, cFileName="WHTGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHTGTX~1.YOU")) returned 0x5b95f0 [0111.765] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0112.048] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", len=0x45 | out: pbstr=0x510ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 1 [0112.049] GetProcessHeap () returned 0x580000 [0112.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x3c) returned 0x61ab70 [0112.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.067] Sleep (dwMilliseconds=0x1) [0112.190] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.206] Sleep (dwMilliseconds=0x1) [0112.314] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", len=0x51 | out: pbstr=0x510ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned 1 [0112.315] GetProcessHeap () returned 0x580000 [0112.315] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x48) returned 0x596cd8 [0112.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.328] Sleep (dwMilliseconds=0x1) [0113.330] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", len=0x3f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 1 [0113.330] GetProcessHeap () returned 0x580000 [0113.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xa4) returned 0x6f0ceb8 [0113.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.481] CloseHandle (hObject=0x39c) returned 1 [0113.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0093~1.YOU")) returned 0x5b9630 [0114.552] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0114.552] GetProcessHeap () returned 0x580000 [0114.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3861) returned 0x658170 [0114.552] GetProcessHeap () returned 0x580000 [0114.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3861) returned 0x65b9e0 [0114.552] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.552] ReadFile (in: hFile=0x39c, lpBuffer=0x658170, nNumberOfBytesToRead=0x3840, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x658170*, lpNumberOfBytesRead=0x510ff14*=0x3840, lpOverlapped=0x0) returned 1 [0116.681] GetProcessHeap () returned 0x580000 [0116.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.681] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.681] WriteFile (in: hFile=0x39c, lpBuffer=0x65b9e0*, nNumberOfBytesToWrite=0x3840, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65b9e0*, lpNumberOfBytesWritten=0x510ff14*=0x3840, lpOverlapped=0x0) returned 1 [0116.681] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.681] WriteFile (in: hFile=0x39c, lpBuffer=0x65f21f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f21f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.682] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.682] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.682] CloseHandle (hObject=0x39c) returned 1 [0116.682] GetProcessHeap () returned 0x580000 [0116.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65b9e0 | out: hHeap=0x580000) returned 1 [0116.682] GetProcessHeap () returned 0x580000 [0116.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658170 | out: hHeap=0x580000) returned 1 [0116.682] GetProcessHeap () returned 0x580000 [0116.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d28f5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3880, dwReserved0=0x510fd28, dwReserved1=0x658170, cFileName="AN00932_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0093~1.YOU")) returned 0x5b9630 [0117.995] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0118.701] CloseHandle (hObject=0x4a4) returned 1 [0118.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~3.YOU")) returned 0x5b9730 [0118.702] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0118.702] GetProcessHeap () returned 0x580000 [0118.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4321) returned 0x6c61108 [0118.702] GetProcessHeap () returned 0x580000 [0118.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4321) returned 0x6c75898 [0118.703] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.703] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c61108, nNumberOfBytesToRead=0x4300, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesRead=0x510ff14*=0x4300, lpOverlapped=0x0) returned 1 [0119.334] GetProcessHeap () returned 0x580000 [0119.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0119.334] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.334] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c75898*, nNumberOfBytesToWrite=0x4300, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75898*, lpNumberOfBytesWritten=0x510ff14*=0x4300, lpOverlapped=0x0) returned 1 [0119.334] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.334] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c79b97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79b97*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.334] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.334] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.334] CloseHandle (hObject=0x4a4) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75898 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0119.685] GetProcessHeap () returned 0x580000 [0119.685] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ebd9f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x510fd28, dwReserved1=0x6c61108, cFileName="SO02791_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0279~3.YOU")) returned 0x5b96f0 [0120.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.157] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", len=0x4c | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 1 [0120.157] GetProcessHeap () returned 0x580000 [0120.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x178c) returned 0x6d06ca8 [0120.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.781] CloseHandle (hObject=0x48c) returned 1 [0120.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.id_1622540890_.your_last_chance")) returned 1 [0121.355] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J0861B~1.YOU")) returned 0x5b9730 [0121.355] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0121.355] GetProcessHeap () returned 0x580000 [0121.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b81) returned 0x6e063d0 [0121.355] GetProcessHeap () returned 0x580000 [0121.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b81) returned 0x6cfecd8 [0121.356] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.356] ReadFile (in: hFile=0x48c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x1b60, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x510ff14*=0x1b60, lpOverlapped=0x0) returned 1 [0121.381] GetProcessHeap () returned 0x580000 [0121.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.381] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.381] WriteFile (in: hFile=0x48c, lpBuffer=0x6cfecd8*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfecd8*, lpNumberOfBytesWritten=0x510ff14*=0x1b60, lpOverlapped=0x0) returned 1 [0121.381] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.381] WriteFile (in: hFile=0x48c, lpBuffer=0x6d00837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00837*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.381] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.381] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.381] CloseHandle (hObject=0x48c) returned 1 [0121.381] GetProcessHeap () returned 0x580000 [0121.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfecd8 | out: hHeap=0x580000) returned 1 [0121.381] GetProcessHeap () returned 0x580000 [0121.381] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0121.382] GetProcessHeap () returned 0x580000 [0121.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ff57380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ba3, dwReserved0=0x510fd28, dwReserved1=0x6e063d0, cFileName="J0143753.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J0861B~1.YOU")) returned 0x5b9730 [0121.912] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.554] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", len=0x4a | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned 1 [0122.554] GetProcessHeap () returned 0x580000 [0122.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x195c) returned 0x6f42f08 [0122.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0122.605] CloseHandle (hObject=0x454) returned 1 [0122.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.id_1622540890_.your_last_chance")) returned 1 [0125.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEX~1.YOU")) returned 0x5b9730 [0125.459] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0125.459] GetProcessHeap () returned 0x580000 [0125.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0125.459] GetProcessHeap () returned 0x580000 [0125.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0125.459] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.459] ReadFile (in: hFile=0x454, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x510ff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.473] GetProcessHeap () returned 0x580000 [0125.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.473] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.473] WriteFile (in: hFile=0x454, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x510ff14*=0xe00, lpOverlapped=0x0) returned 1 [0125.473] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.473] WriteFile (in: hFile=0x454, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.473] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.473] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.473] CloseHandle (hObject=0x454) returned 1 [0125.473] GetProcessHeap () returned 0x580000 [0125.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0125.473] GetProcessHeap () returned 0x580000 [0125.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0125.474] GetProcessHeap () returned 0x580000 [0125.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82677d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe38, dwReserved0=0x510fd28, dwReserved1=0x6f69420, cFileName="Verve.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERVEX~1.YOU")) returned 0x5b9730 [0125.474] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.490] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", len=0x3d | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned 1 [0125.490] GetProcessHeap () returned 0x580000 [0125.490] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f4) returned 0x667250 [0125.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0128.616] CloseHandle (hObject=0x428) returned 1 [0128.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03052~1.YOU")) returned 0x5b9730 [0130.807] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0130.807] GetProcessHeap () returned 0x580000 [0130.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b01) returned 0x6e42840 [0130.808] GetProcessHeap () returned 0x580000 [0130.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b01) returned 0x6e48350 [0130.808] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.808] ReadFile (in: hFile=0x428, lpBuffer=0x6e42840, nNumberOfBytesToRead=0x5ae0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e42840*, lpNumberOfBytesRead=0x510ff14*=0x5ae0, lpOverlapped=0x0) returned 1 [0131.872] GetProcessHeap () returned 0x580000 [0131.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0131.872] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.872] WriteFile (in: hFile=0x428, lpBuffer=0x6e48350*, nNumberOfBytesToWrite=0x5ae0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e48350*, lpNumberOfBytesWritten=0x510ff14*=0x5ae0, lpOverlapped=0x0) returned 1 [0131.872] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.872] WriteFile (in: hFile=0x428, lpBuffer=0x6e4de2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4de2f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.872] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.872] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.872] CloseHandle (hObject=0x428) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e48350 | out: hHeap=0x580000) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e42840 | out: hHeap=0x580000) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x863770e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b14, dwReserved0=0x510fd28, dwReserved1=0x6e42840, cFileName="J0305257.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03052~1.YOU")) returned 0x5b96f0 [0135.293] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.293] Sleep (dwMilliseconds=0x1) [0135.303] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", len=0x43 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned 1 [0135.303] GetProcessHeap () returned 0x580000 [0135.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.249] CloseHandle (hObject=0x470) returned 1 [0139.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bc3b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97bc3b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2144~1.YOU")) returned 0x5b97b0 [0139.822] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.822] GetProcessHeap () returned 0x580000 [0139.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0139.822] GetProcessHeap () returned 0x580000 [0139.822] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0139.822] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.822] ReadFile (in: hFile=0x470, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x510ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.824] GetProcessHeap () returned 0x580000 [0139.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.824] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.824] WriteFile (in: hFile=0x470, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x510ff14*=0x100, lpOverlapped=0x0) returned 1 [0139.824] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.825] WriteFile (in: hFile=0x470, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.825] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.825] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.825] CloseHandle (hObject=0x470) returned 1 [0139.825] GetProcessHeap () returned 0x580000 [0139.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0139.825] GetProcessHeap () returned 0x580000 [0139.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0139.825] GetProcessHeap () returned 0x580000 [0139.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bc3b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8af56e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x510fd28, dwReserved1=0x6f0a9f0, cFileName="BD21448_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2144~1.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.175] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", len=0x52 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css") returned 1 [0140.175] GetProcessHeap () returned 0x580000 [0140.175] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0140.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.204] CloseHandle (hObject=0x3a8) returned 1 [0140.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.id_1622540890_.your_last_chance")) returned 1 [0140.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b9770 [0140.205] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.205] GetProcessHeap () returned 0x580000 [0140.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdc1) returned 0x635768 [0140.205] GetProcessHeap () returned 0x580000 [0140.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdc1) returned 0x6c29878 [0140.205] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.205] ReadFile (in: hFile=0x3a8, lpBuffer=0x635768, nNumberOfBytesToRead=0xda0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x510ff14*=0xda0, lpOverlapped=0x0) returned 1 [0140.278] GetProcessHeap () returned 0x580000 [0140.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.278] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.278] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x510ff14*=0xda0, lpOverlapped=0x0) returned 1 [0140.278] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.278] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c2a617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a617*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.278] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.278] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.278] CloseHandle (hObject=0x3a8) returned 1 [0140.278] GetProcessHeap () returned 0x580000 [0140.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.278] GetProcessHeap () returned 0x580000 [0140.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0140.278] GetProcessHeap () returned 0x580000 [0140.278] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3a7600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xde3, dwReserved0=0x510fd28, dwReserved1=0x635768, cFileName="Slate.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEC~1.YOU")) returned 0x5b9770 [0140.663] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.673] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", len=0x43 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned 1 [0140.673] GetProcessHeap () returned 0x580000 [0140.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d98) returned 0x6f14048 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.038] CloseHandle (hObject=0x4a0) returned 1 [0141.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1476~2.YOU")) returned 0x5b9730 [0141.039] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.039] GetProcessHeap () returned 0x580000 [0141.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0141.039] GetProcessHeap () returned 0x580000 [0141.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0141.039] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.039] ReadFile (in: hFile=0x4a0, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x510ff14*=0x160, lpOverlapped=0x0) returned 1 [0141.041] GetProcessHeap () returned 0x580000 [0141.041] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.041] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.041] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x510ff14*=0x160, lpOverlapped=0x0) returned 1 [0141.042] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.042] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.042] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.042] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.042] CloseHandle (hObject=0x4a0) returned 1 [0141.042] GetProcessHeap () returned 0x580000 [0141.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0141.042] GetProcessHeap () returned 0x580000 [0141.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0141.042] GetProcessHeap () returned 0x580000 [0141.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8baf1960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x18e, dwReserved0=0x510fd28, dwReserved1=0x5aa990, cFileName="BD14769_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1476~2.YOU")) returned 0x5b96f0 [0146.865] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.880] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", len=0x44 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned 1 [0146.880] GetProcessHeap () returned 0x580000 [0146.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0146.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.570] CloseHandle (hObject=0x448) returned 1 [0152.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR18~1.YOU")) returned 0x5b9730 [0152.571] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.571] GetProcessHeap () returned 0x580000 [0152.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4201) returned 0x6ec4068 [0152.571] GetProcessHeap () returned 0x580000 [0152.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4201) returned 0x6599d0 [0152.571] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.571] ReadFile (in: hFile=0x448, lpBuffer=0x6ec4068, nNumberOfBytesToRead=0x41e0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesRead=0x510ff14*=0x41e0, lpOverlapped=0x0) returned 1 [0153.932] GetProcessHeap () returned 0x580000 [0153.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.932] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.932] WriteFile (in: hFile=0x448, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x510ff14*=0x41e0, lpOverlapped=0x0) returned 1 [0153.932] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.932] WriteFile (in: hFile=0x448, lpBuffer=0x65dbaf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65dbaf*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.932] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.932] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.932] CloseHandle (hObject=0x448) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x935d4920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4218, dwReserved0=0x510fd28, dwReserved1=0x6ec4068, cFileName="PDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR18~1.YOU")) returned 0x5b9630 [0153.933] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.677] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", len=0x40 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE") returned 1 [0154.677] GetProcessHeap () returned 0x580000 [0154.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0154.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0157.599] CloseHandle (hObject=0x470) returned 1 [0157.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0157.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id_1622540890_.your_last_chance")) returned 1 [0160.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0160.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZMA~1.YOU")) returned 0x5b9630 [0160.431] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0160.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0160.432] GetProcessHeap () returned 0x580000 [0160.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0160.432] GetProcessHeap () returned 0x580000 [0160.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d63e38 [0160.432] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.432] ReadFile (in: hFile=0x470, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.094] GetProcessHeap () returned 0x580000 [0165.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.427] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.427] WriteFile (in: hFile=0x470, lpBuffer=0x6d63e38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d63e38*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.427] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.428] WriteFile (in: hFile=0x470, lpBuffer=0x6d75637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75637*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.428] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.428] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.428] CloseHandle (hObject=0x470) returned 1 [0165.428] GetProcessHeap () returned 0x580000 [0165.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d63e38 | out: hHeap=0x580000) returned 1 [0165.429] GetProcessHeap () returned 0x580000 [0165.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0165.429] GetProcessHeap () returned 0x580000 [0165.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a379e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8f8024, dwReserved0=0x510fd28, dwReserved1=0x6d10048, cFileName="ACWZMAIN.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZMA~1.YOU")) returned 0x5b9730 [0169.370] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.530] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", len=0x5f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 1 [0169.530] GetProcessHeap () returned 0x580000 [0169.530] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0169.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0169.531] CloseHandle (hObject=0x4ac) returned 1 [0169.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id_1622540890_.your_last_chance")) returned 1 [0169.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUILT-~1.YOU")) returned 0x5b9730 [0169.532] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0169.532] GetProcessHeap () returned 0x580000 [0169.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d430a8 [0169.533] GetProcessHeap () returned 0x580000 [0169.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d548d8 [0169.533] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.533] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d430a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430a8*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.840] GetProcessHeap () returned 0x580000 [0173.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0173.840] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.840] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d548d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d548d8*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0173.841] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.841] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d660d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d660d7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.159] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.159] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.160] CloseHandle (hObject=0x4ac) returned 1 [0174.160] GetProcessHeap () returned 0x580000 [0174.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d548d8 | out: hHeap=0x580000) returned 1 [0174.160] GetProcessHeap () returned 0x580000 [0174.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430a8 | out: hHeap=0x580000) returned 1 [0174.160] GetProcessHeap () returned 0x580000 [0174.160] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f6ca080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4cf, dwReserved0=0x510fd28, dwReserved1=0x6d430a8, cFileName="Built-In Building Blocks.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUILT-~1.YOU")) returned 0x5b96f0 [0176.797] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.831] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS", len=0x39 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS") returned 1 [0176.831] GetProcessHeap () returned 0x580000 [0176.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2134) returned 0x6f14048 [0176.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0178.529] CloseHandle (hObject=0x470) returned 1 [0178.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0178.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.id_1622540890_.your_last_chance")) returned 1 [0178.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0178.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUNNYC~1.YOU")) returned 0x5b96f0 [0179.655] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sunny.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0179.655] GetProcessHeap () returned 0x580000 [0179.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.655] GetProcessHeap () returned 0x580000 [0179.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.655] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.655] ReadFile (in: hFile=0x48c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x510ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.668] GetProcessHeap () returned 0x580000 [0179.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.668] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.668] WriteFile (in: hFile=0x48c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x510ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.668] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.668] WriteFile (in: hFile=0x48c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.669] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.669] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.669] CloseHandle (hObject=0x48c) returned 1 [0179.669] GetProcessHeap () returned 0x580000 [0179.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.669] GetProcessHeap () returned 0x580000 [0179.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.669] GetProcessHeap () returned 0x580000 [0179.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa2b4e5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x510fd28, dwReserved1=0x635768, cFileName="SUNNY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUNNYC~1.YOU")) returned 0x5b9770 [0181.349] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.359] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", len=0x6c | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned 1 [0181.359] GetProcessHeap () returned 0x580000 [0181.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0181.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.599] CloseHandle (hObject=0x488) returned 1 [0182.599] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.600] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b558100, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x70006d, dwReserved1=0x69002e, cFileName="AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALF000~1.YOU")) returned 0x5b9770 [0182.600] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.600] GetProcessHeap () returned 0x580000 [0182.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0182.600] GetProcessHeap () returned 0x580000 [0182.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0182.600] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.600] ReadFile (in: hFile=0x488, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x510ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.625] GetProcessHeap () returned 0x580000 [0182.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0182.625] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.625] WriteFile (in: hFile=0x488, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x510ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.625] WriteFile (in: hFile=0x488, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.625] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.625] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.625] CloseHandle (hObject=0x488) returned 1 [0182.625] GetProcessHeap () returned 0x580000 [0182.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0182.625] GetProcessHeap () returned 0x580000 [0182.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0182.625] GetProcessHeap () returned 0x580000 [0182.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa476c9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x510fd28, dwReserved1=0x6cbc098, cFileName="AlertImage_FileHighMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALF000~1.YOU")) returned 0x5b9770 [0183.801] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.816] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", len=0x71 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned 1 [0183.816] GetProcessHeap () returned 0x580000 [0183.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0183.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.950] CloseHandle (hObject=0x450) returned 1 [0185.950] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e01, dwReserved0=0x6e0049, dwReserved1=0x2e006b, cFileName="DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DIGITA~1.YOU")) returned 0x5b96b0 [0185.951] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0185.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.951] GetProcessHeap () returned 0x580000 [0185.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e21) returned 0x705a4a8 [0185.951] GetProcessHeap () returned 0x580000 [0185.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e21) returned 0x6faab98 [0185.951] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.952] ReadFile (in: hFile=0x450, lpBuffer=0x705a4a8, nNumberOfBytesToRead=0x3e00, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x705a4a8*, lpNumberOfBytesRead=0x510ff14*=0x3e00, lpOverlapped=0x0) returned 1 [0187.444] GetProcessHeap () returned 0x580000 [0187.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0187.444] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.445] WriteFile (in: hFile=0x450, lpBuffer=0x6faab98*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6faab98*, lpNumberOfBytesWritten=0x510ff14*=0x3e00, lpOverlapped=0x0) returned 1 [0187.445] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.445] WriteFile (in: hFile=0x450, lpBuffer=0x6fae997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fae997*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.445] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.445] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.445] CloseHandle (hObject=0x450) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6faab98 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705a4a8 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0188.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa75652a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e25, dwReserved0=0x510fd28, dwReserved1=0x705a4a8, cFileName="DigitalInk.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DIGITA~1.YOU")) returned 0x5b9770 [0188.059] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.075] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", len=0x44 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned 1 [0188.075] GetProcessHeap () returned 0x580000 [0188.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2088) returned 0x6f14048 [0188.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0191.918] CloseHandle (hObject=0x480) returned 1 [0191.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8edb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPE0E6~1.YOU")) returned 0x5b97b0 [0194.878] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0194.878] GetProcessHeap () returned 0x580000 [0194.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8ee1) returned 0x6d10048 [0194.878] GetProcessHeap () returned 0x580000 [0194.878] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8ee1) returned 0x6d18f38 [0194.878] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.878] ReadFile (in: hFile=0x480, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x8ec0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x510ff14*=0x8ec0, lpOverlapped=0x0) returned 1 [0196.107] GetProcessHeap () returned 0x580000 [0196.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.107] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.107] WriteFile (in: hFile=0x480, lpBuffer=0x6d18f38*, nNumberOfBytesToWrite=0x8ec0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d18f38*, lpNumberOfBytesWritten=0x510ff14*=0x8ec0, lpOverlapped=0x0) returned 1 [0196.108] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.108] WriteFile (in: hFile=0x480, lpBuffer=0x6d21df7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21df7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.108] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.108] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.108] CloseHandle (hObject=0x480) returned 1 [0196.209] GetProcessHeap () returned 0x580000 [0196.209] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d18f38 | out: hHeap=0x580000) returned 1 [0196.210] GetProcessHeap () returned 0x580000 [0196.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0196.210] GetProcessHeap () returned 0x580000 [0196.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac7f6dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8eff, dwReserved0=0x510fd28, dwReserved1=0x6d10048, cFileName="ZPDIR4F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPE0E6~1.YOU")) returned 0x5b97f0 [0198.954] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.024] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", len=0x44 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0199.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.039] CloseHandle (hObject=0x4ac) returned 1 [0199.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.039] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.id_1622540890_.your_last_chance")) returned 1 [0199.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.040] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR43~1.YOU")) returned 0x5b97f0 [0199.040] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.040] GetProcessHeap () returned 0x580000 [0199.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x635768 [0199.040] GetProcessHeap () returned 0x580000 [0199.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x6f668d8 [0199.040] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.040] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x510ff14*=0xd20, lpOverlapped=0x0) returned 1 [0199.052] GetProcessHeap () returned 0x580000 [0199.052] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0199.052] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.052] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x510ff14*=0xd20, lpOverlapped=0x0) returned 1 [0199.053] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f675f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675f7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.053] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.053] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.053] CloseHandle (hObject=0x4ac) returned 1 [0199.053] GetProcessHeap () returned 0x580000 [0199.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0199.053] GetProcessHeap () returned 0x580000 [0199.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0199.053] GetProcessHeap () returned 0x580000 [0199.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0199.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae4151a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd50, dwReserved0=0x510fd28, dwReserved1=0x635768, cFileName="PDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR43~1.YOU")) returned 0x5b96b0 [0199.656] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.946] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", len=0x65 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned 1 [0200.946] GetProcessHeap () returned 0x580000 [0200.946] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0200.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.946] CloseHandle (hObject=0x43c) returned 1 [0200.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.947] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.id_1622540890_.your_last_chance")) returned 1 [0200.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9770 [0200.948] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.948] GetProcessHeap () returned 0x580000 [0200.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0200.948] GetProcessHeap () returned 0x580000 [0200.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0200.948] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.948] ReadFile (in: hFile=0x43c, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x510ff14*=0x360, lpOverlapped=0x0) returned 1 [0200.952] GetProcessHeap () returned 0x580000 [0200.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0200.952] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.952] WriteFile (in: hFile=0x43c, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x510ff14*=0x360, lpOverlapped=0x0) returned 1 [0200.952] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.952] WriteFile (in: hFile=0x43c, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.952] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.952] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.952] CloseHandle (hObject=0x43c) returned 1 [0200.953] GetProcessHeap () returned 0x580000 [0200.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0200.953] GetProcessHeap () returned 0x580000 [0200.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0200.953] GetProcessHeap () returned 0x580000 [0200.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0201.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf63b960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x510fd28, dwReserved1=0x6eef020, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9770 [0201.427] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.428] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x6f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0201.428] GetProcessHeap () returned 0x580000 [0201.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0201.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.428] CloseHandle (hObject=0x488) returned 1 [0201.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x2e004e, dwReserved1=0x490047, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.451] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0201.452] GetProcessHeap () returned 0x580000 [0201.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0201.452] GetProcessHeap () returned 0x580000 [0201.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0201.452] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.452] ReadFile (in: hFile=0x488, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x510ff14*=0x160, lpOverlapped=0x0) returned 1 [0201.454] GetProcessHeap () returned 0x580000 [0201.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.454] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.454] WriteFile (in: hFile=0x488, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x510ff14*=0x160, lpOverlapped=0x0) returned 1 [0201.454] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.454] WriteFile (in: hFile=0x488, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.454] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.454] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.454] CloseHandle (hObject=0x488) returned 1 [0201.454] GetProcessHeap () returned 0x580000 [0201.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0201.455] GetProcessHeap () returned 0x580000 [0201.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0201.455] GetProcessHeap () returned 0x580000 [0201.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafafe560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x510fd28, dwReserved1=0x5b8df0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.085] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.130] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS", len=0x45 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS") returned 1 [0202.130] GetProcessHeap () returned 0x580000 [0202.130] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f04) returned 0x6f14048 [0202.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0202.130] CloseHandle (hObject=0x43c) returned 1 [0202.130] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css.id_1622540890_.your_last_chance")) returned 1 [0202.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37359e00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37359e00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1ecfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC14E0~1.YOU")) returned 0x5b9770 [0202.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0202.132] GetProcessHeap () returned 0x580000 [0202.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0202.132] GetProcessHeap () returned 0x580000 [0202.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0202.132] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.132] ReadFile (in: hFile=0x43c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.482] GetProcessHeap () returned 0x580000 [0209.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0209.482] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.482] WriteFile (in: hFile=0x43c, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.483] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.483] WriteFile (in: hFile=0x43c, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.483] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.483] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.483] CloseHandle (hObject=0x43c) returned 1 [0209.483] GetProcessHeap () returned 0x580000 [0209.483] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0209.776] GetProcessHeap () returned 0x580000 [0209.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0209.776] GetProcessHeap () returned 0x580000 [0209.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0209.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37359e00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb479c980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ed20, dwReserved0=0x510fd34, dwReserved1=0x7718ba87, cFileName="SCHEME44.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC14E0~1.YOU")) returned 0x5b97f0 [0209.777] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.822] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", len=0x69 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned 1 [0209.823] GetProcessHeap () returned 0x580000 [0209.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0209.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0210.785] CloseHandle (hObject=0x484) returned 1 [0210.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.id_1622540890_.your_last_chance")) returned 1 [0211.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0211.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b97b0 [0211.991] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0211.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0211.991] GetProcessHeap () returned 0x580000 [0211.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0211.991] GetProcessHeap () returned 0x580000 [0211.991] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0211.991] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.991] ReadFile (in: hFile=0x484, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x510ff14*=0x720, lpOverlapped=0x0) returned 1 [0211.998] GetProcessHeap () returned 0x580000 [0211.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0211.998] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.998] WriteFile (in: hFile=0x484, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x510ff14*=0x720, lpOverlapped=0x0) returned 1 [0211.999] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.999] WriteFile (in: hFile=0x484, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0211.999] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0211.999] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0211.999] CloseHandle (hObject=0x484) returned 1 [0211.999] GetProcessHeap () returned 0x580000 [0211.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0211.999] GetProcessHeap () returned 0x580000 [0211.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0211.999] GetProcessHeap () returned 0x580000 [0211.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f906e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x744, dwReserved0=0x510fd28, dwReserved1=0x6c4e820, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b97b0 [0214.647] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.656] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS", len=0x45 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS") returned 1 [0214.657] GetProcessHeap () returned 0x580000 [0214.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0214.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0214.657] CloseHandle (hObject=0x45c) returned 1 [0214.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.657] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css.id_1622540890_.your_last_chance")) returned 1 [0214.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC1164~1.YOU")) returned 0x5b97b0 [0214.658] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0214.659] GetProcessHeap () returned 0x580000 [0214.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7450048 [0214.659] GetProcessHeap () returned 0x580000 [0214.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0214.660] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.660] ReadFile (in: hFile=0x45c, lpBuffer=0x7450048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.655] GetProcessHeap () returned 0x580000 [0220.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0220.655] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.655] WriteFile (in: hFile=0x45c, lpBuffer=0x72f0208*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.655] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.656] WriteFile (in: hFile=0x45c, lpBuffer=0x7301a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a07*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.656] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.656] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.656] CloseHandle (hObject=0x45c) returned 1 [0220.656] GetProcessHeap () returned 0x580000 [0220.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0220.668] GetProcessHeap () returned 0x580000 [0220.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0220.668] GetProcessHeap () returned 0x580000 [0220.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0221.683] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb222200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f9bc, dwReserved0=0x510fd28, dwReserved1=0x7450048, cFileName="SCHEME08.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC1164~1.YOU")) returned 0x5b9730 [0221.684] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.749] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", len=0x4f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 1 [0221.749] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0221.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.749] CloseHandle (hObject=0x460) returned 1 [0221.749] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.749] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id_1622540890_.your_last_chance")) returned 1 [0221.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b9730 [0221.750] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.751] GetProcessHeap () returned 0x580000 [0221.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d36a68 [0221.751] GetProcessHeap () returned 0x580000 [0221.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d375f0 [0221.751] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.751] ReadFile (in: hFile=0x460, lpBuffer=0x6d36a68, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d36a68*, lpNumberOfBytesRead=0x510ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.803] GetProcessHeap () returned 0x580000 [0221.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.803] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.803] WriteFile (in: hFile=0x460, lpBuffer=0x6d375f0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d375f0*, lpNumberOfBytesWritten=0x510ff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.803] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.803] WriteFile (in: hFile=0x460, lpBuffer=0x6d3810f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3810f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.803] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.803] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.803] CloseHandle (hObject=0x460) returned 1 [0221.803] GetProcessHeap () returned 0x580000 [0221.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d375f0 | out: hHeap=0x580000) returned 1 [0221.803] GetProcessHeap () returned 0x580000 [0221.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d36a68 | out: hHeap=0x580000) returned 1 [0221.803] GetProcessHeap () returned 0x580000 [0221.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbd247c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x510fd28, dwReserved1=0x6d36a68, cFileName="messageboxerror.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b9730 [0221.804] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.864] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", len=0x47 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 1 [0221.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0221.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.047] CloseHandle (hObject=0x480) returned 1 [0223.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id_1622540890_.your_last_chance")) returned 1 [0223.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHEVRO~1.YOU")) returned 0x5b96f0 [0223.048] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.049] GetProcessHeap () returned 0x580000 [0223.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35358 [0223.049] GetProcessHeap () returned 0x580000 [0223.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35ee0 [0223.049] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.049] ReadFile (in: hFile=0x480, lpBuffer=0x6d35358, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35358*, lpNumberOfBytesRead=0x510ff14*=0xb20, lpOverlapped=0x0) returned 1 [0223.060] GetProcessHeap () returned 0x580000 [0223.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.060] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.060] WriteFile (in: hFile=0x480, lpBuffer=0x6d35ee0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35ee0*, lpNumberOfBytesWritten=0x510ff14*=0xb20, lpOverlapped=0x0) returned 1 [0223.060] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.060] WriteFile (in: hFile=0x480, lpBuffer=0x6d369ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d369ff*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.060] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.060] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.060] CloseHandle (hObject=0x480) returned 1 [0223.061] GetProcessHeap () returned 0x580000 [0223.061] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35ee0 | out: hHeap=0x580000) returned 1 [0223.061] GetProcessHeap () returned 0x580000 [0223.061] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35358 | out: hHeap=0x580000) returned 1 [0223.061] GetProcessHeap () returned 0x580000 [0223.061] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc90b5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x510fd28, dwReserved1=0x6d35358, cFileName="CHEVRON.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHEVRO~1.YOU")) returned 0x5b9630 [0225.826] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.872] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", len=0x6f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned 1 [0225.872] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0225.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.873] CloseHandle (hObject=0x448) returned 1 [0225.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance")) returned 1 [0225.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x2e0065, dwReserved1=0x730063, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9630 [0225.874] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.874] GetProcessHeap () returned 0x580000 [0225.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd8f68 [0225.874] GetProcessHeap () returned 0x580000 [0225.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6dd96f0 [0225.875] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.875] ReadFile (in: hFile=0x448, lpBuffer=0x6dd8f68, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesRead=0x510ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.903] GetProcessHeap () returned 0x580000 [0225.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.903] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.903] WriteFile (in: hFile=0x448, lpBuffer=0x6dd96f0*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd96f0*, lpNumberOfBytesWritten=0x510ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.903] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.903] WriteFile (in: hFile=0x448, lpBuffer=0x6dd9e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9e0f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.903] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.903] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.903] CloseHandle (hObject=0x448) returned 1 [0225.903] GetProcessHeap () returned 0x580000 [0225.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd96f0 | out: hHeap=0x580000) returned 1 [0225.903] GetProcessHeap () returned 0x580000 [0225.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0225.903] GetProcessHeap () returned 0x580000 [0225.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe2a2240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x510fd28, dwReserved1=0x6dd8f68, cFileName="TexturedBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TEXTUR~1.YOU")) returned 0x5b9630 [0225.904] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.970] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK", len=0x43 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 1 [0225.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0225.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.000] CloseHandle (hObject=0x448) returned 1 [0226.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.001] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0226.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~3.YOU")) returned 0x5b9630 [0226.004] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0226.004] GetProcessHeap () returned 0x580000 [0226.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0226.004] GetProcessHeap () returned 0x580000 [0226.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0226.004] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.004] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x510ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.005] GetProcessHeap () returned 0x580000 [0226.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.005] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.005] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x510ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.005] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.005] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.005] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.005] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.006] CloseHandle (hObject=0x448) returned 1 [0226.006] GetProcessHeap () returned 0x580000 [0226.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0226.006] GetProcessHeap () returned 0x580000 [0226.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0226.006] GetProcessHeap () returned 0x580000 [0226.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe3acbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x510fd28, dwReserved1=0x61b540, cFileName="MSPUB.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~3.YOU")) returned 0x5b9630 [0226.006] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.017] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS", len=0x42 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 1 [0226.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc0) returned 0x6dee6e0 [0226.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0226.029] CloseHandle (hObject=0x3a8) returned 1 [0226.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id_1622540890_.your_last_chance")) returned 1 [0226.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INC91A~1.YOU")) returned 0x5b9630 [0226.046] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0226.046] GetProcessHeap () returned 0x580000 [0226.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead6a0 [0226.046] GetProcessHeap () returned 0x580000 [0226.047] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71be6d8 [0226.047] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.047] ReadFile (in: hFile=0x3a8, lpBuffer=0x6ead6a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead6a0*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0234.247] GetProcessHeap () returned 0x580000 [0234.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0234.248] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.248] WriteFile (in: hFile=0x3a8, lpBuffer=0x71be6d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x71be6d8*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0234.249] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0234.249] WriteFile (in: hFile=0x3a8, lpBuffer=0x71cfed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x71cfed7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0235.651] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.651] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0235.651] CloseHandle (hObject=0x3a8) returned 1 [0235.652] GetProcessHeap () returned 0x580000 [0235.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71be6d8 | out: hHeap=0x580000) returned 1 [0235.652] GetProcessHeap () returned 0x580000 [0235.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead6a0 | out: hHeap=0x580000) returned 1 [0235.653] GetProcessHeap () returned 0x580000 [0235.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0240.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f9dda0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69806, dwReserved0=0x510fd28, dwReserved1=0x6ead6a0, cFileName="INFOPATHEDITOR.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INC91A~1.YOU")) returned 0x5b9730 [0240.539] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.562] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML", len=0x4b | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned 1 [0240.562] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0240.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0240.586] CloseHandle (hObject=0x420) returned 1 [0240.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml.id_1622540890_.your_last_chance")) returned 1 [0240.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOI~1.YOU")) returned 0x5b9730 [0240.587] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0240.587] GetProcessHeap () returned 0x580000 [0240.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07a60 [0240.587] GetProcessHeap () returned 0x580000 [0240.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07dc8 [0240.587] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.587] ReadFile (in: hFile=0x420, lpBuffer=0x6d07a60, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a60*, lpNumberOfBytesRead=0x510ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.609] GetProcessHeap () returned 0x580000 [0240.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0240.609] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.609] WriteFile (in: hFile=0x420, lpBuffer=0x6d07dc8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07dc8*, lpNumberOfBytesWritten=0x510ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.609] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.609] WriteFile (in: hFile=0x420, lpBuffer=0x6d080e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d080e7*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.609] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.609] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.609] CloseHandle (hObject=0x420) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07dc8 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07a60 | out: hHeap=0x580000) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.620] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0241.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6eed2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x510fd28, dwReserved1=0x6d07a60, cFileName="YAHOO.IT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOI~1.YOU")) returned 0x5b9630 [0241.686] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.728] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML", len=0x3f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned 1 [0241.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0241.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.729] CloseHandle (hObject=0x45c) returned 1 [0241.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml.id_1622540890_.your_last_chance")) returned 1 [0241.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5677c900, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5677c900, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x7aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~3.YOU")) returned 0x5b9630 [0241.730] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0241.730] GetProcessHeap () returned 0x580000 [0241.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c1) returned 0x706e438 [0241.730] GetProcessHeap () returned 0x580000 [0241.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7c1) returned 0x6c79898 [0241.730] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.730] ReadFile (in: hFile=0x45c, lpBuffer=0x706e438, nNumberOfBytesToRead=0x7a0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x706e438*, lpNumberOfBytesRead=0x510ff14*=0x7a0, lpOverlapped=0x0) returned 1 [0241.777] GetProcessHeap () returned 0x580000 [0241.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.777] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.777] WriteFile (in: hFile=0x45c, lpBuffer=0x6c79898*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesWritten=0x510ff14*=0x7a0, lpOverlapped=0x0) returned 1 [0241.777] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.777] WriteFile (in: hFile=0x45c, lpBuffer=0x6c7a037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a037*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.777] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.777] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.777] CloseHandle (hObject=0x45c) returned 1 [0241.777] GetProcessHeap () returned 0x580000 [0241.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0241.777] GetProcessHeap () returned 0x580000 [0241.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e438 | out: hHeap=0x580000) returned 1 [0241.777] GetProcessHeap () returned 0x580000 [0241.777] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5677c900, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a15a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7ce, dwReserved0=0x510fd28, dwReserved1=0x706e438, cFileName="PGMN095.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN09~3.YOU")) returned 0x5b9630 [0241.778] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.822] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML", len=0x3f | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned 1 [0241.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0241.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0244.905] CloseHandle (hObject=0x3b4) returned 1 [0244.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml.id_1622540890_.your_last_chance")) returned 1 [0244.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a4d100, ftCreationTime.dwHighDateTime=0x1ca0452, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a4d100, ftLastWriteTime.dwHighDateTime=0x1ca0452, nFileSizeHigh=0x0, nFileSizeLow=0x101198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~2.YOU")) returned 0x5b96f0 [0244.907] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0244.907] GetProcessHeap () returned 0x580000 [0244.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0244.908] GetProcessHeap () returned 0x580000 [0244.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0244.908] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.908] ReadFile (in: hFile=0x3b4, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.080] GetProcessHeap () returned 0x580000 [0248.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0248.080] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.080] WriteFile (in: hFile=0x3b4, lpBuffer=0x6e21520*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesWritten=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.080] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.081] WriteFile (in: hFile=0x3b4, lpBuffer=0x6e32d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d1f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.212] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.212] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.212] CloseHandle (hObject=0x3b4) returned 1 [0248.256] GetProcessHeap () returned 0x580000 [0248.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0248.256] GetProcessHeap () returned 0x580000 [0248.256] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0248.257] GetProcessHeap () returned 0x580000 [0248.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0253.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a4d100, ftCreationTime.dwHighDateTime=0x1ca0452, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb761080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1011bc, dwReserved0=0x510fd28, dwReserved1=0x6e0fcf0, cFileName="PGMN081.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~2.YOU")) returned 0x5b9730 [0253.235] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.272] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC", len=0x3e | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 1 [0253.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0253.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0253.314] CloseHandle (hObject=0x49c) returned 1 [0253.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.id_1622540890_.your_last_chance")) returned 1 [0253.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.315] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x4d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDRTKF~1.YOU")) returned 0x5b9730 [0253.315] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0253.315] GetProcessHeap () returned 0x580000 [0253.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4da1) returned 0x6e063d0 [0253.316] GetProcessHeap () returned 0x580000 [0253.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4da1) returned 0x72b75f8 [0253.316] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.316] ReadFile (in: hFile=0x49c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x4d80, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x510ff14*=0x4d80, lpOverlapped=0x0) returned 1 [0254.170] GetProcessHeap () returned 0x580000 [0254.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0254.170] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.170] WriteFile (in: hFile=0x49c, lpBuffer=0x72b75f8*, nNumberOfBytesToWrite=0x4d80, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x72b75f8*, lpNumberOfBytesWritten=0x510ff14*=0x4d80, lpOverlapped=0x0) returned 1 [0254.170] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.170] WriteFile (in: hFile=0x49c, lpBuffer=0x72bc377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bc377*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0254.170] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.170] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0254.170] CloseHandle (hObject=0x49c) returned 1 [0254.170] GetProcessHeap () returned 0x580000 [0254.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72b75f8 | out: hHeap=0x580000) returned 1 [0254.170] GetProcessHeap () returned 0x580000 [0254.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0254.170] GetProcessHeap () returned 0x580000 [0254.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf035dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4db4, dwReserved0=0x510fd28, dwReserved1=0x6e063d0, cFileName="BDRTKFUL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDRTKF~1.YOU")) returned 0x5b9730 [0255.061] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.158] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML", len=0x3d | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML") returned 1 [0255.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa4) returned 0x72e5948 [0255.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0255.159] CloseHandle (hObject=0x39c) returned 1 [0255.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml.id_1622540890_.your_last_chance")) returned 1 [0255.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a128500, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a128500, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1dbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBH~1.YOU")) returned 0x5b9730 [0255.160] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0255.160] GetProcessHeap () returned 0x580000 [0255.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x636988 [0255.160] GetProcessHeap () returned 0x580000 [0255.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x638790 [0255.160] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.160] ReadFile (in: hFile=0x39c, lpBuffer=0x636988, nNumberOfBytesToRead=0x1da0, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x636988*, lpNumberOfBytesRead=0x510ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0255.289] GetProcessHeap () returned 0x580000 [0255.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.290] WriteFile (in: hFile=0x39c, lpBuffer=0x638790*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x638790*, lpNumberOfBytesWritten=0x510ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0255.290] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.290] WriteFile (in: hFile=0x39c, lpBuffer=0x63a52f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x63a52f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.290] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.290] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.290] CloseHandle (hObject=0x39c) returned 1 [0255.290] GetProcessHeap () returned 0x580000 [0255.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x638790 | out: hHeap=0x580000) returned 1 [0255.290] GetProcessHeap () returned 0x580000 [0255.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636988 | out: hHeap=0x580000) returned 1 [0255.290] GetProcessHeap () returned 0x580000 [0255.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.290] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a128500, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfaec0c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1de0, dwReserved0=0x510fd28, dwReserved1=0x636988, cFileName="DGWEBHD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBH~1.YOU")) returned 0x5b9730 [0255.290] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.326] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML", len=0x3b | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML") returned 1 [0255.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f8c) returned 0x72e5948 [0255.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0258.919] CloseHandle (hObject=0x428) returned 1 [0258.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml.id_1622540890_.your_last_chance")) returned 1 [0258.961] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd764d00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd764d00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1712, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGTOCX~1.YOU")) returned 0x5b96f0 [0258.962] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0258.962] GetProcessHeap () returned 0x580000 [0258.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x706d508 [0258.962] GetProcessHeap () returned 0x580000 [0258.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x6de8f50 [0258.962] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.962] ReadFile (in: hFile=0x428, lpBuffer=0x706d508, nNumberOfBytesToRead=0x1700, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x706d508*, lpNumberOfBytesRead=0x510ff14*=0x1700, lpOverlapped=0x0) returned 1 [0258.983] GetProcessHeap () returned 0x580000 [0258.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.983] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.984] WriteFile (in: hFile=0x428, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x510ff14*=0x1700, lpOverlapped=0x0) returned 1 [0258.984] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.984] WriteFile (in: hFile=0x428, lpBuffer=0x6dea64f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea64f*, lpNumberOfBytesWritten=0x510ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.984] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.984] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x510ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.984] CloseHandle (hObject=0x428) returned 1 [0258.984] GetProcessHeap () returned 0x580000 [0258.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0258.984] GetProcessHeap () returned 0x580000 [0258.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706d508 | out: hHeap=0x580000) returned 1 [0258.984] GetProcessHeap () returned 0x580000 [0258.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fccc | out: lpFindFileData=0x510fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd764d00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1e2e6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1736, dwReserved0=0x510fd28, dwReserved1=0x706d508, cFileName="DGTOC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGTOCX~1.YOU")) returned 0x5b9630 [0259.225] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.238] SysReAllocStringLen (in: pbstr=0x510ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV", len=0x43 | out: pbstr=0x510ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV") returned 1 [0259.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2078) returned 0x72e5948 [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0259.323] CloseHandle (hObject=0x48c) returned 1 [0259.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x510ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x510fc74 | out: lpFindFileData=0x510fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641f1d00, ftCreationTime.dwHighDateTime=0x1c9c70e, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x641f1d00, ftLastWriteTime.dwHighDateTime=0x1c9c70e, nFileSizeHigh=0x0, nFileSizeLow=0x49e01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIDEBA~1.YOU")) returned 0x5b9630 [0259.324] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0259.324] GetProcessHeap () returned 0x580000 [0259.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7298838 [0259.324] GetProcessHeap () returned 0x580000 [0259.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72aa068 [0259.324] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.324] ReadFile (in: hFile=0x48c, lpBuffer=0x7298838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x510ff14, lpOverlapped=0x0 | out: lpBuffer=0x7298838*, lpNumberOfBytesRead=0x510ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 42 os_tid = 0xaa0 [0039.067] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.839] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.290] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.554] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.010] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.390] Sleep (dwMilliseconds=0x1) [0043.408] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.468] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.561] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.733] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.906] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.019] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.366] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.667] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.730] Sleep (dwMilliseconds=0x1) [0044.745] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.854] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.948] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.995] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.057] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.135] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.291] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.369] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.447] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.572] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.823] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.352] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.479] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.540] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.820] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.006] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.474] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.521] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.552] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.666] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.805] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.897] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.176] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.301] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.535] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.566] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.847] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.941] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.114] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.284] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.315] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.471] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.565] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.627] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.721] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.783] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.832] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.939] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.095] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.204] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.360] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.516] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.906] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.140] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.218] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.343] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.530] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.644] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.762] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.840] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.996] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.246] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.277] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.308] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.371] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.589] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.776] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.478] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.650] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.837] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.962] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.071] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.149] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.227] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.274] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.383] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.461] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.773] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.039] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.241] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0056.722] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", len=0x4d | out: pbstr=0x524ff84*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 1 [0056.722] GetProcessHeap () returned 0x580000 [0056.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0056.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0057.284] CloseHandle (hObject=0x418) returned 1 [0057.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.284] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id_1622540890_.your_last_chance")) returned 1 [0057.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.285] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b9630 [0057.285] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0057.285] GetProcessHeap () returned 0x580000 [0057.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cc0448 [0057.286] GetProcessHeap () returned 0x580000 [0057.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cd1c78 [0057.286] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.286] ReadFile (in: hFile=0x418, lpBuffer=0x6cc0448, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0448*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.206] GetProcessHeap () returned 0x580000 [0060.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0060.206] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.206] WriteFile (in: hFile=0x418, lpBuffer=0x6cd1c78*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cd1c78*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.626] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.626] WriteFile (in: hFile=0x418, lpBuffer=0x6ce3477*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3477*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0060.965] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.966] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0060.966] CloseHandle (hObject=0x418) returned 1 [0064.540] GetProcessHeap () returned 0x580000 [0064.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cd1c78 | out: hHeap=0x580000) returned 1 [0064.540] GetProcessHeap () returned 0x580000 [0064.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cc0448 | out: hHeap=0x580000) returned 1 [0064.540] GetProcessHeap () returned 0x580000 [0064.540] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0064.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0064.540] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5ce04fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bba24, dwReserved0=0x524fd28, dwReserved1=0x6cc0448, cFileName="OutlookMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b9630 [0064.540] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0064.541] Sleep (dwMilliseconds=0x1) [0065.505] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", len=0x4b | out: pbstr=0x524ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 1 [0065.505] GetProcessHeap () returned 0x580000 [0065.505] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x3c) returned 0x5e9710 [0065.505] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0074.357] CloseHandle (hObject=0x444) returned 1 [0074.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.358] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id_1622540890_.your_last_chance")) returned 1 [0075.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.458] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x45, dwReserved1=0x0, cFileName="VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~3.YOU")) returned 0x5b96f0 [0075.458] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0075.459] GetProcessHeap () returned 0x580000 [0075.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ee0838 [0075.459] GetProcessHeap () returned 0x580000 [0075.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ef2068 [0075.459] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.459] ReadFile (in: hFile=0x444, lpBuffer=0x6ee0838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ee0838*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.738] GetProcessHeap () returned 0x580000 [0078.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0078.738] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.738] WriteFile (in: hFile=0x444, lpBuffer=0x6ef2068*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2068*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.739] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.739] WriteFile (in: hFile=0x444, lpBuffer=0x6f03867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03867*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.039] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.039] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.039] CloseHandle (hObject=0x444) returned 1 [0079.040] GetProcessHeap () returned 0x580000 [0079.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef2068 | out: hHeap=0x580000) returned 1 [0079.040] GetProcessHeap () returned 0x580000 [0079.040] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ee0838 | out: hHeap=0x580000) returned 1 [0079.042] GetProcessHeap () returned 0x580000 [0079.042] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0079.438] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x66b91fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb80824, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="VisiorWW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~3.YOU")) returned 0x5b96f0 [0079.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.964] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", len=0x4a | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 1 [0085.964] GetProcessHeap () returned 0x580000 [0085.964] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x94) returned 0x614a48 [0085.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.965] Sleep (dwMilliseconds=0x1) [0085.981] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", len=0x44 | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 1 [0085.981] GetProcessHeap () returned 0x580000 [0085.981] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x28) returned 0x614a48 [0085.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.981] Sleep (dwMilliseconds=0x1) [0086.327] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", len=0x4c | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 1 [0086.327] GetProcessHeap () returned 0x580000 [0086.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0087.826] CloseHandle (hObject=0x48c) returned 1 [0087.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0087.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0087.829] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0087.829] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0087.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0087.829] GetProcessHeap () returned 0x580000 [0087.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6f0c4f8 [0087.829] GetProcessHeap () returned 0x580000 [0087.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6f03bc8 [0087.829] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.829] ReadFile (in: hFile=0x48c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x524ff14*=0x620, lpOverlapped=0x0) returned 1 [0087.836] GetProcessHeap () returned 0x580000 [0087.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0087.836] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.836] WriteFile (in: hFile=0x48c, lpBuffer=0x6f03bc8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bc8*, lpNumberOfBytesWritten=0x524ff14*=0x620, lpOverlapped=0x0) returned 1 [0087.836] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.836] WriteFile (in: hFile=0x48c, lpBuffer=0x6f041e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f041e7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0087.836] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.836] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0087.837] CloseHandle (hObject=0x48c) returned 1 [0087.837] GetProcessHeap () returned 0x580000 [0087.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bc8 | out: hHeap=0x580000) returned 1 [0087.837] GetProcessHeap () returned 0x580000 [0087.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0087.837] GetProcessHeap () returned 0x580000 [0087.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bf7a740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x645, dwReserved0=0x524fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.156] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.172] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", len=0x4a | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 1 [0088.172] GetProcessHeap () returned 0x580000 [0088.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f7a0 [0088.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.173] CloseHandle (hObject=0x484) returned 1 [0088.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.173] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.174] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.174] GetProcessHeap () returned 0x580000 [0088.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6f0c4f8 [0088.174] GetProcessHeap () returned 0x580000 [0088.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6f03bc8 [0088.174] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.174] ReadFile (in: hFile=0x484, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x524ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0088.179] GetProcessHeap () returned 0x580000 [0088.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.179] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.179] WriteFile (in: hFile=0x484, lpBuffer=0x6f03bc8*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bc8*, lpNumberOfBytesWritten=0x524ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0088.180] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.180] WriteFile (in: hFile=0x484, lpBuffer=0x6f03f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03f67*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.180] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.180] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.180] CloseHandle (hObject=0x484) returned 1 [0088.180] GetProcessHeap () returned 0x580000 [0088.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bc8 | out: hHeap=0x580000) returned 1 [0088.180] GetProcessHeap () returned 0x580000 [0088.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0088.180] GetProcessHeap () returned 0x580000 [0088.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c2c0580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d5, dwReserved0=0x524fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0088.180] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.187] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", len=0x49 | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 1 [0088.187] GetProcessHeap () returned 0x580000 [0088.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x2c) returned 0x61f6c0 [0088.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.188] CloseHandle (hObject=0x484) returned 1 [0088.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id_1622540890_.your_last_chance")) returned 1 [0088.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANYON~1.YOU")) returned 0x5b96f0 [0088.189] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.189] GetProcessHeap () returned 0x580000 [0088.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f0c4f8 [0088.189] GetProcessHeap () returned 0x580000 [0088.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0088.189] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.190] ReadFile (in: hFile=0x484, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x524ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0088.192] GetProcessHeap () returned 0x580000 [0088.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.192] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.192] WriteFile (in: hFile=0x484, lpBuffer=0x6d04cc0*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesWritten=0x524ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0088.192] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.192] WriteFile (in: hFile=0x484, lpBuffer=0x6d04e7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04e7f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.192] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.192] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.192] CloseHandle (hObject=0x484) returned 1 [0088.193] GetProcessHeap () returned 0x580000 [0088.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0088.193] GetProcessHeap () returned 0x580000 [0088.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0088.193] GetProcessHeap () returned 0x580000 [0088.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c2e66e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x524fd28, dwReserved1=0x6f0c4f8, cFileName="CANYON.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANYON~1.YOU")) returned 0x5b96f0 [0088.193] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.203] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", len=0x49 | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 1 [0088.203] GetProcessHeap () returned 0x580000 [0088.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x28) returned 0x5dc550 [0088.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.203] CloseHandle (hObject=0x484) returned 1 [0088.203] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.203] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id_1622540890_.your_last_chance")) returned 1 [0088.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANYON~2.YOU")) returned 0x5b96f0 [0088.204] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0088.204] GetProcessHeap () returned 0x580000 [0088.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaee1) returned 0x6c3aed8 [0088.204] GetProcessHeap () returned 0x580000 [0088.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaee1) returned 0x6c45dc8 [0088.204] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.205] ReadFile (in: hFile=0x484, lpBuffer=0x6c3aed8, nNumberOfBytesToRead=0xaec0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3aed8*, lpNumberOfBytesRead=0x524ff14*=0xaec0, lpOverlapped=0x0) returned 1 [0091.008] GetProcessHeap () returned 0x580000 [0091.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0091.009] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.009] WriteFile (in: hFile=0x484, lpBuffer=0x6c45dc8*, nNumberOfBytesToWrite=0xaec0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c45dc8*, lpNumberOfBytesWritten=0x524ff14*=0xaec0, lpOverlapped=0x0) returned 1 [0091.441] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.442] WriteFile (in: hFile=0x484, lpBuffer=0x6c50c87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c50c87*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.673] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.674] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.674] CloseHandle (hObject=0x484) returned 1 [0092.674] GetProcessHeap () returned 0x580000 [0092.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c45dc8 | out: hHeap=0x580000) returned 1 [0092.674] GetProcessHeap () returned 0x580000 [0092.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3aed8 | out: hHeap=0x580000) returned 1 [0092.674] GetProcessHeap () returned 0x580000 [0092.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0092.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ed99180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaeed, dwReserved0=0x524fd28, dwReserved1=0x6c3aed8, cFileName="CANYON.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CANYON~2.YOU")) returned 0x5b96f0 [0092.674] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.191] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 1 [0094.191] GetProcessHeap () returned 0x580000 [0094.192] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x38) returned 0x5b96f0 [0094.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0094.192] CloseHandle (hObject=0x490) returned 1 [0094.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0094.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0094.201] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0094.201] GetProcessHeap () returned 0x580000 [0094.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf81) returned 0x6c9d3d8 [0094.201] GetProcessHeap () returned 0x580000 [0094.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcf81) returned 0x6caa368 [0094.201] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.201] ReadFile (in: hFile=0x490, lpBuffer=0x6c9d3d8, nNumberOfBytesToRead=0xcf60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3d8*, lpNumberOfBytesRead=0x524ff14*=0xcf60, lpOverlapped=0x0) returned 1 [0099.178] GetProcessHeap () returned 0x580000 [0099.179] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.179] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.179] WriteFile (in: hFile=0x490, lpBuffer=0x6caa368*, nNumberOfBytesToWrite=0xcf60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6caa368*, lpNumberOfBytesWritten=0x524ff14*=0xcf60, lpOverlapped=0x0) returned 1 [0099.181] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.181] WriteFile (in: hFile=0x490, lpBuffer=0x6cb72c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cb72c7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.181] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.181] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.182] CloseHandle (hObject=0x490) returned 1 [0099.182] GetProcessHeap () returned 0x580000 [0099.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6caa368 | out: hHeap=0x580000) returned 1 [0099.182] GetProcessHeap () returned 0x580000 [0099.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9d3d8 | out: hHeap=0x580000) returned 1 [0099.182] GetProcessHeap () returned 0x580000 [0099.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72ba2ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcf9f, dwReserved0=0x524fd28, dwReserved1=0x6c9d3d8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0099.182] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.362] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 1 [0101.362] GetProcessHeap () returned 0x580000 [0101.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x2c) returned 0x61f7a0 [0101.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0101.429] CloseHandle (hObject=0x41c) returned 1 [0101.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0101.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0101.577] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0101.577] GetProcessHeap () returned 0x580000 [0101.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x47e1) returned 0x6c6a0f8 [0101.578] GetProcessHeap () returned 0x580000 [0101.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x47e1) returned 0x6c6e8e8 [0101.578] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.578] ReadFile (in: hFile=0x41c, lpBuffer=0x6c6a0f8, nNumberOfBytesToRead=0x47c0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesRead=0x524ff14*=0x47c0, lpOverlapped=0x0) returned 1 [0102.302] GetProcessHeap () returned 0x580000 [0102.302] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.302] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.302] WriteFile (in: hFile=0x41c, lpBuffer=0x6c6e8e8*, nNumberOfBytesToWrite=0x47c0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e8e8*, lpNumberOfBytesWritten=0x524ff14*=0x47c0, lpOverlapped=0x0) returned 1 [0102.302] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.302] WriteFile (in: hFile=0x41c, lpBuffer=0x6c730a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c730a7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.305] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.305] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.305] CloseHandle (hObject=0x41c) returned 1 [0102.305] GetProcessHeap () returned 0x580000 [0102.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e8e8 | out: hHeap=0x580000) returned 1 [0102.305] GetProcessHeap () returned 0x580000 [0102.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0102.305] GetProcessHeap () returned 0x580000 [0102.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x749641e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x47f0, dwReserved0=0x524fd28, dwReserved1=0x6c6a0f8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0102.306] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.965] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", len=0x49 | out: pbstr=0x524ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 1 [0102.965] GetProcessHeap () returned 0x580000 [0102.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92e8 | out: hHeap=0x580000) returned 1 [0102.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0102.966] CloseHandle (hObject=0x454) returned 1 [0102.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0102.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id_1622540890_.your_last_chance")) returned 1 [0102.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1FR~1.YOU")) returned 0x5b9630 [0102.967] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0102.967] GetProcessHeap () returned 0x580000 [0102.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d458e0 [0102.968] GetProcessHeap () returned 0x580000 [0102.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d57110 [0102.968] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.968] ReadFile (in: hFile=0x454, lpBuffer=0x6d458e0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.581] GetProcessHeap () returned 0x580000 [0106.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0106.582] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.582] WriteFile (in: hFile=0x454, lpBuffer=0x6d57110*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d57110*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.582] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.582] WriteFile (in: hFile=0x454, lpBuffer=0x6d6890f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6890f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.770] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.770] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.770] CloseHandle (hObject=0x454) returned 1 [0106.770] GetProcessHeap () returned 0x580000 [0106.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d57110 | out: hHeap=0x580000) returned 1 [0106.771] GetProcessHeap () returned 0x580000 [0106.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0106.771] GetProcessHeap () returned 0x580000 [0106.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0106.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77416c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x166bd2, dwReserved0=0x524fd28, dwReserved1=0x6d458e0, cFileName="MSB1FRAR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1FR~1.YOU")) returned 0x5b9730 [0106.771] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.079] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", len=0x43 | out: pbstr=0x524ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 1 [0112.080] GetProcessHeap () returned 0x580000 [0112.080] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.092] Sleep (dwMilliseconds=0x1) [0112.122] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", len=0x44 | out: pbstr=0x524ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned 1 [0112.122] GetProcessHeap () returned 0x580000 [0112.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0112.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.122] Sleep (dwMilliseconds=0x1) [0112.242] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", len=0x42 | out: pbstr=0x524ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 1 [0112.242] GetProcessHeap () returned 0x580000 [0112.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.242] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.248] Sleep (dwMilliseconds=0x1) [0112.363] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv", len=0x3f | out: pbstr=0x524ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv") returned 1 [0112.363] GetProcessHeap () returned 0x580000 [0112.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b9730 [0112.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.386] Sleep (dwMilliseconds=0x1) [0112.653] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", len=0x55 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 1 [0112.653] GetProcessHeap () returned 0x580000 [0112.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0xc) returned 0x5e92d0 [0112.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0112.654] CloseHandle (hObject=0x41c) returned 1 [0112.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.654] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id_1622540890_.your_last_chance")) returned 1 [0112.654] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOLUI~1.YOU")) returned 0x5b9670 [0112.655] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0112.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0112.655] GetProcessHeap () returned 0x580000 [0112.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a21) returned 0x6e02ff0 [0112.655] GetProcessHeap () returned 0x580000 [0112.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a21) returned 0x630788 [0112.655] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.655] ReadFile (in: hFile=0x41c, lpBuffer=0x6e02ff0, nNumberOfBytesToRead=0x3a00, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02ff0*, lpNumberOfBytesRead=0x524ff14*=0x3a00, lpOverlapped=0x0) returned 1 [0112.900] GetProcessHeap () returned 0x580000 [0112.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0112.900] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.900] WriteFile (in: hFile=0x41c, lpBuffer=0x630788*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x630788*, lpNumberOfBytesWritten=0x524ff14*=0x3a00, lpOverlapped=0x0) returned 1 [0112.900] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.900] WriteFile (in: hFile=0x41c, lpBuffer=0x634187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x634187*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0112.900] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.900] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0112.900] CloseHandle (hObject=0x41c) returned 1 [0112.980] GetProcessHeap () returned 0x580000 [0112.980] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x630788 | out: hHeap=0x580000) returned 1 [0113.027] GetProcessHeap () returned 0x580000 [0113.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02ff0 | out: hHeap=0x580000) returned 1 [0113.027] GetProcessHeap () returned 0x580000 [0113.027] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7ae8e8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a3c, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="msolui100.rll.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOLUI~1.YOU")) returned 0x5b96f0 [0113.027] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0113.311] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", len=0x3f | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 1 [0113.311] GetProcessHeap () returned 0x580000 [0113.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x104) returned 0x6f0ceb8 [0113.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0113.497] CloseHandle (hObject=0x48c) returned 1 [0113.497] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.497] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0420~1.YOU")) returned 0x5b9630 [0115.096] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0115.096] GetProcessHeap () returned 0x580000 [0115.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6c4a808 [0115.096] GetProcessHeap () returned 0x580000 [0115.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6c4c618 [0115.096] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.096] ReadFile (in: hFile=0x48c, lpBuffer=0x6c4a808, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesRead=0x524ff14*=0x1de0, lpOverlapped=0x0) returned 1 [0115.124] GetProcessHeap () returned 0x580000 [0115.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.124] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.124] WriteFile (in: hFile=0x48c, lpBuffer=0x6c4c618*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4c618*, lpNumberOfBytesWritten=0x524ff14*=0x1de0, lpOverlapped=0x0) returned 1 [0115.124] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.124] WriteFile (in: hFile=0x48c, lpBuffer=0x6c4e3f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e3f7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.124] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.124] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.124] CloseHandle (hObject=0x48c) returned 1 [0115.124] GetProcessHeap () returned 0x580000 [0115.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4c618 | out: hHeap=0x580000) returned 1 [0115.124] GetProcessHeap () returned 0x580000 [0115.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0115.124] GetProcessHeap () returned 0x580000 [0115.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c3aec20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e18, dwReserved0=0x524fd28, dwReserved1=0x6c4a808, cFileName="AN04206_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0420~1.YOU")) returned 0x5b9630 [0116.317] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0116.348] CloseHandle (hObject=0x450) returned 1 [0116.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.348] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0045~1.YOU")) returned 0x5b9730 [0116.349] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0116.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0116.349] GetProcessHeap () returned 0x580000 [0116.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f04638 [0116.349] GetProcessHeap () returned 0x580000 [0116.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6dd8f68 [0116.349] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.349] ReadFile (in: hFile=0x450, lpBuffer=0x6f04638, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04638*, lpNumberOfBytesRead=0x524ff14*=0x540, lpOverlapped=0x0) returned 1 [0116.357] GetProcessHeap () returned 0x580000 [0116.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.357] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.357] WriteFile (in: hFile=0x450, lpBuffer=0x6dd8f68*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesWritten=0x524ff14*=0x540, lpOverlapped=0x0) returned 1 [0116.358] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.358] WriteFile (in: hFile=0x450, lpBuffer=0x6dd94a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd94a7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.358] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.358] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.358] CloseHandle (hObject=0x450) returned 1 [0116.358] GetProcessHeap () returned 0x580000 [0116.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0116.358] GetProcessHeap () returned 0x580000 [0116.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04638 | out: hHeap=0x580000) returned 1 [0116.358] GetProcessHeap () returned 0x580000 [0116.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cf6f8c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x524fd28, dwReserved1=0x6f04638, cFileName="SL00452_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0045~1.YOU")) returned 0x5b9630 [0117.933] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0117.937] CloseHandle (hObject=0x470) returned 1 [0117.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id_1622540890_.your_last_chance")) returned 1 [0117.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRNG_~1.YOU")) returned 0x5b9630 [0117.938] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0117.938] GetProcessHeap () returned 0x580000 [0117.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a41) returned 0x667250 [0117.938] GetProcessHeap () returned 0x580000 [0117.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a41) returned 0x6d0e508 [0117.938] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.938] ReadFile (in: hFile=0x470, lpBuffer=0x667250, nNumberOfBytesToRead=0x1a20, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x524ff14*=0x1a20, lpOverlapped=0x0) returned 1 [0117.966] GetProcessHeap () returned 0x580000 [0117.966] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0117.966] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.966] WriteFile (in: hFile=0x470, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x524ff14*=0x1a20, lpOverlapped=0x0) returned 1 [0117.966] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.966] WriteFile (in: hFile=0x470, lpBuffer=0x6d0ff27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ff27*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.967] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.967] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.967] CloseHandle (hObject=0x470) returned 1 [0117.967] GetProcessHeap () returned 0x580000 [0117.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0117.967] GetProcessHeap () returned 0x580000 [0117.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0117.967] GetProcessHeap () returned 0x580000 [0117.967] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0117.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dec2660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a50, dwReserved0=0x524fd28, dwReserved1=0x667250, cFileName="SPRNG_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRNG_~1.YOU")) returned 0x5b9630 [0117.967] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.080] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", len=0x3f | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF") returned 1 [0120.080] GetProcessHeap () returned 0x580000 [0120.080] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1780) returned 0x6d06ca8 [0120.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.081] CloseHandle (hObject=0x438) returned 1 [0120.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~1.YOU")) returned 0x5b96f0 [0120.082] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.082] GetProcessHeap () returned 0x580000 [0120.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6107d8 [0120.082] GetProcessHeap () returned 0x580000 [0120.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x610bc0 [0120.082] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.082] ReadFile (in: hFile=0x438, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x524ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0120.091] GetProcessHeap () returned 0x580000 [0120.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.091] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.092] WriteFile (in: hFile=0x438, lpBuffer=0x610bc0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x610bc0*, lpNumberOfBytesWritten=0x524ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0120.092] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.092] WriteFile (in: hFile=0x438, lpBuffer=0x610f5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x610f5f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.092] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.092] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.092] CloseHandle (hObject=0x438) returned 1 [0120.092] GetProcessHeap () returned 0x580000 [0120.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610bc0 | out: hHeap=0x580000) returned 1 [0120.092] GetProcessHeap () returned 0x580000 [0120.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0120.092] GetProcessHeap () returned 0x580000 [0120.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f3242c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x524fd28, dwReserved1=0x6107d8, cFileName="WB01749_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~1.YOU")) returned 0x5b96f0 [0120.092] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.147] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", len=0x4c | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 1 [0120.148] GetProcessHeap () returned 0x580000 [0120.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f0) returned 0x6d06ca8 [0120.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.260] CloseHandle (hObject=0x470) returned 1 [0120.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.265] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0221~2.YOU")) returned 0x5b9630 [0120.265] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.266] GetProcessHeap () returned 0x580000 [0120.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x635768 [0120.292] GetProcessHeap () returned 0x580000 [0120.292] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbe1) returned 0x6c29878 [0120.292] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.292] ReadFile (in: hFile=0x438, lpBuffer=0x635768, nNumberOfBytesToRead=0xbc0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x524ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0120.339] GetProcessHeap () returned 0x580000 [0120.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.339] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.339] WriteFile (in: hFile=0x438, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x524ff14*=0xbc0, lpOverlapped=0x0) returned 1 [0120.340] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.340] WriteFile (in: hFile=0x438, lpBuffer=0x6c2a437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a437*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.340] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.340] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.340] CloseHandle (hObject=0x438) returned 1 [0120.340] GetProcessHeap () returned 0x580000 [0120.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0120.340] GetProcessHeap () returned 0x580000 [0120.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0120.340] GetProcessHeap () returned 0x580000 [0120.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f5858c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x524fd28, dwReserved1=0x635768, cFileName="WB02218_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0221~2.YOU")) returned 0x5b9630 [0120.340] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.397] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", len=0x44 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 1 [0120.397] GetProcessHeap () returned 0x580000 [0120.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17cc) returned 0x6d06ca8 [0120.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0120.433] CloseHandle (hObject=0x488) returned 1 [0120.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.id_1622540890_.your_last_chance")) returned 1 [0120.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0120.434] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0120.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0120.435] GetProcessHeap () returned 0x580000 [0120.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10701) returned 0x6f468d8 [0120.436] GetProcessHeap () returned 0x580000 [0120.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10701) returned 0x6f56fe8 [0120.436] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.436] ReadFile (in: hFile=0x488, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x106e0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x524ff14*=0x106e0, lpOverlapped=0x0) returned 1 [0121.908] GetProcessHeap () returned 0x580000 [0121.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0121.908] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.908] WriteFile (in: hFile=0x488, lpBuffer=0x6f56fe8*, nNumberOfBytesToWrite=0x106e0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f56fe8*, lpNumberOfBytesWritten=0x524ff14*=0x106e0, lpOverlapped=0x0) returned 1 [0121.908] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.908] WriteFile (in: hFile=0x488, lpBuffer=0x6f676c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f676c7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.909] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.909] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.909] CloseHandle (hObject=0x488) returned 1 [0121.909] GetProcessHeap () returned 0x580000 [0121.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f56fe8 | out: hHeap=0x580000) returned 1 [0121.909] GetProcessHeap () returned 0x580000 [0121.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0121.909] GetProcessHeap () returned 0x580000 [0121.909] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0122.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80466240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1070c, dwReserved0=0x524fd28, dwReserved1=0x6f468d8, cFileName="Slipstream.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9630 [0122.251] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0122.311] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", len=0x42 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned 1 [0122.311] GetProcessHeap () returned 0x580000 [0122.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1970) returned 0x6f42f08 [0122.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0122.401] CloseHandle (hObject=0x4a0) returned 1 [0122.401] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.id_1622540890_.your_last_chance")) returned 1 [0122.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0122.402] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0122.402] GetProcessHeap () returned 0x580000 [0122.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0122.402] GetProcessHeap () returned 0x580000 [0122.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc0a00 [0122.402] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.402] ReadFile (in: hFile=0x4a0, lpBuffer=0x6daf1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.224] GetProcessHeap () returned 0x580000 [0124.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.224] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.224] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dc0a00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.224] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.225] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dd21ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd21ff*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.225] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.225] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.225] CloseHandle (hObject=0x4a0) returned 1 [0124.225] GetProcessHeap () returned 0x580000 [0124.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0124.225] GetProcessHeap () returned 0x580000 [0124.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0124.225] GetProcessHeap () returned 0x580000 [0124.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81a90f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c6a5, dwReserved0=0x524fd28, dwReserved1=0x6daf1d0, cFileName="Waveform.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0124.870] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.359] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned 1 [0125.360] GetProcessHeap () returned 0x580000 [0125.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b8) returned 0x6f42f08 [0125.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0128.884] CloseHandle (hObject=0x3e4) returned 1 [0128.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02975~1.YOU")) returned 0x5b9730 [0130.403] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0130.404] GetProcessHeap () returned 0x580000 [0130.404] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6dc1) returned 0x6e063d0 [0130.404] GetProcessHeap () returned 0x580000 [0130.404] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6dc1) returned 0x6e0d1a0 [0130.405] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.405] ReadFile (in: hFile=0x3e4, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6da0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x524ff14*=0x6da0, lpOverlapped=0x0) returned 1 [0132.399] GetProcessHeap () returned 0x580000 [0132.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.399] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.399] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e0d1a0*, nNumberOfBytesToWrite=0x6da0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0d1a0*, lpNumberOfBytesWritten=0x524ff14*=0x6da0, lpOverlapped=0x0) returned 1 [0132.400] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.400] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e13f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e13f3f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.400] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.400] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.400] CloseHandle (hObject=0x3e4) returned 1 [0132.400] GetProcessHeap () returned 0x580000 [0132.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0d1a0 | out: hHeap=0x580000) returned 1 [0132.400] GetProcessHeap () returned 0x580000 [0132.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0132.400] GetProcessHeap () returned 0x580000 [0132.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x86885fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6ddc, dwReserved0=0x524fd28, dwReserved1=0x6e063d0, cFileName="J0297551.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02975~1.YOU")) returned 0x5b96f0 [0134.934] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.934] Sleep (dwMilliseconds=0x1) [0134.997] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 1 [0134.997] GetProcessHeap () returned 0x580000 [0134.997] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea4) returned 0x6f14048 [0134.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0135.017] CloseHandle (hObject=0x4a0) returned 1 [0135.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.017] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0135.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EX6884~1.YOU")) returned 0x5b96f0 [0135.018] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0135.018] GetProcessHeap () returned 0x580000 [0135.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0135.018] GetProcessHeap () returned 0x580000 [0135.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0135.019] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.019] ReadFile (in: hFile=0x4a0, lpBuffer=0x6daf1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.333] GetProcessHeap () returned 0x580000 [0138.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdcc0 [0138.333] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.333] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.513] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.513] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.563] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.563] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.564] CloseHandle (hObject=0x4a0) returned 1 [0138.599] GetProcessHeap () returned 0x580000 [0138.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0138.600] GetProcessHeap () returned 0x580000 [0138.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0138.603] GetProcessHeap () returned 0x580000 [0138.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdcc0 | out: hHeap=0x580000) returned 1 [0139.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a349ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b2e22, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="EXCEL.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EX6884~1.YOU")) returned 0x5b9770 [0139.879] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.907] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x59 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0139.907] GetProcessHeap () returned 0x580000 [0139.907] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0139.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.922] CloseHandle (hObject=0x3b4) returned 1 [0139.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0139.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0139.942] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.942] GetProcessHeap () returned 0x580000 [0139.942] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0139.942] GetProcessHeap () returned 0x580000 [0139.942] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0139.942] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.942] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x524ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0139.944] GetProcessHeap () returned 0x580000 [0139.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdef0 [0139.944] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.944] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x524ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0139.944] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.945] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.945] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.945] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.945] CloseHandle (hObject=0x3b4) returned 1 [0139.945] GetProcessHeap () returned 0x580000 [0139.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0139.945] GetProcessHeap () returned 0x580000 [0139.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0139.945] GetProcessHeap () returned 0x580000 [0139.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdef0 | out: hHeap=0x580000) returned 1 [0140.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b0617c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x524fd28, dwReserved1=0x6f3ef20, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.179] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", len=0x43 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned 1 [0140.179] GetProcessHeap () returned 0x580000 [0140.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.193] CloseHandle (hObject=0x454) returned 1 [0140.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.193] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e24d100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4e24d100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~4.YOU")) returned 0x5b9770 [0140.194] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.194] GetProcessHeap () returned 0x580000 [0140.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb21) returned 0x6e063d0 [0140.194] GetProcessHeap () returned 0x580000 [0140.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb21) returned 0x677cd0 [0140.194] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.194] ReadFile (in: hFile=0x454, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xb00, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x524ff14*=0xb00, lpOverlapped=0x0) returned 1 [0140.222] GetProcessHeap () returned 0x580000 [0140.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce8c8 [0140.222] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.222] WriteFile (in: hFile=0x454, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x524ff14*=0xb00, lpOverlapped=0x0) returned 1 [0140.222] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.222] WriteFile (in: hFile=0x454, lpBuffer=0x6787cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6787cf*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.222] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.222] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.222] CloseHandle (hObject=0x454) returned 1 [0140.222] GetProcessHeap () returned 0x580000 [0140.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0140.222] GetProcessHeap () returned 0x580000 [0140.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0140.222] GetProcessHeap () returned 0x580000 [0140.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce8c8 | out: hHeap=0x580000) returned 1 [0140.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e24d100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b30f080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb28, dwReserved0=0x524fd28, dwReserved1=0x6e063d0, cFileName="BD21303_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~4.YOU")) returned 0x5b9770 [0140.662] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0141.743] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS", len=0x3b | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS") returned 1 [0141.743] GetProcessHeap () returned 0x580000 [0141.743] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eec) returned 0x6f14048 [0141.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0141.806] CloseHandle (hObject=0x428) returned 1 [0141.806] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.id_1622540890_.your_last_chance")) returned 1 [0141.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e830b00, ftLastWriteTime.dwHighDateTime=0x1ca4730, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRP~1.YOU")) returned 0x5b9730 [0141.807] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0141.807] GetProcessHeap () returned 0x580000 [0141.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c21) returned 0x6d93648 [0141.808] GetProcessHeap () returned 0x580000 [0141.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c21) returned 0x6f58108 [0141.808] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.808] ReadFile (in: hFile=0x428, lpBuffer=0x6d93648, nNumberOfBytesToRead=0x5c00, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d93648*, lpNumberOfBytesRead=0x524ff14*=0x5c00, lpOverlapped=0x0) returned 1 [0142.372] GetProcessHeap () returned 0x580000 [0142.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0142.373] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.373] WriteFile (in: hFile=0x428, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x524ff14*=0x5c00, lpOverlapped=0x0) returned 1 [0142.373] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.373] WriteFile (in: hFile=0x428, lpBuffer=0x6f5dd07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5dd07*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.373] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.373] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.373] CloseHandle (hObject=0x428) returned 1 [0142.975] GetProcessHeap () returned 0x580000 [0142.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0142.975] GetProcessHeap () returned 0x580000 [0142.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d93648 | out: hHeap=0x580000) returned 1 [0142.975] GetProcessHeap () returned 0x580000 [0142.975] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0146.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8c796e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5c24, dwReserved0=0x524fd28, dwReserved1=0x6d93648, cFileName="PROPRPT.VSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRP~1.YOU")) returned 0x5b96f0 [0146.771] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.859] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", len=0x44 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned 1 [0146.859] GetProcessHeap () returned 0x580000 [0146.859] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0146.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.909] CloseHandle (hObject=0x3b4) returned 1 [0149.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0149.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.id_1622540890_.your_last_chance")) returned 1 [0149.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0149.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x910b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR32~1.YOU")) returned 0x5b96f0 [0149.910] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0149.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0149.910] GetProcessHeap () returned 0x580000 [0149.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9121) returned 0x6de0f50 [0149.910] GetProcessHeap () returned 0x580000 [0149.910] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9121) returned 0x6d8e818 [0149.910] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.910] ReadFile (in: hFile=0x3b4, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x9100, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x524ff14*=0x9100, lpOverlapped=0x0) returned 1 [0151.798] GetProcessHeap () returned 0x580000 [0151.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.798] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.798] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x524ff14*=0x9100, lpOverlapped=0x0) returned 1 [0151.798] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.799] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d97917*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d97917*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.799] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.799] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.799] CloseHandle (hObject=0x3b4) returned 1 [0151.799] GetProcessHeap () returned 0x580000 [0151.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0151.799] GetProcessHeap () returned 0x580000 [0151.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0151.799] GetProcessHeap () returned 0x580000 [0151.799] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92172cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x912f, dwReserved0=0x524fd28, dwReserved1=0x6de0f50, cFileName="PDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR32~1.YOU")) returned 0x5b9730 [0152.049] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.302] CloseHandle (hObject=0x488) returned 1 [0155.302] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.302] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~4.YOU")) returned 0x5b9730 [0155.303] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0155.303] GetProcessHeap () returned 0x580000 [0155.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.303] GetProcessHeap () returned 0x580000 [0155.303] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.303] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.303] ReadFile (in: hFile=0x488, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x524ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.305] GetProcessHeap () returned 0x580000 [0155.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.305] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x488, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x524ff14*=0x60, lpOverlapped=0x0) returned 1 [0155.305] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x488, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.305] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.305] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.305] CloseHandle (hObject=0x488) returned 1 [0155.305] GetProcessHeap () returned 0x580000 [0155.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.305] GetProcessHeap () returned 0x580000 [0155.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.305] GetProcessHeap () returned 0x580000 [0155.305] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x942ec220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x524fd28, dwReserved1=0x61b540, cFileName="WINPROJ_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~4.YOU")) returned 0x5b9630 [0155.970] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.985] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 1 [0155.985] GetProcessHeap () returned 0x580000 [0155.985] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0155.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0158.668] CloseHandle (hObject=0x39c) returned 1 [0158.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART8~1.YOU")) returned 0x5b9630 [0158.669] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0158.669] GetProcessHeap () returned 0x580000 [0158.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbfe1) returned 0x6eb0c28 [0158.669] GetProcessHeap () returned 0x580000 [0158.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbfe1) returned 0x6ebcc18 [0158.669] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.670] ReadFile (in: hFile=0x39c, lpBuffer=0x6eb0c28, nNumberOfBytesToRead=0xbfc0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb0c28*, lpNumberOfBytesRead=0x524ff14*=0xbfc0, lpOverlapped=0x0) returned 1 [0162.593] GetProcessHeap () returned 0x580000 [0162.593] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0162.593] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.593] WriteFile (in: hFile=0x39c, lpBuffer=0x6ebcc18*, nNumberOfBytesToWrite=0xbfc0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebcc18*, lpNumberOfBytesWritten=0x524ff14*=0xbfc0, lpOverlapped=0x0) returned 1 [0162.594] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.594] WriteFile (in: hFile=0x39c, lpBuffer=0x6ec8bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec8bd7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0162.594] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.594] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0162.594] CloseHandle (hObject=0x39c) returned 1 [0163.692] GetProcessHeap () returned 0x580000 [0163.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebcc18 | out: hHeap=0x580000) returned 1 [0163.693] GetProcessHeap () returned 0x580000 [0163.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb0c28 | out: hHeap=0x580000) returned 1 [0163.693] GetProcessHeap () returned 0x580000 [0163.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0166.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98866440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbfee, dwReserved0=0x524fd28, dwReserved1=0x6eb0c28, cFileName="MSART8.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART8~1.YOU")) returned 0x5b9630 [0166.207] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0166.284] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", len=0x3e | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 1 [0166.284] GetProcessHeap () returned 0x580000 [0166.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x226c) returned 0x6f14048 [0166.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0166.356] CloseHandle (hObject=0x4a4) returned 1 [0166.356] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id_1622540890_.your_last_chance")) returned 1 [0166.357] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97071d00, ftLastWriteTime.dwHighDateTime=0x1c67f43, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMSLIC~1.YOU")) returned 0x5b9730 [0166.357] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0166.357] GetProcessHeap () returned 0x580000 [0166.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6f63978 [0166.358] GetProcessHeap () returned 0x580000 [0166.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x6fded08 [0166.358] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.358] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f63978, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f63978*, lpNumberOfBytesRead=0x524ff14*=0x2780, lpOverlapped=0x0) returned 1 [0167.315] GetProcessHeap () returned 0x580000 [0167.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0167.315] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.315] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fded08*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fded08*, lpNumberOfBytesWritten=0x524ff14*=0x2780, lpOverlapped=0x0) returned 1 [0167.316] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.316] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fe1487*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe1487*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0167.316] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.316] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0167.316] CloseHandle (hObject=0x4a4) returned 1 [0167.935] GetProcessHeap () returned 0x580000 [0167.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fded08 | out: hHeap=0x580000) returned 1 [0167.935] GetProcessHeap () returned 0x580000 [0167.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f63978 | out: hHeap=0x580000) returned 1 [0167.935] GetProcessHeap () returned 0x580000 [0167.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b57a4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x524fd28, dwReserved1=0x6f63978, cFileName="MMSL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMSLIC~1.YOU")) returned 0x5b9630 [0170.165] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0172.814] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", len=0x3e | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 1 [0172.814] GetProcessHeap () returned 0x580000 [0172.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x228c) returned 0x6f14048 [0172.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.821] CloseHandle (hObject=0x490) returned 1 [0172.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id_1622540890_.your_last_chance")) returned 1 [0172.849] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac132a00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac132a00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMSSIC~1.YOU")) returned 0x5b9770 [0172.850] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.850] GetProcessHeap () returned 0x580000 [0172.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d330c0 [0172.850] GetProcessHeap () returned 0x580000 [0172.850] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d339c8 [0172.850] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.850] ReadFile (in: hFile=0x490, lpBuffer=0x6d330c0, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330c0*, lpNumberOfBytesRead=0x524ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0172.871] GetProcessHeap () returned 0x580000 [0172.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.871] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.871] WriteFile (in: hFile=0x490, lpBuffer=0x6d339c8*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d339c8*, lpNumberOfBytesWritten=0x524ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0172.872] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.872] WriteFile (in: hFile=0x490, lpBuffer=0x6d34267*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d34267*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.872] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.872] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.872] CloseHandle (hObject=0x490) returned 1 [0172.873] GetProcessHeap () returned 0x580000 [0172.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d339c8 | out: hHeap=0x580000) returned 1 [0172.873] GetProcessHeap () returned 0x580000 [0172.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330c0 | out: hHeap=0x580000) returned 1 [0172.873] GetProcessHeap () returned 0x580000 [0172.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.185] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac132a00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ea70e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x524fd28, dwReserved1=0x6d330c0, cFileName="SMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMSSIC~1.YOU")) returned 0x5b9770 [0173.187] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.459] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL", len=0x3c | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 1 [0174.459] GetProcessHeap () returned 0x580000 [0174.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0174.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0174.461] CloseHandle (hObject=0x478) returned 1 [0174.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id_1622540890_.your_last_chance")) returned 1 [0174.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISUTI~1.YOU")) returned 0x5b9730 [0174.462] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0174.462] GetProcessHeap () returned 0x580000 [0174.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc581) returned 0x6f976f8 [0174.463] GetProcessHeap () returned 0x580000 [0174.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc581) returned 0x6fa3c88 [0174.463] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.463] ReadFile (in: hFile=0x478, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0xc560, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x524ff14*=0xc560, lpOverlapped=0x0) returned 1 [0176.228] GetProcessHeap () returned 0x580000 [0176.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.228] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.228] WriteFile (in: hFile=0x478, lpBuffer=0x6fa3c88*, nNumberOfBytesToWrite=0xc560, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa3c88*, lpNumberOfBytesWritten=0x524ff14*=0xc560, lpOverlapped=0x0) returned 1 [0176.228] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.228] WriteFile (in: hFile=0x478, lpBuffer=0x6fb01e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb01e7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.229] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.229] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.229] CloseHandle (hObject=0x478) returned 1 [0176.229] GetProcessHeap () returned 0x580000 [0176.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa3c88 | out: hHeap=0x580000) returned 1 [0176.229] GetProcessHeap () returned 0x580000 [0176.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0176.229] GetProcessHeap () returned 0x580000 [0176.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0a6d600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc594, dwReserved0=0x524fd28, dwReserved1=0x6f976f8, cFileName="VISUTILS.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISUTI~1.YOU")) returned 0x5b96f0 [0179.052] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.064] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", len=0x4c | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx") returned 1 [0179.064] GetProcessHeap () returned 0x580000 [0179.064] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0179.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0179.064] CloseHandle (hObject=0x440) returned 1 [0179.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.id_1622540890_.your_last_chance")) returned 1 [0179.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5adf, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b96f0 [0179.066] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0179.066] GetProcessHeap () returned 0x580000 [0179.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ae1) returned 0x6d708d8 [0179.066] GetProcessHeap () returned 0x580000 [0179.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ae1) returned 0x6e063d0 [0179.067] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.067] ReadFile (in: hFile=0x440, lpBuffer=0x6d708d8, nNumberOfBytesToRead=0x5ac0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d708d8*, lpNumberOfBytesRead=0x524ff14*=0x5ac0, lpOverlapped=0x0) returned 1 [0179.805] GetProcessHeap () returned 0x580000 [0179.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.805] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.806] WriteFile (in: hFile=0x440, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x5ac0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x524ff14*=0x5ac0, lpOverlapped=0x0) returned 1 [0179.806] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.806] WriteFile (in: hFile=0x440, lpBuffer=0x6e0be8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0be8f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.806] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.806] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.795] CloseHandle (hObject=0x440) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d708d8 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa36048e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b03, dwReserved0=0x524fd28, dwReserved1=0x6d708d8, cFileName="Perspective.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSPE~1.YOU")) returned 0x5b9770 [0182.213] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.567] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", len=0x54 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned 1 [0183.567] GetProcessHeap () returned 0x580000 [0183.567] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x213c) returned 0x6f14048 [0183.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.603] CloseHandle (hObject=0x488) returned 1 [0183.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a588200, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~1.YOU")) returned 0x5b9770 [0183.604] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.604] GetProcessHeap () returned 0x580000 [0183.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0183.604] GetProcessHeap () returned 0x580000 [0183.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x7066b08 [0183.604] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.604] ReadFile (in: hFile=0x488, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x524ff14*=0x1320, lpOverlapped=0x0) returned 1 [0183.622] GetProcessHeap () returned 0x580000 [0183.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.622] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.622] WriteFile (in: hFile=0x488, lpBuffer=0x7066b08*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesWritten=0x524ff14*=0x1320, lpOverlapped=0x0) returned 1 [0183.622] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.622] WriteFile (in: hFile=0x488, lpBuffer=0x7067e27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7067e27*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.622] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.622] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.622] CloseHandle (hObject=0x488) returned 1 [0183.622] GetProcessHeap () returned 0x580000 [0183.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0183.622] GetProcessHeap () returned 0x580000 [0183.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0183.622] GetProcessHeap () returned 0x580000 [0183.622] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa50f21c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x135e, dwReserved0=0x524fd28, dwReserved1=0x67ec60, cFileName="NotifierWindowMaskRTL.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~1.YOU")) returned 0x5b9770 [0183.808] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.816] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", len=0x6e | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned 1 [0183.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0183.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0185.537] CloseHandle (hObject=0x4a8) returned 1 [0185.537] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.537] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.538] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e72, dwReserved0=0x4a002e, dwReserved1=0x470050, cFileName="HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADIN~1.YOU")) returned 0x5b9770 [0185.538] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0185.539] GetProcessHeap () returned 0x580000 [0185.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e81) returned 0x6e09e60 [0185.539] GetProcessHeap () returned 0x580000 [0185.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e81) returned 0x707ec98 [0185.539] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.539] ReadFile (in: hFile=0x4a8, lpBuffer=0x6e09e60, nNumberOfBytesToRead=0x3e60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e09e60*, lpNumberOfBytesRead=0x524ff14*=0x3e60, lpOverlapped=0x0) returned 1 [0186.712] GetProcessHeap () returned 0x580000 [0186.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0186.713] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.713] WriteFile (in: hFile=0x4a8, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x524ff14*=0x3e60, lpOverlapped=0x0) returned 1 [0186.713] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.713] WriteFile (in: hFile=0x4a8, lpBuffer=0x7082af7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7082af7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.713] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.713] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.713] CloseHandle (hObject=0x4a8) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e09e60 | out: hHeap=0x580000) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0188.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e67200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e96, dwReserved0=0x524fd28, dwReserved1=0x6e09e60, cFileName="HEADING.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADIN~1.YOU")) returned 0x5b9770 [0188.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.074] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", len=0x45 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned 1 [0188.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x208c) returned 0x6f14048 [0188.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0188.979] CloseHandle (hObject=0x49c) returned 1 [0188.979] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.980] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.id_1622540890_.your_last_chance")) returned 1 [0188.980] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP302D~1.YOU")) returned 0x5b9770 [0188.980] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0188.980] GetProcessHeap () returned 0x580000 [0188.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6efb008 [0188.981] GetProcessHeap () returned 0x580000 [0188.981] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x6f67710 [0188.981] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.981] ReadFile (in: hFile=0x49c, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x524ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0188.996] GetProcessHeap () returned 0x580000 [0188.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.996] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.996] WriteFile (in: hFile=0x49c, lpBuffer=0x6f67710*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesWritten=0x524ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0188.997] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x49c, lpBuffer=0x6f687af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f687af*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.997] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.997] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.997] CloseHandle (hObject=0x49c) returned 1 [0188.997] GetProcessHeap () returned 0x580000 [0188.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0188.997] GetProcessHeap () returned 0x580000 [0188.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0188.997] GetProcessHeap () returned 0x580000 [0188.997] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8445c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10cb, dwReserved0=0x524fd28, dwReserved1=0x6efb008, cFileName="ZPDIR50B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP302D~1.YOU")) returned 0x5b9770 [0193.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.186] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", len=0x66 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned 1 [0193.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0193.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0193.195] CloseHandle (hObject=0x494) returned 1 [0193.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.id_1622540890_.your_last_chance")) returned 1 [0193.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0193.197] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0193.197] GetProcessHeap () returned 0x580000 [0193.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6dcfb90 [0193.197] GetProcessHeap () returned 0x580000 [0193.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x461) returned 0x6df0110 [0193.197] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.197] ReadFile (in: hFile=0x494, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x440, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x524ff14*=0x440, lpOverlapped=0x0) returned 1 [0193.202] GetProcessHeap () returned 0x580000 [0193.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.202] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.202] WriteFile (in: hFile=0x494, lpBuffer=0x6df0110*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df0110*, lpNumberOfBytesWritten=0x524ff14*=0x440, lpOverlapped=0x0) returned 1 [0193.202] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.202] WriteFile (in: hFile=0x494, lpBuffer=0x6df054f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df054f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.202] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.202] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.202] CloseHandle (hObject=0x494) returned 1 [0193.202] GetProcessHeap () returned 0x580000 [0193.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df0110 | out: hHeap=0x580000) returned 1 [0193.203] GetProcessHeap () returned 0x580000 [0193.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0193.203] GetProcessHeap () returned 0x580000 [0193.203] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.203] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaac4ae00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x481, dwReserved0=0x524fd28, dwReserved1=0x6dcfb90, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0193.203] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.208] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned 1 [0193.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2084) returned 0x6f14048 [0193.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0193.281] CloseHandle (hObject=0x3e4) returned 1 [0193.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0193.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46fe, dwReserved0=0x6c006d, dwReserved1=0x69002e, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b9770 [0193.282] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0193.282] GetProcessHeap () returned 0x580000 [0193.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x6d06ca8 [0193.282] GetProcessHeap () returned 0x580000 [0193.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x6fe37c8 [0193.282] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.282] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x46e0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x524ff14*=0x46e0, lpOverlapped=0x0) returned 1 [0195.067] GetProcessHeap () returned 0x580000 [0195.067] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.067] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.067] WriteFile (in: hFile=0x3e4, lpBuffer=0x6fe37c8*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe37c8*, lpNumberOfBytesWritten=0x524ff14*=0x46e0, lpOverlapped=0x0) returned 1 [0195.067] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x3e4, lpBuffer=0x6fe7ea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7ea7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.068] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.068] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.068] CloseHandle (hObject=0x3e4) returned 1 [0195.068] GetProcessHeap () returned 0x580000 [0195.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe37c8 | out: hHeap=0x580000) returned 1 [0195.068] GetProcessHeap () returned 0x580000 [0195.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0195.068] GetProcessHeap () returned 0x580000 [0195.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabe25300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4722, dwReserved0=0x524fd28, dwReserved1=0x6d06ca8, cFileName="FormsPreviewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~2.YOU")) returned 0x5b97b0 [0195.068] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.135] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", len=0x44 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned 1 [0199.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0199.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0199.136] CloseHandle (hObject=0x488) returned 1 [0199.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdf73, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR42~1.YOU")) returned 0x5b97f0 [0199.137] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0199.137] GetProcessHeap () returned 0x580000 [0199.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdf81) returned 0x7100718 [0199.137] GetProcessHeap () returned 0x580000 [0199.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdf81) returned 0x6f976f8 [0199.137] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.137] ReadFile (in: hFile=0x488, lpBuffer=0x7100718, nNumberOfBytesToRead=0xdf60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesRead=0x524ff14*=0xdf60, lpOverlapped=0x0) returned 1 [0200.855] GetProcessHeap () returned 0x580000 [0200.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.855] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.855] WriteFile (in: hFile=0x488, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0xdf60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x524ff14*=0xdf60, lpOverlapped=0x0) returned 1 [0200.855] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.855] WriteFile (in: hFile=0x488, lpBuffer=0x6fa5657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5657*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.856] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.856] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.856] CloseHandle (hObject=0x488) returned 1 [0200.856] GetProcessHeap () returned 0x580000 [0200.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0200.856] GetProcessHeap () returned 0x580000 [0200.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0200.856] GetProcessHeap () returned 0x580000 [0200.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf557120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdf97, dwReserved0=0x524fd28, dwReserved1=0x7100718, cFileName="PDIR42F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR42~1.YOU")) returned 0x5b9770 [0201.395] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.398] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", len=0x6b | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned 1 [0201.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0201.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.399] CloseHandle (hObject=0x480) returned 1 [0201.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.id_1622540890_.your_last_chance")) returned 1 [0201.400] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b9770 [0201.400] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.400] GetProcessHeap () returned 0x580000 [0201.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0201.400] GetProcessHeap () returned 0x580000 [0201.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x67ec60 [0201.400] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.401] ReadFile (in: hFile=0x480, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x524ff14*=0xe20, lpOverlapped=0x0) returned 1 [0201.424] GetProcessHeap () returned 0x580000 [0201.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.425] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.425] WriteFile (in: hFile=0x480, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x524ff14*=0xe20, lpOverlapped=0x0) returned 1 [0201.425] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.425] WriteFile (in: hFile=0x480, lpBuffer=0x67fa7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fa7f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.425] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.425] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.425] CloseHandle (hObject=0x480) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafab22a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe58, dwReserved0=0x524fd28, dwReserved1=0x6c29878, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b9770 [0201.456] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.179] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned 1 [0203.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0203.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.153] CloseHandle (hObject=0x484) returned 1 [0209.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.id_1622540890_.your_last_chance")) returned 1 [0209.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9830 [0209.154] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.154] GetProcessHeap () returned 0x580000 [0209.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6c79898 [0209.552] GetProcessHeap () returned 0x580000 [0209.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706ecb0 [0209.552] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.552] ReadFile (in: hFile=0x484, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x524ff14*=0x840, lpOverlapped=0x0) returned 1 [0209.574] GetProcessHeap () returned 0x580000 [0209.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.574] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.574] WriteFile (in: hFile=0x484, lpBuffer=0x706ecb0*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesWritten=0x524ff14*=0x840, lpOverlapped=0x0) returned 1 [0209.574] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.574] WriteFile (in: hFile=0x484, lpBuffer=0x706f4ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x706f4ef*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.574] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.574] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.574] CloseHandle (hObject=0x484) returned 1 [0209.574] GetProcessHeap () returned 0x580000 [0209.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0209.574] GetProcessHeap () returned 0x580000 [0209.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0209.574] GetProcessHeap () returned 0x580000 [0209.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48811c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x524fd28, dwReserved1=0x6c79898, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b97b0 [0210.091] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.144] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS", len=0x45 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS") returned 1 [0210.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0210.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0210.145] CloseHandle (hObject=0x47c) returned 1 [0210.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css.id_1622540890_.your_last_chance")) returned 1 [0210.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b50400, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b50400, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC6875~1.YOU")) returned 0x5b97b0 [0210.146] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0210.146] GetProcessHeap () returned 0x580000 [0210.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0210.146] GetProcessHeap () returned 0x580000 [0210.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0210.147] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.147] ReadFile (in: hFile=0x47c, lpBuffer=0x72d6838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.948] GetProcessHeap () returned 0x580000 [0213.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0213.949] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.949] WriteFile (in: hFile=0x47c, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.949] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.949] WriteFile (in: hFile=0x47c, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0213.950] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.950] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0213.950] CloseHandle (hObject=0x47c) returned 1 [0213.950] GetProcessHeap () returned 0x580000 [0213.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0214.250] GetProcessHeap () returned 0x580000 [0214.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0214.250] GetProcessHeap () returned 0x580000 [0214.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0214.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b50400, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb72292c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20016, dwReserved0=0x524fd28, dwReserved1=0x72d6838, cFileName="SCHEME19.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC6875~1.YOU")) returned 0x5b97b0 [0214.969] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.012] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 1 [0215.012] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0215.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.032] CloseHandle (hObject=0x458) returned 1 [0215.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_K_~1.YOU")) returned 0x5b97b0 [0215.033] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.033] GetProcessHeap () returned 0x580000 [0215.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.033] GetProcessHeap () returned 0x580000 [0215.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.033] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.033] ReadFile (in: hFile=0x458, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x524ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.035] GetProcessHeap () returned 0x580000 [0215.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0215.035] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.035] WriteFile (in: hFile=0x458, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x524ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.035] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.035] WriteFile (in: hFile=0x458, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.035] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.035] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.035] CloseHandle (hObject=0x458) returned 1 [0215.035] GetProcessHeap () returned 0x580000 [0215.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.035] GetProcessHeap () returned 0x580000 [0215.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.035] GetProcessHeap () returned 0x580000 [0215.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0215.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7c93300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x524fd28, dwReserved1=0x61b540, cFileName="OIS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_K_~1.YOU")) returned 0x5b97b0 [0215.036] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.048] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS", len=0x37 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 1 [0215.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0215.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0215.083] CloseHandle (hObject=0x428) returned 1 [0215.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id_1622540890_.your_last_chance")) returned 1 [0215.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6fd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OISHXS~1.YOU")) returned 0x5b97b0 [0215.084] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0215.084] GetProcessHeap () returned 0x580000 [0215.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0215.085] GetProcessHeap () returned 0x580000 [0215.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0215.085] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.085] ReadFile (in: hFile=0x428, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.451] GetProcessHeap () returned 0x580000 [0220.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0220.451] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.451] WriteFile (in: hFile=0x428, lpBuffer=0x6e21520*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.458] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.458] WriteFile (in: hFile=0x428, lpBuffer=0x6e32d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d1f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.788] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.788] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.788] CloseHandle (hObject=0x428) returned 1 [0220.788] GetProcessHeap () returned 0x580000 [0220.788] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0220.788] GetProcessHeap () returned 0x580000 [0220.788] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0220.788] GetProcessHeap () returned 0x580000 [0220.788] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0221.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbb378e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6fd28, dwReserved0=0x524fd28, dwReserved1=0x6e0fcf0, cFileName="OIS.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OISHXS~1.YOU")) returned 0x5b9730 [0221.868] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.879] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", len=0x61 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned 1 [0221.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0221.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.880] CloseHandle (hObject=0x460) returned 1 [0221.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.881] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICONIM~2.YOU")) returned 0x5b9730 [0221.881] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.881] GetProcessHeap () returned 0x580000 [0221.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1101) returned 0x65d9d0 [0221.881] GetProcessHeap () returned 0x580000 [0221.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1101) returned 0x67ec60 [0221.881] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.881] ReadFile (in: hFile=0x460, lpBuffer=0x65d9d0, nNumberOfBytesToRead=0x10e0, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x65d9d0*, lpNumberOfBytesRead=0x524ff14*=0x10e0, lpOverlapped=0x0) returned 1 [0221.900] GetProcessHeap () returned 0x580000 [0221.900] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0221.900] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.900] WriteFile (in: hFile=0x460, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x10e0, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x524ff14*=0x10e0, lpOverlapped=0x0) returned 1 [0221.900] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.900] WriteFile (in: hFile=0x460, lpBuffer=0x67fd3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fd3f*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.900] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.900] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.901] CloseHandle (hObject=0x460) returned 1 [0221.901] GetProcessHeap () returned 0x580000 [0221.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0221.901] GetProcessHeap () returned 0x580000 [0221.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d9d0 | out: hHeap=0x580000) returned 1 [0221.901] GetProcessHeap () returned 0x580000 [0221.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0221.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbe09000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1117, dwReserved0=0x524fd28, dwReserved1=0x65d9d0, cFileName="IconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICONIM~2.YOU")) returned 0x5b9730 [0221.901] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.952] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", len=0x6a | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned 1 [0221.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0221.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0221.952] CloseHandle (hObject=0x480) returned 1 [0221.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~2.YOU")) returned 0x5b9730 [0221.954] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0221.954] GetProcessHeap () returned 0x580000 [0221.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5f21) returned 0x7301a38 [0221.954] GetProcessHeap () returned 0x580000 [0221.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5f21) returned 0x6d10048 [0221.955] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.955] ReadFile (in: hFile=0x480, lpBuffer=0x7301a38, nNumberOfBytesToRead=0x5f00, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesRead=0x524ff14*=0x5f00, lpOverlapped=0x0) returned 1 [0222.529] GetProcessHeap () returned 0x580000 [0222.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.529] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.529] WriteFile (in: hFile=0x480, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x5f00, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x524ff14*=0x5f00, lpOverlapped=0x0) returned 1 [0222.529] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.529] WriteFile (in: hFile=0x480, lpBuffer=0x6d15f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d15f47*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.529] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.530] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.530] CloseHandle (hObject=0x480) returned 1 [0222.619] GetProcessHeap () returned 0x580000 [0222.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0222.619] GetProcessHeap () returned 0x580000 [0222.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0222.619] GetProcessHeap () returned 0x580000 [0222.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0225.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc3fc700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5f24, dwReserved0=0x524fd28, dwReserved1=0x7301a38, cFileName="SplashImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~2.YOU")) returned 0x5b9630 [0225.414] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.450] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", len=0x42 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 1 [0225.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0225.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0227.387] CloseHandle (hObject=0x438) returned 1 [0227.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0227.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id_1622540890_.your_last_chance")) returned 1 [0227.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0227.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTAL~2.YOU")) returned 0x5b9730 [0227.389] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0227.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0227.389] GetProcessHeap () returned 0x580000 [0227.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0227.389] GetProcessHeap () returned 0x580000 [0227.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7450048 [0227.389] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.389] ReadFile (in: hFile=0x438, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.621] GetProcessHeap () returned 0x580000 [0235.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0235.621] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.621] WriteFile (in: hFile=0x438, lpBuffer=0x7450048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.622] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.622] WriteFile (in: hFile=0x438, lpBuffer=0x7461847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461847*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0235.623] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.623] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0235.623] CloseHandle (hObject=0x438) returned 1 [0235.623] GetProcessHeap () returned 0x580000 [0235.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0235.623] GetProcessHeap () returned 0x580000 [0235.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0235.624] GetProcessHeap () returned 0x580000 [0235.624] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0240.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f77c40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85024, dwReserved0=0x524fd28, dwReserved1=0x6f976f8, cFileName="Installed_schemas14.xss.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTAL~2.YOU")) returned 0x5b9730 [0240.538] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.561] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML", len=0x4b | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned 1 [0240.561] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0240.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.582] CloseHandle (hObject=0x488) returned 1 [0240.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.583] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml.id_1622540890_.your_last_chance")) returned 1 [0240.583] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOJ~1.YOU")) returned 0x5b9730 [0240.584] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.584] GetProcessHeap () returned 0x580000 [0240.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.584] GetProcessHeap () returned 0x580000 [0240.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.584] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.584] ReadFile (in: hFile=0x488, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x524ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.606] GetProcessHeap () returned 0x580000 [0240.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0240.606] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.606] WriteFile (in: hFile=0x488, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x524ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.606] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.606] WriteFile (in: hFile=0x488, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.606] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.606] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.606] CloseHandle (hObject=0x488) returned 1 [0240.620] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.621] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.621] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0241.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6eed2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x355, dwReserved0=0x524fd28, dwReserved1=0x6d07028, cFileName="YAHOO.JP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOJ~1.YOU")) returned 0x5b9630 [0241.851] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.869] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML", len=0x40 | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned 1 [0241.869] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0241.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0245.154] CloseHandle (hObject=0x4a0) returned 1 [0245.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml.id_1622540890_.your_last_chance")) returned 1 [0245.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d1f00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x656d1f00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x40198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG7DD9~1.YOU")) returned 0x5b96f0 [0245.156] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0245.156] GetProcessHeap () returned 0x580000 [0245.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0245.156] GetProcessHeap () returned 0x580000 [0245.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0245.156] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.156] ReadFile (in: hFile=0x4a0, lpBuffer=0x7018958, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.182] GetProcessHeap () returned 0x580000 [0248.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0248.182] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.182] WriteFile (in: hFile=0x4a0, lpBuffer=0x702a188*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.183] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.183] WriteFile (in: hFile=0x4a0, lpBuffer=0x703b987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b987*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.213] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.213] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.213] CloseHandle (hObject=0x4a0) returned 1 [0248.247] GetProcessHeap () returned 0x580000 [0248.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0248.247] GetProcessHeap () returned 0x580000 [0248.247] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0248.247] GetProcessHeap () returned 0x580000 [0248.248] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0253.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d1f00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb7871e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x401bc, dwReserved0=0x524fd28, dwReserved1=0x7018958, cFileName="PGLBL111.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG7DD9~1.YOU")) returned 0x5b9730 [0253.157] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.192] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 1 [0253.192] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0253.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0253.193] CloseHandle (hObject=0x448) returned 1 [0253.193] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.194] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id_1622540890_.your_last_chance")) returned 1 [0253.194] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d76700, ftCreationTime.dwHighDateTime=0x1c5ee67, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d76700, ftLastWriteTime.dwHighDateTime=0x1c5ee67, nFileSizeHigh=0x0, nFileSizeLow=0x1b7ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZFOR~2.YOU")) returned 0x5b9730 [0253.195] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0253.195] GetProcessHeap () returned 0x580000 [0253.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0253.196] GetProcessHeap () returned 0x580000 [0253.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0253.196] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.196] ReadFile (in: hFile=0x448, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.488] GetProcessHeap () returned 0x580000 [0257.488] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0257.489] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.489] WriteFile (in: hFile=0x448, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x524ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.489] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.489] WriteFile (in: hFile=0x448, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.890] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.890] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.890] CloseHandle (hObject=0x448) returned 1 [0258.301] GetProcessHeap () returned 0x580000 [0258.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0258.301] GetProcessHeap () returned 0x580000 [0258.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0258.301] GetProcessHeap () returned 0x580000 [0258.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0259.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fccc | out: lpFindFileData=0x524fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d76700, ftCreationTime.dwHighDateTime=0x1c5ee67, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd13c4660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b7ee2, dwReserved0=0x524fd28, dwReserved1=0x707ec98, cFileName="BIZFORM.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZFOR~2.YOU")) returned 0x5b9630 [0259.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.232] SysReAllocStringLen (in: pbstr=0x524ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML", len=0x3d | out: pbstr=0x524ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML") returned 1 [0259.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d0) returned 0x72e5948 [0259.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0259.402] CloseHandle (hObject=0x484) returned 1 [0259.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml.id_1622540890_.your_last_chance")) returned 1 [0259.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x524ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x524fc74 | out: lpFindFileData=0x524fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd7a7a00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd7a7a00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x3d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBPAGE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBPAG~2.YOU")) returned 0x5b9630 [0259.405] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0259.405] GetProcessHeap () returned 0x580000 [0259.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d81) returned 0x7114ff8 [0259.405] GetProcessHeap () returned 0x580000 [0259.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d81) returned 0x72be368 [0259.406] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.406] ReadFile (in: hFile=0x484, lpBuffer=0x7114ff8, nNumberOfBytesToRead=0x3d60, lpNumberOfBytesRead=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x7114ff8*, lpNumberOfBytesRead=0x524ff14*=0x3d60, lpOverlapped=0x0) returned 1 [0261.947] GetProcessHeap () returned 0x580000 [0261.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0261.947] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.947] WriteFile (in: hFile=0x484, lpBuffer=0x72be368*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x72be368*, lpNumberOfBytesWritten=0x524ff14*=0x3d60, lpOverlapped=0x0) returned 1 [0261.947] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.947] WriteFile (in: hFile=0x484, lpBuffer=0x72c20c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c20c7*, lpNumberOfBytesWritten=0x524ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.947] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.947] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x524ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x524ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.947] CloseHandle (hObject=0x484) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72be368 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7114ff8 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 Thread: id = 43 os_tid = 0xaa4 [0039.067] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.817] Sleep (dwMilliseconds=0x1) [0039.841] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.594] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.554] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.916] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.359] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.390] Sleep (dwMilliseconds=0x1) [0043.408] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.436] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.468] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.562] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.593] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.841] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.872] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.418] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.558] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.714] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.823] Sleep (dwMilliseconds=0x1) [0044.839] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.901] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.979] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.026] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.213] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.588] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.165] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.321] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.415] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.508] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.555] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.934] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.178] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.584] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.684] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.708] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.849] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.020] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.473] Sleep (dwMilliseconds=0x1) [0048.488] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.644] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.972] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.097] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.393] Sleep (dwMilliseconds=0x1) [0049.409] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.442] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.705] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.799] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.861] Sleep (dwMilliseconds=0x1) [0049.877] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.908] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.329] Sleep (dwMilliseconds=0x1) [0050.345] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.407] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.455] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.719] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.813] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.984] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.281] Sleep (dwMilliseconds=0x1) [0051.296] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.374] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.903] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.074] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.230] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.355] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.386] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.605] Sleep (dwMilliseconds=0x1) [0052.620] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.839] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.979] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.057] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.166] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.447] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.525] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.681] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.915] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.993] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.243] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.539] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.617] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.695] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.742] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.929] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.007] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.163] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.475] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0056.722] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", len=0x4a | out: pbstr=0x538ff84*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 1 [0056.722] GetProcessHeap () returned 0x580000 [0056.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0056.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.241] CloseHandle (hObject=0x410) returned 1 [0057.242] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.242] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id_1622540890_.your_last_chance")) returned 1 [0057.242] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.242] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLKL~1.YOU")) returned 0x5b9630 [0057.242] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.242] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0057.243] GetProcessHeap () returned 0x580000 [0057.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c9d3e8 [0057.243] GetProcessHeap () returned 0x580000 [0057.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6caec18 [0057.244] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.244] ReadFile (in: hFile=0x410, lpBuffer=0x6c9d3e8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3e8*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.177] GetProcessHeap () returned 0x580000 [0060.177] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0060.177] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.177] WriteFile (in: hFile=0x410, lpBuffer=0x6caec18*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6caec18*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.624] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.624] WriteFile (in: hFile=0x410, lpBuffer=0x6cc0417*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0417*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0060.864] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.864] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0060.864] CloseHandle (hObject=0x410) returned 1 [0066.646] GetProcessHeap () returned 0x580000 [0066.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6caec18 | out: hHeap=0x580000) returned 1 [0066.646] GetProcessHeap () returned 0x580000 [0066.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9d3e8 | out: hHeap=0x580000) returned 1 [0066.646] GetProcessHeap () returned 0x580000 [0066.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0066.646] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5f786f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe21ff0, dwReserved0=0x538fd28, dwReserved1=0x6c9d3e8, cFileName="OutlkLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLKL~1.YOU")) returned 0x5b96b0 [0066.646] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0067.034] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", len=0x44 | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 1 [0067.034] GetProcessHeap () returned 0x580000 [0067.034] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x2c) returned 0x5e9710 [0067.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0067.995] CloseHandle (hObject=0x468) returned 1 [0067.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0067.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id_1622540890_.your_last_chance")) returned 1 [0067.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0067.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQNEDT~1.YOU")) returned 0x5b9630 [0067.996] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0067.997] GetProcessHeap () returned 0x580000 [0067.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f10048 [0067.997] GetProcessHeap () returned 0x580000 [0067.997] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0067.998] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.998] ReadFile (in: hFile=0x468, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.193] GetProcessHeap () returned 0x580000 [0073.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0073.193] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.193] WriteFile (in: hFile=0x468, lpBuffer=0x6d9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.918] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x468, lpBuffer=0x6db09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db09cf*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.918] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.918] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.918] CloseHandle (hObject=0x468) returned 1 [0073.919] GetProcessHeap () returned 0x580000 [0073.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0073.919] GetProcessHeap () returned 0x580000 [0073.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0073.919] GetProcessHeap () returned 0x580000 [0073.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0073.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b0db, dwReserved0=0x538fd28, dwReserved1=0x6f10048, cFileName="EQNEDT32.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQNEDT~1.YOU")) returned 0x5b96b0 [0073.919] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.948] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", len=0x42 | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 1 [0074.948] GetProcessHeap () returned 0x580000 [0074.948] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0074.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.949] Sleep (dwMilliseconds=0x1) [0074.965] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", len=0x3d | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 1 [0074.965] GetProcessHeap () returned 0x580000 [0074.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xa0) returned 0x5f76f0 [0074.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.967] Sleep (dwMilliseconds=0x1) [0079.338] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", len=0x3d | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 1 [0079.338] GetProcessHeap () returned 0x580000 [0079.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x70) returned 0x5f76f0 [0079.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.338] Sleep (dwMilliseconds=0x1) [0079.354] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", len=0x4c | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 1 [0079.354] GetProcessHeap () returned 0x580000 [0079.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x1c) returned 0x5f76f0 [0079.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.361] Sleep (dwMilliseconds=0x1) [0084.368] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", len=0x4e | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 1 [0084.368] GetProcessHeap () returned 0x580000 [0084.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0084.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0084.414] CloseHandle (hObject=0x428) returned 1 [0084.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.415] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id_1622540890_.your_last_chance")) returned 1 [0084.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOCKS~1.YOU")) returned 0x5b96b0 [0084.416] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0084.416] GetProcessHeap () returned 0x580000 [0084.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9881) returned 0x626d18 [0084.416] GetProcessHeap () returned 0x580000 [0084.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9881) returned 0x6d10048 [0084.417] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.417] ReadFile (in: hFile=0x428, lpBuffer=0x626d18, nNumberOfBytesToRead=0x9860, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x538ff14*=0x9860, lpOverlapped=0x0) returned 1 [0085.475] GetProcessHeap () returned 0x580000 [0085.475] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0085.475] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.476] WriteFile (in: hFile=0x428, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x9860, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x538ff14*=0x9860, lpOverlapped=0x0) returned 1 [0085.476] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.476] WriteFile (in: hFile=0x428, lpBuffer=0x6d198a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d198a7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0085.476] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0085.476] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0085.476] CloseHandle (hObject=0x428) returned 1 [0085.476] GetProcessHeap () returned 0x580000 [0085.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0085.476] GetProcessHeap () returned 0x580000 [0085.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0085.476] GetProcessHeap () returned 0x580000 [0085.476] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0085.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a9037a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x988d, dwReserved0=0x538fd28, dwReserved1=0x626d18, cFileName="STOCKS.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOCKS~1.YOU")) returned 0x5b9630 [0085.477] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.225] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 1 [0088.225] GetProcessHeap () returned 0x580000 [0088.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0088.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0088.225] CloseHandle (hObject=0x46c) returned 1 [0088.225] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0089.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0089.109] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0089.109] GetProcessHeap () returned 0x580000 [0089.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa921) returned 0x6cf6cd8 [0089.109] GetProcessHeap () returned 0x580000 [0089.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa921) returned 0x6481a0 [0089.109] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.109] ReadFile (in: hFile=0x46c, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0xa900, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x538ff14*=0xa900, lpOverlapped=0x0) returned 1 [0091.056] GetProcessHeap () returned 0x580000 [0091.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0091.057] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.057] WriteFile (in: hFile=0x46c, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0xa900, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x538ff14*=0xa900, lpOverlapped=0x0) returned 1 [0091.442] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.442] WriteFile (in: hFile=0x46c, lpBuffer=0x652a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x652a9f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0092.674] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.675] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0092.675] CloseHandle (hObject=0x46c) returned 1 [0092.675] GetProcessHeap () returned 0x580000 [0092.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0092.675] GetProcessHeap () returned 0x580000 [0092.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0092.675] GetProcessHeap () returned 0x580000 [0092.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0092.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ed99180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa930, dwReserved0=0x538fd28, dwReserved1=0x6cf6cd8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0092.675] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.198] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 1 [0094.198] GetProcessHeap () returned 0x580000 [0094.199] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x44) returned 0x596cd8 [0094.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0094.251] CloseHandle (hObject=0x474) returned 1 [0094.251] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.251] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0094.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0094.337] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0094.337] GetProcessHeap () returned 0x580000 [0094.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d01) returned 0x673cd0 [0094.338] GetProcessHeap () returned 0x580000 [0094.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7d01) returned 0x6e1d770 [0094.338] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.338] ReadFile (in: hFile=0x474, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x7ce0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x538ff14*=0x7ce0, lpOverlapped=0x0) returned 1 [0097.217] GetProcessHeap () returned 0x580000 [0097.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0097.217] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.217] WriteFile (in: hFile=0x474, lpBuffer=0x6e1d770*, nNumberOfBytesToWrite=0x7ce0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1d770*, lpNumberOfBytesWritten=0x538ff14*=0x7ce0, lpOverlapped=0x0) returned 1 [0097.217] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x474, lpBuffer=0x6e2544f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e2544f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.218] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.218] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.218] CloseHandle (hObject=0x474) returned 1 [0097.218] GetProcessHeap () returned 0x580000 [0097.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e1d770 | out: hHeap=0x580000) returned 1 [0097.218] GetProcessHeap () returned 0x580000 [0097.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0097.218] GetProcessHeap () returned 0x580000 [0097.218] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0097.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x718e41a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7d0b, dwReserved0=0x538fd28, dwReserved1=0x673cd0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.218] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0098.285] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", len=0x47 | out: pbstr=0x538ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 1 [0098.285] GetProcessHeap () returned 0x580000 [0098.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0098.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0100.002] CloseHandle (hObject=0x4a8) returned 1 [0100.002] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0100.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id_1622540890_.your_last_chance")) returned 1 [0100.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEE~1.YOU")) returned 0x5b96f0 [0100.011] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0100.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0100.011] GetProcessHeap () returned 0x580000 [0100.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0100.012] GetProcessHeap () returned 0x580000 [0100.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0100.013] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.013] ReadFile (in: hFile=0x4a8, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0103.387] GetProcessHeap () returned 0x580000 [0103.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.388] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.388] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0103.388] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.388] WriteFile (in: hFile=0x4a8, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.388] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.388] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.389] CloseHandle (hObject=0x4a8) returned 1 [0103.389] GetProcessHeap () returned 0x580000 [0103.389] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0103.394] GetProcessHeap () returned 0x580000 [0103.395] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0103.395] GetProcessHeap () returned 0x580000 [0103.395] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x753ce220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14c64, dwReserved0=0x580000, dwReserved1=0x6f03890, cFileName="SLATE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEE~1.YOU")) returned 0x5b9630 [0103.395] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.055] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", len=0x52 | out: pbstr=0x538ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 1 [0112.055] GetProcessHeap () returned 0x580000 [0112.055] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.067] Sleep (dwMilliseconds=0x1) [0112.189] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.206] Sleep (dwMilliseconds=0x1) [0112.314] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", len=0x49 | out: pbstr=0x538ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned 1 [0112.314] GetProcessHeap () returned 0x580000 [0112.314] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1828, Size=0x4c) returned 0x5e1ae8 [0112.314] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.327] Sleep (dwMilliseconds=0x1) [0113.329] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", len=0x3f | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 1 [0113.329] GetProcessHeap () returned 0x580000 [0113.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xa8) returned 0x6f0ceb8 [0113.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0113.482] CloseHandle (hObject=0x474) returned 1 [0113.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.598] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0096~1.YOU")) returned 0x5b9630 [0114.599] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0114.599] GetProcessHeap () returned 0x580000 [0114.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x6e063d0 [0114.599] GetProcessHeap () returned 0x580000 [0114.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1bc1) returned 0x65f250 [0114.599] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.599] ReadFile (in: hFile=0x474, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x1ba0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x538ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0114.625] GetProcessHeap () returned 0x580000 [0114.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.625] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.625] WriteFile (in: hFile=0x474, lpBuffer=0x65f250*, nNumberOfBytesToWrite=0x1ba0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f250*, lpNumberOfBytesWritten=0x538ff14*=0x1ba0, lpOverlapped=0x0) returned 1 [0114.625] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.625] WriteFile (in: hFile=0x474, lpBuffer=0x660def*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x660def*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.625] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.625] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.625] CloseHandle (hObject=0x474) returned 1 [0114.625] GetProcessHeap () returned 0x580000 [0114.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f250 | out: hHeap=0x580000) returned 1 [0114.625] GetProcessHeap () returned 0x580000 [0114.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0114.625] GetProcessHeap () returned 0x580000 [0114.625] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7beec020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x538fd28, dwReserved1=0x6e063d0, cFileName="AN00965_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0096~1.YOU")) returned 0x5b9630 [0115.609] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0115.615] CloseHandle (hObject=0x458) returned 1 [0115.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.616] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.616] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~1.YOU")) returned 0x5b9630 [0115.616] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0115.617] GetProcessHeap () returned 0x580000 [0115.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6cfec68 [0115.617] GetProcessHeap () returned 0x580000 [0115.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x23a1) returned 0x6c51c28 [0115.617] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.617] ReadFile (in: hFile=0x458, lpBuffer=0x6cfec68, nNumberOfBytesToRead=0x2380, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfec68*, lpNumberOfBytesRead=0x538ff14*=0x2380, lpOverlapped=0x0) returned 1 [0115.649] GetProcessHeap () returned 0x580000 [0115.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.649] WriteFile (in: hFile=0x458, lpBuffer=0x6c51c28*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c51c28*, lpNumberOfBytesWritten=0x538ff14*=0x2380, lpOverlapped=0x0) returned 1 [0115.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.649] WriteFile (in: hFile=0x458, lpBuffer=0x6c53fa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c53fa7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.649] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.649] CloseHandle (hObject=0x458) returned 1 [0115.649] GetProcessHeap () returned 0x580000 [0115.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c51c28 | out: hHeap=0x580000) returned 1 [0115.650] GetProcessHeap () returned 0x580000 [0115.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfec68 | out: hHeap=0x580000) returned 1 [0115.650] GetProcessHeap () returned 0x580000 [0115.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c8bdae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x23b0, dwReserved0=0x538fd28, dwReserved1=0x6cfec68, cFileName="SO00197_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~1.YOU")) returned 0x5b9630 [0117.326] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.100] CloseHandle (hObject=0x4a0) returned 1 [0118.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~1.YOU")) returned 0x5b9730 [0118.414] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.414] GetProcessHeap () returned 0x580000 [0118.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6c676b8 [0118.415] GetProcessHeap () returned 0x580000 [0118.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x677cd0 [0118.415] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.415] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x538ff14*=0x800, lpOverlapped=0x0) returned 1 [0118.424] GetProcessHeap () returned 0x580000 [0118.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.424] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.424] WriteFile (in: hFile=0x4a0, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x538ff14*=0x800, lpOverlapped=0x0) returned 1 [0118.424] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.424] WriteFile (in: hFile=0x4a0, lpBuffer=0x6784cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6784cf*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.424] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.424] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.425] CloseHandle (hObject=0x4a0) returned 1 [0118.425] GetProcessHeap () returned 0x580000 [0118.425] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0118.425] GetProcessHeap () returned 0x580000 [0118.425] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.425] GetProcessHeap () returned 0x580000 [0118.425] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e338fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x538fd28, dwReserved1=0x6c676b8, cFileName="SO02261_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~1.YOU")) returned 0x5b96f0 [0120.123] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.149] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", len=0x4c | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 1 [0120.149] GetProcessHeap () returned 0x580000 [0120.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e0) returned 0x6d06ca8 [0120.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.682] CloseHandle (hObject=0x48c) returned 1 [0120.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0218~1.YOU")) returned 0x5b9630 [0120.685] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.686] GetProcessHeap () returned 0x580000 [0120.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x626d30 [0120.686] GetProcessHeap () returned 0x580000 [0120.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6272f8 [0120.686] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.686] ReadFile (in: hFile=0x48c, lpBuffer=0x626d30, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x538ff14*=0x560, lpOverlapped=0x0) returned 1 [0120.692] GetProcessHeap () returned 0x580000 [0120.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.692] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.692] WriteFile (in: hFile=0x48c, lpBuffer=0x6272f8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6272f8*, lpNumberOfBytesWritten=0x538ff14*=0x560, lpOverlapped=0x0) returned 1 [0120.692] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.692] WriteFile (in: hFile=0x48c, lpBuffer=0x627857*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x627857*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.692] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.692] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.692] CloseHandle (hObject=0x48c) returned 1 [0120.692] GetProcessHeap () returned 0x580000 [0120.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6272f8 | out: hHeap=0x580000) returned 1 [0120.692] GetProcessHeap () returned 0x580000 [0120.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0120.692] GetProcessHeap () returned 0x580000 [0120.692] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.692] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f8cb700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x538fd28, dwReserved1=0x626d30, cFileName="WB02187_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0218~1.YOU")) returned 0x5b9630 [0120.692] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.709] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", len=0x4c | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned 1 [0120.710] GetProcessHeap () returned 0x580000 [0120.710] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1858) returned 0x6e00ac0 [0120.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.658] CloseHandle (hObject=0x3fc) returned 1 [0122.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.id_1622540890_.your_last_chance")) returned 1 [0122.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0122.659] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.659] GetProcessHeap () returned 0x580000 [0122.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.659] GetProcessHeap () returned 0x580000 [0122.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.659] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.659] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x538ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.664] GetProcessHeap () returned 0x580000 [0122.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.664] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.664] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x538ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.664] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.664] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.664] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.664] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.664] CloseHandle (hObject=0x3fc) returned 1 [0122.664] GetProcessHeap () returned 0x580000 [0122.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.664] GetProcessHeap () returned 0x580000 [0122.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.664] GetProcessHeap () returned 0x580000 [0122.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bb05a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e5, dwReserved0=0x538fd28, dwReserved1=0x678958, cFileName="Thatch.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0124.540] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.558] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", len=0x4e | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned 1 [0124.558] GetProcessHeap () returned 0x580000 [0124.558] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e0) returned 0x6f42f08 [0124.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.576] CloseHandle (hObject=0x470) returned 1 [0124.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.id_1622540890_.your_last_chance")) returned 1 [0124.576] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Composite.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPOS~1.YOU")) returned 0x5b9730 [0124.577] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.577] GetProcessHeap () returned 0x580000 [0124.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.577] GetProcessHeap () returned 0x580000 [0124.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.577] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.577] ReadFile (in: hFile=0x470, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x538ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.602] GetProcessHeap () returned 0x580000 [0124.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.602] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.602] WriteFile (in: hFile=0x470, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x538ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.602] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.602] WriteFile (in: hFile=0x470, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.603] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.603] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.603] CloseHandle (hObject=0x470) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.697] GetProcessHeap () returned 0x580000 [0124.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81e23020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x538fd28, dwReserved1=0x6f67710, cFileName="Composite.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPOS~1.YOU")) returned 0x5b9730 [0125.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.344] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", len=0x3d | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned 1 [0125.344] GetProcessHeap () returned 0x580000 [0125.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1940) returned 0x6f42f08 [0125.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0128.882] CloseHandle (hObject=0x3b8) returned 1 [0128.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02330~2.YOU")) returned 0x5b9730 [0130.312] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0130.312] GetProcessHeap () returned 0x580000 [0130.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7801) returned 0x6d69228 [0130.312] GetProcessHeap () returned 0x580000 [0130.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7801) returned 0x6d70a38 [0130.312] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.312] ReadFile (in: hFile=0x3b8, lpBuffer=0x6d69228, nNumberOfBytesToRead=0x77e0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d69228*, lpNumberOfBytesRead=0x538ff14*=0x77e0, lpOverlapped=0x0) returned 1 [0132.334] GetProcessHeap () returned 0x580000 [0132.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.335] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.335] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d70a38*, nNumberOfBytesToWrite=0x77e0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d70a38*, lpNumberOfBytesWritten=0x538ff14*=0x77e0, lpOverlapped=0x0) returned 1 [0132.335] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.335] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d78217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d78217*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.335] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.335] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.336] CloseHandle (hObject=0x3b8) returned 1 [0132.336] GetProcessHeap () returned 0x580000 [0132.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d70a38 | out: hHeap=0x580000) returned 1 [0132.336] GetProcessHeap () returned 0x580000 [0132.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d69228 | out: hHeap=0x580000) returned 1 [0132.336] GetProcessHeap () returned 0x580000 [0132.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x867eda20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7814, dwReserved0=0x538fd28, dwReserved1=0x6d69228, cFileName="J0233018.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02330~2.YOU")) returned 0x5b96f0 [0134.921] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.921] Sleep (dwMilliseconds=0x1) [0134.934] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL", len=0x45 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 1 [0134.934] GetProcessHeap () returned 0x580000 [0134.934] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0134.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0134.935] CloseHandle (hObject=0x464) returned 1 [0134.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0134.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRINTL~1.YOU")) returned 0x5b96f0 [0134.937] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0134.937] GetProcessHeap () returned 0x580000 [0134.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d69228 [0134.937] GetProcessHeap () returned 0x580000 [0134.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0134.937] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.937] ReadFile (in: hFile=0x464, lpBuffer=0x6d69228, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d69228*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.168] GetProcessHeap () returned 0x580000 [0138.168] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0138.169] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.169] WriteFile (in: hFile=0x464, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.492] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x464, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.492] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.492] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.492] CloseHandle (hObject=0x464) returned 1 [0138.578] GetProcessHeap () returned 0x580000 [0138.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0138.578] GetProcessHeap () returned 0x580000 [0138.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d69228 | out: hHeap=0x580000) returned 1 [0138.578] GetProcessHeap () returned 0x580000 [0138.578] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0139.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x187a4, dwReserved0=0x538fd28, dwReserved1=0x6d69228, cFileName="GRINTL32.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRINTL~1.YOU")) returned 0x5b9770 [0139.878] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.904] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x59 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0139.904] GetProcessHeap () returned 0x580000 [0139.904] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0139.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.904] CloseHandle (hObject=0x170) returned 1 [0139.904] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.904] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0139.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0139.932] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.932] GetProcessHeap () returned 0x580000 [0139.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0139.932] GetProcessHeap () returned 0x580000 [0139.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0139.932] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.932] ReadFile (in: hFile=0x170, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x538ff14*=0x400, lpOverlapped=0x0) returned 1 [0139.937] GetProcessHeap () returned 0x580000 [0139.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.937] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.937] WriteFile (in: hFile=0x170, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x538ff14*=0x400, lpOverlapped=0x0) returned 1 [0139.937] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.937] WriteFile (in: hFile=0x170, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.937] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.938] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.938] CloseHandle (hObject=0x170) returned 1 [0139.938] GetProcessHeap () returned 0x580000 [0139.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0139.938] GetProcessHeap () returned 0x580000 [0139.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0139.938] GetProcessHeap () returned 0x580000 [0139.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b0617c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x538fd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.140] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", len=0x60 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0140.140] GetProcessHeap () returned 0x580000 [0140.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0140.180] CloseHandle (hObject=0x470) returned 1 [0140.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0140.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0140.223] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0140.223] GetProcessHeap () returned 0x580000 [0140.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6f15e40 [0140.223] GetProcessHeap () returned 0x580000 [0140.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6dd20d0 [0140.224] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.224] ReadFile (in: hFile=0x470, lpBuffer=0x6f15e40, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15e40*, lpNumberOfBytesRead=0x538ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0140.249] GetProcessHeap () returned 0x580000 [0140.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce7b0 [0140.249] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.249] WriteFile (in: hFile=0x470, lpBuffer=0x6dd20d0*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesWritten=0x538ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0140.249] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.249] WriteFile (in: hFile=0x470, lpBuffer=0x6dd3baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3baf*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.254] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.254] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.254] CloseHandle (hObject=0x470) returned 1 [0140.254] GetProcessHeap () returned 0x580000 [0140.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0140.254] GetProcessHeap () returned 0x580000 [0140.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f15e40 | out: hHeap=0x580000) returned 1 [0140.254] GetProcessHeap () returned 0x580000 [0140.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce7b0 | out: hHeap=0x580000) returned 1 [0140.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b35b340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b1e, dwReserved0=0x538fd28, dwReserved1=0x6f15e40, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0140.662] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.666] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", len=0x43 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned 1 [0140.666] GetProcessHeap () returned 0x580000 [0140.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da8) returned 0x6f14048 [0140.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.047] CloseHandle (hObject=0x4a0) returned 1 [0141.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1484~2.YOU")) returned 0x5b9730 [0141.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.048] GetProcessHeap () returned 0x580000 [0141.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0141.048] GetProcessHeap () returned 0x580000 [0141.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0141.049] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.049] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x538ff14*=0x100, lpOverlapped=0x0) returned 1 [0141.050] GetProcessHeap () returned 0x580000 [0141.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.050] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.050] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x538ff14*=0x100, lpOverlapped=0x0) returned 1 [0141.051] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.051] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.051] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.051] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.051] CloseHandle (hObject=0x4a0) returned 1 [0141.051] GetProcessHeap () returned 0x580000 [0141.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0141.051] GetProcessHeap () returned 0x580000 [0141.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0141.051] GetProcessHeap () returned 0x580000 [0141.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8baf1960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x538fd28, dwReserved1=0x6f0a9f0, cFileName="BD14845_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1484~2.YOU")) returned 0x5b9730 [0146.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.453] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", len=0x45 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 1 [0146.453] GetProcessHeap () returned 0x580000 [0146.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0146.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0146.484] CloseHandle (hObject=0x448) returned 1 [0146.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0146.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x41b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUB6IN~1.YOU")) returned 0x5b9730 [0146.486] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0146.486] GetProcessHeap () returned 0x580000 [0146.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703cbf8 [0146.486] GetProcessHeap () returned 0x580000 [0146.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x704e428 [0146.487] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.487] ReadFile (in: hFile=0x448, lpBuffer=0x703cbf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x703cbf8*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.123] GetProcessHeap () returned 0x580000 [0151.123] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.123] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.123] WriteFile (in: hFile=0x448, lpBuffer=0x704e428*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x704e428*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.123] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.123] WriteFile (in: hFile=0x448, lpBuffer=0x705fc27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x705fc27*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.617] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.617] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.618] CloseHandle (hObject=0x448) returned 1 [0151.771] GetProcessHeap () returned 0x580000 [0151.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704e428 | out: hHeap=0x580000) returned 1 [0151.771] GetProcessHeap () returned 0x580000 [0151.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703cbf8 | out: hHeap=0x580000) returned 1 [0151.771] GetProcessHeap () returned 0x580000 [0151.771] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fcfda0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x41ba4, dwReserved0=0x538fd28, dwReserved1=0x703cbf8, cFileName="PUB6INTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUB6IN~1.YOU")) returned 0x5b9730 [0152.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.058] CloseHandle (hObject=0x478) returned 1 [0152.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0152.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~3.YOU")) returned 0x5b9730 [0152.060] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0152.060] GetProcessHeap () returned 0x580000 [0152.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0152.060] GetProcessHeap () returned 0x580000 [0152.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0152.060] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.060] ReadFile (in: hFile=0x478, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x538ff14*=0xc0, lpOverlapped=0x0) returned 1 [0152.061] GetProcessHeap () returned 0x580000 [0152.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.061] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.061] WriteFile (in: hFile=0x478, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x538ff14*=0xc0, lpOverlapped=0x0) returned 1 [0152.061] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.062] WriteFile (in: hFile=0x478, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.062] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.062] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.062] CloseHandle (hObject=0x478) returned 1 [0152.062] GetProcessHeap () returned 0x580000 [0152.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0152.062] GetProcessHeap () returned 0x580000 [0152.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0152.062] GetProcessHeap () returned 0x580000 [0152.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x923fa420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x538fd28, dwReserved1=0x5ad8a0, cFileName="VISIO.SHAPESHEET_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOS~3.YOU")) returned 0x5b9730 [0152.062] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0155.630] CloseHandle (hObject=0x430) returned 1 [0155.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.id_1622540890_.your_last_chance")) returned 1 [0155.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOC~1.YOU")) returned 0x5b9730 [0155.674] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0155.674] GetProcessHeap () returned 0x580000 [0155.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0155.674] GetProcessHeap () returned 0x580000 [0155.674] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6d9c298 [0155.675] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.675] ReadFile (in: hFile=0x430, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x538ff14*=0xd60, lpOverlapped=0x0) returned 1 [0155.688] GetProcessHeap () returned 0x580000 [0155.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.688] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x430, lpBuffer=0x6d9c298*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9c298*, lpNumberOfBytesWritten=0x538ff14*=0xd60, lpOverlapped=0x0) returned 1 [0155.688] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x430, lpBuffer=0x6d9cff7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9cff7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.688] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.688] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.688] CloseHandle (hObject=0x430) returned 1 [0155.688] GetProcessHeap () returned 0x580000 [0155.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9c298 | out: hHeap=0x580000) returned 1 [0155.688] GetProcessHeap () returned 0x580000 [0155.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0155.688] GetProcessHeap () returned 0x580000 [0155.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9467e320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x538fd28, dwReserved1=0x635768, cFileName="VISIO.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOC~1.YOU")) returned 0x5b9630 [0155.973] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.987] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", len=0x3e | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 1 [0155.987] GetProcessHeap () returned 0x580000 [0155.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0155.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0158.358] CloseHandle (hObject=0x478) returned 1 [0158.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~2.YOU")) returned 0x5b9630 [0158.359] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0158.359] GetProcessHeap () returned 0x580000 [0158.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc8c1) returned 0x6dbf1d0 [0158.360] GetProcessHeap () returned 0x580000 [0158.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc8c1) returned 0x705f068 [0158.360] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.360] ReadFile (in: hFile=0x478, lpBuffer=0x6dbf1d0, nNumberOfBytesToRead=0xc8a0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesRead=0x538ff14*=0xc8a0, lpOverlapped=0x0) returned 1 [0163.463] GetProcessHeap () returned 0x580000 [0163.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0163.463] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.463] WriteFile (in: hFile=0x478, lpBuffer=0x705f068*, nNumberOfBytesToWrite=0xc8a0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f068*, lpNumberOfBytesWritten=0x538ff14*=0xc8a0, lpOverlapped=0x0) returned 1 [0163.464] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] WriteFile (in: hFile=0x478, lpBuffer=0x706b907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x706b907*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0163.464] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0163.464] CloseHandle (hObject=0x478) returned 1 [0164.570] GetProcessHeap () returned 0x580000 [0164.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f068 | out: hHeap=0x580000) returned 1 [0164.571] GetProcessHeap () returned 0x580000 [0164.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0164.571] GetProcessHeap () returned 0x580000 [0164.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0166.508] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x990bb140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc8e0, dwReserved0=0x538fd28, dwReserved1=0x6dbf1d0, cFileName="MSART14.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~2.YOU")) returned 0x5b9730 [0166.508] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.548] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", len=0x3e | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 1 [0166.548] GetProcessHeap () returned 0x580000 [0166.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2244) returned 0x6f14048 [0166.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0166.574] CloseHandle (hObject=0x480) returned 1 [0166.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id_1622540890_.your_last_chance")) returned 1 [0166.575] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCSIC~1.YOU")) returned 0x5b9730 [0166.575] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0166.575] GetProcessHeap () returned 0x580000 [0166.575] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0166.576] GetProcessHeap () returned 0x580000 [0166.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0166.576] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.576] ReadFile (in: hFile=0x480, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.629] GetProcessHeap () returned 0x580000 [0166.629] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.629] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.629] WriteFile (in: hFile=0x480, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.630] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.630] WriteFile (in: hFile=0x480, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.630] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.630] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.630] CloseHandle (hObject=0x480) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0166.655] GetProcessHeap () returned 0x580000 [0166.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0169.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aeee860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x538fd28, dwReserved1=0x65f268, cFileName="DOCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DOCSIC~1.YOU")) returned 0x5b9730 [0169.809] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.869] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", len=0x43 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 1 [0169.869] GetProcessHeap () returned 0x580000 [0169.869] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0169.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.047] CloseHandle (hObject=0x480) returned 1 [0170.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id_1622540890_.your_last_chance")) returned 1 [0170.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLTASK~1.YOU")) returned 0x5b9730 [0170.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0170.048] GetProcessHeap () returned 0x580000 [0170.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x29c1) returned 0x704dd48 [0170.049] GetProcessHeap () returned 0x580000 [0170.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x29c1) returned 0x7050718 [0170.049] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.049] ReadFile (in: hFile=0x480, lpBuffer=0x704dd48, nNumberOfBytesToRead=0x29a0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x704dd48*, lpNumberOfBytesRead=0x538ff14*=0x29a0, lpOverlapped=0x0) returned 1 [0170.117] GetProcessHeap () returned 0x580000 [0170.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.117] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.117] WriteFile (in: hFile=0x480, lpBuffer=0x7050718*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x7050718*, lpNumberOfBytesWritten=0x538ff14*=0x29a0, lpOverlapped=0x0) returned 1 [0170.117] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.117] WriteFile (in: hFile=0x480, lpBuffer=0x70530b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70530b7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.118] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.118] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.118] CloseHandle (hObject=0x480) returned 1 [0170.118] GetProcessHeap () returned 0x580000 [0170.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7050718 | out: hHeap=0x580000) returned 1 [0170.118] GetProcessHeap () returned 0x580000 [0170.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704dd48 | out: hHeap=0x580000) returned 1 [0170.118] GetProcessHeap () returned 0x580000 [0170.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d01bb00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29d4, dwReserved0=0x538fd28, dwReserved1=0x704dd48, cFileName="OLTASKR.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLTASK~1.YOU")) returned 0x5b9730 [0170.118] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0173.046] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", len=0x42 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 1 [0173.046] GetProcessHeap () returned 0x580000 [0173.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2238) returned 0x6f14048 [0173.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.048] CloseHandle (hObject=0x46c) returned 1 [0173.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id_1622540890_.your_last_chance")) returned 1 [0173.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~2.YOU")) returned 0x5b9770 [0173.049] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.049] GetProcessHeap () returned 0x580000 [0173.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0173.049] GetProcessHeap () returned 0x580000 [0173.049] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0173.049] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.049] ReadFile (in: hFile=0x46c, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.061] GetProcessHeap () returned 0x580000 [0173.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.061] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.061] WriteFile (in: hFile=0x46c, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.061] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.062] WriteFile (in: hFile=0x46c, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.062] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.062] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.062] CloseHandle (hObject=0x46c) returned 1 [0173.062] GetProcessHeap () returned 0x580000 [0173.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0173.062] GetProcessHeap () returned 0x580000 [0173.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0173.062] GetProcessHeap () returned 0x580000 [0173.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec39ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x538fd28, dwReserved1=0x660a78, cFileName="SCDRESPS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~2.YOU")) returned 0x5b9770 [0173.062] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.067] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", len=0x42 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 1 [0173.067] GetProcessHeap () returned 0x580000 [0173.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2230) returned 0x6f14048 [0173.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.067] CloseHandle (hObject=0x454) returned 1 [0173.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.068] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id_1622540890_.your_last_chance")) returned 1 [0173.068] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC98AD~1.YOU")) returned 0x5b9770 [0173.068] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0173.069] GetProcessHeap () returned 0x580000 [0173.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0173.069] GetProcessHeap () returned 0x580000 [0173.069] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0173.069] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.069] ReadFile (in: hFile=0x454, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.080] GetProcessHeap () returned 0x580000 [0173.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.080] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.080] WriteFile (in: hFile=0x454, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.080] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.080] WriteFile (in: hFile=0x454, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.080] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.080] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.080] CloseHandle (hObject=0x454) returned 1 [0173.080] GetProcessHeap () returned 0x580000 [0173.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0173.080] GetProcessHeap () returned 0x580000 [0173.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0173.080] GetProcessHeap () returned 0x580000 [0173.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec60040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x538fd28, dwReserved1=0x660a78, cFileName="SCDRESNS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC98AD~1.YOU")) returned 0x5b9770 [0173.081] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.331] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", len=0x41 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 1 [0173.331] GetProcessHeap () returned 0x580000 [0173.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0173.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.331] CloseHandle (hObject=0x3fc) returned 1 [0173.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.331] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id_1622540890_.your_last_chance")) returned 1 [0173.332] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~1.YOU")) returned 0x5b9770 [0173.332] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.332] GetProcessHeap () returned 0x580000 [0173.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.332] GetProcessHeap () returned 0x580000 [0173.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.332] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.332] ReadFile (in: hFile=0x3fc, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.343] GetProcessHeap () returned 0x580000 [0173.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.343] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.343] WriteFile (in: hFile=0x3fc, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x538ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.344] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.344] WriteFile (in: hFile=0x3fc, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.344] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.344] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.344] CloseHandle (hObject=0x3fc) returned 1 [0173.344] GetProcessHeap () returned 0x580000 [0173.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0173.344] GetProcessHeap () returned 0x580000 [0173.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0173.344] GetProcessHeap () returned 0x580000 [0173.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eee77a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x538fd28, dwReserved1=0x662288, cFileName="POSTITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~1.YOU")) returned 0x5b9770 [0173.344] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0176.710] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", len=0x4b | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned 1 [0176.711] GetProcessHeap () returned 0x580000 [0176.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0176.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0176.713] CloseHandle (hObject=0x488) returned 1 [0176.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.713] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.id_1622540890_.your_last_chance")) returned 1 [0176.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.714] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x45, dwReserved1=0x0, cFileName="COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUPLE~1.YOU")) returned 0x5b96f0 [0176.714] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0176.714] GetProcessHeap () returned 0x580000 [0176.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9f21) returned 0x6d6ccf8 [0176.714] GetProcessHeap () returned 0x580000 [0176.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9f21) returned 0x6d8e818 [0176.714] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.714] ReadFile (in: hFile=0x488, lpBuffer=0x6d6ccf8, nNumberOfBytesToRead=0x9f00, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ccf8*, lpNumberOfBytesRead=0x538ff14*=0x9f00, lpOverlapped=0x0) returned 1 [0177.853] GetProcessHeap () returned 0x580000 [0177.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0177.853] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.853] WriteFile (in: hFile=0x488, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x9f00, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x538ff14*=0x9f00, lpOverlapped=0x0) returned 1 [0177.853] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.853] WriteFile (in: hFile=0x488, lpBuffer=0x6d98717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d98717*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.853] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.853] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.854] CloseHandle (hObject=0x488) returned 1 [0177.854] GetProcessHeap () returned 0x580000 [0177.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0177.854] GetProcessHeap () returned 0x580000 [0177.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6ccf8 | out: hHeap=0x580000) returned 1 [0177.855] GetProcessHeap () returned 0x580000 [0177.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa19e6500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9f3c, dwReserved0=0x538fd28, dwReserved1=0x6d6ccf8, cFileName="COUPLER.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUPLE~1.YOU")) returned 0x5b96f0 [0180.028] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.050] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", len=0x55 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned 1 [0180.051] GetProcessHeap () returned 0x580000 [0180.051] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0180.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.092] CloseHandle (hObject=0x43c) returned 1 [0180.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~2.YOU")) returned 0x5b96b0 [0180.101] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.101] GetProcessHeap () returned 0x580000 [0180.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6dcd2e0 [0180.101] GetProcessHeap () returned 0x580000 [0180.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0180.101] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.101] ReadFile (in: hFile=0x43c, lpBuffer=0x6dcd2e0, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd2e0*, lpNumberOfBytesRead=0x538ff14*=0x820, lpOverlapped=0x0) returned 1 [0180.144] GetProcessHeap () returned 0x580000 [0180.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0180.144] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.144] WriteFile (in: hFile=0x43c, lpBuffer=0x6c79898*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesWritten=0x538ff14*=0x820, lpOverlapped=0x0) returned 1 [0180.144] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.144] WriteFile (in: hFile=0x43c, lpBuffer=0x6c7a0b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a0b7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.144] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.144] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.144] CloseHandle (hObject=0x43c) returned 1 [0180.144] GetProcessHeap () returned 0x580000 [0180.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0180.144] GetProcessHeap () returned 0x580000 [0180.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd2e0 | out: hHeap=0x580000) returned 1 [0180.144] GetProcessHeap () returned 0x580000 [0180.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2fc4f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x538fd28, dwReserved1=0x6dcd2e0, cFileName="WebToolImagesMask16x16.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~2.YOU")) returned 0x5b96b0 [0180.145] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.190] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", len=0x50 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned 1 [0180.191] GetProcessHeap () returned 0x580000 [0180.191] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0180.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0180.191] CloseHandle (hObject=0x48c) returned 1 [0180.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90bafc00, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5431, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~4.YOU")) returned 0x5b9770 [0180.192] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0180.192] GetProcessHeap () returned 0x580000 [0180.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5441) returned 0x6fbecc8 [0180.192] GetProcessHeap () returned 0x580000 [0180.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5441) returned 0x708aa28 [0180.193] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.193] ReadFile (in: hFile=0x48c, lpBuffer=0x6fbecc8, nNumberOfBytesToRead=0x5420, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbecc8*, lpNumberOfBytesRead=0x538ff14*=0x5420, lpOverlapped=0x0) returned 1 [0181.852] GetProcessHeap () returned 0x580000 [0181.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0181.852] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.852] WriteFile (in: hFile=0x48c, lpBuffer=0x708aa28*, nNumberOfBytesToWrite=0x5420, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x708aa28*, lpNumberOfBytesWritten=0x538ff14*=0x5420, lpOverlapped=0x0) returned 1 [0181.852] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.852] WriteFile (in: hFile=0x48c, lpBuffer=0x708fe47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x708fe47*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.852] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.852] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.852] CloseHandle (hObject=0x48c) returned 1 [0181.853] GetProcessHeap () returned 0x580000 [0181.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708aa28 | out: hHeap=0x580000) returned 1 [0181.853] GetProcessHeap () returned 0x580000 [0181.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbecc8 | out: hHeap=0x580000) returned 1 [0181.853] GetProcessHeap () returned 0x580000 [0181.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4022660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5455, dwReserved0=0x538fd28, dwReserved1=0x6fbecc8, cFileName="WebToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBTOO~4.YOU")) returned 0x5b96b0 [0183.351] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.410] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", len=0x71 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned 1 [0183.410] GetProcessHeap () returned 0x580000 [0183.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.456] CloseHandle (hObject=0x3fc) returned 1 [0183.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x730061, dwReserved1=0x2e006b, cFileName="DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b96b0 [0183.457] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.457] GetProcessHeap () returned 0x580000 [0183.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1741) returned 0x6de8f50 [0183.458] GetProcessHeap () returned 0x580000 [0183.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1741) returned 0x6c6e0f8 [0183.458] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.458] ReadFile (in: hFile=0x3fc, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x1720, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x538ff14*=0x1720, lpOverlapped=0x0) returned 1 [0183.492] GetProcessHeap () returned 0x580000 [0183.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.492] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.492] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x538ff14*=0x1720, lpOverlapped=0x0) returned 1 [0183.493] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.493] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c6f817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f817*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.493] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.493] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.493] CloseHandle (hObject=0x3fc) returned 1 [0183.493] GetProcessHeap () returned 0x580000 [0183.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0183.493] GetProcessHeap () returned 0x580000 [0183.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0183.493] GetProcessHeap () returned 0x580000 [0183.493] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fc16c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x538fd28, dwReserved1=0x6de8f50, cFileName="DiscussionToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b96b0 [0183.493] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.566] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", len=0x6d | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned 1 [0183.566] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0183.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0184.096] CloseHandle (hObject=0x49c) returned 1 [0184.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0184.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x70006a, dwReserved1=0x2e0067, cFileName="ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVE~1.YOU")) returned 0x5b9770 [0184.098] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0184.098] GetProcessHeap () returned 0x580000 [0184.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x6fc1d78 [0184.098] GetProcessHeap () returned 0x580000 [0184.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x705d3f8 [0184.098] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.098] ReadFile (in: hFile=0x49c, lpBuffer=0x6fc1d78, nNumberOfBytesToRead=0x2500, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc1d78*, lpNumberOfBytesRead=0x538ff14*=0x2500, lpOverlapped=0x0) returned 1 [0184.668] GetProcessHeap () returned 0x580000 [0184.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0184.668] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.668] WriteFile (in: hFile=0x49c, lpBuffer=0x705d3f8*, nNumberOfBytesToWrite=0x2500, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x705d3f8*, lpNumberOfBytesWritten=0x538ff14*=0x2500, lpOverlapped=0x0) returned 1 [0184.668] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.668] WriteFile (in: hFile=0x49c, lpBuffer=0x705f8f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f8f7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.668] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.669] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.669] CloseHandle (hObject=0x49c) returned 1 [0184.669] GetProcessHeap () returned 0x580000 [0184.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705d3f8 | out: hHeap=0x580000) returned 1 [0184.669] GetProcessHeap () returned 0x580000 [0184.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc1d78 | out: hHeap=0x580000) returned 1 [0184.669] GetProcessHeap () returned 0x580000 [0184.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0184.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5ae9de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x253d, dwReserved0=0x538fd28, dwReserved1=0x6fc1d78, cFileName="ActiveTabImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVE~1.YOU")) returned 0x5b9770 [0184.669] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.836] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", len=0x57 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned 1 [0184.836] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2114) returned 0x6f14048 [0184.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.049] CloseHandle (hObject=0x43c) returned 1 [0185.049] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x22f6, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b9770 [0185.050] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.050] GetProcessHeap () returned 0x580000 [0185.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2301) returned 0x705d3f8 [0185.050] GetProcessHeap () returned 0x580000 [0185.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2301) returned 0x6dec6e0 [0185.050] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.050] ReadFile (in: hFile=0x43c, lpBuffer=0x705d3f8, nNumberOfBytesToRead=0x22e0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x705d3f8*, lpNumberOfBytesRead=0x538ff14*=0x22e0, lpOverlapped=0x0) returned 1 [0185.081] GetProcessHeap () returned 0x580000 [0185.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0185.081] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.081] WriteFile (in: hFile=0x43c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x538ff14*=0x22e0, lpOverlapped=0x0) returned 1 [0185.081] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.081] WriteFile (in: hFile=0x43c, lpBuffer=0x6dee9bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee9bf*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.081] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.081] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.081] CloseHandle (hObject=0x43c) returned 1 [0185.081] GetProcessHeap () returned 0x580000 [0185.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0185.081] GetProcessHeap () returned 0x580000 [0185.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705d3f8 | out: hHeap=0x580000) returned 1 [0185.081] GetProcessHeap () returned 0x580000 [0185.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0185.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5eee300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x231a, dwReserved0=0x538fd28, dwReserved1=0x705d3f8, cFileName="MessageHistoryIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~1.YOU")) returned 0x5b9770 [0185.533] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.581] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", len=0x4e | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned 1 [0185.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0187.121] CloseHandle (hObject=0x458) returned 1 [0187.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0187.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0187.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0187.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~1.YOU")) returned 0x5b96b0 [0187.122] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0187.122] GetProcessHeap () returned 0x580000 [0187.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0187.124] GetProcessHeap () returned 0x580000 [0187.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x635768 [0187.124] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.124] ReadFile (in: hFile=0x458, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x538ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0187.135] GetProcessHeap () returned 0x580000 [0187.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0187.135] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x458, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x538ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x458, lpBuffer=0x636347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x636347*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.135] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.135] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.135] CloseHandle (hObject=0x458) returned 1 [0187.136] GetProcessHeap () returned 0x580000 [0187.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0187.136] GetProcessHeap () returned 0x580000 [0187.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0187.136] GetProcessHeap () returned 0x580000 [0187.136] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0187.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa726b720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x538fd28, dwReserved1=0x677cd0, cFileName="InformationIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~1.YOU")) returned 0x5b96b0 [0187.136] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.138] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", len=0x72 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 1 [0187.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b4) returned 0x6f14048 [0187.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.660] CloseHandle (hObject=0x4a8) returned 1 [0188.660] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x6f0070, dwReserved1=0x740072, cFileName="Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~1.YOU")) returned 0x5b9770 [0188.699] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.699] GetProcessHeap () returned 0x580000 [0188.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70e7db8 [0188.700] GetProcessHeap () returned 0x580000 [0188.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70f95e8 [0188.700] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.700] ReadFile (in: hFile=0x4a8, lpBuffer=0x70e7db8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70e7db8*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.858] GetProcessHeap () returned 0x580000 [0191.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0191.858] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.858] WriteFile (in: hFile=0x4a8, lpBuffer=0x70f95e8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70f95e8*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.859] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.859] WriteFile (in: hFile=0x4a8, lpBuffer=0x710ade7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x710ade7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.859] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.859] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.859] CloseHandle (hObject=0x4a8) returned 1 [0191.859] GetProcessHeap () returned 0x580000 [0191.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70f95e8 | out: hHeap=0x580000) returned 1 [0191.859] GetProcessHeap () returned 0x580000 [0191.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70e7db8 | out: hHeap=0x580000) returned 1 [0191.859] GetProcessHeap () returned 0x580000 [0191.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f7f7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x18ed1, dwReserved0=0x538fd28, dwReserved1=0x70e7db8, cFileName="Status Report.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~1.YOU")) returned 0x5b97b0 [0193.424] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.460] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", len=0x65 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned 1 [0193.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0193.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0193.565] CloseHandle (hObject=0x478) returned 1 [0193.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.id_1622540890_.your_last_chance")) returned 1 [0193.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.567] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b97f0 [0193.567] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0193.567] GetProcessHeap () returned 0x580000 [0193.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c0730 [0193.567] GetProcessHeap () returned 0x580000 [0193.567] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x70c2938 [0193.567] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.567] ReadFile (in: hFile=0x478, lpBuffer=0x70c0730, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0730*, lpNumberOfBytesRead=0x538ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0195.197] GetProcessHeap () returned 0x580000 [0195.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.198] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.198] WriteFile (in: hFile=0x478, lpBuffer=0x70c2938*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c2938*, lpNumberOfBytesWritten=0x538ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0195.198] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.198] WriteFile (in: hFile=0x478, lpBuffer=0x70c4ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4ad7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.198] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.198] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.198] CloseHandle (hObject=0x478) returned 1 [0195.207] GetProcessHeap () returned 0x580000 [0195.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c2938 | out: hHeap=0x580000) returned 1 [0195.207] GetProcessHeap () returned 0x580000 [0195.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0730 | out: hHeap=0x580000) returned 1 [0195.207] GetProcessHeap () returned 0x580000 [0195.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabf55e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21ca, dwReserved0=0x538fd28, dwReserved1=0x70c0730, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b97b0 [0195.207] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0198.012] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", len=0x44 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned 1 [0198.012] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0198.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0198.070] CloseHandle (hObject=0x480) returned 1 [0198.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR51~1.YOU")) returned 0x5b97f0 [0198.071] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0198.072] GetProcessHeap () returned 0x580000 [0198.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16c1) returned 0x6de8f50 [0198.072] GetProcessHeap () returned 0x580000 [0198.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16c1) returned 0x6c6e0f8 [0198.072] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.072] ReadFile (in: hFile=0x480, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x538ff14*=0x16a0, lpOverlapped=0x0) returned 1 [0198.234] GetProcessHeap () returned 0x580000 [0198.234] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0198.235] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.235] WriteFile (in: hFile=0x480, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x538ff14*=0x16a0, lpOverlapped=0x0) returned 1 [0198.235] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.235] WriteFile (in: hFile=0x480, lpBuffer=0x6c6f797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f797*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.235] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.235] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.235] CloseHandle (hObject=0x480) returned 1 [0198.613] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0198.614] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0198.614] GetProcessHeap () returned 0x580000 [0198.614] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadc58a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x538fd28, dwReserved1=0x6de8f50, cFileName="PDIR51F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR51~1.YOU")) returned 0x5b96b0 [0199.652] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.959] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", len=0x65 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned 1 [0200.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fcc) returned 0x6f14048 [0200.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.358] CloseHandle (hObject=0x440) returned 1 [0201.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0201.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9770 [0201.359] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.359] GetProcessHeap () returned 0x580000 [0201.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x6dee6e0 [0201.360] GetProcessHeap () returned 0x580000 [0201.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x6c59108 [0201.360] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.360] ReadFile (in: hFile=0x440, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1be0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x538ff14*=0x1be0, lpOverlapped=0x0) returned 1 [0201.385] GetProcessHeap () returned 0x580000 [0201.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0201.385] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.386] WriteFile (in: hFile=0x440, lpBuffer=0x6c59108*, nNumberOfBytesToWrite=0x1be0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesWritten=0x538ff14*=0x1be0, lpOverlapped=0x0) returned 1 [0201.386] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.386] WriteFile (in: hFile=0x440, lpBuffer=0x6c5ace7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5ace7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.386] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.386] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.386] CloseHandle (hObject=0x440) returned 1 [0201.386] GetProcessHeap () returned 0x580000 [0201.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0201.386] GetProcessHeap () returned 0x580000 [0201.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0201.386] GetProcessHeap () returned 0x580000 [0201.386] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0202.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafa65fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c1f, dwReserved0=0x538fd28, dwReserved1=0x6dee6e0, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9770 [0202.027] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.084] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", len=0x44 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned 1 [0202.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0202.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0203.658] CloseHandle (hObject=0x448) returned 1 [0203.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.id_1622540890_.your_last_chance")) returned 1 [0203.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.660] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR34~2.YOU")) returned 0x5b97b0 [0203.660] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0203.660] GetProcessHeap () returned 0x580000 [0203.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6efb008 [0203.660] GetProcessHeap () returned 0x580000 [0203.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1181) returned 0x6f19958 [0203.660] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.660] ReadFile (in: hFile=0x448, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1160, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x538ff14*=0x1160, lpOverlapped=0x0) returned 1 [0203.710] GetProcessHeap () returned 0x580000 [0203.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0203.710] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.710] WriteFile (in: hFile=0x448, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1160, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x538ff14*=0x1160, lpOverlapped=0x0) returned 1 [0203.710] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.710] WriteFile (in: hFile=0x448, lpBuffer=0x6f1aab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aab7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.710] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.711] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.711] CloseHandle (hObject=0x448) returned 1 [0203.711] GetProcessHeap () returned 0x580000 [0203.711] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0203.711] GetProcessHeap () returned 0x580000 [0203.711] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0203.711] GetProcessHeap () returned 0x580000 [0203.711] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0203.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1090cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x119d, dwReserved0=0x538fd28, dwReserved1=0x6efb008, cFileName="PDIR34B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR34~2.YOU")) returned 0x5b97b0 [0203.711] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.738] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", len=0x69 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned 1 [0203.738] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0203.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0208.490] CloseHandle (hObject=0x4a8) returned 1 [0208.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0208.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.id_1622540890_.your_last_chance")) returned 1 [0208.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0208.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x72e, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b9830 [0208.492] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0208.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0208.492] GetProcessHeap () returned 0x580000 [0208.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0208.492] GetProcessHeap () returned 0x580000 [0208.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0208.492] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.492] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x538ff14*=0x720, lpOverlapped=0x0) returned 1 [0208.547] GetProcessHeap () returned 0x580000 [0208.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.547] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.547] WriteFile (in: hFile=0x4a8, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x538ff14*=0x720, lpOverlapped=0x0) returned 1 [0208.547] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.547] WriteFile (in: hFile=0x4a8, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.547] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.547] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.548] CloseHandle (hObject=0x4a8) returned 1 [0208.548] GetProcessHeap () returned 0x580000 [0208.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0208.548] GetProcessHeap () returned 0x580000 [0208.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0208.548] GetProcessHeap () returned 0x580000 [0208.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0209.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3eaf700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x538fd28, dwReserved1=0x6c4e820, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b97b0 [0210.057] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.119] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x73 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0210.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0210.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0210.163] CloseHandle (hObject=0x43c) returned 1 [0210.163] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0212.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0212.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0212.693] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0212.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0212.693] GetProcessHeap () returned 0x580000 [0212.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0212.693] GetProcessHeap () returned 0x580000 [0212.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0212.693] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.694] ReadFile (in: hFile=0x43c, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x538ff14*=0xc0, lpOverlapped=0x0) returned 1 [0212.695] GetProcessHeap () returned 0x580000 [0212.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0212.695] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.696] WriteFile (in: hFile=0x43c, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x538ff14*=0xc0, lpOverlapped=0x0) returned 1 [0212.696] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.696] WriteFile (in: hFile=0x43c, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0212.702] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0212.702] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0212.702] CloseHandle (hObject=0x43c) returned 1 [0212.703] GetProcessHeap () returned 0x580000 [0212.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0212.703] GetProcessHeap () returned 0x580000 [0212.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0212.703] GetProcessHeap () returned 0x580000 [0212.703] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb66424c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x538fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.648] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.756] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS", len=0x45 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS") returned 1 [0214.756] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0214.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.757] CloseHandle (hObject=0x478) returned 1 [0214.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css.id_1622540890_.your_last_chance")) returned 1 [0214.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.758] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a657a00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a657a00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f024, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCFBF6~1.YOU")) returned 0x5b97b0 [0214.759] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0214.759] GetProcessHeap () returned 0x580000 [0214.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0214.759] GetProcessHeap () returned 0x580000 [0214.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0214.759] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.759] ReadFile (in: hFile=0x478, lpBuffer=0x70904c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.115] GetProcessHeap () returned 0x580000 [0220.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0220.115] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.115] WriteFile (in: hFile=0x478, lpBuffer=0x70a1cf8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.116] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.116] WriteFile (in: hFile=0x478, lpBuffer=0x70b34f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b34f7*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.116] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.116] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.116] CloseHandle (hObject=0x478) returned 1 [0220.116] GetProcessHeap () returned 0x580000 [0220.116] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0220.116] GetProcessHeap () returned 0x580000 [0220.116] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0220.668] GetProcessHeap () returned 0x580000 [0220.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a657a00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbaced1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f048, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="SCHEME03.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCFBF6~1.YOU")) returned 0x5b9730 [0221.748] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.807] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", len=0x43 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 1 [0221.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0221.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.808] CloseHandle (hObject=0x458) returned 1 [0221.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id_1622540890_.your_last_chance")) returned 1 [0221.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GWEICO~1.YOU")) returned 0x5b9730 [0221.809] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.809] GetProcessHeap () returned 0x580000 [0221.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d65438 [0221.809] GetProcessHeap () returned 0x580000 [0221.809] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0221.810] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.810] ReadFile (in: hFile=0x458, lpBuffer=0x6d65438, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d65438*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0223.125] GetProcessHeap () returned 0x580000 [0223.126] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.126] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.126] WriteFile (in: hFile=0x458, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0223.126] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.126] WriteFile (in: hFile=0x458, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.127] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.127] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.127] CloseHandle (hObject=0x458) returned 1 [0223.127] GetProcessHeap () returned 0x580000 [0223.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0223.127] GetProcessHeap () returned 0x580000 [0223.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d65438 | out: hHeap=0x580000) returned 1 [0223.127] GetProcessHeap () returned 0x580000 [0223.127] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc9a3b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29501, dwReserved0=0x538fd28, dwReserved1=0x6d65438, cFileName="GWE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GWEICO~1.YOU")) returned 0x5b9630 [0225.872] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.893] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", len=0x6f | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned 1 [0225.893] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0225.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.894] CloseHandle (hObject=0x4a8) returned 1 [0225.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.894] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0225.895] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x2e0052, dwReserved1=0x490047, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9630 [0225.895] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.895] GetProcessHeap () returned 0x580000 [0225.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x6e063d0 [0225.895] GetProcessHeap () returned 0x580000 [0225.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x69a1) returned 0x715c008 [0225.895] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.895] ReadFile (in: hFile=0x4a8, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6980, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x538ff14*=0x6980, lpOverlapped=0x0) returned 1 [0228.774] GetProcessHeap () returned 0x580000 [0228.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0228.774] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.774] WriteFile (in: hFile=0x4a8, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x538ff14*=0x6980, lpOverlapped=0x0) returned 1 [0228.774] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.774] WriteFile (in: hFile=0x4a8, lpBuffer=0x7162987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162987*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0228.774] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.775] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0228.775] CloseHandle (hObject=0x4a8) returned 1 [0228.775] GetProcessHeap () returned 0x580000 [0228.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0228.775] GetProcessHeap () returned 0x580000 [0228.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0228.775] GetProcessHeap () returned 0x580000 [0228.775] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfe280a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69b7, dwReserved0=0x538fd28, dwReserved1=0x6e063d0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9630 [0230.731] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.812] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", len=0x36 | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 1 [0230.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0230.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0230.851] CloseHandle (hObject=0x420) returned 1 [0230.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id_1622540890_.your_last_chance")) returned 1 [0230.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7F~1.YOU")) returned 0x5b9630 [0230.852] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0230.853] GetProcessHeap () returned 0x580000 [0230.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x758bed8 [0230.853] GetProcessHeap () returned 0x580000 [0230.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x759d708 [0230.854] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.854] ReadFile (in: hFile=0x420, lpBuffer=0x758bed8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x758bed8*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.009] GetProcessHeap () returned 0x580000 [0238.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0238.010] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.010] WriteFile (in: hFile=0x420, lpBuffer=0x759d708*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x759d708*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.274] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.275] WriteFile (in: hFile=0x420, lpBuffer=0x75aef07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x75aef07*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.344] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.344] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.344] CloseHandle (hObject=0x420) returned 1 [0239.469] GetProcessHeap () returned 0x580000 [0239.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x759d708 | out: hHeap=0x580000) returned 1 [0239.469] GetProcessHeap () returned 0x580000 [0239.469] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x758bed8 | out: hHeap=0x580000) returned 1 [0239.471] GetProcessHeap () returned 0x580000 [0239.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0241.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c40, dwReserved0=0x538fd28, dwReserved1=0x580000, cFileName="mset7fr.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7F~1.YOU")) returned 0x5b9630 [0241.849] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.867] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML", len=0x3f | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned 1 [0241.867] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0241.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0245.383] CloseHandle (hObject=0x41c) returned 1 [0245.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml.id_1622540890_.your_last_chance")) returned 1 [0249.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17af0200, ftCreationTime.dwHighDateTime=0x1ca06ab, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17af0200, ftLastWriteTime.dwHighDateTime=0x1ca06ab, nFileSizeHigh=0x0, nFileSizeLow=0x167d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~2.YOU")) returned 0x5b96f0 [0249.023] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0249.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0249.023] GetProcessHeap () returned 0x580000 [0249.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc14d0 [0249.023] GetProcessHeap () returned 0x580000 [0249.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd2d00 [0249.023] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.023] ReadFile (in: hFile=0x41c, lpBuffer=0x6fc14d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc14d0*, lpNumberOfBytesRead=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.692] GetProcessHeap () returned 0x580000 [0252.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.692] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.692] WriteFile (in: hFile=0x41c, lpBuffer=0x6fd2d00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd2d00*, lpNumberOfBytesWritten=0x538ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.692] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.692] WriteFile (in: hFile=0x41c, lpBuffer=0x6fe44ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe44ff*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.692] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.692] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.693] CloseHandle (hObject=0x41c) returned 1 [0252.693] GetProcessHeap () returned 0x580000 [0252.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd2d00 | out: hHeap=0x580000) returned 1 [0252.693] GetProcessHeap () returned 0x580000 [0252.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc14d0 | out: hHeap=0x580000) returned 1 [0252.693] GetProcessHeap () returned 0x580000 [0252.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fccc | out: lpFindFileData=0x538fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17af0200, ftCreationTime.dwHighDateTime=0x1ca06ab, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce239c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167f8, dwReserved0=0x538fd28, dwReserved1=0x6fc14d0, cFileName="PGMN022.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~2.YOU")) returned 0x5b9730 [0254.424] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.362] SysReAllocStringLen (in: pbstr=0x538ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV", len=0x3e | out: pbstr=0x538ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 1 [0255.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f68) returned 0x72e5948 [0255.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.692] CloseHandle (hObject=0x170) returned 1 [0258.692] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.692] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x538ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x538fc74 | out: lpFindFileData=0x538fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2465f500, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2465f500, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGREPF~1.YOU")) returned 0x5b96f0 [0258.693] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.694] GetProcessHeap () returned 0x580000 [0258.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ea1) returned 0x6ead008 [0258.694] GetProcessHeap () returned 0x580000 [0258.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ea1) returned 0x6eb3eb8 [0258.694] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.694] ReadFile (in: hFile=0x170, lpBuffer=0x6ead008, nNumberOfBytesToRead=0x6e80, lpNumberOfBytesRead=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead008*, lpNumberOfBytesRead=0x538ff14*=0x6e80, lpOverlapped=0x0) returned 1 [0262.598] GetProcessHeap () returned 0x580000 [0262.598] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0262.598] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.598] WriteFile (in: hFile=0x170, lpBuffer=0x6eb3eb8*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb3eb8*, lpNumberOfBytesWritten=0x538ff14*=0x6e80, lpOverlapped=0x0) returned 1 [0264.374] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.374] WriteFile (in: hFile=0x170, lpBuffer=0x6ebad37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebad37*, lpNumberOfBytesWritten=0x538ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.374] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.374] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x538ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x538ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.374] CloseHandle (hObject=0x170) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb3eb8 | out: hHeap=0x580000) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead008 | out: hHeap=0x580000) returned 1 [0265.873] GetProcessHeap () returned 0x580000 [0265.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 Thread: id = 44 os_tid = 0xaa8 [0039.067] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.818] Sleep (dwMilliseconds=0x1) [0039.841] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.346] Sleep (dwMilliseconds=0x1) [0040.372] Sleep (dwMilliseconds=0x1) [0040.391] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.554] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.658] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.830] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.327] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.360] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.390] Sleep (dwMilliseconds=0x1) [0043.408] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.437] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.468] Sleep (dwMilliseconds=0x1) [0043.483] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.515] Sleep (dwMilliseconds=0x1) [0043.530] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.562] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.594] Sleep (dwMilliseconds=0x1) [0043.700] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.919] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.982] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.044] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.792] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.151] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.182] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.308] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.496] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.682] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.792] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.978] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.009] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.087] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.399] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.633] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.711] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.758] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.789] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.867] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.945] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.131] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.256] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.287] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.538] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.911] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.989] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.161] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.223] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.317] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.379] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.613] Sleep (dwMilliseconds=0x1) [0048.629] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.691] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.724] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.769] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.925] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.003] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.050] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.253] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.549] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.064] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.173] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.251] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.501] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.532] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.828] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.390] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.825] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.965] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.043] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.121] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.683] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.369] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.572] Sleep (dwMilliseconds=0x1) [0053.588] Sleep (dwMilliseconds=0x1) [0053.603] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.118] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.399] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.898] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.132] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.288] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.319] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0057.409] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", len=0x4a | out: pbstr=0x54cff84*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 1 [0057.409] GetProcessHeap () returned 0x580000 [0057.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0057.409] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.409] CloseHandle (hObject=0x41c) returned 1 [0057.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.409] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id_1622540890_.your_last_chance")) returned 1 [0057.410] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.410] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~1.YOU")) returned 0x5b9630 [0057.410] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.410] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.410] GetProcessHeap () returned 0x580000 [0057.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6c56108 [0057.410] GetProcessHeap () returned 0x580000 [0057.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6c56838 [0057.410] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.410] ReadFile (in: hFile=0x41c, lpBuffer=0x6c56108, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesRead=0x54cff14*=0x700, lpOverlapped=0x0) returned 1 [0057.418] GetProcessHeap () returned 0x580000 [0057.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0057.418] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.418] WriteFile (in: hFile=0x41c, lpBuffer=0x6c56838*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56838*, lpNumberOfBytesWritten=0x54cff14*=0x700, lpOverlapped=0x0) returned 1 [0057.418] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.418] WriteFile (in: hFile=0x41c, lpBuffer=0x6c56f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56f37*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0057.418] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.418] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0057.418] CloseHandle (hObject=0x41c) returned 1 [0057.419] GetProcessHeap () returned 0x580000 [0057.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56838 | out: hHeap=0x580000) returned 1 [0057.419] GetProcessHeap () returned 0x580000 [0057.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0057.419] GetProcessHeap () returned 0x580000 [0057.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0057.419] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5a058980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x54cfd28, dwReserved1=0x6c56108, cFileName="WordMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~1.YOU")) returned 0x5b9630 [0057.419] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.424] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", len=0x49 | out: pbstr=0x54cff84*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 1 [0057.424] GetProcessHeap () returned 0x580000 [0057.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0057.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0057.425] CloseHandle (hObject=0x420) returned 1 [0057.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.425] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id_1622540890_.your_last_chance")) returned 1 [0057.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.425] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDLR~1.YOU")) returned 0x5b9630 [0057.426] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0057.426] GetProcessHeap () returned 0x580000 [0057.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0057.427] GetProcessHeap () returned 0x580000 [0057.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0057.427] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.427] ReadFile (in: hFile=0x420, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.272] GetProcessHeap () returned 0x580000 [0060.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0060.273] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.273] WriteFile (in: hFile=0x420, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0061.802] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.803] WriteFile (in: hFile=0x420, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0064.541] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.541] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0064.541] CloseHandle (hObject=0x420) returned 1 [0070.481] GetProcessHeap () returned 0x580000 [0070.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0070.481] GetProcessHeap () returned 0x580000 [0070.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0070.481] GetProcessHeap () returned 0x580000 [0070.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0072.142] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x6156e3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29c6de1, dwReserved0=0x54cfd28, dwReserved1=0x6d10048, cFileName="WordLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDLR~1.YOU")) returned 0x5b9770 [0072.142] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.152] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", len=0x52 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 1 [0072.152] GetProcessHeap () returned 0x580000 [0072.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x58) returned 0x5b5d08 [0072.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.995] Sleep (dwMilliseconds=0x1) [0073.072] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", len=0x57 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 1 [0073.072] GetProcessHeap () returned 0x580000 [0073.072] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x48) returned 0x5b5d08 [0073.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.075] Sleep (dwMilliseconds=0x1) [0073.087] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", len=0x3d | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 1 [0073.087] GetProcessHeap () returned 0x580000 [0073.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x20) returned 0x5b5d08 [0073.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0074.725] CloseHandle (hObject=0x44c) returned 1 [0074.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.725] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id_1622540890_.your_last_chance")) returned 1 [0074.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCGMI~1.YOU")) returned 0x5b9730 [0074.725] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0074.726] GetProcessHeap () returned 0x580000 [0074.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6f0cfe0 [0074.726] GetProcessHeap () returned 0x580000 [0074.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6f0d770 [0074.726] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.726] ReadFile (in: hFile=0x44c, lpBuffer=0x6f0cfe0, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cfe0*, lpNumberOfBytesRead=0x54cff14*=0x760, lpOverlapped=0x0) returned 1 [0074.734] GetProcessHeap () returned 0x580000 [0074.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0074.734] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x44c, lpBuffer=0x6f0d770*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0d770*, lpNumberOfBytesWritten=0x54cff14*=0x760, lpOverlapped=0x0) returned 1 [0074.734] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x44c, lpBuffer=0x6f0decf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0decf*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0074.734] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.734] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0074.734] CloseHandle (hObject=0x44c) returned 1 [0074.734] GetProcessHeap () returned 0x580000 [0074.734] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0d770 | out: hHeap=0x580000) returned 1 [0074.734] GetProcessHeap () returned 0x580000 [0074.734] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0cfe0 | out: hHeap=0x580000) returned 1 [0074.734] GetProcessHeap () returned 0x580000 [0074.734] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0079.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x642ce700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x798, dwReserved0=0x54cfd28, dwReserved1=0x6f0cfe0, cFileName="MS.CGM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCGMI~1.YOU")) returned 0x5b96f0 [0079.333] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.348] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", len=0x3f | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 1 [0079.348] GetProcessHeap () returned 0x580000 [0079.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x44) returned 0x5f76f0 [0079.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.359] Sleep (dwMilliseconds=0x1) [0081.684] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", len=0x6c | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 1 [0081.684] GetProcessHeap () returned 0x580000 [0081.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.703] CloseHandle (hObject=0x488) returned 1 [0081.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id_1622540890_.your_last_chance")) returned 1 [0081.704] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x4c004d, dwReserved1=0x69002e, cFileName="OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b96f0 [0081.704] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.705] GetProcessHeap () returned 0x580000 [0081.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x6f094f0 [0081.705] GetProcessHeap () returned 0x580000 [0081.705] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc81) returned 0x6d0e508 [0081.705] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.705] ReadFile (in: hFile=0x488, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0xc60, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x54cff14*=0xc60, lpOverlapped=0x0) returned 1 [0081.717] GetProcessHeap () returned 0x580000 [0081.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.717] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.717] WriteFile (in: hFile=0x488, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0xc60, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x54cff14*=0xc60, lpOverlapped=0x0) returned 1 [0081.717] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.717] WriteFile (in: hFile=0x488, lpBuffer=0x6d0f167*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f167*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0081.718] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.718] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0081.718] CloseHandle (hObject=0x488) returned 1 [0081.718] GetProcessHeap () returned 0x580000 [0081.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.718] GetProcessHeap () returned 0x580000 [0081.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.718] GetProcessHeap () returned 0x580000 [0081.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68528c40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x54cfd28, dwReserved1=0x6f094f0, cFileName="OutlookMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b96f0 [0081.718] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.841] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", len=0x6c | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 1 [0081.841] GetProcessHeap () returned 0x580000 [0081.841] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.841] CloseHandle (hObject=0x458) returned 1 [0081.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id_1622540890_.your_last_chance")) returned 1 [0081.842] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x4c004d, dwReserved1=0x69002e, cFileName="ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b96f0 [0081.842] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0081.842] GetProcessHeap () returned 0x580000 [0081.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f0c4f8 [0081.842] GetProcessHeap () returned 0x580000 [0081.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6d0e508 [0081.843] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.843] ReadFile (in: hFile=0x458, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x54cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.857] GetProcessHeap () returned 0x580000 [0081.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0081.857] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.857] WriteFile (in: hFile=0x458, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x54cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.857] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.857] WriteFile (in: hFile=0x458, lpBuffer=0x6d0eaa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0eaa7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0081.857] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.857] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0081.857] CloseHandle (hObject=0x458) returned 1 [0081.857] GetProcessHeap () returned 0x580000 [0081.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.858] GetProcessHeap () returned 0x580000 [0081.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0081.858] GetProcessHeap () returned 0x580000 [0081.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0081.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6867f8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x54cfd28, dwReserved1=0x6f0c4f8, cFileName="ProjectMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b96f0 [0081.858] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.901] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", len=0x62 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 1 [0081.901] GetProcessHeap () returned 0x580000 [0081.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0081.905] CloseHandle (hObject=0x478) returned 1 [0081.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0081.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96f0 [0081.906] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0081.906] GetProcessHeap () returned 0x580000 [0081.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f09a60 [0081.906] GetProcessHeap () returned 0x580000 [0081.906] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6d0e508 [0081.906] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.906] ReadFile (in: hFile=0x478, lpBuffer=0x6f09a60, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09a60*, lpNumberOfBytesRead=0x54cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.919] GetProcessHeap () returned 0x580000 [0081.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0081.919] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.919] WriteFile (in: hFile=0x478, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x54cff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.919] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.919] WriteFile (in: hFile=0x478, lpBuffer=0x6d0eaa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0eaa7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0081.919] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.919] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0081.919] CloseHandle (hObject=0x478) returned 1 [0081.919] GetProcessHeap () returned 0x580000 [0081.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.919] GetProcessHeap () returned 0x580000 [0081.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a60 | out: hHeap=0x580000) returned 1 [0081.919] GetProcessHeap () returned 0x580000 [0081.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0081.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68717e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x54cfd28, dwReserved1=0x6f09a60, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96f0 [0081.920] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.356] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 1 [0082.356] GetProcessHeap () returned 0x580000 [0082.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0082.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0082.358] CloseHandle (hObject=0x48c) returned 1 [0082.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0082.358] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0082.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0082.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0082.360] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0082.361] GetProcessHeap () returned 0x580000 [0082.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x6d0e508 [0082.361] GetProcessHeap () returned 0x580000 [0082.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1701) returned 0x673cd0 [0082.361] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x48c, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x16e0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x54cff14*=0x16e0, lpOverlapped=0x0) returned 1 [0082.383] GetProcessHeap () returned 0x580000 [0082.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0082.383] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.383] WriteFile (in: hFile=0x48c, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x54cff14*=0x16e0, lpOverlapped=0x0) returned 1 [0082.383] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.383] WriteFile (in: hFile=0x48c, lpBuffer=0x6753af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6753af*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0082.383] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.383] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0082.383] CloseHandle (hObject=0x48c) returned 1 [0082.384] GetProcessHeap () returned 0x580000 [0082.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0082.384] GetProcessHeap () returned 0x580000 [0082.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0082.384] GetProcessHeap () returned 0x580000 [0082.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0082.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68b68600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x54cfd28, dwReserved1=0x6d0e508, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0082.384] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.320] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", len=0x69 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 1 [0083.320] GetProcessHeap () returned 0x580000 [0083.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0083.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0083.321] CloseHandle (hObject=0x488) returned 1 [0083.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0083.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0083.322] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0083.322] GetProcessHeap () returned 0x580000 [0083.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f0c4f8 [0083.322] GetProcessHeap () returned 0x580000 [0083.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6f094f0 [0083.322] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.322] ReadFile (in: hFile=0x488, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x54cff14*=0x640, lpOverlapped=0x0) returned 1 [0083.506] GetProcessHeap () returned 0x580000 [0083.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0083.506] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.506] WriteFile (in: hFile=0x488, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x54cff14*=0x640, lpOverlapped=0x0) returned 1 [0083.506] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.506] WriteFile (in: hFile=0x488, lpBuffer=0x6f09b2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b2f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0083.506] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.506] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0083.507] CloseHandle (hObject=0x488) returned 1 [0083.507] GetProcessHeap () returned 0x580000 [0083.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0083.507] GetProcessHeap () returned 0x580000 [0083.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0083.507] GetProcessHeap () returned 0x580000 [0083.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0083.507] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6961e900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x54cfd28, dwReserved1=0x6f0c4f8, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0083.507] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.296] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", len=0x49 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 1 [0084.297] GetProcessHeap () returned 0x580000 [0084.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0084.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0084.297] CloseHandle (hObject=0x480) returned 1 [0084.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.297] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id_1622540890_.your_last_chance")) returned 1 [0084.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MCABOU~1.YOU")) returned 0x5b9730 [0084.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0084.318] GetProcessHeap () returned 0x580000 [0084.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ce1) returned 0x674cd8 [0084.318] GetProcessHeap () returned 0x580000 [0084.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ce1) returned 0x6779c8 [0084.318] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.318] ReadFile (in: hFile=0x480, lpBuffer=0x674cd8, nNumberOfBytesToRead=0x2cc0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x674cd8*, lpNumberOfBytesRead=0x54cff14*=0x2cc0, lpOverlapped=0x0) returned 1 [0084.753] GetProcessHeap () returned 0x580000 [0084.753] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.753] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.753] WriteFile (in: hFile=0x480, lpBuffer=0x6779c8*, nNumberOfBytesToWrite=0x2cc0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6779c8*, lpNumberOfBytesWritten=0x54cff14*=0x2cc0, lpOverlapped=0x0) returned 1 [0084.753] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.753] WriteFile (in: hFile=0x480, lpBuffer=0x67a687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x67a687*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0084.753] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.753] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0084.753] CloseHandle (hObject=0x480) returned 1 [0084.754] GetProcessHeap () returned 0x580000 [0084.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6779c8 | out: hHeap=0x580000) returned 1 [0084.754] GetProcessHeap () returned 0x580000 [0084.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x674cd8 | out: hHeap=0x580000) returned 1 [0084.754] GetProcessHeap () returned 0x580000 [0084.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a205700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2ceb, dwReserved0=0x54cfd28, dwReserved1=0x674cd8, cFileName="MCABOUT.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MCABOU~1.YOU")) returned 0x5b9630 [0084.754] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.226] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", len=0x49 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 1 [0088.226] GetProcessHeap () returned 0x580000 [0088.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0088.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0089.155] CloseHandle (hObject=0x440) returned 1 [0089.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0089.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id_1622540890_.your_last_chance")) returned 1 [0089.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREEZE~2.YOU")) returned 0x5b96b0 [0089.156] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0089.156] GetProcessHeap () returned 0x580000 [0089.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dd43b0 [0089.156] GetProcessHeap () returned 0x580000 [0089.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0089.157] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.157] ReadFile (in: hFile=0x440, lpBuffer=0x6dd43b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd43b0*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0092.726] GetProcessHeap () returned 0x580000 [0092.726] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0092.726] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.726] WriteFile (in: hFile=0x440, lpBuffer=0x6d340b0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0092.727] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.727] WriteFile (in: hFile=0x440, lpBuffer=0x6d458af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458af*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.727] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.727] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.727] CloseHandle (hObject=0x440) returned 1 [0092.727] GetProcessHeap () returned 0x580000 [0092.727] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0092.727] GetProcessHeap () returned 0x580000 [0092.728] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd43b0 | out: hHeap=0x580000) returned 1 [0092.728] GetProcessHeap () returned 0x580000 [0092.728] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0092.728] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ee31700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a55b, dwReserved0=0x54cfd28, dwReserved1=0x6dd43b0, cFileName="BREEZE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREEZE~2.YOU")) returned 0x5b96f0 [0092.728] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.335] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", len=0x47 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 1 [0094.335] GetProcessHeap () returned 0x580000 [0094.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x5c) returned 0x6c561f0 [0094.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.395] CloseHandle (hObject=0x43c) returned 1 [0094.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id_1622540890_.your_last_chance")) returned 1 [0094.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SATINI~1.YOU")) returned 0x5b96b0 [0094.396] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0094.397] GetProcessHeap () returned 0x580000 [0094.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0094.397] GetProcessHeap () returned 0x580000 [0094.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04eb8 [0094.397] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.397] ReadFile (in: hFile=0x43c, lpBuffer=0x6d04cc0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesRead=0x54cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0094.429] GetProcessHeap () returned 0x580000 [0094.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.429] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x43c, lpBuffer=0x6d04eb8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04eb8*, lpNumberOfBytesWritten=0x54cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0094.429] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x43c, lpBuffer=0x6d05077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d05077*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.429] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.429] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.429] CloseHandle (hObject=0x43c) returned 1 [0094.429] GetProcessHeap () returned 0x580000 [0094.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04eb8 | out: hHeap=0x580000) returned 1 [0094.429] GetProcessHeap () returned 0x580000 [0094.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0094.429] GetProcessHeap () returned 0x580000 [0094.429] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fe68ce0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ec, dwReserved0=0x54cfd28, dwReserved1=0x6d04cc0, cFileName="SATIN.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SATINI~1.YOU")) returned 0x5b96b0 [0094.430] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.443] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 1 [0094.443] GetProcessHeap () returned 0x580000 [0094.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x44) returned 0x596cd8 [0094.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.453] CloseHandle (hObject=0x4ac) returned 1 [0094.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0094.454] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.454] GetProcessHeap () returned 0x580000 [0094.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x67ec60 [0094.454] GetProcessHeap () returned 0x580000 [0094.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6d9bb80 [0094.454] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.455] ReadFile (in: hFile=0x4ac, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x54cff14*=0x1000, lpOverlapped=0x0) returned 1 [0094.597] GetProcessHeap () returned 0x580000 [0094.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.597] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.597] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d9bb80*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9bb80*, lpNumberOfBytesWritten=0x54cff14*=0x1000, lpOverlapped=0x0) returned 1 [0094.598] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.598] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d9cb7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9cb7f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.618] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.618] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.618] CloseHandle (hObject=0x4ac) returned 1 [0094.618] GetProcessHeap () returned 0x580000 [0094.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9bb80 | out: hHeap=0x580000) returned 1 [0094.618] GetProcessHeap () returned 0x580000 [0094.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0094.618] GetProcessHeap () returned 0x580000 [0094.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70031d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x54cfd28, dwReserved1=0x67ec60, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0094.618] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.630] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", len=0x4d | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 1 [0094.630] GetProcessHeap () returned 0x580000 [0094.630] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b96f0 [0094.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.635] CloseHandle (hObject=0x4ac) returned 1 [0094.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id_1622540890_.your_last_chance")) returned 1 [0094.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RICEPA~2.YOU")) returned 0x5b96f0 [0094.662] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.662] GetProcessHeap () returned 0x580000 [0094.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f0c4f8 [0094.662] GetProcessHeap () returned 0x580000 [0094.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f0c748 [0094.662] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.662] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x54cff14*=0x220, lpOverlapped=0x0) returned 1 [0094.665] GetProcessHeap () returned 0x580000 [0094.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.665] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.665] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f0c748*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c748*, lpNumberOfBytesWritten=0x54cff14*=0x220, lpOverlapped=0x0) returned 1 [0094.666] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.666] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f0c967*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c967*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.666] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.666] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.666] CloseHandle (hObject=0x4ac) returned 1 [0094.666] GetProcessHeap () returned 0x580000 [0094.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c748 | out: hHeap=0x580000) returned 1 [0094.666] GetProcessHeap () returned 0x580000 [0094.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0094.666] GetProcessHeap () returned 0x580000 [0094.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x700a4180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x54cfd28, dwReserved1=0x6f0c4f8, cFileName="RICEPAPR.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RICEPA~2.YOU")) returned 0x5b96f0 [0094.666] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.677] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", len=0x4c | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 1 [0094.677] GetProcessHeap () returned 0x580000 [0094.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x2c) returned 0x61f7a0 [0094.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.677] CloseHandle (hObject=0x4ac) returned 1 [0094.677] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0094.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0094.678] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0094.678] GetProcessHeap () returned 0x580000 [0094.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfa1) returned 0x67b9e0 [0094.678] GetProcessHeap () returned 0x580000 [0094.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfa1) returned 0x6e25480 [0094.678] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.679] ReadFile (in: hFile=0x4ac, lpBuffer=0x67b9e0, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x67b9e0*, lpNumberOfBytesRead=0x54cff14*=0xf80, lpOverlapped=0x0) returned 1 [0096.165] GetProcessHeap () returned 0x580000 [0096.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0096.165] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.165] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e25480*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e25480*, lpNumberOfBytesWritten=0x54cff14*=0xf80, lpOverlapped=0x0) returned 1 [0096.165] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.166] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e263ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e263ff*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0096.166] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.166] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0096.166] CloseHandle (hObject=0x4ac) returned 1 [0096.166] GetProcessHeap () returned 0x580000 [0096.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e25480 | out: hHeap=0x580000) returned 1 [0096.166] GetProcessHeap () returned 0x580000 [0096.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67b9e0 | out: hHeap=0x580000) returned 1 [0096.166] GetProcessHeap () returned 0x580000 [0096.166] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0096.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70eec580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfa6, dwReserved0=0x54cfd28, dwReserved1=0x67b9e0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0096.166] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0097.487] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", len=0x43 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 1 [0097.511] GetProcessHeap () returned 0x580000 [0097.511] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0097.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0097.511] CloseHandle (hObject=0x408) returned 1 [0097.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0097.512] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id_1622540890_.your_last_chance")) returned 1 [0097.512] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYINF~1.YOU")) returned 0x5b96f0 [0097.512] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0097.513] GetProcessHeap () returned 0x580000 [0097.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c65268 [0097.513] GetProcessHeap () returned 0x580000 [0097.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c65438 [0097.513] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.513] ReadFile (in: hFile=0x408, lpBuffer=0x6c65268, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65268*, lpNumberOfBytesRead=0x54cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0097.515] GetProcessHeap () returned 0x580000 [0097.515] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.515] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.515] WriteFile (in: hFile=0x408, lpBuffer=0x6c65438*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65438*, lpNumberOfBytesWritten=0x54cff14*=0x1a0, lpOverlapped=0x0) returned 1 [0097.515] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.515] WriteFile (in: hFile=0x408, lpBuffer=0x6c655d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c655d7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0097.515] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.515] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0097.515] CloseHandle (hObject=0x408) returned 1 [0097.516] GetProcessHeap () returned 0x580000 [0097.516] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65438 | out: hHeap=0x580000) returned 1 [0097.516] GetProcessHeap () returned 0x580000 [0097.516] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65268 | out: hHeap=0x580000) returned 1 [0097.516] GetProcessHeap () returned 0x580000 [0097.516] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71bb7bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x54cfd28, dwReserved1=0x6c65268, cFileName="SKY.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SKYINF~1.YOU")) returned 0x5b96f0 [0097.516] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.657] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", len=0x49 | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 1 [0101.657] GetProcessHeap () returned 0x580000 [0101.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7d8, Size=0x28) returned 0x5dc550 [0101.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0101.657] CloseHandle (hObject=0x448) returned 1 [0101.657] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id_1622540890_.your_last_chance")) returned 1 [0101.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1AR~1.YOU")) returned 0x5b9630 [0101.658] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0101.659] GetProcessHeap () returned 0x580000 [0101.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0101.659] GetProcessHeap () returned 0x580000 [0101.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0101.659] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.660] ReadFile (in: hFile=0x448, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.094] GetProcessHeap () returned 0x580000 [0105.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0105.094] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.094] WriteFile (in: hFile=0x448, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.095] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.095] WriteFile (in: hFile=0x448, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0105.716] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.716] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0105.716] CloseHandle (hObject=0x448) returned 1 [0105.716] GetProcessHeap () returned 0x580000 [0105.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0105.716] GetProcessHeap () returned 0x580000 [0105.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0105.716] GetProcessHeap () returned 0x580000 [0105.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0105.717] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x769f8f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19503c, dwReserved0=0x54cfd28, dwReserved1=0x636970, cFileName="MSB1ARFR.ITS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1AR~1.YOU")) returned 0x5b9730 [0105.717] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0106.874] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", len=0x4c | out: pbstr=0x54cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 1 [0106.874] GetProcessHeap () returned 0x580000 [0106.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0106.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0107.797] CloseHandle (hObject=0x390) returned 1 [0107.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id_1622540890_.your_last_chance")) returned 1 [0107.798] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHGTXT~1.YOU")) returned 0x5b9730 [0107.798] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0107.798] GetProcessHeap () returned 0x580000 [0107.798] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d57110 [0107.799] GetProcessHeap () returned 0x580000 [0107.799] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d68940 [0107.799] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.799] ReadFile (in: hFile=0x390, lpBuffer=0x6d57110, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d57110*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.460] GetProcessHeap () returned 0x580000 [0111.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0111.461] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.461] WriteFile (in: hFile=0x390, lpBuffer=0x6d68940*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d68940*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.461] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.461] WriteFile (in: hFile=0x390, lpBuffer=0x6d7a13f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7a13f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0111.461] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.461] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0111.461] CloseHandle (hObject=0x390) returned 1 [0111.462] GetProcessHeap () returned 0x580000 [0111.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d68940 | out: hHeap=0x580000) returned 1 [0111.462] GetProcessHeap () returned 0x580000 [0111.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d57110 | out: hHeap=0x580000) returned 1 [0111.462] GetProcessHeap () returned 0x580000 [0111.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0111.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7a0b8900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fe09, dwReserved0=0x54cfd28, dwReserved1=0x6d57110, cFileName="WHGTXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHGTXT~1.YOU")) returned 0x5b96f0 [0111.462] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.049] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", len=0x43 | out: pbstr=0x54cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 1 [0112.049] GetProcessHeap () returned 0x580000 [0112.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ab70, Size=0x38) returned 0x5b9730 [0112.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.065] Sleep (dwMilliseconds=0x1) [0112.158] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", len=0x56 | out: pbstr=0x54cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 1 [0112.158] GetProcessHeap () returned 0x580000 [0112.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x48) returned 0x596cd8 [0112.158] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.159] Sleep (dwMilliseconds=0x1) [0112.188] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.205] Sleep (dwMilliseconds=0x1) [0112.266] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", len=0x4c | out: pbstr=0x54cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned 1 [0112.266] GetProcessHeap () returned 0x580000 [0112.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.266] Sleep (dwMilliseconds=0x1) [0112.313] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", len=0x4d | out: pbstr=0x54cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 1 [0112.313] GetProcessHeap () returned 0x580000 [0112.313] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0112.313] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.327] Sleep (dwMilliseconds=0x1) [0113.327] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", len=0x3f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 1 [0113.328] GetProcessHeap () returned 0x580000 [0113.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xb0) returned 0x6f0ceb8 [0113.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0113.483] CloseHandle (hObject=0x3a8) returned 1 [0113.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.640] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0104~1.YOU")) returned 0x5b9630 [0114.641] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0114.641] GetProcessHeap () returned 0x580000 [0114.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6d00d78 [0114.641] GetProcessHeap () returned 0x580000 [0114.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6c59120 [0114.641] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.641] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d00d78, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00d78*, lpNumberOfBytesRead=0x54cff14*=0x620, lpOverlapped=0x0) returned 1 [0114.647] GetProcessHeap () returned 0x580000 [0114.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.648] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.648] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c59120*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesWritten=0x54cff14*=0x620, lpOverlapped=0x0) returned 1 [0114.648] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.648] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c5973f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5973f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.648] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.648] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.648] CloseHandle (hObject=0x3a8) returned 1 [0114.648] GetProcessHeap () returned 0x580000 [0114.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0114.648] GetProcessHeap () returned 0x580000 [0114.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00d78 | out: hHeap=0x580000) returned 1 [0114.648] GetProcessHeap () returned 0x580000 [0114.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bf382e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x54cfd28, dwReserved1=0x6d00d78, cFileName="AN01044_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0104~1.YOU")) returned 0x5b9630 [0115.611] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.658] CloseHandle (hObject=0x4a0) returned 1 [0115.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~4.YOU")) returned 0x5b9630 [0115.658] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.659] GetProcessHeap () returned 0x580000 [0115.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2821) returned 0x6c6a0f8 [0115.659] GetProcessHeap () returned 0x580000 [0115.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2821) returned 0x6c6c928 [0115.659] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.659] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c6a0f8, nNumberOfBytesToRead=0x2800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesRead=0x54cff14*=0x2800, lpOverlapped=0x0) returned 1 [0115.777] GetProcessHeap () returned 0x580000 [0115.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.777] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.777] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6c928*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6c928*, lpNumberOfBytesWritten=0x54cff14*=0x2800, lpOverlapped=0x0) returned 1 [0115.777] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.777] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c6f127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f127*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0115.777] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.777] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0115.777] CloseHandle (hObject=0x4a0) returned 1 [0115.778] GetProcessHeap () returned 0x580000 [0115.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6c928 | out: hHeap=0x580000) returned 1 [0115.778] GetProcessHeap () returned 0x580000 [0115.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0115.778] GetProcessHeap () returned 0x580000 [0115.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0115.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9ee5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2830, dwReserved0=0x54cfd28, dwReserved1=0x6c6a0f8, cFileName="SO00192_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0019~4.YOU")) returned 0x5b9630 [0115.778] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.374] CloseHandle (hObject=0x49c) returned 1 [0117.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id_1622540890_.your_last_chance")) returned 1 [0117.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMER_~1.YOU")) returned 0x5b9630 [0117.375] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.375] GetProcessHeap () returned 0x580000 [0117.375] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36e1) returned 0x6df26c0 [0117.376] GetProcessHeap () returned 0x580000 [0117.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x36e1) returned 0x6c61108 [0117.376] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.376] ReadFile (in: hFile=0x49c, lpBuffer=0x6df26c0, nNumberOfBytesToRead=0x36c0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df26c0*, lpNumberOfBytesRead=0x54cff14*=0x36c0, lpOverlapped=0x0) returned 1 [0117.825] GetProcessHeap () returned 0x580000 [0117.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0117.825] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.825] WriteFile (in: hFile=0x49c, lpBuffer=0x6c61108*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61108*, lpNumberOfBytesWritten=0x54cff14*=0x36c0, lpOverlapped=0x0) returned 1 [0117.825] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.825] WriteFile (in: hFile=0x49c, lpBuffer=0x6c647c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c647c7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0117.826] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.826] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0117.826] CloseHandle (hObject=0x49c) returned 1 [0118.140] GetProcessHeap () returned 0x580000 [0118.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61108 | out: hHeap=0x580000) returned 1 [0118.140] GetProcessHeap () returned 0x580000 [0118.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df26c0 | out: hHeap=0x580000) returned 1 [0118.141] GetProcessHeap () returned 0x580000 [0118.141] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dd6ba00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x54cfd28, dwReserved1=0x6df26c0, cFileName="SUMER_01.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMER_~1.YOU")) returned 0x5b96f0 [0120.077] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.096] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", len=0x3f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF") returned 1 [0120.096] GetProcessHeap () returned 0x580000 [0120.096] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1778) returned 0x6d06ca8 [0120.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.096] CloseHandle (hObject=0x4a0) returned 1 [0120.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~3.YOU")) returned 0x5b96f0 [0120.097] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.097] GetProcessHeap () returned 0x580000 [0120.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60c7d8 [0120.098] GetProcessHeap () returned 0x580000 [0120.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60cba0 [0120.098] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.098] ReadFile (in: hFile=0x4a0, lpBuffer=0x60c7d8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x60c7d8*, lpNumberOfBytesRead=0x54cff14*=0x380, lpOverlapped=0x0) returned 1 [0120.109] GetProcessHeap () returned 0x580000 [0120.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.109] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.109] WriteFile (in: hFile=0x4a0, lpBuffer=0x60cba0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x60cba0*, lpNumberOfBytesWritten=0x54cff14*=0x380, lpOverlapped=0x0) returned 1 [0120.109] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.109] WriteFile (in: hFile=0x4a0, lpBuffer=0x60cf1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x60cf1f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.109] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.109] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.110] CloseHandle (hObject=0x4a0) returned 1 [0120.114] GetProcessHeap () returned 0x580000 [0120.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60cba0 | out: hHeap=0x580000) returned 1 [0120.114] GetProcessHeap () returned 0x580000 [0120.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c7d8 | out: hHeap=0x580000) returned 1 [0120.114] GetProcessHeap () returned 0x580000 [0120.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f34a420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x54cfd28, dwReserved1=0x60c7d8, cFileName="WB01747_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~3.YOU")) returned 0x5b9630 [0120.174] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.305] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", len=0x40 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 1 [0120.305] GetProcessHeap () returned 0x580000 [0120.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d8) returned 0x6d06ca8 [0120.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.344] CloseHandle (hObject=0x170) returned 1 [0120.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.id_1622540890_.your_last_chance")) returned 1 [0120.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9630 [0120.345] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.345] GetProcessHeap () returned 0x580000 [0120.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de0f50 [0120.345] GetProcessHeap () returned 0x580000 [0120.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eef008 [0120.346] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.346] ReadFile (in: hFile=0x170, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0122.021] GetProcessHeap () returned 0x580000 [0122.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0122.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.021] WriteFile (in: hFile=0x170, lpBuffer=0x6eef008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0122.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.021] WriteFile (in: hFile=0x170, lpBuffer=0x6f00807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f00807*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.022] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.022] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.022] CloseHandle (hObject=0x170) returned 1 [0122.022] GetProcessHeap () returned 0x580000 [0122.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0122.022] GetProcessHeap () returned 0x580000 [0122.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0122.022] GetProcessHeap () returned 0x580000 [0122.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80570be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x15d99, dwReserved0=0x54cfd28, dwReserved1=0x6de0f50, cFileName="Thatch.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THATCH~1.YOU")) returned 0x5b9730 [0124.305] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.322] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", len=0x4c | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned 1 [0124.322] GetProcessHeap () returned 0x580000 [0124.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x192c) returned 0x6f42f08 [0124.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.323] CloseHandle (hObject=0x440) returned 1 [0124.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.id_1622540890_.your_last_chance")) returned 1 [0124.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0124.323] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.324] GetProcessHeap () returned 0x580000 [0124.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.324] GetProcessHeap () returned 0x580000 [0124.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.324] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.324] ReadFile (in: hFile=0x440, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x54cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.351] GetProcessHeap () returned 0x580000 [0124.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.351] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.351] WriteFile (in: hFile=0x440, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x54cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.351] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.351] WriteFile (in: hFile=0x440, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.351] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.351] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.351] CloseHandle (hObject=0x440) returned 1 [0124.351] GetProcessHeap () returned 0x580000 [0124.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.352] GetProcessHeap () returned 0x580000 [0124.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.352] GetProcessHeap () returned 0x580000 [0124.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81bc1a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe41, dwReserved0=0x54cfd28, dwReserved1=0x6f67710, cFileName="Opulent.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0124.352] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.378] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", len=0x4b | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned 1 [0124.379] GetProcessHeap () returned 0x580000 [0124.379] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1918) returned 0x6f42f08 [0124.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.379] CloseHandle (hObject=0x4a0) returned 1 [0124.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.id_1622540890_.your_last_chance")) returned 1 [0124.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.496] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x45, dwReserved1=0x0, cFileName="Module.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0124.496] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.496] GetProcessHeap () returned 0x580000 [0124.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.496] GetProcessHeap () returned 0x580000 [0124.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.496] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.496] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x54cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.516] GetProcessHeap () returned 0x580000 [0124.516] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.516] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.516] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x54cff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.516] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.516] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.516] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.516] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.517] CloseHandle (hObject=0x4a0) returned 1 [0124.517] GetProcessHeap () returned 0x580000 [0124.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.517] GetProcessHeap () returned 0x580000 [0124.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.517] GetProcessHeap () returned 0x580000 [0124.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81d3e7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe29, dwReserved0=0x54cfd28, dwReserved1=0x6f67710, cFileName="Module.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MODULE~1.YOU")) returned 0x5b9730 [0125.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.342] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", len=0x3d | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned 1 [0125.342] GetProcessHeap () returned 0x580000 [0125.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1958) returned 0x6f42f08 [0125.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0128.877] CloseHandle (hObject=0x490) returned 1 [0128.878] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.id_1622540890_.your_last_chance")) returned 1 [0130.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02346~1.YOU")) returned 0x5b9730 [0130.058] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0130.059] GetProcessHeap () returned 0x580000 [0130.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x635768 [0130.059] GetProcessHeap () returned 0x580000 [0130.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x6c29878 [0130.059] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.059] ReadFile (in: hFile=0x490, lpBuffer=0x635768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x54cff14*=0xd40, lpOverlapped=0x0) returned 1 [0130.072] GetProcessHeap () returned 0x580000 [0130.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.072] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.072] WriteFile (in: hFile=0x490, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x54cff14*=0xd40, lpOverlapped=0x0) returned 1 [0130.072] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.072] WriteFile (in: hFile=0x490, lpBuffer=0x6c2a5b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5b7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0130.072] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.072] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0130.072] CloseHandle (hObject=0x490) returned 1 [0130.072] GetProcessHeap () returned 0x580000 [0130.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0130.072] GetProcessHeap () returned 0x580000 [0130.072] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0130.072] GetProcessHeap () returned 0x580000 [0130.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0130.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85235160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd73, dwReserved0=0x54cfd28, dwReserved1=0x635768, cFileName="J0234687.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02346~1.YOU")) returned 0x5b9730 [0130.073] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0130.271] CloseHandle (hObject=0x490) returned 1 [0130.272] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0130.272] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id_1622540890_.your_last_chance")) returned 1 [0130.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTV~1.YOU")) returned 0x5b9730 [0131.787] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0131.787] GetProcessHeap () returned 0x580000 [0131.787] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e5b5e0 [0131.788] GetProcessHeap () returned 0x580000 [0131.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e6ce10 [0131.789] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.789] ReadFile (in: hFile=0x43c, lpBuffer=0x6e5b5e0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5b5e0*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0136.264] GetProcessHeap () returned 0x580000 [0136.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0136.264] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.264] WriteFile (in: hFile=0x43c, lpBuffer=0x6e6ce10*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e6ce10*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0136.265] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.265] WriteFile (in: hFile=0x43c, lpBuffer=0x6e7e60f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7e60f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.436] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.436] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.436] CloseHandle (hObject=0x43c) returned 1 [0138.518] GetProcessHeap () returned 0x580000 [0138.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e6ce10 | out: hHeap=0x580000) returned 1 [0138.518] GetProcessHeap () returned 0x580000 [0138.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e5b5e0 | out: hHeap=0x580000) returned 1 [0138.524] GetProcessHeap () returned 0x580000 [0138.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0138.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4e594, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="GANTT.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GANTTV~1.YOU")) returned 0x5b9770 [0138.612] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.654] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", len=0x43 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned 1 [0138.654] GetProcessHeap () returned 0x580000 [0138.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0138.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.855] CloseHandle (hObject=0x3b4) returned 1 [0139.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56009300, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56009300, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0xd1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~1.YOU")) returned 0x5b97b0 [0139.857] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.857] GetProcessHeap () returned 0x580000 [0139.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0139.857] GetProcessHeap () returned 0x580000 [0139.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6c29878 [0139.857] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.857] ReadFile (in: hFile=0x3b4, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x54cff14*=0xd00, lpOverlapped=0x0) returned 1 [0139.869] GetProcessHeap () returned 0x580000 [0139.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.869] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.869] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x54cff14*=0xd00, lpOverlapped=0x0) returned 1 [0139.869] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.870] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c2a577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a577*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0139.870] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.870] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0139.870] CloseHandle (hObject=0x3b4) returned 1 [0139.870] GetProcessHeap () returned 0x580000 [0139.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0139.870] GetProcessHeap () returned 0x580000 [0139.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0139.870] GetProcessHeap () returned 0x580000 [0139.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56009300, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8afa30e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x54cfd28, dwReserved1=0x635768, cFileName="BD21309_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~1.YOU")) returned 0x5b9770 [0140.126] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.177] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", len=0x5a | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0140.177] GetProcessHeap () returned 0x580000 [0140.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.177] CloseHandle (hObject=0x428) returned 1 [0140.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.178] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0140.196] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0140.196] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.196] GetProcessHeap () returned 0x580000 [0140.196] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd00e8 [0140.197] GetProcessHeap () returned 0x580000 [0140.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd0198 [0140.197] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.197] ReadFile (in: hFile=0x428, lpBuffer=0x6dd00e8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd00e8*, lpNumberOfBytesRead=0x54cff14*=0x80, lpOverlapped=0x0) returned 1 [0140.198] GetProcessHeap () returned 0x580000 [0140.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0140.198] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.198] WriteFile (in: hFile=0x428, lpBuffer=0x6dd0198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0198*, lpNumberOfBytesWritten=0x54cff14*=0x80, lpOverlapped=0x0) returned 1 [0140.198] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.198] WriteFile (in: hFile=0x428, lpBuffer=0x6dd0217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0217*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.198] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.198] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.198] CloseHandle (hObject=0x428) returned 1 [0140.198] GetProcessHeap () returned 0x580000 [0140.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd0198 | out: hHeap=0x580000) returned 1 [0140.199] GetProcessHeap () returned 0x580000 [0140.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd00e8 | out: hHeap=0x580000) returned 1 [0140.199] GetProcessHeap () returned 0x580000 [0140.199] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0140.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b2e8f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x54cfd28, dwReserved1=0x6dd00e8, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0140.489] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.859] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK", len=0x42 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 1 [0140.859] GetProcessHeap () returned 0x580000 [0140.859] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0140.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.860] CloseHandle (hObject=0x448) returned 1 [0140.860] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~1.YOU")) returned 0x5b9730 [0140.861] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.862] GetProcessHeap () returned 0x580000 [0140.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.862] GetProcessHeap () returned 0x580000 [0140.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.862] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.862] ReadFile (in: hFile=0x448, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0140.863] GetProcessHeap () returned 0x580000 [0140.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.863] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.863] WriteFile (in: hFile=0x448, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0140.863] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.863] WriteFile (in: hFile=0x448, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.863] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.863] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.863] CloseHandle (hObject=0x448) returned 1 [0140.863] GetProcessHeap () returned 0x580000 [0140.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.864] GetProcessHeap () returned 0x580000 [0140.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.864] GetProcessHeap () returned 0x580000 [0140.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9288e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x54cfd28, dwReserved1=0x61b540, cFileName="MSACCESS_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~1.YOU")) returned 0x5b9730 [0140.864] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.919] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK", len=0x46 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 1 [0140.919] GetProcessHeap () returned 0x580000 [0140.919] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.919] CloseHandle (hObject=0x488) returned 1 [0140.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.921] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSFED4~1.YOU")) returned 0x5b9730 [0140.921] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.921] GetProcessHeap () returned 0x580000 [0140.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.921] GetProcessHeap () returned 0x580000 [0140.921] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.921] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.921] ReadFile (in: hFile=0x488, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0140.922] GetProcessHeap () returned 0x580000 [0140.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.922] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.922] WriteFile (in: hFile=0x488, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0140.922] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.922] WriteFile (in: hFile=0x488, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.923] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.923] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.923] CloseHandle (hObject=0x488) returned 1 [0140.923] GetProcessHeap () returned 0x580000 [0140.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.923] GetProcessHeap () returned 0x580000 [0140.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.923] GetProcessHeap () returned 0x580000 [0140.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9c0e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x54cfd28, dwReserved1=0x61b540, cFileName="MSACCESS.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSFED4~1.YOU")) returned 0x5b9730 [0140.923] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.965] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS", len=0x40 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 1 [0140.965] GetProcessHeap () returned 0x580000 [0140.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0140.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.966] CloseHandle (hObject=0x488) returned 1 [0140.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.966] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0140.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0xa3f874, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD843~1.YOU")) returned 0x5b9730 [0140.967] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.967] GetProcessHeap () returned 0x580000 [0140.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eb2838 [0140.967] GetProcessHeap () returned 0x580000 [0140.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0140.968] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.968] ReadFile (in: hFile=0x488, lpBuffer=0x6eb2838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb2838*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.064] GetProcessHeap () returned 0x580000 [0143.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0143.064] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.064] WriteFile (in: hFile=0x488, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.065] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.065] WriteFile (in: hFile=0x488, lpBuffer=0x64816f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x64816f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0143.294] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.294] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0143.294] CloseHandle (hObject=0x488) returned 1 [0143.851] GetProcessHeap () returned 0x580000 [0143.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0143.851] GetProcessHeap () returned 0x580000 [0143.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb2838 | out: hHeap=0x580000) returned 1 [0143.851] GetProcessHeap () returned 0x580000 [0143.851] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0146.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d05df60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa3f898, dwReserved0=0x54cfd28, dwReserved1=0x6eb2838, cFileName="MSACCESS.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD843~1.YOU")) returned 0x5b96f0 [0146.861] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.875] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", len=0x43 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF") returned 1 [0146.875] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.023] CloseHandle (hObject=0x4a0) returned 1 [0153.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.023] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.id_1622540890_.your_last_chance")) returned 1 [0153.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3567a000, ftCreationTime.dwHighDateTime=0x1bdb36e, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3567a000, ftLastWriteTime.dwHighDateTime=0x1bdb36e, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR2B~1.YOU")) returned 0x5b9730 [0153.024] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.024] GetProcessHeap () returned 0x580000 [0153.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x677cd0 [0153.024] GetProcessHeap () returned 0x580000 [0153.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba1) returned 0x706e008 [0153.024] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.024] ReadFile (in: hFile=0x4a0, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xb80, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x54cff14*=0xb80, lpOverlapped=0x0) returned 1 [0153.035] GetProcessHeap () returned 0x580000 [0153.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.035] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.035] WriteFile (in: hFile=0x4a0, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xb80, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x54cff14*=0xb80, lpOverlapped=0x0) returned 1 [0153.037] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.037] WriteFile (in: hFile=0x4a0, lpBuffer=0x706eb87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x706eb87*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0153.037] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.038] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0153.038] CloseHandle (hObject=0x4a0) returned 1 [0153.038] GetProcessHeap () returned 0x580000 [0153.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0153.038] GetProcessHeap () returned 0x580000 [0153.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0153.038] GetProcessHeap () returned 0x580000 [0153.038] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3567a000, ftCreationTime.dwHighDateTime=0x1bdb36e, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92d59ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbba, dwReserved0=0x54cfd28, dwReserved1=0x677cd0, cFileName="PDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR2B~1.YOU")) returned 0x5b9630 [0153.753] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.460] CloseHandle (hObject=0x4a0) returned 1 [0155.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WICEFF~1.YOU")) returned 0x5b9730 [0155.462] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.462] GetProcessHeap () returned 0x580000 [0155.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.462] GetProcessHeap () returned 0x580000 [0155.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.462] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.462] ReadFile (in: hFile=0x4a0, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0155.463] GetProcessHeap () returned 0x580000 [0155.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.463] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.463] WriteFile (in: hFile=0x4a0, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x54cff14*=0x60, lpOverlapped=0x0) returned 1 [0155.463] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.464] WriteFile (in: hFile=0x4a0, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0155.464] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.464] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0155.464] CloseHandle (hObject=0x4a0) returned 1 [0155.464] GetProcessHeap () returned 0x580000 [0155.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.464] GetProcessHeap () returned 0x580000 [0155.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.464] GetProcessHeap () returned 0x580000 [0155.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94468fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x54cfd28, dwReserved1=0x61b540, cFileName="WINWORD_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WICEFF~1.YOU")) returned 0x5b9630 [0155.972] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.987] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", len=0x3e | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 1 [0155.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0155.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0157.912] CloseHandle (hObject=0x428) returned 1 [0157.912] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0157.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id_1622540890_.your_last_chance")) returned 1 [0157.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0157.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~1.YOU")) returned 0x5b9630 [0157.913] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0157.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0157.913] GetProcessHeap () returned 0x580000 [0157.913] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b21) returned 0x6d59538 [0157.914] GetProcessHeap () returned 0x580000 [0157.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6b21) returned 0x6f976f8 [0157.914] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.914] ReadFile (in: hFile=0x428, lpBuffer=0x6d59538, nNumberOfBytesToRead=0x6b00, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d59538*, lpNumberOfBytesRead=0x54cff14*=0x6b00, lpOverlapped=0x0) returned 1 [0160.221] GetProcessHeap () returned 0x580000 [0160.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0160.222] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] WriteFile (in: hFile=0x428, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x6b00, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x54cff14*=0x6b00, lpOverlapped=0x0) returned 1 [0160.222] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] WriteFile (in: hFile=0x428, lpBuffer=0x6f9e1f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9e1f7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0160.222] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.222] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0160.222] CloseHandle (hObject=0x428) returned 1 [0160.222] GetProcessHeap () returned 0x580000 [0160.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0160.222] GetProcessHeap () returned 0x580000 [0160.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d59538 | out: hHeap=0x580000) returned 1 [0160.222] GetProcessHeap () returned 0x580000 [0160.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0164.493] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x971c9340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6b38, dwReserved0=0x54cfd28, dwReserved1=0x6d59538, cFileName="MSART15.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART1~1.YOU")) returned 0x5b9730 [0164.493] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.565] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", len=0x3e | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 1 [0164.566] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0164.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0164.566] CloseHandle (hObject=0x4ac) returned 1 [0164.566] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0164.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id_1622540890_.your_last_chance")) returned 1 [0165.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PMAILE~1.YOU")) returned 0x5b9730 [0165.420] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0165.420] GetProcessHeap () returned 0x580000 [0165.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0165.421] GetProcessHeap () returned 0x580000 [0165.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0165.421] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.421] ReadFile (in: hFile=0x48c, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x54cff14*=0x260, lpOverlapped=0x0) returned 1 [0165.425] GetProcessHeap () returned 0x580000 [0165.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.425] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.425] WriteFile (in: hFile=0x48c, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x54cff14*=0x260, lpOverlapped=0x0) returned 1 [0165.425] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.425] WriteFile (in: hFile=0x48c, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0165.425] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.425] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0165.425] CloseHandle (hObject=0x48c) returned 1 [0165.425] GetProcessHeap () returned 0x580000 [0165.425] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0165.425] GetProcessHeap () returned 0x580000 [0165.425] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0165.425] GetProcessHeap () returned 0x580000 [0165.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a379e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x54cfd28, dwReserved1=0x6df2798, cFileName="PMAILEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PMAILE~1.YOU")) returned 0x5b9730 [0169.287] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.382] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", len=0x35 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 1 [0169.382] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0169.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0169.528] CloseHandle (hObject=0x460) returned 1 [0169.528] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.528] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.id_1622540890_.your_last_chance")) returned 1 [0169.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.529] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGDIC~1.YOU")) returned 0x5b9730 [0169.529] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0169.529] GetProcessHeap () returned 0x580000 [0169.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0169.529] GetProcessHeap () returned 0x580000 [0169.529] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0169.529] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.529] ReadFile (in: hFile=0x460, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.157] GetProcessHeap () returned 0x580000 [0174.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0174.157] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.158] WriteFile (in: hFile=0x460, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.158] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.158] WriteFile (in: hFile=0x460, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.222] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.222] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.222] CloseHandle (hObject=0x460) returned 1 [0174.222] GetProcessHeap () returned 0x580000 [0174.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0174.224] GetProcessHeap () returned 0x580000 [0174.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0174.225] GetProcessHeap () returned 0x580000 [0174.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0176.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f762600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x46caa, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="ENGDIC.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENGDIC~1.YOU")) returned 0x5b96f0 [0176.798] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.842] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", len=0x3a | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS") returned 1 [0176.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2124) returned 0x6f14048 [0176.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.604] CloseHandle (hObject=0x43c) returned 1 [0179.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.id_1622540890_.your_last_chance")) returned 1 [0179.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b96f0 [0179.605] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\spring.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.605] GetProcessHeap () returned 0x580000 [0179.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.605] GetProcessHeap () returned 0x580000 [0179.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.605] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.605] ReadFile (in: hFile=0x43c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x54cff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.617] GetProcessHeap () returned 0x580000 [0179.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.617] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.617] WriteFile (in: hFile=0x43c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x54cff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.618] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.618] WriteFile (in: hFile=0x43c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0179.618] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.618] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0179.618] CloseHandle (hObject=0x43c) returned 1 [0179.618] GetProcessHeap () returned 0x580000 [0179.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.618] GetProcessHeap () returned 0x580000 [0179.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.618] GetProcessHeap () returned 0x580000 [0179.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa2ab6060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x54cfd28, dwReserved1=0x635768, cFileName="SPRING.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b9770 [0181.348] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.357] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", len=0x64 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned 1 [0181.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0181.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.082] CloseHandle (hObject=0x46c) returned 1 [0183.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2b7f600, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL4FDC~1.YOU")) returned 0x5b9770 [0183.083] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.083] GetProcessHeap () returned 0x580000 [0183.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x7066b08 [0183.083] GetProcessHeap () returned 0x580000 [0183.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6efb008 [0183.084] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.084] ReadFile (in: hFile=0x46c, lpBuffer=0x7066b08, nNumberOfBytesToRead=0x13c0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesRead=0x54cff14*=0x13c0, lpOverlapped=0x0) returned 1 [0183.101] GetProcessHeap () returned 0x580000 [0183.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.101] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.101] WriteFile (in: hFile=0x46c, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x54cff14*=0x13c0, lpOverlapped=0x0) returned 1 [0183.102] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.102] WriteFile (in: hFile=0x46c, lpBuffer=0x6efc3c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc3c7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0183.102] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.102] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0183.102] CloseHandle (hObject=0x46c) returned 1 [0183.102] GetProcessHeap () returned 0x580000 [0183.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0183.102] GetProcessHeap () returned 0x580000 [0183.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0183.102] GetProcessHeap () returned 0x580000 [0183.102] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4c09460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13ee, dwReserved0=0x54cfd28, dwReserved1=0x7066b08, cFileName="AlertImage_High.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL4FDC~1.YOU")) returned 0x5b9770 [0183.806] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.823] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", len=0x68 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned 1 [0183.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0183.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.853] CloseHandle (hObject=0x450) returned 1 [0183.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.id_1622540890_.your_last_chance")) returned 1 [0183.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2E84~1.YOU")) returned 0x5b9770 [0183.854] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.854] GetProcessHeap () returned 0x580000 [0183.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596cd8 [0183.855] GetProcessHeap () returned 0x580000 [0183.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596828 [0183.855] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.855] ReadFile (in: hFile=0x450, lpBuffer=0x596cd8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x596cd8*, lpNumberOfBytesRead=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0183.856] GetProcessHeap () returned 0x580000 [0183.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0183.856] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.856] WriteFile (in: hFile=0x450, lpBuffer=0x596828*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x596828*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0183.856] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.856] WriteFile (in: hFile=0x450, lpBuffer=0x596847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x596847*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0183.856] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.856] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0183.856] CloseHandle (hObject=0x450) returned 1 [0183.856] GetProcessHeap () returned 0x580000 [0183.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596828 | out: hHeap=0x580000) returned 1 [0183.856] GetProcessHeap () returned 0x580000 [0183.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596cd8 | out: hHeap=0x580000) returned 1 [0183.856] GetProcessHeap () returned 0x580000 [0183.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa532d660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x54cfd28, dwReserved1=0x596cd8, cFileName="button_mid_disable.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2E84~1.YOU")) returned 0x5b9770 [0183.856] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.863] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", len=0x63 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned 1 [0183.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0183.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0183.893] CloseHandle (hObject=0x464) returned 1 [0183.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.id_1622540890_.your_last_chance")) returned 1 [0183.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b9770 [0183.894] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0183.894] GetProcessHeap () returned 0x580000 [0183.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x6d74f88 [0183.895] GetProcessHeap () returned 0x580000 [0183.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d61) returned 0x7047008 [0183.895] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.895] ReadFile (in: hFile=0x464, lpBuffer=0x6d74f88, nNumberOfBytesToRead=0x3d40, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d74f88*, lpNumberOfBytesRead=0x54cff14*=0x3d40, lpOverlapped=0x0) returned 1 [0184.560] GetProcessHeap () returned 0x580000 [0184.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0184.561] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.561] WriteFile (in: hFile=0x464, lpBuffer=0x7047008*, nNumberOfBytesToWrite=0x3d40, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7047008*, lpNumberOfBytesWritten=0x54cff14*=0x3d40, lpOverlapped=0x0) returned 1 [0184.561] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.561] WriteFile (in: hFile=0x464, lpBuffer=0x704ad47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x704ad47*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.561] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.561] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.561] CloseHandle (hObject=0x464) returned 1 [0184.925] GetProcessHeap () returned 0x580000 [0184.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7047008 | out: hHeap=0x580000) returned 1 [0184.925] GetProcessHeap () returned 0x580000 [0184.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d74f88 | out: hHeap=0x580000) returned 1 [0184.925] GetProcessHeap () returned 0x580000 [0184.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0185.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa59df440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d7b, dwReserved0=0x54cfd28, dwReserved1=0x6d74f88, cFileName="bg_OliveGreen.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_OLI~1.YOU")) returned 0x5b9770 [0185.532] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.580] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", len=0x57 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned 1 [0185.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0185.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0185.719] CloseHandle (hObject=0x464) returned 1 [0185.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.720] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0185.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf8, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGINT~2.YOU")) returned 0x5b9770 [0185.720] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0185.721] GetProcessHeap () returned 0x580000 [0185.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0185.721] GetProcessHeap () returned 0x580000 [0185.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x706e008 [0185.721] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.721] ReadFile (in: hFile=0x464, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x54cff14*=0xae0, lpOverlapped=0x0) returned 1 [0185.744] GetProcessHeap () returned 0x580000 [0185.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0185.744] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.744] WriteFile (in: hFile=0x464, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x54cff14*=0xae0, lpOverlapped=0x0) returned 1 [0185.744] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.744] WriteFile (in: hFile=0x464, lpBuffer=0x706eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x706eae7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0185.744] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.744] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0185.745] CloseHandle (hObject=0x464) returned 1 [0185.745] GetProcessHeap () returned 0x580000 [0185.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0185.745] GetProcessHeap () returned 0x580000 [0185.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0185.745] GetProcessHeap () returned 0x580000 [0185.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0185.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa652dcc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb1c, dwReserved0=0x54cfd28, dwReserved1=0x677cd0, cFileName="LoginTool24x24ImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGINT~2.YOU")) returned 0x5b9770 [0185.745] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.822] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", len=0x44 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned 1 [0185.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a0) returned 0x6f14048 [0185.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0185.823] CloseHandle (hObject=0x490) returned 1 [0185.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.id_1622540890_.your_last_chance")) returned 1 [0185.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~1.YOU")) returned 0x5b9770 [0185.824] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0185.824] GetProcessHeap () returned 0x580000 [0185.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdb41) returned 0x7047008 [0185.824] GetProcessHeap () returned 0x580000 [0185.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdb41) returned 0x6f976f8 [0185.824] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.824] ReadFile (in: hFile=0x490, lpBuffer=0x7047008, nNumberOfBytesToRead=0xdb20, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7047008*, lpNumberOfBytesRead=0x54cff14*=0xdb20, lpOverlapped=0x0) returned 1 [0189.621] GetProcessHeap () returned 0x580000 [0189.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0189.621] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.622] WriteFile (in: hFile=0x490, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0xdb20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x54cff14*=0xdb20, lpOverlapped=0x0) returned 1 [0189.622] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.622] WriteFile (in: hFile=0x490, lpBuffer=0x6fa5217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5217*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0189.622] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.622] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0189.622] CloseHandle (hObject=0x490) returned 1 [0190.277] GetProcessHeap () returned 0x580000 [0190.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0190.277] GetProcessHeap () returned 0x580000 [0190.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7047008 | out: hHeap=0x580000) returned 1 [0190.277] GetProcessHeap () returned 0x580000 [0190.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8a39320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdb52, dwReserved0=0x54cfd28, dwReserved1=0x7047008, cFileName="ZPDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~1.YOU")) returned 0x5b9770 [0193.192] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.220] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned 1 [0193.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2080) returned 0x6f14048 [0193.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0193.221] CloseHandle (hObject=0x478) returned 1 [0193.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.id_1622540890_.your_last_chance")) returned 1 [0193.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x856, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b9770 [0193.222] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0193.222] GetProcessHeap () returned 0x580000 [0193.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6c79898 [0193.222] GetProcessHeap () returned 0x580000 [0193.225] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6d00cd8 [0193.225] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.233] ReadFile (in: hFile=0x478, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x54cff14*=0x840, lpOverlapped=0x0) returned 1 [0193.333] GetProcessHeap () returned 0x580000 [0193.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.333] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x478, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x54cff14*=0x840, lpOverlapped=0x0) returned 1 [0193.334] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x478, lpBuffer=0x6d01517*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01517*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0193.334] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0193.334] CloseHandle (hObject=0x478) returned 1 [0193.334] GetProcessHeap () returned 0x580000 [0193.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0193.334] GetProcessHeap () returned 0x580000 [0193.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0193.334] GetProcessHeap () returned 0x580000 [0193.334] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaada1a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x87a, dwReserved0=0x54cfd28, dwReserved1=0x6c79898, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b97b0 [0193.334] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.421] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", len=0x5f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned 1 [0193.421] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0193.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.436] CloseHandle (hObject=0x3b8) returned 1 [0193.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.id_1622540890_.your_last_chance")) returned 1 [0193.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b97b0 [0193.437] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.438] GetProcessHeap () returned 0x580000 [0193.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6599e8 [0193.438] GetProcessHeap () returned 0x580000 [0193.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x659db0 [0193.438] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.438] ReadFile (in: hFile=0x3b8, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x54cff14*=0x380, lpOverlapped=0x0) returned 1 [0193.466] GetProcessHeap () returned 0x580000 [0193.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0193.466] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x3b8, lpBuffer=0x659db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x659db0*, lpNumberOfBytesWritten=0x54cff14*=0x380, lpOverlapped=0x0) returned 1 [0193.466] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x3b8, lpBuffer=0x65a12f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x65a12f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0193.466] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.466] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0193.467] CloseHandle (hObject=0x3b8) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659db0 | out: hHeap=0x580000) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0193.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaed2560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x54cfd28, dwReserved1=0x6599e8, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b97f0 [0193.923] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.956] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0193.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0193.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0194.013] CloseHandle (hObject=0x468) returned 1 [0194.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0194.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0042, dwReserved1=0x46004f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0194.014] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0194.014] GetProcessHeap () returned 0x580000 [0194.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0194.014] GetProcessHeap () returned 0x580000 [0194.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0194.014] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.014] ReadFile (in: hFile=0x468, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x54cff14*=0x140, lpOverlapped=0x0) returned 1 [0194.016] GetProcessHeap () returned 0x580000 [0194.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0194.016] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.016] WriteFile (in: hFile=0x468, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x54cff14*=0x140, lpOverlapped=0x0) returned 1 [0194.016] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.016] WriteFile (in: hFile=0x468, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0194.016] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.017] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0194.017] CloseHandle (hObject=0x468) returned 1 [0194.017] GetProcessHeap () returned 0x580000 [0194.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0194.017] GetProcessHeap () returned 0x580000 [0194.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0194.017] GetProcessHeap () returned 0x580000 [0194.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0194.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab407580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x54cfd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0194.017] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.045] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", len=0x6e | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned 1 [0194.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0194.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0195.622] CloseHandle (hObject=0x454) returned 1 [0195.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance")) returned 1 [0196.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x63002e, dwReserved1=0x730073, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b97f0 [0196.609] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.609] GetProcessHeap () returned 0x580000 [0196.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0196.609] GetProcessHeap () returned 0x580000 [0196.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0196.609] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.609] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x54cff14*=0x400, lpOverlapped=0x0) returned 1 [0196.618] GetProcessHeap () returned 0x580000 [0196.618] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.618] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.618] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x54cff14*=0x400, lpOverlapped=0x0) returned 1 [0196.619] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.619] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.619] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.619] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.619] CloseHandle (hObject=0x4ac) returned 1 [0196.619] GetProcessHeap () returned 0x580000 [0196.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0196.619] GetProcessHeap () returned 0x580000 [0196.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0196.619] GetProcessHeap () returned 0x580000 [0196.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccdfb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x435, dwReserved0=0x54cfd28, dwReserved1=0x6c6a110, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b97b0 [0196.619] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.634] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", len=0x69 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned 1 [0196.634] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0196.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.635] CloseHandle (hObject=0x4ac) returned 1 [0196.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.id_1622540890_.your_last_chance")) returned 1 [0196.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b97b0 [0196.636] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.636] GetProcessHeap () returned 0x580000 [0196.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x635768 [0196.636] GetProcessHeap () returned 0x580000 [0196.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x6f668d8 [0196.636] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.636] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x54cff14*=0xd40, lpOverlapped=0x0) returned 1 [0196.661] GetProcessHeap () returned 0x580000 [0196.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.661] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x54cff14*=0xd40, lpOverlapped=0x0) returned 1 [0196.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.661] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f67617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67617*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.661] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.662] CloseHandle (hObject=0x4ac) returned 1 [0196.686] GetProcessHeap () returned 0x580000 [0196.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0196.686] GetProcessHeap () returned 0x580000 [0196.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0196.696] GetProcessHeap () returned 0x580000 [0196.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd51f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd69, dwReserved0=0x54cfd28, dwReserved1=0x635768, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b97b0 [0196.696] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.798] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", len=0x45 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned 1 [0196.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd0) returned 0x6f14048 [0196.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.836] CloseHandle (hObject=0x488) returned 1 [0196.836] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.836] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~3.YOU")) returned 0x5b97b0 [0196.837] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.837] GetProcessHeap () returned 0x580000 [0196.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c01) returned 0x6e37060 [0196.837] GetProcessHeap () returned 0x580000 [0196.837] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c01) returned 0x7062940 [0196.837] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.838] ReadFile (in: hFile=0x488, lpBuffer=0x6e37060, nNumberOfBytesToRead=0x4be0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e37060*, lpNumberOfBytesRead=0x54cff14*=0x4be0, lpOverlapped=0x0) returned 1 [0197.669] GetProcessHeap () returned 0x580000 [0197.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0197.669] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.669] WriteFile (in: hFile=0x488, lpBuffer=0x7062940*, nNumberOfBytesToWrite=0x4be0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesWritten=0x54cff14*=0x4be0, lpOverlapped=0x0) returned 1 [0197.669] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.669] WriteFile (in: hFile=0x488, lpBuffer=0x706751f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x706751f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0197.669] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.669] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0197.669] CloseHandle (hObject=0x488) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e37060 | out: hHeap=0x580000) returned 1 [0197.792] GetProcessHeap () returned 0x580000 [0197.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad6fd8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c0d, dwReserved0=0x54cfd28, dwReserved1=0x6e37060, cFileName="ZPDIR18F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~3.YOU")) returned 0x5b96b0 [0199.652] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.957] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", len=0x5d | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned 1 [0200.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd4) returned 0x6f14048 [0200.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0200.990] CloseHandle (hObject=0x450) returned 1 [0200.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.990] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.id_1622540890_.your_last_chance")) returned 1 [0201.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b97b0 [0201.754] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.754] GetProcessHeap () returned 0x580000 [0201.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0201.754] GetProcessHeap () returned 0x580000 [0201.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0201.754] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.754] ReadFile (in: hFile=0x450, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x54cff14*=0x260, lpOverlapped=0x0) returned 1 [0201.758] GetProcessHeap () returned 0x580000 [0201.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.758] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x450, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x54cff14*=0x260, lpOverlapped=0x0) returned 1 [0201.758] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x450, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.758] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.758] CloseHandle (hObject=0x450) returned 1 [0201.758] GetProcessHeap () returned 0x580000 [0201.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0201.758] GetProcessHeap () returned 0x580000 [0201.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0201.758] GetProcessHeap () returned 0x580000 [0201.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafdf80e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x54cfd28, dwReserved1=0x6c61120, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b9770 [0202.646] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.699] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS", len=0x45 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS") returned 1 [0202.699] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ecc) returned 0x6f14048 [0202.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0202.740] CloseHandle (hObject=0x45c) returned 1 [0202.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css.id_1622540890_.your_last_chance")) returned 1 [0202.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35bb00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa35bb00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d522, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC2A3A~1.YOU")) returned 0x5b9770 [0202.742] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0202.742] GetProcessHeap () returned 0x580000 [0202.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71acea8 [0202.742] GetProcessHeap () returned 0x580000 [0202.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71be6d8 [0202.743] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.743] ReadFile (in: hFile=0x45c, lpBuffer=0x71acea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x71acea8*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.048] GetProcessHeap () returned 0x580000 [0209.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0209.049] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.049] WriteFile (in: hFile=0x45c, lpBuffer=0x71be6d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x71be6d8*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.049] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.049] WriteFile (in: hFile=0x45c, lpBuffer=0x71cfed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x71cfed7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0209.049] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.049] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0209.050] CloseHandle (hObject=0x45c) returned 1 [0209.050] GetProcessHeap () returned 0x580000 [0209.050] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71be6d8 | out: hHeap=0x580000) returned 1 [0209.523] GetProcessHeap () returned 0x580000 [0209.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71acea8 | out: hHeap=0x580000) returned 1 [0209.527] GetProcessHeap () returned 0x580000 [0209.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0210.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35bb00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4372300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d546, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="SCHEME30.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC2A3A~1.YOU")) returned 0x5b97b0 [0210.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.124] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", len=0x69 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned 1 [0210.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0210.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.297] CloseHandle (hObject=0x3b8) returned 1 [0215.297] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0215.299] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b97b0 [0215.299] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.299] GetProcessHeap () returned 0x580000 [0215.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce54c0 [0215.299] GetProcessHeap () returned 0x580000 [0215.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6ce5e48 [0215.299] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.299] ReadFile (in: hFile=0x3b8, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x54cff14*=0x920, lpOverlapped=0x0) returned 1 [0215.308] GetProcessHeap () returned 0x580000 [0215.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.308] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.308] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ce5e48*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5e48*, lpNumberOfBytesWritten=0x54cff14*=0x920, lpOverlapped=0x0) returned 1 [0215.309] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.309] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ce6767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6767*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0215.309] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.309] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0215.309] CloseHandle (hObject=0x3b8) returned 1 [0215.309] GetProcessHeap () returned 0x580000 [0215.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5e48 | out: hHeap=0x580000) returned 1 [0215.309] GetProcessHeap () returned 0x580000 [0215.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0215.309] GetProcessHeap () returned 0x580000 [0215.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f1aa60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x54cfd28, dwReserved1=0x6ce54c0, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b9770 [0217.462] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.522] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", len=0x60 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned 1 [0217.522] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0217.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.523] CloseHandle (hObject=0x48c) returned 1 [0217.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.id_1622540890_.your_last_chance")) returned 1 [0217.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b9770 [0217.524] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.524] GetProcessHeap () returned 0x580000 [0217.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0217.524] GetProcessHeap () returned 0x580000 [0217.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x6e0d050 [0217.524] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.524] ReadFile (in: hFile=0x48c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x54cff14*=0xae0, lpOverlapped=0x0) returned 1 [0217.538] GetProcessHeap () returned 0x580000 [0217.539] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.539] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.539] WriteFile (in: hFile=0x48c, lpBuffer=0x6e0d050*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0d050*, lpNumberOfBytesWritten=0x54cff14*=0xae0, lpOverlapped=0x0) returned 1 [0217.539] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.539] WriteFile (in: hFile=0x48c, lpBuffer=0x6e0db2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0db2f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0217.539] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.539] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0217.539] CloseHandle (hObject=0x48c) returned 1 [0217.539] GetProcessHeap () returned 0x580000 [0217.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0d050 | out: hHeap=0x580000) returned 1 [0217.539] GetProcessHeap () returned 0x580000 [0217.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0217.539] GetProcessHeap () returned 0x580000 [0217.539] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.539] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9460f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0c, dwReserved0=0x54cfd28, dwReserved1=0x677cd0, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b9770 [0217.539] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.556] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", len=0x60 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned 1 [0217.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0217.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0217.557] CloseHandle (hObject=0x4a8) returned 1 [0217.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.id_1622540890_.your_last_chance")) returned 1 [0217.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64b3, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b9770 [0217.558] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0217.558] GetProcessHeap () returned 0x580000 [0217.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x64c1) returned 0x7062940 [0217.558] GetProcessHeap () returned 0x580000 [0217.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x64c1) returned 0x6ec3600 [0217.559] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.559] ReadFile (in: hFile=0x4a8, lpBuffer=0x7062940, nNumberOfBytesToRead=0x64a0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7062940*, lpNumberOfBytesRead=0x54cff14*=0x64a0, lpOverlapped=0x0) returned 1 [0219.565] GetProcessHeap () returned 0x580000 [0219.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0219.565] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.565] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ec3600*, nNumberOfBytesToWrite=0x64a0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec3600*, lpNumberOfBytesWritten=0x54cff14*=0x64a0, lpOverlapped=0x0) returned 1 [0219.566] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.566] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ec9a9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec9a9f*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0219.566] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0219.566] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0219.566] CloseHandle (hObject=0x4a8) returned 1 [0220.319] GetProcessHeap () returned 0x580000 [0220.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec3600 | out: hHeap=0x580000) returned 1 [0220.667] GetProcessHeap () returned 0x580000 [0220.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062940 | out: hHeap=0x580000) returned 1 [0220.667] GetProcessHeap () returned 0x580000 [0220.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0223.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba7b81c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x64d7, dwReserved0=0x54cfd28, dwReserved1=0x7062940, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b96f0 [0223.407] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.437] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned 1 [0223.438] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0223.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0223.439] CloseHandle (hObject=0x45c) returned 1 [0223.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.id_1622540890_.your_last_chance")) returned 1 [0223.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b96f0 [0223.468] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0223.468] GetProcessHeap () returned 0x580000 [0223.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6f04558 [0223.468] GetProcessHeap () returned 0x580000 [0223.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6d045f8 [0223.468] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.468] ReadFile (in: hFile=0x45c, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x54cff14*=0x340, lpOverlapped=0x0) returned 1 [0223.473] GetProcessHeap () returned 0x580000 [0223.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0223.473] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.473] WriteFile (in: hFile=0x45c, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x54cff14*=0x340, lpOverlapped=0x0) returned 1 [0223.473] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.473] WriteFile (in: hFile=0x45c, lpBuffer=0x6d04937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04937*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0223.473] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.473] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0223.473] CloseHandle (hObject=0x45c) returned 1 [0223.473] GetProcessHeap () returned 0x580000 [0223.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0223.473] GetProcessHeap () returned 0x580000 [0223.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0223.473] GetProcessHeap () returned 0x580000 [0223.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0226.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcd0fae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x374, dwReserved0=0x54cfd28, dwReserved1=0x6f04558, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~2.YOU")) returned 0x5b9630 [0226.022] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.316] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", len=0x48 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 1 [0226.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da0) returned 0x6dee6e0 [0226.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.434] CloseHandle (hObject=0x484) returned 1 [0226.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.id_1622540890_.your_last_chance")) returned 1 [0226.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ANALYS~1.YOU")) returned 0x5b9630 [0226.435] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0226.435] GetProcessHeap () returned 0x580000 [0226.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7264b28 [0226.436] GetProcessHeap () returned 0x580000 [0226.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7276358 [0226.436] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.436] ReadFile (in: hFile=0x484, lpBuffer=0x7264b28, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7264b28*, lpNumberOfBytesRead=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.415] GetProcessHeap () returned 0x580000 [0235.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0235.415] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.415] WriteFile (in: hFile=0x484, lpBuffer=0x7276358*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7276358*, lpNumberOfBytesWritten=0x54cff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.416] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.416] WriteFile (in: hFile=0x484, lpBuffer=0x7287b57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x7287b57*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0235.416] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.416] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0235.416] CloseHandle (hObject=0x484) returned 1 [0235.416] GetProcessHeap () returned 0x580000 [0235.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7276358 | out: hHeap=0x580000) returned 1 [0235.417] GetProcessHeap () returned 0x580000 [0235.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7264b28 | out: hHeap=0x580000) returned 1 [0235.417] GetProcessHeap () returned 0x580000 [0235.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0235.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc3d62900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3bb84, dwReserved0=0x54cfd28, dwReserved1=0x7264b28, cFileName="ANALYS32.XLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ANALYS~1.YOU")) returned 0x5b9730 [0235.417] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.548] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML", len=0x4b | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned 1 [0240.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0240.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.550] CloseHandle (hObject=0x488) returned 1 [0240.550] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml.id_1622540890_.your_last_chance")) returned 1 [0240.552] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOP~1.YOU")) returned 0x5b9730 [0240.552] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.552] GetProcessHeap () returned 0x580000 [0240.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.552] GetProcessHeap () returned 0x580000 [0240.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.556] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.556] ReadFile (in: hFile=0x488, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.569] GetProcessHeap () returned 0x580000 [0240.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.569] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.569] WriteFile (in: hFile=0x488, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.569] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.569] WriteFile (in: hFile=0x488, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.569] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.569] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.569] CloseHandle (hObject=0x488) returned 1 [0240.572] GetProcessHeap () returned 0x580000 [0240.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.572] GetProcessHeap () returned 0x580000 [0240.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.572] GetProcessHeap () returned 0x580000 [0240.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6ea1020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x54cfd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.PL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOP~1.YOU")) returned 0x5b9730 [0240.623] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.633] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML", len=0x4f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned 1 [0240.633] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0240.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.633] CloseHandle (hObject=0x3a8) returned 1 [0240.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml.id_1622540890_.your_last_chance")) returned 1 [0240.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~3.YOU")) returned 0x5b9730 [0240.634] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0240.635] GetProcessHeap () returned 0x580000 [0240.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0240.635] GetProcessHeap () returned 0x580000 [0240.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07390 [0240.635] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.635] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d07028, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesRead=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.642] GetProcessHeap () returned 0x580000 [0240.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.643] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.643] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d07390*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07390*, lpNumberOfBytesWritten=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.643] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.643] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d076af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076af*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.643] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.643] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.643] CloseHandle (hObject=0x3a8) returned 1 [0240.643] GetProcessHeap () returned 0x580000 [0240.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07390 | out: hHeap=0x580000) returned 1 [0240.643] GetProcessHeap () returned 0x580000 [0240.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0240.643] GetProcessHeap () returned 0x580000 [0240.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f395a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x54cfd28, dwReserved1=0x6d07028, cFileName="YAHOO.COM.TW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~3.YOU")) returned 0x5b9730 [0240.643] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.653] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML", len=0x4f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned 1 [0240.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0240.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.689] CloseHandle (hObject=0x414) returned 1 [0240.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml.id_1622540890_.your_last_chance")) returned 1 [0240.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAAA73~1.YOU")) returned 0x5b9730 [0240.690] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.691] GetProcessHeap () returned 0x580000 [0240.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07a60 [0240.691] GetProcessHeap () returned 0x580000 [0240.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07dc8 [0240.691] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.691] ReadFile (in: hFile=0x414, lpBuffer=0x6d07a60, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a60*, lpNumberOfBytesRead=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.739] GetProcessHeap () returned 0x580000 [0240.739] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.739] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.739] WriteFile (in: hFile=0x414, lpBuffer=0x6d07dc8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07dc8*, lpNumberOfBytesWritten=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.739] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.739] WriteFile (in: hFile=0x414, lpBuffer=0x6d080e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d080e7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.739] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.739] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.739] CloseHandle (hObject=0x414) returned 1 [0240.739] GetProcessHeap () returned 0x580000 [0240.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07dc8 | out: hHeap=0x580000) returned 1 [0240.739] GetProcessHeap () returned 0x580000 [0240.739] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07a60 | out: hHeap=0x580000) returned 1 [0240.740] GetProcessHeap () returned 0x580000 [0240.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc701dde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x54cfd28, dwReserved1=0x6d07a60, cFileName="YAHOO.COM.MX.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAAA73~1.YOU")) returned 0x5b9730 [0240.740] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.798] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML", len=0x50 | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned 1 [0240.798] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0240.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.799] CloseHandle (hObject=0x414) returned 1 [0240.799] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.799] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SBCGLO~1.YOU")) returned 0x5b9730 [0240.800] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.800] GetProcessHeap () returned 0x580000 [0240.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07a60 [0240.800] GetProcessHeap () returned 0x580000 [0240.800] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07dc8 [0240.800] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.800] ReadFile (in: hFile=0x414, lpBuffer=0x6d07a60, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a60*, lpNumberOfBytesRead=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.820] GetProcessHeap () returned 0x580000 [0240.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0240.820] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.820] WriteFile (in: hFile=0x414, lpBuffer=0x6d07dc8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07dc8*, lpNumberOfBytesWritten=0x54cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.820] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.820] WriteFile (in: hFile=0x414, lpBuffer=0x6d080e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d080e7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.820] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.821] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.821] CloseHandle (hObject=0x414) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07dc8 | out: hHeap=0x580000) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07a60 | out: hHeap=0x580000) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0241.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7102620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x54cfd28, dwReserved1=0x6d07a60, cFileName="SBCGLOBAL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SBCGLO~1.YOU")) returned 0x5b9630 [0241.821] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.848] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML", len=0x3f | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned 1 [0241.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0241.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0244.998] CloseHandle (hObject=0x48c) returned 1 [0244.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.999] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml.id_1622540890_.your_last_chance")) returned 1 [0245.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409da800, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x409da800, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x8e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN05~1.YOU")) returned 0x5b96f0 [0245.004] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0245.005] GetProcessHeap () returned 0x580000 [0245.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c3a820 [0245.005] GetProcessHeap () returned 0x580000 [0245.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c3b1a8 [0245.005] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.005] ReadFile (in: hFile=0x48c, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x54cff14*=0x8e0, lpOverlapped=0x0) returned 1 [0245.014] GetProcessHeap () returned 0x580000 [0245.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0245.014] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.014] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3b1a8*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b1a8*, lpNumberOfBytesWritten=0x54cff14*=0x8e0, lpOverlapped=0x0) returned 1 [0245.014] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.014] WriteFile (in: hFile=0x48c, lpBuffer=0x6c3ba87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3ba87*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0245.014] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.014] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0245.014] CloseHandle (hObject=0x48c) returned 1 [0245.014] GetProcessHeap () returned 0x580000 [0245.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3b1a8 | out: hHeap=0x580000) returned 1 [0245.014] GetProcessHeap () returned 0x580000 [0245.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0245.014] GetProcessHeap () returned 0x580000 [0245.014] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409da800, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9907800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x54cfd28, dwReserved1=0x6c3a820, cFileName="PGMN058.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN05~1.YOU")) returned 0x5b9730 [0249.275] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.390] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC", len=0x3d | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 1 [0249.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0249.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0252.966] CloseHandle (hObject=0x47c) returned 1 [0252.966] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0252.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.id_1622540890_.your_last_chance")) returned 1 [0252.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0252.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS2BAR~1.YOU")) returned 0x5b96f0 [0252.968] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0252.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0252.968] GetProcessHeap () returned 0x580000 [0252.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10060 [0252.968] GetProcessHeap () returned 0x580000 [0252.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10ae8 [0252.968] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.968] ReadFile (in: hFile=0x47c, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x54cff14*=0xa20, lpOverlapped=0x0) returned 1 [0252.978] GetProcessHeap () returned 0x580000 [0252.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.978] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.978] WriteFile (in: hFile=0x47c, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x54cff14*=0xa20, lpOverlapped=0x0) returned 1 [0252.978] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.979] WriteFile (in: hFile=0x47c, lpBuffer=0x6c11507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11507*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0252.979] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.979] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0252.979] CloseHandle (hObject=0x47c) returned 1 [0252.979] GetProcessHeap () returned 0x580000 [0252.979] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0252.979] GetProcessHeap () returned 0x580000 [0252.979] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0252.979] GetProcessHeap () returned 0x580000 [0252.979] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfccc | out: lpFindFileData=0x54cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce4e7540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x54cfd28, dwReserved1=0x6c10060, cFileName="BS2BARB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BS2BAR~1.YOU")) returned 0x5b9730 [0254.426] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.365] SysReAllocStringLen (in: pbstr=0x54cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV", len=0x3e | out: pbstr=0x54cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 1 [0255.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f48) returned 0x72e5948 [0255.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0258.470] CloseHandle (hObject=0x268) returned 1 [0258.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x54cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x54cfc74 | out: lpFindFileData=0x54cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c37b00, ftCreationTime.dwHighDateTime=0x1c6272e, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8c37b00, ftLastWriteTime.dwHighDateTime=0x1c6272e, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGNAVB~1.YOU")) returned 0x5b96f0 [0258.471] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0258.471] GetProcessHeap () returned 0x580000 [0258.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x71c1) returned 0x6e063d0 [0258.472] GetProcessHeap () returned 0x580000 [0258.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x71c1) returned 0x715c008 [0258.472] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.472] ReadFile (in: hFile=0x268, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x71a0, lpNumberOfBytesRead=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x54cff14*=0x71a0, lpOverlapped=0x0) returned 1 [0262.486] GetProcessHeap () returned 0x580000 [0262.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0262.486] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0262.486] WriteFile (in: hFile=0x268, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x71a0, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x54cff14*=0x71a0, lpOverlapped=0x0) returned 1 [0264.280] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.280] WriteFile (in: hFile=0x268, lpBuffer=0x71631a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x71631a7*, lpNumberOfBytesWritten=0x54cff14*=0x20, lpOverlapped=0x0) returned 1 [0264.280] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.281] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x54cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x54cff14*=0x4, lpOverlapped=0x0) returned 1 [0264.281] CloseHandle (hObject=0x268) returned 1 [0265.872] GetProcessHeap () returned 0x580000 [0265.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0265.872] GetProcessHeap () returned 0x580000 [0265.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0265.872] GetProcessHeap () returned 0x580000 [0265.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 Thread: id = 45 os_tid = 0xaac [0039.067] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.410] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.726] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.756] Sleep (dwMilliseconds=0x1) [0039.818] Sleep (dwMilliseconds=0x1) [0039.841] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.055] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.392] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.554] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.861] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.196] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.328] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.360] Sleep (dwMilliseconds=0x1) [0043.374] Sleep (dwMilliseconds=0x1) [0043.390] Sleep (dwMilliseconds=0x1) [0043.408] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.437] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.468] Sleep (dwMilliseconds=0x1) [0043.484] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.516] Sleep (dwMilliseconds=0x1) [0043.531] Sleep (dwMilliseconds=0x1) [0043.546] Sleep (dwMilliseconds=0x1) [0043.562] Sleep (dwMilliseconds=0x1) [0043.577] Sleep (dwMilliseconds=0x1) [0043.594] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.857] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.888] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.449] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.761] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.229] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.385] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.463] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.541] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.654] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.683] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.900] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.931] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.134] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.243] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.531] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.836] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.100] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.412] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.443] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.568] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.755] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.005] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.067] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.114] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.334] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.457] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.504] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.081] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.128] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.237] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.362] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.674] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.752] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.485] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.549] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.641] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.031] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.109] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.156] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.329] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.506] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.189] Sleep (dwMilliseconds=0x1) [0052.199] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.498] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.745] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.792] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.026] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.112] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.135] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.291] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.775] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.853] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.884] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.040] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.352] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.430] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.867] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.179] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.210] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.541] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0057.419] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", len=0x4a | out: pbstr=0x560ff84*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 1 [0057.419] GetProcessHeap () returned 0x580000 [0057.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0057.420] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.420] CloseHandle (hObject=0x41c) returned 1 [0057.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.420] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id_1622540890_.your_last_chance")) returned 1 [0057.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.421] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~2.YOU")) returned 0x5b9630 [0057.421] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.421] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0057.421] GetProcessHeap () returned 0x580000 [0057.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0057.422] GetProcessHeap () returned 0x580000 [0057.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cf6cd8 [0057.422] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.422] ReadFile (in: hFile=0x41c, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.237] GetProcessHeap () returned 0x580000 [0060.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0060.238] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.238] WriteFile (in: hFile=0x41c, lpBuffer=0x6cf6cd8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0060.669] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.669] WriteFile (in: hFile=0x41c, lpBuffer=0x6d084d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d084d7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.018] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.018] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.018] CloseHandle (hObject=0x41c) returned 1 [0062.228] GetProcessHeap () returned 0x580000 [0062.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0062.228] GetProcessHeap () returned 0x580000 [0062.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0062.228] GetProcessHeap () returned 0x580000 [0062.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0062.228] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5ce04fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x267e24, dwReserved0=0x560fd28, dwReserved1=0x6ce54a8, cFileName="WordMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~2.YOU")) returned 0x5b9670 [0062.228] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0063.322] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", len=0x59 | out: pbstr=0x560ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 1 [0063.322] GetProcessHeap () returned 0x580000 [0063.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x24) returned 0x5b5bc8 [0063.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0066.145] CloseHandle (hObject=0x458) returned 1 [0066.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0066.145] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id_1622540890_.your_last_chance")) returned 1 [0066.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0066.827] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b96b0 [0066.827] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.827] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0066.828] GetProcessHeap () returned 0x580000 [0066.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6fb2a00 [0066.828] GetProcessHeap () returned 0x580000 [0066.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x67f5c0 [0066.828] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.828] ReadFile (in: hFile=0x458, lpBuffer=0x6fb2a00, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2a00*, lpNumberOfBytesRead=0x560ff14*=0x540, lpOverlapped=0x0) returned 1 [0067.680] GetProcessHeap () returned 0x580000 [0067.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0067.680] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.680] WriteFile (in: hFile=0x458, lpBuffer=0x67f5c0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f5c0*, lpNumberOfBytesWritten=0x560ff14*=0x540, lpOverlapped=0x0) returned 1 [0067.680] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.680] WriteFile (in: hFile=0x458, lpBuffer=0x67faff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x67faff*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.681] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.681] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.681] CloseHandle (hObject=0x458) returned 1 [0067.682] GetProcessHeap () returned 0x580000 [0067.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67f5c0 | out: hHeap=0x580000) returned 1 [0067.682] GetProcessHeap () returned 0x580000 [0067.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2a00 | out: hHeap=0x580000) returned 1 [0067.682] GetProcessHeap () returned 0x580000 [0067.682] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0068.633] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x60158a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x569, dwReserved0=0x560fd28, dwReserved1=0x6fb2a00, cFileName="AccessMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~1.YOU")) returned 0x5b96b0 [0068.633] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.719] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", len=0x4b | out: pbstr=0x560ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 1 [0068.719] GetProcessHeap () returned 0x580000 [0068.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x10) returned 0x5e9710 [0068.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0068.719] CloseHandle (hObject=0x454) returned 1 [0068.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.719] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id_1622540890_.your_last_chance")) returned 1 [0068.720] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.720] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x45, dwReserved1=0x0, cFileName="OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFF5DF~1.YOU")) returned 0x5b96b0 [0068.720] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0068.720] GetProcessHeap () returned 0x580000 [0068.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e40b80 [0068.721] GetProcessHeap () returned 0x580000 [0068.721] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e523b0 [0068.721] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.721] ReadFile (in: hFile=0x454, lpBuffer=0x6e40b80, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40b80*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.391] GetProcessHeap () returned 0x580000 [0073.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0073.392] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.392] WriteFile (in: hFile=0x454, lpBuffer=0x6e523b0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e523b0*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.392] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.392] WriteFile (in: hFile=0x454, lpBuffer=0x6e63baf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e63baf*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.925] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.925] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.925] CloseHandle (hObject=0x454) returned 1 [0073.925] GetProcessHeap () returned 0x580000 [0073.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e523b0 | out: hHeap=0x580000) returned 1 [0073.927] GetProcessHeap () returned 0x580000 [0073.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e40b80 | out: hHeap=0x580000) returned 1 [0073.929] GetProcessHeap () returned 0x580000 [0073.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0073.929] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd792a6, dwReserved0=0x560fd28, dwReserved1=0x580000, cFileName="OfficeLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFF5DF~1.YOU")) returned 0x5b96b0 [0073.929] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.966] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 1 [0074.966] GetProcessHeap () returned 0x580000 [0074.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x98) returned 0x5f76f0 [0074.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.968] Sleep (dwMilliseconds=0x1) [0079.338] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 1 [0079.339] GetProcessHeap () returned 0x580000 [0079.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x68) returned 0x5f76f0 [0079.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.340] Sleep (dwMilliseconds=0x1) [0079.357] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 1 [0079.357] GetProcessHeap () returned 0x580000 [0079.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xc) returned 0x5f76f0 [0079.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.392] CloseHandle (hObject=0x440) returned 1 [0079.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id_1622540890_.your_last_chance")) returned 1 [0079.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~3.YOU")) returned 0x5b96f0 [0079.393] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.393] GetProcessHeap () returned 0x580000 [0079.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f10048 [0079.393] GetProcessHeap () returned 0x580000 [0079.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f21878 [0079.394] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.394] ReadFile (in: hFile=0x440, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.189] GetProcessHeap () returned 0x580000 [0081.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0081.189] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.189] WriteFile (in: hFile=0x440, lpBuffer=0x6f21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21878*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.190] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.190] WriteFile (in: hFile=0x440, lpBuffer=0x6f33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f33077*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.404] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.404] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.404] CloseHandle (hObject=0x440) returned 1 [0081.404] GetProcessHeap () returned 0x580000 [0081.404] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f21878 | out: hHeap=0x580000) returned 1 [0081.407] GetProcessHeap () returned 0x580000 [0081.407] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0081.408] GetProcessHeap () returned 0x580000 [0081.408] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0081.589] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6822f0c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f184, dwReserved0=0x580000, dwReserved1=0x67ef68, cFileName="CGMIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~3.YOU")) returned 0x5b9730 [0081.589] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.611] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", len=0x6a | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 1 [0081.611] GetProcessHeap () returned 0x580000 [0081.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.612] CloseHandle (hObject=0x48c) returned 1 [0081.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id_1622540890_.your_last_chance")) returned 1 [0081.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.613] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x1, dwReserved1=0x5f0064, cFileName="Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0081.613] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.613] GetProcessHeap () returned 0x580000 [0081.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x673cd0 [0081.613] GetProcessHeap () returned 0x580000 [0081.613] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10c1) returned 0x674da0 [0081.613] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.613] ReadFile (in: hFile=0x48c, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x10a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x560ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0081.663] GetProcessHeap () returned 0x580000 [0081.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.663] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.663] WriteFile (in: hFile=0x48c, lpBuffer=0x674da0*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x674da0*, lpNumberOfBytesWritten=0x560ff14*=0x10a0, lpOverlapped=0x0) returned 1 [0081.663] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.663] WriteFile (in: hFile=0x48c, lpBuffer=0x675e3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x675e3f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.663] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.663] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.663] CloseHandle (hObject=0x48c) returned 1 [0081.664] GetProcessHeap () returned 0x580000 [0081.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x674da0 | out: hHeap=0x580000) returned 1 [0081.665] GetProcessHeap () returned 0x580000 [0081.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0081.666] GetProcessHeap () returned 0x580000 [0081.666] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x684906c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d6, dwReserved0=0x580000, dwReserved1=0x6f094e8, cFileName="Office32WW.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0081.666] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.518] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", len=0x68 | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 1 [0083.518] GetProcessHeap () returned 0x580000 [0083.518] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0083.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0083.520] CloseHandle (hObject=0x488) returned 1 [0083.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.521] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id_1622540890_.your_last_chance")) returned 1 [0083.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~1.YOU")) returned 0x5b9730 [0083.548] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0083.549] GetProcessHeap () returned 0x580000 [0083.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x625d20 [0083.549] GetProcessHeap () returned 0x580000 [0083.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2521) returned 0x628250 [0083.549] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.549] ReadFile (in: hFile=0x488, lpBuffer=0x625d20, nNumberOfBytesToRead=0x2500, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x625d20*, lpNumberOfBytesRead=0x560ff14*=0x2500, lpOverlapped=0x0) returned 1 [0083.724] GetProcessHeap () returned 0x580000 [0083.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.724] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.724] WriteFile (in: hFile=0x488, lpBuffer=0x628250*, nNumberOfBytesToWrite=0x2500, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x628250*, lpNumberOfBytesWritten=0x560ff14*=0x2500, lpOverlapped=0x0) returned 1 [0083.724] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.724] WriteFile (in: hFile=0x488, lpBuffer=0x62a74f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x62a74f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.725] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.725] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.725] CloseHandle (hObject=0x488) returned 1 [0083.725] GetProcessHeap () returned 0x580000 [0083.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x628250 | out: hHeap=0x580000) returned 1 [0083.725] GetProcessHeap () returned 0x580000 [0083.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x625d20 | out: hHeap=0x580000) returned 1 [0083.725] GetProcessHeap () returned 0x580000 [0083.725] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x69833c40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2543, dwReserved0=0x560fd28, dwReserved1=0x625d20, cFileName="VisioMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOM~1.YOU")) returned 0x5b96f0 [0083.725] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.052] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", len=0x41 | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 1 [0084.052] GetProcessHeap () returned 0x580000 [0084.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0084.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0084.313] CloseHandle (hObject=0x490) returned 1 [0084.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.315] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id_1622540890_.your_last_chance")) returned 1 [0084.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~1.YOU")) returned 0x5b9630 [0084.651] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0084.694] GetProcessHeap () returned 0x580000 [0084.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f21878 [0084.694] GetProcessHeap () returned 0x580000 [0084.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f330a8 [0084.694] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.694] ReadFile (in: hFile=0x490, lpBuffer=0x6f21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21878*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.165] GetProcessHeap () returned 0x580000 [0086.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0086.165] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.165] WriteFile (in: hFile=0x490, lpBuffer=0x6f330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f330a8*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.166] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.166] WriteFile (in: hFile=0x490, lpBuffer=0x6f448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f448a7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.188] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.188] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.188] CloseHandle (hObject=0x490) returned 1 [0086.188] GetProcessHeap () returned 0x580000 [0086.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f330a8 | out: hHeap=0x580000) returned 1 [0086.190] GetProcessHeap () returned 0x580000 [0086.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f21878 | out: hHeap=0x580000) returned 1 [0086.644] GetProcessHeap () returned 0x580000 [0086.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0086.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6afb5580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6c69f, dwReserved0=0x560fd34, dwReserved1=0x7718ba87, cFileName="MSWDS_EN.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~1.YOU")) returned 0x5b96f0 [0086.644] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.223] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 1 [0088.223] GetProcessHeap () returned 0x580000 [0088.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b96f0 [0088.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0088.223] CloseHandle (hObject=0x48c) returned 1 [0088.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0089.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0089.016] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.016] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0089.016] GetProcessHeap () returned 0x580000 [0089.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7501) returned 0x62ec88 [0089.016] GetProcessHeap () returned 0x580000 [0089.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7501) returned 0x6c20e18 [0089.016] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.016] ReadFile (in: hFile=0x48c, lpBuffer=0x62ec88, nNumberOfBytesToRead=0x74e0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ec88*, lpNumberOfBytesRead=0x560ff14*=0x74e0, lpOverlapped=0x0) returned 1 [0090.523] GetProcessHeap () returned 0x580000 [0090.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0090.523] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.523] WriteFile (in: hFile=0x48c, lpBuffer=0x6c20e18*, nNumberOfBytesToWrite=0x74e0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c20e18*, lpNumberOfBytesWritten=0x560ff14*=0x74e0, lpOverlapped=0x0) returned 1 [0091.605] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] WriteFile (in: hFile=0x48c, lpBuffer=0x6c282f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c282f7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.606] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.606] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.606] CloseHandle (hObject=0x48c) returned 1 [0091.606] GetProcessHeap () returned 0x580000 [0091.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c20e18 | out: hHeap=0x580000) returned 1 [0091.607] GetProcessHeap () returned 0x580000 [0091.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ec88 | out: hHeap=0x580000) returned 1 [0091.607] GetProcessHeap () returned 0x580000 [0091.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0091.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e37b400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7509, dwReserved0=0x560fd28, dwReserved1=0x62ec88, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.628] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.318] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", len=0x47 | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 1 [0092.318] GetProcessHeap () returned 0x580000 [0092.318] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x58) returned 0x5a4778 [0092.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.329] CloseHandle (hObject=0x464) returned 1 [0092.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id_1622540890_.your_last_chance")) returned 1 [0092.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LEVELE~1.YOU")) returned 0x5b96b0 [0092.330] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe301) returned 0x6c1c6b8 [0092.331] GetProcessHeap () returned 0x580000 [0092.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe301) returned 0x6c2a9c8 [0092.331] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.331] ReadFile (in: hFile=0x464, lpBuffer=0x6c1c6b8, nNumberOfBytesToRead=0xe2e0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c1c6b8*, lpNumberOfBytesRead=0x560ff14*=0xe2e0, lpOverlapped=0x0) returned 1 [0098.638] GetProcessHeap () returned 0x580000 [0098.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.638] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.638] WriteFile (in: hFile=0x464, lpBuffer=0x6c2a9c8*, nNumberOfBytesToWrite=0xe2e0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a9c8*, lpNumberOfBytesWritten=0x560ff14*=0xe2e0, lpOverlapped=0x0) returned 1 [0098.639] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.639] WriteFile (in: hFile=0x464, lpBuffer=0x6c38ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c38ca7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.639] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.639] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.639] CloseHandle (hObject=0x464) returned 1 [0098.639] GetProcessHeap () returned 0x580000 [0098.639] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a9c8 | out: hHeap=0x580000) returned 1 [0098.639] GetProcessHeap () returned 0x580000 [0098.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c1c6b8 | out: hHeap=0x580000) returned 1 [0098.640] GetProcessHeap () returned 0x580000 [0098.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72694020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe310, dwReserved0=0x560fd28, dwReserved1=0x6c1c6b8, cFileName="LEVEL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LEVELE~1.YOU")) returned 0x5b96b0 [0098.640] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.760] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", len=0x4d | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 1 [0101.761] GetProcessHeap () returned 0x580000 [0101.761] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0101.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0101.761] CloseHandle (hObject=0x45c) returned 1 [0101.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.761] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id_1622540890_.your_last_chance")) returned 1 [0101.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMIPN~2.YOU")) returned 0x5b96b0 [0101.762] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0101.762] GetProcessHeap () returned 0x580000 [0101.762] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ef2068 [0101.763] GetProcessHeap () returned 0x580000 [0101.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0101.764] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.764] ReadFile (in: hFile=0x45c, lpBuffer=0x6ef2068, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2068*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.731] GetProcessHeap () returned 0x580000 [0105.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0105.732] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.732] WriteFile (in: hFile=0x45c, lpBuffer=0x6c10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0105.732] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.732] WriteFile (in: hFile=0x45c, lpBuffer=0x6c21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21847*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0105.732] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0105.732] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0105.733] CloseHandle (hObject=0x45c) returned 1 [0105.733] GetProcessHeap () returned 0x580000 [0105.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0105.733] GetProcessHeap () returned 0x580000 [0105.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef2068 | out: hHeap=0x580000) returned 1 [0105.733] GetProcessHeap () returned 0x580000 [0105.733] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0105.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a1f060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19e38, dwReserved0=0x560fd28, dwReserved1=0x6ef2068, cFileName="SUMIPNTG.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUMIPN~2.YOU")) returned 0x5b9730 [0105.734] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0106.876] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", len=0x4a | out: pbstr=0x560ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 1 [0106.876] GetProcessHeap () returned 0x580000 [0106.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614d08, Size=0x1c) returned 0x615078 [0106.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0107.206] CloseHandle (hObject=0x474) returned 1 [0107.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id_1622540890_.your_last_chance")) returned 1 [0107.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICADFM~1.YOU")) returned 0x5b9630 [0107.207] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0107.207] GetProcessHeap () returned 0x580000 [0107.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x5f1920 [0107.207] GetProcessHeap () returned 0x580000 [0107.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x5f1a98 [0107.207] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.207] ReadFile (in: hFile=0x474, lpBuffer=0x5f1920, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f1920*, lpNumberOfBytesRead=0x560ff14*=0x140, lpOverlapped=0x0) returned 1 [0107.209] GetProcessHeap () returned 0x580000 [0107.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0107.209] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.209] WriteFile (in: hFile=0x474, lpBuffer=0x5f1a98*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f1a98*, lpNumberOfBytesWritten=0x560ff14*=0x140, lpOverlapped=0x0) returned 1 [0107.210] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.210] WriteFile (in: hFile=0x474, lpBuffer=0x5f1bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f1bd7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0107.212] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.212] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0107.212] CloseHandle (hObject=0x474) returned 1 [0107.212] GetProcessHeap () returned 0x580000 [0107.212] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f1a98 | out: hHeap=0x580000) returned 1 [0107.212] GetProcessHeap () returned 0x580000 [0107.212] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f1920 | out: hHeap=0x580000) returned 1 [0107.212] GetProcessHeap () returned 0x580000 [0107.213] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0107.213] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x77841300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x560fd28, dwReserved1=0x5f1920, cFileName="ICAD.FMP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICADFM~1.YOU")) returned 0x5b9630 [0107.213] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.843] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", len=0x2c | out: pbstr=0x560ff84*="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 1 [0111.843] GetProcessHeap () returned 0x580000 [0111.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0111.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.868] Sleep (dwMilliseconds=0x1) [0112.127] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", len=0x42 | out: pbstr=0x560ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 1 [0112.127] GetProcessHeap () returned 0x580000 [0112.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9730 [0112.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.137] Sleep (dwMilliseconds=0x1) [0112.203] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.203] Sleep (dwMilliseconds=0x1) [0112.218] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", len=0x3e | out: pbstr=0x560ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned 1 [0112.218] GetProcessHeap () returned 0x580000 [0112.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f880 [0112.218] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.218] Sleep (dwMilliseconds=0x1) [0112.235] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", len=0x4a | out: pbstr=0x560ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned 1 [0112.235] GetProcessHeap () returned 0x580000 [0112.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x4c) returned 0x5e1828 [0112.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.235] Sleep (dwMilliseconds=0x1) [0112.362] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", len=0x44 | out: pbstr=0x560ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png") returned 1 [0112.362] GetProcessHeap () returned 0x580000 [0112.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9630 [0112.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.385] Sleep (dwMilliseconds=0x1) [0112.481] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", len=0x4c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 1 [0112.481] GetProcessHeap () returned 0x580000 [0112.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92d0 | out: hHeap=0x580000) returned 1 [0112.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0113.553] CloseHandle (hObject=0x4ac) returned 1 [0113.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id_1622540890_.your_last_chance")) returned 1 [0113.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x450043, dwReserved1=0x0, cFileName="as80.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AS80XS~1.YOU")) returned 0x5b9630 [0113.554] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0113.554] GetProcessHeap () returned 0x580000 [0113.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4381) returned 0x62e188 [0113.554] GetProcessHeap () returned 0x580000 [0113.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4381) returned 0x6c6a0f8 [0113.554] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.555] ReadFile (in: hFile=0x4ac, lpBuffer=0x62e188, nNumberOfBytesToRead=0x4360, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x62e188*, lpNumberOfBytesRead=0x560ff14*=0x4360, lpOverlapped=0x0) returned 1 [0113.740] GetProcessHeap () returned 0x580000 [0113.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.740] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.741] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x560ff14*=0x4360, lpOverlapped=0x0) returned 1 [0113.741] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.741] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6e457*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e457*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.741] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.741] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.741] CloseHandle (hObject=0x4ac) returned 1 [0113.741] GetProcessHeap () returned 0x580000 [0113.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0113.741] GetProcessHeap () returned 0x580000 [0113.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62e188 | out: hHeap=0x580000) returned 1 [0113.741] GetProcessHeap () returned 0x580000 [0113.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b697320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4384, dwReserved0=0x560fd28, dwReserved1=0x62e188, cFileName="as80.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AS80XS~1.YOU")) returned 0x5b9630 [0113.868] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0113.915] CloseHandle (hObject=0x440) returned 1 [0113.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0211~1.YOU")) returned 0x5b9630 [0113.920] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0113.920] GetProcessHeap () returned 0x580000 [0113.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1241) returned 0x6f19958 [0113.920] GetProcessHeap () returned 0x580000 [0113.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1241) returned 0x6d035f8 [0113.920] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.920] ReadFile (in: hFile=0x440, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1220, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x560ff14*=0x1220, lpOverlapped=0x0) returned 1 [0113.937] GetProcessHeap () returned 0x580000 [0113.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.937] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.938] WriteFile (in: hFile=0x440, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x560ff14*=0x1220, lpOverlapped=0x0) returned 1 [0113.938] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.938] WriteFile (in: hFile=0x440, lpBuffer=0x6d04817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04817*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.938] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.938] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.938] CloseHandle (hObject=0x440) returned 1 [0113.938] GetProcessHeap () returned 0x580000 [0113.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0113.938] GetProcessHeap () returned 0x580000 [0113.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0113.938] GetProcessHeap () returned 0x580000 [0113.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b8603a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x560fd28, dwReserved1=0x6f19958, cFileName="FD02115_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0211~1.YOU")) returned 0x5b9630 [0113.938] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.985] CloseHandle (hObject=0x488) returned 1 [0113.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.985] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J00991~1.YOU")) returned 0x5b9630 [0114.119] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0114.119] GetProcessHeap () returned 0x580000 [0114.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0114.119] GetProcessHeap () returned 0x580000 [0114.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f1bea8 [0114.120] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.120] ReadFile (in: hFile=0x488, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0118.269] GetProcessHeap () returned 0x580000 [0118.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0118.269] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.269] WriteFile (in: hFile=0x488, lpBuffer=0x6f1bea8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0118.270] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.270] WriteFile (in: hFile=0x488, lpBuffer=0x6f2d6a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2d6a7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.270] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.270] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.270] CloseHandle (hObject=0x488) returned 1 [0118.326] GetProcessHeap () returned 0x580000 [0118.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0118.327] GetProcessHeap () returned 0x580000 [0118.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0118.327] GetProcessHeap () returned 0x580000 [0118.327] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0120.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e1bc1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x11e22, dwReserved0=0x560fd28, dwReserved1=0x6ce54a8, cFileName="J0099149.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J00991~1.YOU")) returned 0x5b96f0 [0120.093] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.161] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", len=0x4c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned 1 [0120.161] GetProcessHeap () returned 0x580000 [0120.161] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x176c) returned 0x6d06ca8 [0120.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.693] CloseHandle (hObject=0x48c) returned 1 [0120.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.id_1622540890_.your_last_chance")) returned 1 [0120.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~2.YOU")) returned 0x5b9630 [0120.694] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.694] GetProcessHeap () returned 0x580000 [0120.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c29878 [0120.694] GetProcessHeap () returned 0x580000 [0120.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6d10048 [0120.694] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.694] ReadFile (in: hFile=0x48c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x560ff14*=0xf60, lpOverlapped=0x0) returned 1 [0120.708] GetProcessHeap () returned 0x580000 [0120.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.708] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.708] WriteFile (in: hFile=0x48c, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x560ff14*=0xf60, lpOverlapped=0x0) returned 1 [0120.709] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.709] WriteFile (in: hFile=0x48c, lpBuffer=0x6d10fa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10fa7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.709] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.709] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.709] CloseHandle (hObject=0x48c) returned 1 [0120.709] GetProcessHeap () returned 0x580000 [0120.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0120.709] GetProcessHeap () returned 0x580000 [0120.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0120.709] GetProcessHeap () returned 0x580000 [0120.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f8f1860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf9b, dwReserved0=0x560fd28, dwReserved1=0x6c29878, cFileName="J0143743.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~2.YOU")) returned 0x5b9630 [0120.709] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.716] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", len=0x4d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned 1 [0120.716] GetProcessHeap () returned 0x580000 [0120.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1854) returned 0x6e00ac0 [0120.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.665] CloseHandle (hObject=0x3fc) returned 1 [0122.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.id_1622540890_.your_last_chance")) returned 1 [0122.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0122.666] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.666] GetProcessHeap () returned 0x580000 [0122.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.666] GetProcessHeap () returned 0x580000 [0122.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.666] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.666] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x560ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.671] GetProcessHeap () returned 0x580000 [0122.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.671] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.671] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x560ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.671] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.671] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.671] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.671] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.671] CloseHandle (hObject=0x3fc) returned 1 [0122.671] GetProcessHeap () returned 0x580000 [0122.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.671] GetProcessHeap () returned 0x580000 [0122.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.671] GetProcessHeap () returned 0x580000 [0122.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bb05a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e6, dwReserved0=0x560fd28, dwReserved1=0x678958, cFileName="Technic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0124.555] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.588] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", len=0x4c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned 1 [0124.588] GetProcessHeap () returned 0x580000 [0124.588] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18dc) returned 0x6f42f08 [0124.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.589] CloseHandle (hObject=0x484) returned 1 [0124.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.id_1622540890_.your_last_chance")) returned 1 [0124.714] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLARIT~1.YOU")) returned 0x5b9730 [0124.715] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.715] GetProcessHeap () returned 0x580000 [0124.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f67710 [0124.715] GetProcessHeap () returned 0x580000 [0124.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f68598 [0124.715] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.715] ReadFile (in: hFile=0x484, lpBuffer=0x6f67710, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x560ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.734] GetProcessHeap () returned 0x580000 [0124.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.734] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.734] WriteFile (in: hFile=0x484, lpBuffer=0x6f68598*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68598*, lpNumberOfBytesWritten=0x560ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.734] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.735] WriteFile (in: hFile=0x484, lpBuffer=0x6f69397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69397*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.735] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.735] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.735] CloseHandle (hObject=0x484) returned 1 [0124.735] GetProcessHeap () returned 0x580000 [0124.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68598 | out: hHeap=0x580000) returned 1 [0124.735] GetProcessHeap () returned 0x580000 [0124.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0124.735] GetProcessHeap () returned 0x580000 [0124.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0124.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f53b20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe33, dwReserved0=0x560fd28, dwReserved1=0x6f67710, cFileName="Clarity.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLARIT~1.YOU")) returned 0x5b9730 [0124.802] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.128] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned 1 [0126.128] GetProcessHeap () returned 0x580000 [0126.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e0) returned 0x667250 [0126.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0128.871] CloseHandle (hObject=0x4b0) returned 1 [0128.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.200] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03012~1.YOU")) returned 0x5b96f0 [0129.201] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0129.201] GetProcessHeap () returned 0x580000 [0129.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9541) returned 0x6ef3008 [0129.202] GetProcessHeap () returned 0x580000 [0129.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9541) returned 0x6f976f8 [0129.202] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.202] ReadFile (in: hFile=0x4b0, lpBuffer=0x6ef3008, nNumberOfBytesToRead=0x9520, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3008*, lpNumberOfBytesRead=0x560ff14*=0x9520, lpOverlapped=0x0) returned 1 [0129.402] GetProcessHeap () returned 0x580000 [0129.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.747] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.747] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x9520, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x560ff14*=0x9520, lpOverlapped=0x0) returned 1 [0129.747] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.747] WriteFile (in: hFile=0x4b0, lpBuffer=0x6fa0c17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa0c17*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.747] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.747] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.747] CloseHandle (hObject=0x4b0) returned 1 [0129.747] GetProcessHeap () returned 0x580000 [0129.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0129.747] GetProcessHeap () returned 0x580000 [0129.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3008 | out: hHeap=0x580000) returned 1 [0129.747] GetProcessHeap () returned 0x580000 [0129.747] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84f3b5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x955e, dwReserved0=0x560fd28, dwReserved1=0x6ef3008, cFileName="J0301252.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03012~1.YOU")) returned 0x5b9730 [0129.748] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.666] CloseHandle (hObject=0x428) returned 1 [0132.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0132.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~4.YOU")) returned 0x5b9730 [0132.667] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0132.667] GetProcessHeap () returned 0x580000 [0132.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0132.667] GetProcessHeap () returned 0x580000 [0132.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0132.667] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.668] ReadFile (in: hFile=0x428, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x560ff14*=0x260, lpOverlapped=0x0) returned 1 [0132.671] GetProcessHeap () returned 0x580000 [0132.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.671] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.671] WriteFile (in: hFile=0x428, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x560ff14*=0x260, lpOverlapped=0x0) returned 1 [0132.671] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.671] WriteFile (in: hFile=0x428, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.671] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.671] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.672] CloseHandle (hObject=0x428) returned 1 [0132.672] GetProcessHeap () returned 0x580000 [0132.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0132.672] GetProcessHeap () returned 0x580000 [0132.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0132.672] GetProcessHeap () returned 0x580000 [0132.672] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x86b0d700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x560fd28, dwReserved1=0x6d08520, cFileName="EXCEL_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCEL_~4.YOU")) returned 0x5b96f0 [0135.256] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.257] Sleep (dwMilliseconds=0x1) [0135.278] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", len=0x58 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc") returned 1 [0135.278] GetProcessHeap () returned 0x580000 [0135.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0135.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.279] CloseHandle (hObject=0x4ac) returned 1 [0135.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.id_1622540890_.your_last_chance")) returned 1 [0135.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="_NEWSQ~1.YOU")) returned 0x5b96f0 [0135.280] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.280] GetProcessHeap () returned 0x580000 [0135.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0135.280] GetProcessHeap () returned 0x580000 [0135.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0135.280] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.280] ReadFile (in: hFile=0x4ac, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x560ff14*=0xc0, lpOverlapped=0x0) returned 1 [0135.282] GetProcessHeap () returned 0x580000 [0135.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.282] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.282] WriteFile (in: hFile=0x4ac, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x560ff14*=0xc0, lpOverlapped=0x0) returned 1 [0135.282] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.282] WriteFile (in: hFile=0x4ac, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.282] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.282] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.282] CloseHandle (hObject=0x4ac) returned 1 [0135.282] GetProcessHeap () returned 0x580000 [0135.282] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0135.282] GetProcessHeap () returned 0x580000 [0135.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0135.283] GetProcessHeap () returned 0x580000 [0135.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x883e5ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x560fd28, dwReserved1=0x5ad8a0, cFileName="+NewSQLServerConnection.odc.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="_NEWSQ~1.YOU")) returned 0x5b96f0 [0135.283] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.283] Sleep (dwMilliseconds=0x1) [0135.357] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned 1 [0135.357] GetProcessHeap () returned 0x580000 [0135.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.389] CloseHandle (hObject=0x45c) returned 1 [0135.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.390] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5462cc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5462cc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x8e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2137~1.YOU")) returned 0x5b96b0 [0135.390] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0135.390] GetProcessHeap () returned 0x580000 [0135.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6cf6cf0 [0135.390] GetProcessHeap () returned 0x580000 [0135.390] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6cf7678 [0135.390] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.390] ReadFile (in: hFile=0x45c, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x560ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0135.448] GetProcessHeap () returned 0x580000 [0135.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.448] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.449] WriteFile (in: hFile=0x45c, lpBuffer=0x6cf7678*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7678*, lpNumberOfBytesWritten=0x560ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0135.449] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.449] WriteFile (in: hFile=0x45c, lpBuffer=0x6cf7f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7f57*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.449] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.449] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.449] CloseHandle (hObject=0x45c) returned 1 [0135.449] GetProcessHeap () returned 0x580000 [0135.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf7678 | out: hHeap=0x580000) returned 1 [0135.449] GetProcessHeap () returned 0x580000 [0135.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0135.449] GetProcessHeap () returned 0x580000 [0135.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5462cc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88588bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x907, dwReserved0=0x560fd28, dwReserved1=0x6cf6cf0, cFileName="BD21370_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2137~1.YOU")) returned 0x5b96b0 [0135.449] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.556] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", len=0x4f | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned 1 [0135.556] GetProcessHeap () returned 0x580000 [0135.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.557] CloseHandle (hObject=0x390) returned 1 [0135.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.id_1622540890_.your_last_chance")) returned 1 [0135.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b96b0 [0135.558] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0135.558] GetProcessHeap () returned 0x580000 [0135.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x6f650b8 [0135.558] GetProcessHeap () returned 0x580000 [0135.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x640c50 [0135.558] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.558] ReadFile (in: hFile=0x390, lpBuffer=0x6f650b8, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f650b8*, lpNumberOfBytesRead=0x560ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0136.881] GetProcessHeap () returned 0x580000 [0136.881] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0136.881] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.881] WriteFile (in: hFile=0x390, lpBuffer=0x640c50*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x640c50*, lpNumberOfBytesWritten=0x560ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0138.434] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.434] WriteFile (in: hFile=0x390, lpBuffer=0x642def*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x642def*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.443] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.443] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.443] CloseHandle (hObject=0x390) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x640c50 | out: hHeap=0x580000) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f650b8 | out: hHeap=0x580000) returned 1 [0138.443] GetProcessHeap () returned 0x580000 [0138.443] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0138.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21ca, dwReserved0=0x560fd28, dwReserved1=0x6f650b8, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b96b0 [0138.444] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.455] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned 1 [0138.455] GetProcessHeap () returned 0x580000 [0138.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0138.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.010] CloseHandle (hObject=0x170) returned 1 [0140.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7128600, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7128600, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD9333~1.YOU")) returned 0x5b9770 [0140.011] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.011] GetProcessHeap () returned 0x580000 [0140.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x614a48 [0140.011] GetProcessHeap () returned 0x580000 [0140.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x5bad00 [0140.011] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.012] ReadFile (in: hFile=0x170, lpBuffer=0x614a48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x614a48*, lpNumberOfBytesRead=0x560ff14*=0x180, lpOverlapped=0x0) returned 1 [0140.014] GetProcessHeap () returned 0x580000 [0140.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.014] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.014] WriteFile (in: hFile=0x170, lpBuffer=0x5bad00*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesWritten=0x560ff14*=0x180, lpOverlapped=0x0) returned 1 [0140.015] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.015] WriteFile (in: hFile=0x170, lpBuffer=0x5bae7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bae7f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.015] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.015] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.015] CloseHandle (hObject=0x170) returned 1 [0140.015] GetProcessHeap () returned 0x580000 [0140.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0140.015] GetProcessHeap () returned 0x580000 [0140.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x614a48 | out: hHeap=0x580000) returned 1 [0140.015] GetProcessHeap () returned 0x580000 [0140.015] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7128600, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b11fea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b7, dwReserved0=0x560fd28, dwReserved1=0x614a48, cFileName="BD21319_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD9333~1.YOU")) returned 0x5b9770 [0140.407] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.446] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned 1 [0140.446] GetProcessHeap () returned 0x580000 [0140.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0140.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.476] CloseHandle (hObject=0x428) returned 1 [0140.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7332a00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7332a00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1530~1.YOU")) returned 0x5b9770 [0140.477] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.477] GetProcessHeap () returned 0x580000 [0140.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5bad00 [0140.477] GetProcessHeap () returned 0x580000 [0140.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5b0428 [0140.477] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.477] ReadFile (in: hFile=0x428, lpBuffer=0x5bad00, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesRead=0x560ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.480] GetProcessHeap () returned 0x580000 [0140.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.480] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.480] WriteFile (in: hFile=0x428, lpBuffer=0x5b0428*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b0428*, lpNumberOfBytesWritten=0x560ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.480] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.480] WriteFile (in: hFile=0x428, lpBuffer=0x5b05c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b05c7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.480] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.480] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.480] CloseHandle (hObject=0x428) returned 1 [0140.480] GetProcessHeap () returned 0x580000 [0140.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b0428 | out: hHeap=0x580000) returned 1 [0140.480] GetProcessHeap () returned 0x580000 [0140.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0140.480] GetProcessHeap () returned 0x580000 [0140.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7332a00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b5967e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1de, dwReserved0=0x560fd28, dwReserved1=0x5bad00, cFileName="BD15302_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1530~1.YOU")) returned 0x5b9770 [0140.481] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.820] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS", len=0x39 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 1 [0140.820] GetProcessHeap () returned 0x580000 [0140.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0140.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.820] CloseHandle (hObject=0x490) returned 1 [0140.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id_1622540890_.your_last_chance")) returned 1 [0140.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe15bf200, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x69560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUCH~1.YOU")) returned 0x5b9730 [0140.827] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.853] GetProcessHeap () returned 0x580000 [0140.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0140.854] GetProcessHeap () returned 0x580000 [0140.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0140.854] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.854] ReadFile (in: hFile=0x490, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0142.690] GetProcessHeap () returned 0x580000 [0142.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0142.690] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.691] WriteFile (in: hFile=0x490, lpBuffer=0x6d7cfe8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0142.691] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.691] WriteFile (in: hFile=0x490, lpBuffer=0x6d8e7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e7e7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0143.066] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.066] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0143.067] CloseHandle (hObject=0x490) returned 1 [0143.601] GetProcessHeap () returned 0x580000 [0143.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0143.601] GetProcessHeap () returned 0x580000 [0143.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0143.601] GetProcessHeap () returned 0x580000 [0143.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8ce22ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x69584, dwReserved0=0x560fd28, dwReserved1=0x6f976f8, cFileName="MSOUC.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOUCH~1.YOU")) returned 0x5b96f0 [0146.861] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.875] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned 1 [0146.875] GetProcessHeap () returned 0x580000 [0146.875] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0146.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.006] CloseHandle (hObject=0x4a0) returned 1 [0153.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.id_1622540890_.your_last_chance")) returned 1 [0153.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf73, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR2F~1.YOU")) returned 0x5b9730 [0153.007] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0153.007] GetProcessHeap () returned 0x580000 [0153.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c29878 [0153.007] GetProcessHeap () returned 0x580000 [0153.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x65dbe0 [0153.007] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.007] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x560ff14*=0xf60, lpOverlapped=0x0) returned 1 [0153.021] GetProcessHeap () returned 0x580000 [0153.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.022] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.022] WriteFile (in: hFile=0x4a0, lpBuffer=0x65dbe0*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x65dbe0*, lpNumberOfBytesWritten=0x560ff14*=0xf60, lpOverlapped=0x0) returned 1 [0153.022] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.022] WriteFile (in: hFile=0x4a0, lpBuffer=0x65eb3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x65eb3f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.022] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.022] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.022] CloseHandle (hObject=0x4a0) returned 1 [0153.022] GetProcessHeap () returned 0x580000 [0153.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65dbe0 | out: hHeap=0x580000) returned 1 [0153.022] GetProcessHeap () returned 0x580000 [0153.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0153.022] GetProcessHeap () returned 0x580000 [0153.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92d33960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf97, dwReserved0=0x560fd28, dwReserved1=0x6c29878, cFileName="PDIR2F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR2F~1.YOU")) returned 0x5b9630 [0153.752] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.465] CloseHandle (hObject=0x4a0) returned 1 [0155.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.465] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id_1622540890_.your_last_chance")) returned 1 [0155.465] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORKFL~1.YOU")) returned 0x5b9730 [0155.466] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.466] GetProcessHeap () returned 0x580000 [0155.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa581) returned 0x6d8e818 [0155.466] GetProcessHeap () returned 0x580000 [0155.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa581) returned 0x6dbf1d0 [0155.467] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.467] ReadFile (in: hFile=0x4a0, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xa560, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x560ff14*=0xa560, lpOverlapped=0x0) returned 1 [0158.050] GetProcessHeap () returned 0x580000 [0158.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0158.051] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.051] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0xa560, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x560ff14*=0xa560, lpOverlapped=0x0) returned 1 [0158.051] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.051] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dc972f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc972f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.051] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.051] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.051] CloseHandle (hObject=0x4a0) returned 1 [0158.051] GetProcessHeap () returned 0x580000 [0158.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0158.052] GetProcessHeap () returned 0x580000 [0158.052] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0158.053] GetProcessHeap () returned 0x580000 [0158.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0159.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95d1b420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa584, dwReserved0=0x560fd28, dwReserved1=0x6d8e818, cFileName="WORKFLOW.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORKFL~1.YOU")) returned 0x5b9630 [0159.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.261] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", len=0x45 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL") returned 1 [0159.261] GetProcessHeap () returned 0x580000 [0159.261] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0159.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0159.308] CloseHandle (hObject=0x4a8) returned 1 [0159.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MLAXSL~1.YOU")) returned 0x5b9630 [0159.309] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0159.309] GetProcessHeap () returned 0x580000 [0159.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70b3528 [0159.309] GetProcessHeap () returned 0x580000 [0159.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70c4d58 [0159.310] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.310] ReadFile (in: hFile=0x4a8, lpBuffer=0x70b3528, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.885] GetProcessHeap () returned 0x580000 [0164.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0164.885] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.885] WriteFile (in: hFile=0x4a8, lpBuffer=0x70c4d58*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4d58*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.886] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.886] WriteFile (in: hFile=0x4a8, lpBuffer=0x70d6557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x70d6557*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.385] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.385] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.385] CloseHandle (hObject=0x4a8) returned 1 [0165.385] GetProcessHeap () returned 0x580000 [0165.385] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c4d58 | out: hHeap=0x580000) returned 1 [0165.388] GetProcessHeap () returned 0x580000 [0165.388] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0165.391] GetProcessHeap () returned 0x580000 [0165.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0169.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a307a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x49075, dwReserved0=0x580000, dwReserved1=0x580000, cFileName="MLA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MLAXSL~1.YOU")) returned 0x5b9730 [0169.270] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.281] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", len=0x42 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 1 [0169.281] GetProcessHeap () returned 0x580000 [0169.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0169.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0169.295] CloseHandle (hObject=0x460) returned 1 [0169.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id_1622540890_.your_last_chance")) returned 1 [0169.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~3.YOU")) returned 0x5b9730 [0169.296] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0169.296] GetProcessHeap () returned 0x580000 [0169.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0169.296] GetProcessHeap () returned 0x580000 [0169.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0169.296] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.296] ReadFile (in: hFile=0x460, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x560ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.393] GetProcessHeap () returned 0x580000 [0169.393] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0169.393] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.393] WriteFile (in: hFile=0x460, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x560ff14*=0xba0, lpOverlapped=0x0) returned 1 [0169.393] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.393] WriteFile (in: hFile=0x460, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.393] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.393] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.393] CloseHandle (hObject=0x460) returned 1 [0169.394] GetProcessHeap () returned 0x580000 [0169.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0169.394] GetProcessHeap () returned 0x580000 [0169.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0169.394] GetProcessHeap () returned 0x580000 [0169.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0169.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c943bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x560fd28, dwReserved1=0x65f268, cFileName="ACTIVITS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVI~3.YOU")) returned 0x5b9730 [0169.394] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.535] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 1 [0169.535] GetProcessHeap () returned 0x580000 [0169.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0169.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0169.658] CloseHandle (hObject=0x49c) returned 1 [0169.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id_1622540890_.your_last_chance")) returned 1 [0169.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLJRNL~1.YOU")) returned 0x5b9730 [0169.659] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0169.659] GetProcessHeap () returned 0x580000 [0169.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x117c1) returned 0x7150898 [0169.659] GetProcessHeap () returned 0x580000 [0169.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x117c1) returned 0x6fdd148 [0169.660] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.660] ReadFile (in: hFile=0x49c, lpBuffer=0x7150898, nNumberOfBytesToRead=0x117a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7150898*, lpNumberOfBytesRead=0x560ff14*=0x117a0, lpOverlapped=0x0) returned 1 [0174.183] GetProcessHeap () returned 0x580000 [0174.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.183] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.183] WriteFile (in: hFile=0x49c, lpBuffer=0x6fdd148*, nNumberOfBytesToWrite=0x117a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdd148*, lpNumberOfBytesWritten=0x560ff14*=0x117a0, lpOverlapped=0x0) returned 1 [0174.184] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.184] WriteFile (in: hFile=0x49c, lpBuffer=0x6fee8e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fee8e7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.184] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.184] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.184] CloseHandle (hObject=0x49c) returned 1 [0174.184] GetProcessHeap () returned 0x580000 [0174.184] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fdd148 | out: hHeap=0x580000) returned 1 [0174.186] GetProcessHeap () returned 0x580000 [0174.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7150898 | out: hHeap=0x580000) returned 1 [0174.189] GetProcessHeap () returned 0x580000 [0174.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f6f01e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x117c4, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="OLJRNL.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLJRNL~1.YOU")) returned 0x5b96f0 [0176.798] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.842] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", len=0x37 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS") returned 1 [0176.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2128) returned 0x6f14048 [0176.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.618] CloseHandle (hObject=0x43c) returned 1 [0179.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.id_1622540890_.your_last_chance")) returned 1 [0179.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPSCSS~1.YOU")) returned 0x5b96f0 [0179.620] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sps.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0179.620] GetProcessHeap () returned 0x580000 [0179.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.620] GetProcessHeap () returned 0x580000 [0179.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.620] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.620] ReadFile (in: hFile=0x43c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x560ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.633] GetProcessHeap () returned 0x580000 [0179.633] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.633] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.633] WriteFile (in: hFile=0x43c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x560ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.633] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.633] WriteFile (in: hFile=0x43c, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.633] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.633] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.633] CloseHandle (hObject=0x43c) returned 1 [0179.633] GetProcessHeap () returned 0x580000 [0179.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.633] GetProcessHeap () returned 0x580000 [0179.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.633] GetProcessHeap () returned 0x580000 [0179.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0181.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa2adc1c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x560fd28, dwReserved1=0x635768, cFileName="SPS.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPSCSS~1.YOU")) returned 0x5b9770 [0181.349] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.357] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", len=0x6b | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned 1 [0181.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0181.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.103] CloseHandle (hObject=0x46c) returned 1 [0183.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.103] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0183.104] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x427c8f00, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x2e0070, dwReserved1=0x640069, cFileName="AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL5DBF~1.YOU")) returned 0x5b9770 [0183.104] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.104] GetProcessHeap () returned 0x580000 [0183.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0183.104] GetProcessHeap () returned 0x580000 [0183.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0183.104] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.104] ReadFile (in: hFile=0x46c, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x560ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0183.129] GetProcessHeap () returned 0x580000 [0183.129] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.129] WriteFile (in: hFile=0x46c, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x560ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0183.129] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.130] WriteFile (in: hFile=0x46c, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.130] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.130] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.130] CloseHandle (hObject=0x46c) returned 1 [0183.130] GetProcessHeap () returned 0x580000 [0183.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0183.130] GetProcessHeap () returned 0x580000 [0183.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0183.130] GetProcessHeap () returned 0x580000 [0183.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4c55720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x560fd28, dwReserved1=0x6cbc098, cFileName="AlertImage_FileOffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL5DBF~1.YOU")) returned 0x5b9770 [0183.807] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.823] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", len=0x60 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned 1 [0183.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0183.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.857] CloseHandle (hObject=0x450) returned 1 [0183.857] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.857] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.id_1622540890_.your_last_chance")) returned 1 [0183.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU5DFD~1.YOU")) returned 0x5b9770 [0183.858] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0183.858] GetProcessHeap () returned 0x580000 [0183.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0183.858] GetProcessHeap () returned 0x580000 [0183.858] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0183.858] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.858] ReadFile (in: hFile=0x450, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x560ff14*=0xa0, lpOverlapped=0x0) returned 1 [0183.860] GetProcessHeap () returned 0x580000 [0183.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0183.860] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.860] WriteFile (in: hFile=0x450, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x560ff14*=0xa0, lpOverlapped=0x0) returned 1 [0183.860] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.860] WriteFile (in: hFile=0x450, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.860] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.860] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.860] CloseHandle (hObject=0x450) returned 1 [0183.860] GetProcessHeap () returned 0x580000 [0183.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0183.860] GetProcessHeap () returned 0x580000 [0183.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0183.860] GetProcessHeap () returned 0x580000 [0183.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa532d660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x560fd28, dwReserved1=0x60e8a8, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU5DFD~1.YOU")) returned 0x5b9770 [0183.861] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.863] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", len=0x64 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned 1 [0183.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0183.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0183.902] CloseHandle (hObject=0x49c) returned 1 [0183.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.902] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.id_1622540890_.your_last_chance")) returned 1 [0183.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b9770 [0183.903] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0183.903] GetProcessHeap () returned 0x580000 [0183.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x6f1bec0 [0183.903] GetProcessHeap () returned 0x580000 [0183.903] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x21c1) returned 0x6f1e0c8 [0183.903] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.903] ReadFile (in: hFile=0x49c, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x21a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x560ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0184.071] GetProcessHeap () returned 0x580000 [0184.071] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.071] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.071] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1e0c8*, nNumberOfBytesToWrite=0x21a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e0c8*, lpNumberOfBytesWritten=0x560ff14*=0x21a0, lpOverlapped=0x0) returned 1 [0184.071] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.071] WriteFile (in: hFile=0x49c, lpBuffer=0x6f20267*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f20267*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.071] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.071] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.071] CloseHandle (hObject=0x49c) returned 1 [0184.071] GetProcessHeap () returned 0x580000 [0184.071] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1e0c8 | out: hHeap=0x580000) returned 1 [0184.071] GetProcessHeap () returned 0x580000 [0184.071] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0184.071] GetProcessHeap () returned 0x580000 [0184.071] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55429a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x21ca, dwReserved0=0x560fd28, dwReserved1=0x6f1bec0, cFileName="bg_LightSpirit.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_LIG~1.YOU")) returned 0x5b9770 [0184.072] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.658] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", len=0x68 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned 1 [0184.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2138) returned 0x6f14048 [0184.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.402] CloseHandle (hObject=0x49c) returned 1 [0185.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.402] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0185.403] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.403] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b9770 [0185.403] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.403] GetProcessHeap () returned 0x580000 [0185.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6cf6cf0 [0185.403] GetProcessHeap () returned 0x580000 [0185.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x941) returned 0x6cf7678 [0185.403] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.403] ReadFile (in: hFile=0x49c, lpBuffer=0x6cf6cf0, nNumberOfBytesToRead=0x920, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesRead=0x560ff14*=0x920, lpOverlapped=0x0) returned 1 [0185.412] GetProcessHeap () returned 0x580000 [0185.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.413] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.413] WriteFile (in: hFile=0x49c, lpBuffer=0x6cf7678*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7678*, lpNumberOfBytesWritten=0x560ff14*=0x920, lpOverlapped=0x0) returned 1 [0185.413] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.413] WriteFile (in: hFile=0x49c, lpBuffer=0x6cf7f97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf7f97*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.413] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.413] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.413] CloseHandle (hObject=0x49c) returned 1 [0185.413] GetProcessHeap () returned 0x580000 [0185.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf7678 | out: hHeap=0x580000) returned 1 [0185.413] GetProcessHeap () returned 0x580000 [0185.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0185.413] GetProcessHeap () returned 0x580000 [0185.413] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa620dfe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x560fd28, dwReserved1=0x6cf6cf0, cFileName="AddToViewArrowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b9770 [0185.536] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.584] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned 1 [0185.584] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0185.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.840] CloseHandle (hObject=0x4a8) returned 1 [0186.840] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.860] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.861] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b96b0 [0186.861] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.862] GetProcessHeap () returned 0x580000 [0186.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6cda390 [0186.862] GetProcessHeap () returned 0x580000 [0186.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x541) returned 0x6cda918 [0186.862] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.862] ReadFile (in: hFile=0x478, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x520, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x560ff14*=0x520, lpOverlapped=0x0) returned 1 [0186.867] GetProcessHeap () returned 0x580000 [0186.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0186.867] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.867] WriteFile (in: hFile=0x478, lpBuffer=0x6cda918*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda918*, lpNumberOfBytesWritten=0x560ff14*=0x520, lpOverlapped=0x0) returned 1 [0186.868] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.868] WriteFile (in: hFile=0x478, lpBuffer=0x6cdae37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdae37*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.868] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.868] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.868] CloseHandle (hObject=0x478) returned 1 [0186.868] GetProcessHeap () returned 0x580000 [0186.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda918 | out: hHeap=0x580000) returned 1 [0186.868] GetProcessHeap () returned 0x580000 [0186.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0186.868] GetProcessHeap () returned 0x580000 [0186.868] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0186.868] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6fe3fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x560fd28, dwReserved1=0x6cda390, cFileName="CalendarToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~2.YOU")) returned 0x5b96b0 [0186.868] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.886] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", len=0x5c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned 1 [0186.886] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0186.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.563] CloseHandle (hObject=0x4a8) returned 1 [0188.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.id_1622540890_.your_last_chance")) returned 1 [0188.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SEARCH~1.YOU")) returned 0x5b9770 [0188.564] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0188.564] GetProcessHeap () returned 0x580000 [0188.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x7018de8 [0188.565] GetProcessHeap () returned 0x580000 [0188.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x6dcfb90 [0188.565] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.565] ReadFile (in: hFile=0x4a8, lpBuffer=0x7018de8, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018de8*, lpNumberOfBytesRead=0x560ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0188.570] GetProcessHeap () returned 0x580000 [0188.570] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.570] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dcfb90*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesWritten=0x560ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x4a8, lpBuffer=0x6dd002f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd002f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0188.570] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.570] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0188.570] CloseHandle (hObject=0x4a8) returned 1 [0188.570] GetProcessHeap () returned 0x580000 [0188.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0188.570] GetProcessHeap () returned 0x580000 [0188.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018de8 | out: hHeap=0x580000) returned 1 [0188.571] GetProcessHeap () returned 0x580000 [0188.571] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa801b5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x560fd28, dwReserved1=0x7018de8, cFileName="SEARCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SEARCH~1.YOU")) returned 0x5b9770 [0191.444] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.606] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", len=0x44 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned 1 [0191.606] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0191.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0191.607] CloseHandle (hObject=0x43c) returned 1 [0191.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.607] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.id_1622540890_.your_last_chance")) returned 1 [0191.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a5ff00, ftCreationTime.dwHighDateTime=0x1bdb3a4, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20a5ff00, ftLastWriteTime.dwHighDateTime=0x1bdb3a4, nFileSizeHigh=0x0, nFileSizeLow=0xc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~2.YOU")) returned 0x5b9770 [0191.608] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0191.608] GetProcessHeap () returned 0x580000 [0191.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x677cd0 [0191.608] GetProcessHeap () returned 0x580000 [0191.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x635768 [0191.608] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.608] ReadFile (in: hFile=0x43c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x560ff14*=0xc40, lpOverlapped=0x0) returned 1 [0191.677] GetProcessHeap () returned 0x580000 [0191.677] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0191.677] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.677] WriteFile (in: hFile=0x43c, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x560ff14*=0xc40, lpOverlapped=0x0) returned 1 [0191.677] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.677] WriteFile (in: hFile=0x43c, lpBuffer=0x6363a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6363a7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.677] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.677] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.677] CloseHandle (hObject=0x43c) returned 1 [0191.677] GetProcessHeap () returned 0x580000 [0191.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0191.677] GetProcessHeap () returned 0x580000 [0191.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0191.677] GetProcessHeap () returned 0x580000 [0191.677] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0191.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a5ff00, ftCreationTime.dwHighDateTime=0x1bdb3a4, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9db6740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc6d, dwReserved0=0x560fd28, dwReserved1=0x677cd0, cFileName="ZPDIR2B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~2.YOU")) returned 0x5b9770 [0191.678] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.681] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", len=0x45 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned 1 [0191.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0191.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0191.683] CloseHandle (hObject=0x43c) returned 1 [0191.683] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~3.YOU")) returned 0x5b9770 [0191.684] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0191.684] GetProcessHeap () returned 0x580000 [0191.684] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1bec0 [0191.684] GetProcessHeap () returned 0x580000 [0191.684] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1e0c8 [0191.684] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.684] ReadFile (in: hFile=0x43c, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x560ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0192.557] GetProcessHeap () returned 0x580000 [0192.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0192.557] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.557] WriteFile (in: hFile=0x43c, lpBuffer=0x6f1e0c8*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e0c8*, lpNumberOfBytesWritten=0x560ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0192.557] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x43c, lpBuffer=0x6f201a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f201a7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0192.558] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.558] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0192.558] CloseHandle (hObject=0x43c) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1e0c8 | out: hHeap=0x580000) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0193.113] GetProcessHeap () returned 0x580000 [0193.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0193.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa6315a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2114, dwReserved0=0x560fd28, dwReserved1=0x6f1bec0, cFileName="ZPDIR27F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR2~3.YOU")) returned 0x5b97b0 [0193.420] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.471] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", len=0x60 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned 1 [0193.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0193.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0195.142] CloseHandle (hObject=0x48c) returned 1 [0195.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.142] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.id_1622540890_.your_last_chance")) returned 1 [0195.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0195.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b97b0 [0195.143] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0195.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0195.143] GetProcessHeap () returned 0x580000 [0195.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0195.144] GetProcessHeap () returned 0x580000 [0195.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0195.144] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.144] ReadFile (in: hFile=0x48c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x560ff14*=0x60, lpOverlapped=0x0) returned 1 [0195.145] GetProcessHeap () returned 0x580000 [0195.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.145] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x48c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x560ff14*=0x60, lpOverlapped=0x0) returned 1 [0195.145] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x48c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.145] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.145] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.145] CloseHandle (hObject=0x48c) returned 1 [0195.145] GetProcessHeap () returned 0x580000 [0195.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0195.145] GetProcessHeap () returned 0x580000 [0195.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0195.146] GetProcessHeap () returned 0x580000 [0195.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabee39e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x560fd28, dwReserved1=0x61b540, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b97b0 [0195.146] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.938] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", len=0x43 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned 1 [0197.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0197.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.939] CloseHandle (hObject=0x440) returned 1 [0197.939] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR6F~1.YOU")) returned 0x5b97f0 [0197.940] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0197.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.940] GetProcessHeap () returned 0x580000 [0197.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e61) returned 0x7100718 [0197.940] GetProcessHeap () returned 0x580000 [0197.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e61) returned 0x7107588 [0197.940] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.940] ReadFile (in: hFile=0x440, lpBuffer=0x7100718, nNumberOfBytesToRead=0x6e40, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesRead=0x560ff14*=0x6e40, lpOverlapped=0x0) returned 1 [0198.714] GetProcessHeap () returned 0x580000 [0198.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0198.715] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] WriteFile (in: hFile=0x440, lpBuffer=0x7107588*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7107588*, lpNumberOfBytesWritten=0x560ff14*=0x6e40, lpOverlapped=0x0) returned 1 [0198.715] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] WriteFile (in: hFile=0x440, lpBuffer=0x710e3c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x710e3c7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.715] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.715] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.716] CloseHandle (hObject=0x440) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7107588 | out: hHeap=0x580000) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0198.889] GetProcessHeap () returned 0x580000 [0198.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae0f54c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6e6e, dwReserved0=0x560fd28, dwReserved1=0x7100718, cFileName="PDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR6F~1.YOU")) returned 0x5b96b0 [0199.655] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.998] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", len=0x70 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned 1 [0200.998] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0200.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0201.205] CloseHandle (hObject=0x428) returned 1 [0201.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0201.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x771a1ecd, dwReserved1=0x3769b7, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0201.983] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0201.983] GetProcessHeap () returned 0x580000 [0201.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0201.983] GetProcessHeap () returned 0x580000 [0201.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0201.983] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.983] ReadFile (in: hFile=0x428, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x560ff14*=0x140, lpOverlapped=0x0) returned 1 [0201.985] GetProcessHeap () returned 0x580000 [0201.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0201.985] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.985] WriteFile (in: hFile=0x428, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x560ff14*=0x140, lpOverlapped=0x0) returned 1 [0201.985] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.985] WriteFile (in: hFile=0x428, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.985] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.985] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.985] CloseHandle (hObject=0x428) returned 1 [0201.985] GetProcessHeap () returned 0x580000 [0201.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0201.985] GetProcessHeap () returned 0x580000 [0201.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0201.985] GetProcessHeap () returned 0x580000 [0201.985] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0203.161] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb000d420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x560fd28, dwReserved1=0x6dec6f8, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0203.161] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.176] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", len=0x67 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned 1 [0203.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0203.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.155] CloseHandle (hObject=0x3b8) returned 1 [0209.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.id_1622540890_.your_last_chance")) returned 1 [0209.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b9830 [0209.156] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.156] GetProcessHeap () returned 0x580000 [0209.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dd8c30 [0209.565] GetProcessHeap () returned 0x580000 [0209.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dc71e8 [0209.565] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.565] ReadFile (in: hFile=0x3b8, lpBuffer=0x6dd8c30, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8c30*, lpNumberOfBytesRead=0x560ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0209.578] GetProcessHeap () returned 0x580000 [0209.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.578] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.578] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dc71e8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71e8*, lpNumberOfBytesWritten=0x560ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0209.578] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.578] WriteFile (in: hFile=0x3b8, lpBuffer=0x6dc74c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc74c7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.579] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.579] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.579] CloseHandle (hObject=0x3b8) returned 1 [0209.579] GetProcessHeap () returned 0x580000 [0209.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71e8 | out: hHeap=0x580000) returned 1 [0209.579] GetProcessHeap () returned 0x580000 [0209.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8c30 | out: hHeap=0x580000) returned 1 [0209.579] GetProcessHeap () returned 0x580000 [0209.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48811c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x560fd28, dwReserved1=0x6dd8c30, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b97b0 [0210.091] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.149] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS", len=0x45 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS") returned 1 [0210.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0210.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0210.150] CloseHandle (hObject=0x4a4) returned 1 [0210.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css.id_1622540890_.your_last_chance")) returned 1 [0210.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae63100, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ae63100, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20438, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC1416~1.YOU")) returned 0x5b97b0 [0210.151] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0210.151] GetProcessHeap () returned 0x580000 [0210.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0210.151] GetProcessHeap () returned 0x580000 [0210.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0210.151] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.151] ReadFile (in: hFile=0x4a4, lpBuffer=0x6e21520, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.311] GetProcessHeap () returned 0x580000 [0214.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0214.312] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.312] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e32d50*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.312] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.312] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e4454f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4454f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.312] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.312] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.312] CloseHandle (hObject=0x4a4) returned 1 [0214.312] GetProcessHeap () returned 0x580000 [0214.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0214.313] GetProcessHeap () returned 0x580000 [0214.313] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0214.314] GetProcessHeap () returned 0x580000 [0214.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0215.129] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae63100, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7595260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2045c, dwReserved0=0x560fd28, dwReserved1=0x6e21520, cFileName="SCHEME18.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC1416~1.YOU")) returned 0x5b97b0 [0215.129] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.192] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 1 [0215.192] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0215.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.266] CloseHandle (hObject=0x3b8) returned 1 [0215.266] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0215.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~2.YOU")) returned 0x5b97b0 [0215.267] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.267] GetProcessHeap () returned 0x580000 [0215.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0215.267] GetProcessHeap () returned 0x580000 [0215.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0215.267] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.267] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x560ff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.269] GetProcessHeap () returned 0x580000 [0215.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.269] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x560ff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.269] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.269] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.269] CloseHandle (hObject=0x3b8) returned 1 [0215.269] GetProcessHeap () returned 0x580000 [0215.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0215.270] GetProcessHeap () returned 0x580000 [0215.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0215.270] GetProcessHeap () returned 0x580000 [0215.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ece7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x560fd28, dwReserved1=0x5ae2f0, cFileName="MSPUB_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~2.YOU")) returned 0x5b9770 [0217.307] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.308] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned 1 [0217.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0217.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.309] CloseHandle (hObject=0x48c) returned 1 [0217.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.id_1622540890_.your_last_chance")) returned 1 [0217.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b9770 [0217.310] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.311] GetProcessHeap () returned 0x580000 [0217.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d330c0 [0217.311] GetProcessHeap () returned 0x580000 [0217.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d339c8 [0217.311] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.311] ReadFile (in: hFile=0x48c, lpBuffer=0x6d330c0, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330c0*, lpNumberOfBytesRead=0x560ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0217.320] GetProcessHeap () returned 0x580000 [0217.320] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.320] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.320] WriteFile (in: hFile=0x48c, lpBuffer=0x6d339c8*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d339c8*, lpNumberOfBytesWritten=0x560ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0217.320] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.320] WriteFile (in: hFile=0x48c, lpBuffer=0x6d34267*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d34267*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.320] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.320] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.320] CloseHandle (hObject=0x48c) returned 1 [0217.320] GetProcessHeap () returned 0x580000 [0217.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d339c8 | out: hHeap=0x580000) returned 1 [0217.320] GetProcessHeap () returned 0x580000 [0217.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330c0 | out: hHeap=0x580000) returned 1 [0217.320] GetProcessHeap () returned 0x580000 [0217.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb924bbc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8cf, dwReserved0=0x560fd28, dwReserved1=0x6d330c0, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b9770 [0217.321] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.324] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", len=0x6c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned 1 [0217.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0217.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0217.325] CloseHandle (hObject=0x43c) returned 1 [0217.325] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.325] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.id_1622540890_.your_last_chance")) returned 1 [0217.326] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69fe8900, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x13c5, dwReserved0=0x6c006d, dwReserved1=0x69002e, cFileName="FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b9770 [0217.326] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0217.326] GetProcessHeap () returned 0x580000 [0217.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6f19958 [0217.326] GetProcessHeap () returned 0x580000 [0217.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6efb008 [0217.326] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.326] ReadFile (in: hFile=0x43c, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x13c0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x560ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0218.484] GetProcessHeap () returned 0x580000 [0218.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.484] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.484] WriteFile (in: hFile=0x43c, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x560ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0218.484] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.484] WriteFile (in: hFile=0x43c, lpBuffer=0x6efc3c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc3c7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0218.484] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.484] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0218.484] CloseHandle (hObject=0x43c) returned 1 [0218.484] GetProcessHeap () returned 0x580000 [0218.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0218.484] GetProcessHeap () returned 0x580000 [0218.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0218.485] GetProcessHeap () returned 0x580000 [0218.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9d742e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13e9, dwReserved0=0x560fd28, dwReserved1=0x6f19958, cFileName="FormsFormTemplateRTL.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b96b0 [0221.333] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0221.386] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", len=0x8c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned 1 [0221.387] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0221.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0221.387] CloseHandle (hObject=0x46c) returned 1 [0221.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl.id_1622540890_.your_last_chance")) returned 1 [0221.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b97b0 [0221.388] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0221.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0221.389] GetProcessHeap () returned 0x580000 [0221.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x635768 [0221.389] GetProcessHeap () returned 0x580000 [0221.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x6f668d8 [0221.389] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.389] ReadFile (in: hFile=0x46c, lpBuffer=0x635768, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x560ff14*=0xce0, lpOverlapped=0x0) returned 1 [0221.411] GetProcessHeap () returned 0x580000 [0221.411] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.411] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.412] WriteFile (in: hFile=0x46c, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x560ff14*=0xce0, lpOverlapped=0x0) returned 1 [0221.412] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.412] WriteFile (in: hFile=0x46c, lpBuffer=0x6f675b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675b7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.412] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.412] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.412] CloseHandle (hObject=0x46c) returned 1 [0221.412] GetProcessHeap () returned 0x580000 [0221.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0221.412] GetProcessHeap () returned 0x580000 [0221.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0221.412] GetProcessHeap () returned 0x580000 [0221.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb96c560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd11, dwReserved0=0x560fd28, dwReserved1=0x635768, cFileName="DEFAULT.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DEFAUL~1.YOU")) returned 0x5b9770 [0221.412] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.443] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", len=0x48 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 1 [0221.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f54) returned 0x6dee6e0 [0221.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0221.453] CloseHandle (hObject=0x46c) returned 1 [0221.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.453] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id_1622540890_.your_last_chance")) returned 1 [0221.454] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TOOLIC~1.YOU")) returned 0x5b9730 [0221.454] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0221.454] GetProcessHeap () returned 0x580000 [0221.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x715c008 [0221.455] GetProcessHeap () returned 0x580000 [0221.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x27a1) returned 0x715e7b8 [0221.455] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.455] ReadFile (in: hFile=0x46c, lpBuffer=0x715c008, nNumberOfBytesToRead=0x2780, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x560ff14*=0x2780, lpOverlapped=0x0) returned 1 [0222.174] GetProcessHeap () returned 0x580000 [0222.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.175] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.175] WriteFile (in: hFile=0x46c, lpBuffer=0x715e7b8*, nNumberOfBytesToWrite=0x2780, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x715e7b8*, lpNumberOfBytesWritten=0x560ff14*=0x2780, lpOverlapped=0x0) returned 1 [0222.175] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.175] WriteFile (in: hFile=0x46c, lpBuffer=0x7160f37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7160f37*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.175] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.175] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.175] CloseHandle (hObject=0x46c) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715e7b8 | out: hHeap=0x580000) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0225.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc090760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x560fd28, dwReserved1=0x715c008, cFileName="TOOLICON.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TOOLIC~1.YOU")) returned 0x5b9630 [0225.413] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.440] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", len=0x35 | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned 1 [0225.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0225.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0225.441] CloseHandle (hObject=0x3e4) returned 1 [0225.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.id_1622540890_.your_last_chance")) returned 1 [0225.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPIRMV~1.YOU")) returned 0x5b9630 [0225.442] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0225.443] GetProcessHeap () returned 0x580000 [0225.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0225.443] GetProcessHeap () returned 0x580000 [0225.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0225.444] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.444] ReadFile (in: hFile=0x3e4, lpBuffer=0x6e21520, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.957] GetProcessHeap () returned 0x580000 [0233.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0233.957] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.957] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e32d50*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesWritten=0x560ff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.958] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.958] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e4454f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4454f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0233.958] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.958] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0233.958] CloseHandle (hObject=0x3e4) returned 1 [0236.637] GetProcessHeap () returned 0x580000 [0236.637] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0236.638] GetProcessHeap () returned 0x580000 [0236.638] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0236.638] GetProcessHeap () returned 0x580000 [0236.638] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0240.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2f8c920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x135c8, dwReserved0=0x560fd28, dwReserved1=0x6e21520, cFileName="IPIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPIRMV~1.YOU")) returned 0x5b9730 [0240.549] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.565] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", len=0x4b | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned 1 [0240.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0240.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.630] CloseHandle (hObject=0x170) returned 1 [0240.630] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.630] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml.id_1622540890_.your_last_chance")) returned 1 [0240.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOD~1.YOU")) returned 0x5b9730 [0240.631] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.631] GetProcessHeap () returned 0x580000 [0240.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.631] GetProcessHeap () returned 0x580000 [0240.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.631] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.631] ReadFile (in: hFile=0x170, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.638] GetProcessHeap () returned 0x580000 [0240.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.638] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.638] WriteFile (in: hFile=0x170, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.639] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.639] WriteFile (in: hFile=0x170, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.639] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.639] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.639] CloseHandle (hObject=0x170) returned 1 [0240.639] GetProcessHeap () returned 0x580000 [0240.639] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.639] GetProcessHeap () returned 0x580000 [0240.639] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.639] GetProcessHeap () returned 0x580000 [0240.639] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f395a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x560fd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.DE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOD~1.YOU")) returned 0x5b9730 [0240.639] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.649] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML", len=0x4f | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned 1 [0240.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0240.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.650] CloseHandle (hObject=0x170) returned 1 [0240.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml.id_1622540890_.your_last_chance")) returned 1 [0240.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5BAB~1.YOU")) returned 0x5b9730 [0240.651] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.651] GetProcessHeap () returned 0x580000 [0240.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.652] GetProcessHeap () returned 0x580000 [0240.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.652] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.652] ReadFile (in: hFile=0x170, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.671] GetProcessHeap () returned 0x580000 [0240.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0240.671] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.671] WriteFile (in: hFile=0x170, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.672] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.672] WriteFile (in: hFile=0x170, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.672] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.672] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.672] CloseHandle (hObject=0x170) returned 1 [0240.673] GetProcessHeap () returned 0x580000 [0240.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.673] GetProcessHeap () returned 0x580000 [0240.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.673] GetProcessHeap () returned 0x580000 [0240.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0240.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6f85860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x560fd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.COM.PH.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA5BAB~1.YOU")) returned 0x5b9730 [0240.692] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.740] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML", len=0x4d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned 1 [0240.740] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0240.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.741] CloseHandle (hObject=0x414) returned 1 [0240.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml.id_1622540890_.your_last_chance")) returned 1 [0240.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TALK21~1.YOU")) returned 0x5b9730 [0240.742] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.742] GetProcessHeap () returned 0x580000 [0240.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07a60 [0240.742] GetProcessHeap () returned 0x580000 [0240.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07dc8 [0240.742] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.742] ReadFile (in: hFile=0x414, lpBuffer=0x6d07a60, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a60*, lpNumberOfBytesRead=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.797] GetProcessHeap () returned 0x580000 [0240.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.797] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.797] WriteFile (in: hFile=0x414, lpBuffer=0x6d07dc8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07dc8*, lpNumberOfBytesWritten=0x560ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.797] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.797] WriteFile (in: hFile=0x414, lpBuffer=0x6d080e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d080e7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.798] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.798] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.798] CloseHandle (hObject=0x414) returned 1 [0240.798] GetProcessHeap () returned 0x580000 [0240.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07dc8 | out: hHeap=0x580000) returned 1 [0240.798] GetProcessHeap () returned 0x580000 [0240.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07a60 | out: hHeap=0x580000) returned 1 [0240.798] GetProcessHeap () returned 0x580000 [0240.798] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.798] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc70b6360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x560fd28, dwReserved1=0x6d07a60, cFileName="TALK21.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TALK21~1.YOU")) returned 0x5b9730 [0240.798] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.821] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", len=0x5c | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned 1 [0240.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd4) returned 0x6dee6e0 [0240.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.822] CloseHandle (hObject=0x414) returned 1 [0240.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.id_1622540890_.your_last_chance")) returned 1 [0240.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI41E1~1.YOU")) returned 0x5b9730 [0240.824] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0240.824] GetProcessHeap () returned 0x580000 [0240.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2961) returned 0x6d748d8 [0240.824] GetProcessHeap () returned 0x580000 [0240.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2961) returned 0x7111f48 [0240.824] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.824] ReadFile (in: hFile=0x414, lpBuffer=0x6d748d8, nNumberOfBytesToRead=0x2940, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesRead=0x560ff14*=0x2940, lpOverlapped=0x0) returned 1 [0241.273] GetProcessHeap () returned 0x580000 [0241.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.273] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.273] WriteFile (in: hFile=0x414, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x2940, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x560ff14*=0x2940, lpOverlapped=0x0) returned 1 [0241.273] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.273] WriteFile (in: hFile=0x414, lpBuffer=0x7114887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x7114887*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.273] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.273] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.273] CloseHandle (hObject=0x414) returned 1 [0241.273] GetProcessHeap () returned 0x580000 [0241.273] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0241.273] GetProcessHeap () returned 0x580000 [0241.274] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0241.274] GetProcessHeap () returned 0x580000 [0241.274] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7552e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x560fd28, dwReserved1=0x6d748d8, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI41E1~1.YOU")) returned 0x5b9630 [0241.851] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.869] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML", len=0x3f | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned 1 [0241.869] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0241.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0245.248] CloseHandle (hObject=0x268) returned 1 [0245.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml.id_1622540890_.your_last_chance")) returned 1 [0245.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e4c00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x669e4c00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xeb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN00~2.YOU")) returned 0x5b96f0 [0245.250] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0245.250] GetProcessHeap () returned 0x580000 [0245.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb81) returned 0x6fc4630 [0245.250] GetProcessHeap () returned 0x580000 [0245.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xeb81) returned 0x6fd31c0 [0245.250] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.250] ReadFile (in: hFile=0x268, lpBuffer=0x6fc4630, nNumberOfBytesToRead=0xeb60, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4630*, lpNumberOfBytesRead=0x560ff14*=0xeb60, lpOverlapped=0x0) returned 1 [0248.202] GetProcessHeap () returned 0x580000 [0248.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0248.202] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.202] WriteFile (in: hFile=0x268, lpBuffer=0x6fd31c0*, nNumberOfBytesToWrite=0xeb60, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd31c0*, lpNumberOfBytesWritten=0x560ff14*=0xeb60, lpOverlapped=0x0) returned 1 [0248.202] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.203] WriteFile (in: hFile=0x268, lpBuffer=0x6fe1d1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe1d1f*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.203] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.203] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.203] CloseHandle (hObject=0x268) returned 1 [0248.478] GetProcessHeap () returned 0x580000 [0248.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd31c0 | out: hHeap=0x580000) returned 1 [0248.478] GetProcessHeap () returned 0x580000 [0248.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4630 | out: hHeap=0x580000) returned 1 [0248.478] GetProcessHeap () returned 0x580000 [0248.478] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e4c00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb761080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeb8c, dwReserved0=0x560fd28, dwReserved1=0x6fc4630, cFileName="PGMN002.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN00~2.YOU")) returned 0x5b9730 [0253.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.547] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC", len=0x3b | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 1 [0253.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0253.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0253.548] CloseHandle (hObject=0x4a8) returned 1 [0253.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.id_1622540890_.your_last_chance")) returned 1 [0253.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x594c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AIR98P~1.YOU")) returned 0x5b9730 [0253.549] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0253.549] GetProcessHeap () returned 0x580000 [0253.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5961) returned 0x715c008 [0253.550] GetProcessHeap () returned 0x580000 [0253.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5961) returned 0x703a4c8 [0253.550] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.550] ReadFile (in: hFile=0x4a8, lpBuffer=0x715c008, nNumberOfBytesToRead=0x5940, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x560ff14*=0x5940, lpOverlapped=0x0) returned 1 [0254.382] GetProcessHeap () returned 0x580000 [0254.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0254.382] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.382] WriteFile (in: hFile=0x4a8, lpBuffer=0x703a4c8*, nNumberOfBytesToWrite=0x5940, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x703a4c8*, lpNumberOfBytesWritten=0x560ff14*=0x5940, lpOverlapped=0x0) returned 1 [0254.383] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.383] WriteFile (in: hFile=0x4a8, lpBuffer=0x703fe07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x703fe07*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0254.383] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.383] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0254.383] CloseHandle (hObject=0x4a8) returned 1 [0254.383] GetProcessHeap () returned 0x580000 [0254.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703a4c8 | out: hHeap=0x580000) returned 1 [0254.383] GetProcessHeap () returned 0x580000 [0254.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0254.383] GetProcessHeap () returned 0x580000 [0254.383] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf24b100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5970, dwReserved0=0x560fd28, dwReserved1=0x715c008, cFileName="AIR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AIR98P~1.YOU")) returned 0x5b9730 [0255.065] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.081] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV", len=0x3e | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 1 [0255.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb4) returned 0x72e5948 [0255.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0255.081] CloseHandle (hObject=0x48c) returned 1 [0255.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.081] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.id_1622540890_.your_last_chance")) returned 1 [0255.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.082] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4495b400, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4495b400, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBS~2.YOU")) returned 0x5b9730 [0255.082] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0255.083] GetProcessHeap () returned 0x580000 [0255.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e01) returned 0x6e063d0 [0255.083] GetProcessHeap () returned 0x580000 [0255.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6e01) returned 0x72b75f8 [0255.083] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.083] ReadFile (in: hFile=0x48c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6de0, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x560ff14*=0x6de0, lpOverlapped=0x0) returned 1 [0257.033] GetProcessHeap () returned 0x580000 [0257.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0257.033] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.033] WriteFile (in: hFile=0x48c, lpBuffer=0x72b75f8*, nNumberOfBytesToWrite=0x6de0, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x72b75f8*, lpNumberOfBytesWritten=0x560ff14*=0x6de0, lpOverlapped=0x0) returned 1 [0257.033] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.033] WriteFile (in: hFile=0x48c, lpBuffer=0x72be3d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x72be3d7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.033] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.033] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.034] CloseHandle (hObject=0x48c) returned 1 [0257.823] GetProcessHeap () returned 0x580000 [0257.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72b75f8 | out: hHeap=0x580000) returned 1 [0257.823] GetProcessHeap () returned 0x580000 [0257.823] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0257.824] GetProcessHeap () returned 0x580000 [0257.824] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0259.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4495b400, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0b95ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6e1b, dwReserved0=0x560fd28, dwReserved1=0x6e063d0, cFileName="DGWEBSBR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBS~2.YOU")) returned 0x5b9630 [0259.218] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.230] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML", len=0x3d | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML") returned 1 [0259.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e0) returned 0x72e5948 [0259.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0259.319] CloseHandle (hObject=0x458) returned 1 [0259.319] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.320] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml.id_1622540890_.your_last_chance")) returned 1 [0259.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.321] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef5c1d00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef5c1d00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x1854, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDRE~2.YOU")) returned 0x5b9630 [0259.321] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0259.321] GetProcessHeap () returned 0x580000 [0259.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6cba390 [0259.321] GetProcessHeap () returned 0x580000 [0259.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6cbbc98 [0259.321] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.321] ReadFile (in: hFile=0x458, lpBuffer=0x6cba390, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesRead=0x560ff14*=0x1840, lpOverlapped=0x0) returned 1 [0259.446] GetProcessHeap () returned 0x580000 [0259.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0259.447] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.447] WriteFile (in: hFile=0x458, lpBuffer=0x6cbbc98*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbbc98*, lpNumberOfBytesWritten=0x560ff14*=0x1840, lpOverlapped=0x0) returned 1 [0259.447] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.447] WriteFile (in: hFile=0x458, lpBuffer=0x6cbd4d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbd4d7*, lpNumberOfBytesWritten=0x560ff14*=0x20, lpOverlapped=0x0) returned 1 [0259.447] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.447] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x560ff14*=0x4, lpOverlapped=0x0) returned 1 [0259.447] CloseHandle (hObject=0x458) returned 1 [0259.447] GetProcessHeap () returned 0x580000 [0259.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbbc98 | out: hHeap=0x580000) returned 1 [0259.447] GetProcessHeap () returned 0x580000 [0259.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0259.447] GetProcessHeap () returned 0x580000 [0259.447] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fccc | out: lpFindFileData=0x560fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef5c1d00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd22a4fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1878, dwReserved0=0x560fd28, dwReserved1=0x6cba390, cFileName="WORDREP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDRE~2.YOU")) returned 0x5b9630 [0259.448] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.271] SysReAllocStringLen (in: pbstr=0x560ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC", len=0x3f | out: pbstr=0x560ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC") returned 1 [0260.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2074) returned 0x72e5948 [0260.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0260.273] CloseHandle (hObject=0x494) returned 1 [0260.273] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.273] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc.id_1622540890_.your_last_chance")) returned 1 [0260.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x560ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x560fc74 | out: lpFindFileData=0x560fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e5ea000, ftCreationTime.dwHighDateTime=0x1c98d8b, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e5ea000, ftLastWriteTime.dwHighDateTime=0x1c98d8b, nFileSizeHigh=0x0, nFileSizeLow=0xb08a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIDEBA~3.YOU")) returned 0x5b9630 [0260.309] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0260.309] GetProcessHeap () returned 0x580000 [0260.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb0a1) returned 0x727ba98 [0260.309] GetProcessHeap () returned 0x580000 [0260.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb0a1) returned 0x7450048 [0260.310] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.310] ReadFile (in: hFile=0x494, lpBuffer=0x727ba98, nNumberOfBytesToRead=0xb080, lpNumberOfBytesRead=0x560ff14, lpOverlapped=0x0 | out: lpBuffer=0x727ba98*, lpNumberOfBytesRead=0x560ff14*=0xb080, lpOverlapped=0x0) returned 1 Thread: id = 46 os_tid = 0xab0 [0039.068] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.112] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.284] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.727] Sleep (dwMilliseconds=0x1) [0039.746] Sleep (dwMilliseconds=0x1) [0039.757] Sleep (dwMilliseconds=0x1) [0039.818] Sleep (dwMilliseconds=0x1) [0039.841] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.392] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.539] Sleep (dwMilliseconds=0x1) [0040.554] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.554] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.698] Sleep (dwMilliseconds=0x1) [0042.790] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.996] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.116] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.197] Sleep (dwMilliseconds=0x1) [0043.206] Sleep (dwMilliseconds=0x1) [0043.283] Sleep (dwMilliseconds=0x1) [0043.296] Sleep (dwMilliseconds=0x1) [0043.312] Sleep (dwMilliseconds=0x1) [0043.328] Sleep (dwMilliseconds=0x1) [0043.345] Sleep (dwMilliseconds=0x1) [0043.360] Sleep (dwMilliseconds=0x1) [0043.375] Sleep (dwMilliseconds=0x1) [0043.390] Sleep (dwMilliseconds=0x1) [0043.408] Sleep (dwMilliseconds=0x1) [0043.421] Sleep (dwMilliseconds=0x1) [0043.437] Sleep (dwMilliseconds=0x1) [0043.452] Sleep (dwMilliseconds=0x1) [0043.468] Sleep (dwMilliseconds=0x1) [0043.484] Sleep (dwMilliseconds=0x1) [0043.499] Sleep (dwMilliseconds=0x1) [0043.516] Sleep (dwMilliseconds=0x1) [0043.531] Sleep (dwMilliseconds=0x1) [0043.547] Sleep (dwMilliseconds=0x1) [0043.562] Sleep (dwMilliseconds=0x1) [0043.578] Sleep (dwMilliseconds=0x1) [0043.594] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.764] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.810] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.966] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.001] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.063] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.393] Sleep (dwMilliseconds=0x1) [0044.403] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.496] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.574] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.605] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.870] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.917] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.073] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.338] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.683] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.901] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.932] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.056] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.103] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.135] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.244] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.290] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.446] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.602] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.680] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.727] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.914] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.069] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.381] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] Sleep (dwMilliseconds=0x1) [0047.771] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.833] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.145] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] Sleep (dwMilliseconds=0x1) [0048.348] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.402] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.363] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.462] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.487] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.518] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.617] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.675] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.753] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.986] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.142] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.486] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.550] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.642] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.688] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.797] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.875] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.095] Sleep (dwMilliseconds=0x1) [0051.110] Sleep (dwMilliseconds=0x1) [0051.125] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.265] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.437] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.577] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.731] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.887] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.215] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.511] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.549] Sleep (dwMilliseconds=0x1) [0052.558] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.667] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.714] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.870] Sleep (dwMilliseconds=0x1) [0052.886] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.995] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.338] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.463] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.494] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.728] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.806] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.932] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.508] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.633] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.664] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.820] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.976] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.054] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.335] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.366] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.444] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.697] Sleep (dwMilliseconds=0x1) [0057.534] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x574ff84*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0057.534] GetProcessHeap () returned 0x580000 [0057.534] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0057.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0057.535] CloseHandle (hObject=0x424) returned 1 [0057.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0057.535] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0057.535] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0057.535] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0057.535] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.536] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0057.536] GetProcessHeap () returned 0x580000 [0057.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6c56108 [0057.536] GetProcessHeap () returned 0x580000 [0057.536] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6d330a8 [0057.536] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.536] ReadFile (in: hFile=0x424, lpBuffer=0x6c56108, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesRead=0x574ff14*=0x960, lpOverlapped=0x0) returned 1 [0057.545] GetProcessHeap () returned 0x580000 [0057.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0057.546] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.546] WriteFile (in: hFile=0x424, lpBuffer=0x6d330a8*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesWritten=0x574ff14*=0x960, lpOverlapped=0x0) returned 1 [0057.546] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.546] WriteFile (in: hFile=0x424, lpBuffer=0x6d33a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33a07*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0057.546] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.546] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0057.546] CloseHandle (hObject=0x424) returned 1 [0057.547] GetProcessHeap () returned 0x580000 [0057.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0057.547] GetProcessHeap () returned 0x580000 [0057.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0057.547] GetProcessHeap () returned 0x580000 [0057.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0057.547] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5a189480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x574fd28, dwReserved1=0x6c56108, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0057.547] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.142] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", len=0x51 | out: pbstr=0x574ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 1 [0058.142] GetProcessHeap () returned 0x580000 [0058.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0058.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0058.145] CloseHandle (hObject=0x43c) returned 1 [0058.145] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.146] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id_1622540890_.your_last_chance")) returned 1 [0058.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.146] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b96b0 [0058.146] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.146] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0058.146] GetProcessHeap () returned 0x580000 [0058.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0058.147] GetProcessHeap () returned 0x580000 [0058.147] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d458e0 [0058.148] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.148] ReadFile (in: hFile=0x43c, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0063.626] GetProcessHeap () returned 0x580000 [0063.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0063.627] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.627] WriteFile (in: hFile=0x43c, lpBuffer=0x6d458e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d458e0*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0064.768] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.768] WriteFile (in: hFile=0x43c, lpBuffer=0x6d570df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d570df*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.401] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.401] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.401] CloseHandle (hObject=0x43c) returned 1 [0067.246] GetProcessHeap () returned 0x580000 [0067.246] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d458e0 | out: hHeap=0x580000) returned 1 [0067.246] GetProcessHeap () returned 0x580000 [0067.246] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0067.246] GetProcessHeap () returned 0x580000 [0067.246] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0067.246] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x5fd2e380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd5c24, dwReserved0=0x574fd28, dwReserved1=0x6d340b0, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b9630 [0067.246] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.579] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x574ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0067.579] GetProcessHeap () returned 0x580000 [0067.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x24) returned 0x5e9710 [0067.579] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0071.841] CloseHandle (hObject=0x474) returned 1 [0071.841] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0071.842] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance")) returned 1 [0072.999] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0073.000] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0073.913] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0073.914] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0074.873] GetProcessHeap () returned 0x580000 [0074.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f330a8 [0074.873] GetProcessHeap () returned 0x580000 [0074.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0074.873] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.873] ReadFile (in: hFile=0x428, lpBuffer=0x6f330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f330a8*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.305] GetProcessHeap () returned 0x580000 [0078.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0078.306] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.306] WriteFile (in: hFile=0x428, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.306] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.306] WriteFile (in: hFile=0x428, lpBuffer=0x6cf6ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ca7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0078.740] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.740] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0078.740] CloseHandle (hObject=0x428) returned 1 [0078.740] GetProcessHeap () returned 0x580000 [0078.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0078.740] GetProcessHeap () returned 0x580000 [0078.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f330a8 | out: hHeap=0x580000) returned 1 [0078.740] GetProcessHeap () returned 0x580000 [0078.740] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0079.436] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x668be5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6624, dwReserved0=0x574fd28, dwReserved1=0x6f330a8, cFileName="Office32WW.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0079.436] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.454] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", len=0x47 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 1 [0079.454] GetProcessHeap () returned 0x580000 [0079.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0079.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0079.462] CloseHandle (hObject=0x458) returned 1 [0079.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id_1622540890_.your_last_chance")) returned 1 [0079.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="README~1.YOU")) returned 0x5b96f0 [0079.463] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0079.463] GetProcessHeap () returned 0x580000 [0079.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6f06bb8 [0079.463] GetProcessHeap () returned 0x580000 [0079.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6d0e508 [0079.463] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.463] ReadFile (in: hFile=0x458, lpBuffer=0x6f06bb8, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesRead=0x574ff14*=0x780, lpOverlapped=0x0) returned 1 [0079.472] GetProcessHeap () returned 0x580000 [0079.472] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0079.472] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.472] WriteFile (in: hFile=0x458, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x574ff14*=0x780, lpOverlapped=0x0) returned 1 [0079.472] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.472] WriteFile (in: hFile=0x458, lpBuffer=0x6d0ec87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ec87*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.472] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.472] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.472] CloseHandle (hObject=0x458) returned 1 [0079.473] GetProcessHeap () returned 0x580000 [0079.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0079.473] GetProcessHeap () returned 0x580000 [0079.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0079.473] GetProcessHeap () returned 0x580000 [0079.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0079.473] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66fbc640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7b9, dwReserved0=0x574fd28, dwReserved1=0x6f06bb8, cFileName="README.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="README~1.YOU")) returned 0x5b96f0 [0079.473] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.173] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", len=0x6e | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 1 [0080.173] GetProcessHeap () returned 0x580000 [0080.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0080.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0080.173] CloseHandle (hObject=0x478) returned 1 [0080.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id_1622540890_.your_last_chance")) returned 1 [0080.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.174] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x58002e, dwReserved1=0x4c004d, cFileName="InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b96f0 [0080.174] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.174] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0080.175] GetProcessHeap () returned 0x580000 [0080.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x5f3a40 [0080.175] GetProcessHeap () returned 0x580000 [0080.175] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6f094f0 [0080.175] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.175] ReadFile (in: hFile=0x478, lpBuffer=0x5f3a40, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3a40*, lpNumberOfBytesRead=0x574ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0080.188] GetProcessHeap () returned 0x580000 [0080.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0080.188] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x478, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x574ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x478, lpBuffer=0x6f099af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f099af*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0080.188] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.188] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0080.188] CloseHandle (hObject=0x478) returned 1 [0080.188] GetProcessHeap () returned 0x580000 [0080.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0080.188] GetProcessHeap () returned 0x580000 [0080.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3a40 | out: hHeap=0x580000) returned 1 [0080.189] GetProcessHeap () returned 0x580000 [0080.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0080.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67694580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x574fd28, dwReserved1=0x5f3a40, cFileName="InfoPathMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b96f0 [0080.189] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.716] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", len=0x67 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 1 [0080.716] GetProcessHeap () returned 0x580000 [0080.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x615370 [0080.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0080.735] CloseHandle (hObject=0x488) returned 1 [0080.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id_1622540890_.your_last_chance")) returned 1 [0080.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10R~1.YOU")) returned 0x5b96f0 [0080.736] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0080.736] GetProcessHeap () returned 0x580000 [0080.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x6d10048 [0080.737] GetProcessHeap () returned 0x580000 [0080.737] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x6d16a98 [0080.737] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.737] ReadFile (in: hFile=0x488, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x6a20, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x574ff14*=0x6a20, lpOverlapped=0x0) returned 1 [0081.355] GetProcessHeap () returned 0x580000 [0081.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.356] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.356] WriteFile (in: hFile=0x488, lpBuffer=0x6d16a98*, nNumberOfBytesToWrite=0x6a20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d16a98*, lpNumberOfBytesWritten=0x574ff14*=0x6a20, lpOverlapped=0x0) returned 1 [0081.356] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.356] WriteFile (in: hFile=0x488, lpBuffer=0x6d1d4b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1d4b7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.356] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.356] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.356] CloseHandle (hObject=0x488) returned 1 [0081.524] GetProcessHeap () returned 0x580000 [0081.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d16a98 | out: hHeap=0x580000) returned 1 [0081.525] GetProcessHeap () returned 0x580000 [0081.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0081.526] GetProcessHeap () returned 0x580000 [0081.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x681bcca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a5f, dwReserved0=0x580000, dwReserved1=0x67ef68, cFileName="PSS10R.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10R~1.YOU")) returned 0x5b96f0 [0081.595] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.970] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", len=0x45 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 1 [0085.970] GetProcessHeap () returned 0x580000 [0085.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x70) returned 0x614a48 [0085.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.970] Sleep (dwMilliseconds=0x1) [0085.984] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", len=0x43 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 1 [0085.984] GetProcessHeap () returned 0x580000 [0085.984] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x614a48 | out: hHeap=0x580000) returned 1 [0085.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.992] Sleep (dwMilliseconds=0x1) [0086.942] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", len=0x4d | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 1 [0086.942] GetProcessHeap () returned 0x580000 [0086.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.952] CloseHandle (hObject=0x448) returned 1 [0086.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.952] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id_1622540890_.your_last_chance")) returned 1 [0086.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUEPR~1.YOU")) returned 0x5b96f0 [0086.954] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0086.954] GetProcessHeap () returned 0x580000 [0086.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6c79768 [0086.954] GetProcessHeap () returned 0x580000 [0086.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6c799b8 [0086.954] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.954] ReadFile (in: hFile=0x448, lpBuffer=0x6c79768, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79768*, lpNumberOfBytesRead=0x574ff14*=0x220, lpOverlapped=0x0) returned 1 [0086.957] GetProcessHeap () returned 0x580000 [0086.957] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0086.957] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.957] WriteFile (in: hFile=0x448, lpBuffer=0x6c799b8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c799b8*, lpNumberOfBytesWritten=0x574ff14*=0x220, lpOverlapped=0x0) returned 1 [0086.957] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.957] WriteFile (in: hFile=0x448, lpBuffer=0x6c79bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79bd7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.958] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.958] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.958] CloseHandle (hObject=0x448) returned 1 [0086.958] GetProcessHeap () returned 0x580000 [0086.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c799b8 | out: hHeap=0x580000) returned 1 [0086.958] GetProcessHeap () returned 0x580000 [0086.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79768 | out: hHeap=0x580000) returned 1 [0086.958] GetProcessHeap () returned 0x580000 [0086.958] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0086.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b725a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x574fd28, dwReserved1=0x6c79768, cFileName="BLUEPRNT.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLUEPR~1.YOU")) returned 0x5b96f0 [0086.958] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.156] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 1 [0088.156] GetProcessHeap () returned 0x580000 [0088.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b96f0 [0088.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0088.157] CloseHandle (hObject=0x3f4) returned 1 [0088.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0088.160] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0088.160] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0088.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0088.160] GetProcessHeap () returned 0x580000 [0088.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x673cd0 [0088.160] GetProcessHeap () returned 0x580000 [0088.160] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7f61) returned 0x626d18 [0088.160] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.160] ReadFile (in: hFile=0x3f4, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x7f40, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x574ff14*=0x7f40, lpOverlapped=0x0) returned 1 [0090.456] GetProcessHeap () returned 0x580000 [0090.456] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0090.456] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.456] WriteFile (in: hFile=0x3f4, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0x7f40, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x574ff14*=0x7f40, lpOverlapped=0x0) returned 1 [0090.764] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.764] WriteFile (in: hFile=0x3f4, lpBuffer=0x62ec57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ec57*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.439] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.439] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.439] CloseHandle (hObject=0x3f4) returned 1 [0091.616] GetProcessHeap () returned 0x580000 [0091.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0091.617] GetProcessHeap () returned 0x580000 [0091.617] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0091.617] GetProcessHeap () returned 0x580000 [0091.617] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0091.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7f83, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.630] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.408] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", len=0x49 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 1 [0092.408] GetProcessHeap () returned 0x580000 [0092.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b96f0 [0092.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0092.467] CloseHandle (hObject=0x460) returned 1 [0092.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id_1622540890_.your_last_chance")) returned 1 [0093.544] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0093.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDUST~1.YOU")) returned 0x5b96f0 [0093.545] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0093.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0093.545] GetProcessHeap () returned 0x580000 [0093.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x67fc68 [0093.545] GetProcessHeap () returned 0x580000 [0093.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x6f0c4f8 [0093.545] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.545] ReadFile (in: hFile=0x460, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x574ff14*=0x220, lpOverlapped=0x0) returned 1 [0093.548] GetProcessHeap () returned 0x580000 [0093.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.548] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.548] WriteFile (in: hFile=0x460, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x574ff14*=0x220, lpOverlapped=0x0) returned 1 [0093.548] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.548] WriteFile (in: hFile=0x460, lpBuffer=0x6f0c717*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c717*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0093.548] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.548] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0093.549] CloseHandle (hObject=0x460) returned 1 [0093.549] GetProcessHeap () returned 0x580000 [0093.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0093.549] GetProcessHeap () returned 0x580000 [0093.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0093.549] GetProcessHeap () returned 0x580000 [0093.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f5ede80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x574fd28, dwReserved1=0x67fc68, cFileName="INDUST.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDUST~1.YOU")) returned 0x5b9730 [0094.173] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.186] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", len=0x49 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 1 [0094.186] GetProcessHeap () returned 0x580000 [0094.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x2c) returned 0x61f7a0 [0094.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0094.288] CloseHandle (hObject=0x470) returned 1 [0094.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.288] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id_1622540890_.your_last_chance")) returned 1 [0094.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.288] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIAL~1.YOU")) returned 0x5b96b0 [0094.288] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0094.289] GetProcessHeap () returned 0x580000 [0094.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb761) returned 0x6cc2628 [0094.289] GetProcessHeap () returned 0x580000 [0094.289] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb761) returned 0x6ccdd98 [0094.289] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.289] ReadFile (in: hFile=0x470, lpBuffer=0x6cc2628, nNumberOfBytesToRead=0xb740, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc2628*, lpNumberOfBytesRead=0x574ff14*=0xb740, lpOverlapped=0x0) returned 1 [0098.283] GetProcessHeap () returned 0x580000 [0098.283] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.283] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.283] WriteFile (in: hFile=0x470, lpBuffer=0x6ccdd98*, nNumberOfBytesToWrite=0xb740, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ccdd98*, lpNumberOfBytesWritten=0x574ff14*=0xb740, lpOverlapped=0x0) returned 1 [0098.284] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.284] WriteFile (in: hFile=0x470, lpBuffer=0x6cd94d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cd94d7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.284] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.284] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.284] CloseHandle (hObject=0x470) returned 1 [0098.284] GetProcessHeap () returned 0x580000 [0098.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ccdd98 | out: hHeap=0x580000) returned 1 [0098.284] GetProcessHeap () returned 0x580000 [0098.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cc2628 | out: hHeap=0x580000) returned 1 [0098.284] GetProcessHeap () returned 0x580000 [0098.284] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72328080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb782, dwReserved0=0x574fd28, dwReserved1=0x6cc2628, cFileName="RADIAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIAL~1.YOU")) returned 0x5b96f0 [0098.284] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0099.185] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", len=0x4a | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 1 [0099.185] GetProcessHeap () returned 0x580000 [0099.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0099.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0100.674] CloseHandle (hObject=0x41c) returned 1 [0100.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0100.721] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0100.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0100.722] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0100.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0100.722] GetProcessHeap () returned 0x580000 [0100.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d00d28 [0100.722] GetProcessHeap () returned 0x580000 [0100.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6c676b8 [0100.722] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.722] ReadFile (in: hFile=0x41c, lpBuffer=0x6d00d28, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00d28*, lpNumberOfBytesRead=0x574ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0100.731] GetProcessHeap () returned 0x580000 [0100.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0100.731] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.731] WriteFile (in: hFile=0x41c, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x574ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0100.731] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.731] WriteFile (in: hFile=0x41c, lpBuffer=0x6c67f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67f57*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.732] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.732] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.732] CloseHandle (hObject=0x41c) returned 1 [0100.732] GetProcessHeap () returned 0x580000 [0100.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0100.732] GetProcessHeap () returned 0x580000 [0100.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00d28 | out: hHeap=0x580000) returned 1 [0100.732] GetProcessHeap () returned 0x580000 [0100.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73a83860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8c5, dwReserved0=0x574fd28, dwReserved1=0x6d00d28, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.841] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.166] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", len=0x46 | out: pbstr=0x574ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 1 [0106.166] GetProcessHeap () returned 0x580000 [0106.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e92e8 [0106.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0107.254] CloseHandle (hObject=0x4b0) returned 1 [0107.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id_1622540890_.your_last_chance")) returned 1 [0107.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBCN6C~1.YOU")) returned 0x5b9630 [0107.255] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0107.256] GetProcessHeap () returned 0x580000 [0107.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c448d8 [0107.256] GetProcessHeap () returned 0x580000 [0107.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d9f1d0 [0107.257] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.257] ReadFile (in: hFile=0x4b0, lpBuffer=0x6c448d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448d8*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.579] GetProcessHeap () returned 0x580000 [0111.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0111.580] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.580] WriteFile (in: hFile=0x4b0, lpBuffer=0x6d9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.580] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.580] WriteFile (in: hFile=0x4b0, lpBuffer=0x6db09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db09cf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.580] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.580] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.580] CloseHandle (hObject=0x4b0) returned 1 [0111.580] GetProcessHeap () returned 0x580000 [0111.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0111.580] GetProcessHeap () returned 0x580000 [0111.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c448d8 | out: hHeap=0x580000) returned 1 [0111.581] GetProcessHeap () returned 0x580000 [0111.581] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0111.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a1e9400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1acba, dwReserved0=0x574fd28, dwReserved1=0x6c448d8, cFileName="VBCN6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBCN6C~1.YOU")) returned 0x5b96f0 [0111.582] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.123] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", len=0x52 | out: pbstr=0x574ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.124] GetProcessHeap () returned 0x580000 [0112.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1ae8 [0112.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.124] Sleep (dwMilliseconds=0x1) [0112.264] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", len=0x61 | out: pbstr=0x574ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.264] GetProcessHeap () returned 0x580000 [0112.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.264] Sleep (dwMilliseconds=0x1) [0112.304] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", len=0x4c | out: pbstr=0x574ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 1 [0112.304] GetProcessHeap () returned 0x580000 [0112.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa1f0, Size=0x7c) returned 0x5f99f8 [0112.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.326] Sleep (dwMilliseconds=0x1) [0112.393] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", len=0x46 | out: pbstr=0x574ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned 1 [0112.393] GetProcessHeap () returned 0x580000 [0112.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92d0 | out: hHeap=0x580000) returned 1 [0112.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.393] Sleep (dwMilliseconds=0x1) [0113.324] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", len=0x3f | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 1 [0113.325] GetProcessHeap () returned 0x580000 [0113.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xc0) returned 0x6f0ceb8 [0113.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0113.486] CloseHandle (hObject=0x170) returned 1 [0113.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.486] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0117~2.YOU")) returned 0x5b9630 [0114.724] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0114.724] GetProcessHeap () returned 0x580000 [0114.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ce1) returned 0x6c1ce28 [0114.724] GetProcessHeap () returned 0x580000 [0114.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ce1) returned 0x6c23b18 [0114.724] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.724] ReadFile (in: hFile=0x170, lpBuffer=0x6c1ce28, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c1ce28*, lpNumberOfBytesRead=0x574ff14*=0x6cc0, lpOverlapped=0x0) returned 1 [0117.485] GetProcessHeap () returned 0x580000 [0117.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0117.485] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.485] WriteFile (in: hFile=0x170, lpBuffer=0x6c23b18*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c23b18*, lpNumberOfBytesWritten=0x574ff14*=0x6cc0, lpOverlapped=0x0) returned 1 [0117.485] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.485] WriteFile (in: hFile=0x170, lpBuffer=0x6c2a7d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a7d7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.485] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.485] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.485] CloseHandle (hObject=0x170) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c23b18 | out: hHeap=0x580000) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c1ce28 | out: hHeap=0x580000) returned 1 [0117.923] GetProcessHeap () returned 0x580000 [0117.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0120.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da4bd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6cf6, dwReserved0=0x574fd28, dwReserved1=0x6c1ce28, cFileName="AN01174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0117~2.YOU")) returned 0x5b96f0 [0120.013] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.029] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", len=0x3f | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF") returned 1 [0120.029] GetProcessHeap () returned 0x580000 [0120.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a0) returned 0x6d06ca8 [0120.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.947] CloseHandle (hObject=0x470) returned 1 [0121.947] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~3.YOU")) returned 0x5b9730 [0121.948] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0121.948] GetProcessHeap () returned 0x580000 [0121.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12e1) returned 0x67ec60 [0121.949] GetProcessHeap () returned 0x580000 [0121.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12e1) returned 0x6f19958 [0121.949] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.949] ReadFile (in: hFile=0x470, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x12c0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x574ff14*=0x12c0, lpOverlapped=0x0) returned 1 [0121.967] GetProcessHeap () returned 0x580000 [0121.967] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.967] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.967] WriteFile (in: hFile=0x470, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x574ff14*=0x12c0, lpOverlapped=0x0) returned 1 [0121.967] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.967] WriteFile (in: hFile=0x470, lpBuffer=0x6f1ac17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ac17*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.967] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.967] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.967] CloseHandle (hObject=0x470) returned 1 [0121.967] GetProcessHeap () returned 0x580000 [0121.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0121.968] GetProcessHeap () returned 0x580000 [0121.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0121.968] GetProcessHeap () returned 0x580000 [0121.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0122.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x804fe7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x574fd28, dwReserved1=0x67ec60, cFileName="WB01843_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0184~3.YOU")) returned 0x5b9730 [0122.605] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.605] Sleep (dwMilliseconds=0x1) [0122.635] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", len=0x4a | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned 1 [0122.635] GetProcessHeap () returned 0x580000 [0122.635] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1938) returned 0x6f42f08 [0122.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0124.762] CloseHandle (hObject=0x4a0) returned 1 [0124.762] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.763] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.id_1622540890_.your_last_chance")) returned 1 [0125.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERX~1.YOU")) returned 0x5b9730 [0125.396] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0125.396] GetProcessHeap () returned 0x580000 [0125.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6f66848 [0125.396] GetProcessHeap () returned 0x580000 [0125.396] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0125.396] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.396] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f66848, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66848*, lpNumberOfBytesRead=0x574ff14*=0xe20, lpOverlapped=0x0) returned 1 [0125.410] GetProcessHeap () returned 0x580000 [0125.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.410] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x574ff14*=0xe20, lpOverlapped=0x0) returned 1 [0125.410] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.410] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c2a697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a697*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.411] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.411] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.411] CloseHandle (hObject=0x4a0) returned 1 [0125.411] GetProcessHeap () returned 0x580000 [0125.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.411] GetProcessHeap () returned 0x580000 [0125.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f66848 | out: hHeap=0x580000) returned 1 [0125.411] GetProcessHeap () returned 0x580000 [0125.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x825df7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe50, dwReserved0=0x574fd28, dwReserved1=0x6f66848, cFileName="Paper.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERX~1.YOU")) returned 0x5b9730 [0125.411] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.427] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", len=0x3d | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned 1 [0125.427] GetProcessHeap () returned 0x580000 [0125.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a04) returned 0x667250 [0125.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0128.617] CloseHandle (hObject=0x470) returned 1 [0128.617] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.617] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03323~1.YOU")) returned 0x5b9730 [0130.854] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0130.854] GetProcessHeap () returned 0x580000 [0130.854] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x47e1) returned 0x6e4de60 [0130.855] GetProcessHeap () returned 0x580000 [0130.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x47e1) returned 0x6e52650 [0130.855] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.855] ReadFile (in: hFile=0x470, lpBuffer=0x6e4de60, nNumberOfBytesToRead=0x47c0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4de60*, lpNumberOfBytesRead=0x574ff14*=0x47c0, lpOverlapped=0x0) returned 1 [0131.892] GetProcessHeap () returned 0x580000 [0131.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0131.893] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.893] WriteFile (in: hFile=0x470, lpBuffer=0x6e52650*, nNumberOfBytesToWrite=0x47c0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e52650*, lpNumberOfBytesWritten=0x574ff14*=0x47c0, lpOverlapped=0x0) returned 1 [0131.893] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.893] WriteFile (in: hFile=0x470, lpBuffer=0x6e56e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e56e0f*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.893] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.893] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.893] CloseHandle (hObject=0x470) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e52650 | out: hHeap=0x580000) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e4de60 | out: hHeap=0x580000) returned 1 [0132.908] GetProcessHeap () returned 0x580000 [0132.908] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0135.293] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8639d240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x47e6, dwReserved0=0x574fd28, dwReserved1=0x6e4de60, cFileName="J0332364.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03323~1.YOU")) returned 0x5b96f0 [0135.293] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.294] Sleep (dwMilliseconds=0x1) [0135.304] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", len=0x43 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned 1 [0135.304] GetProcessHeap () returned 0x580000 [0135.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0135.310] CloseHandle (hObject=0x478) returned 1 [0135.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd290b00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd290b00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2142~1.YOU")) returned 0x5b96f0 [0135.311] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0135.311] GetProcessHeap () returned 0x580000 [0135.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6cda390 [0135.311] GetProcessHeap () returned 0x580000 [0135.311] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6cdab58 [0135.311] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.312] ReadFile (in: hFile=0x478, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x574ff14*=0x760, lpOverlapped=0x0) returned 1 [0135.353] GetProcessHeap () returned 0x580000 [0135.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.353] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.353] WriteFile (in: hFile=0x478, lpBuffer=0x6cdab58*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab58*, lpNumberOfBytesWritten=0x574ff14*=0x760, lpOverlapped=0x0) returned 1 [0135.353] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.353] WriteFile (in: hFile=0x478, lpBuffer=0x6cdb2b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb2b7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.353] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.353] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.353] CloseHandle (hObject=0x478) returned 1 [0135.353] GetProcessHeap () returned 0x580000 [0135.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab58 | out: hHeap=0x580000) returned 1 [0135.353] GetProcessHeap () returned 0x580000 [0135.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0135.353] GetProcessHeap () returned 0x580000 [0135.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd290b00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x884a4380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x574fd28, dwReserved1=0x6cda390, cFileName="BD21427_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2142~1.YOU")) returned 0x5b96f0 [0135.354] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.354] Sleep (dwMilliseconds=0x1) [0135.362] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", len=0x43 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned 1 [0135.362] GetProcessHeap () returned 0x580000 [0135.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0135.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0138.337] CloseHandle (hObject=0x3b4) returned 1 [0138.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e75c900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1e75c900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x888, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD315C~1.YOU")) returned 0x5b97b0 [0139.592] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.592] GetProcessHeap () returned 0x580000 [0139.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6ce54c0 [0139.592] GetProcessHeap () returned 0x580000 [0139.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6ce5dc8 [0139.592] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.592] ReadFile (in: hFile=0x3b4, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x574ff14*=0x880, lpOverlapped=0x0) returned 1 [0139.601] GetProcessHeap () returned 0x580000 [0139.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.601] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.601] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ce5dc8*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5dc8*, lpNumberOfBytesWritten=0x574ff14*=0x880, lpOverlapped=0x0) returned 1 [0139.601] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.602] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ce6647*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6647*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.602] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.602] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.602] CloseHandle (hObject=0x3b4) returned 1 [0139.602] GetProcessHeap () returned 0x580000 [0139.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5dc8 | out: hHeap=0x580000) returned 1 [0139.602] GetProcessHeap () returned 0x580000 [0139.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0139.602] GetProcessHeap () returned 0x580000 [0139.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e75c900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ad1b980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x574fd28, dwReserved1=0x6ce54c0, cFileName="BD21334_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD315C~1.YOU")) returned 0x5b9770 [0140.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.170] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", len=0x56 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css") returned 1 [0140.171] GetProcessHeap () returned 0x580000 [0140.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0140.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.207] CloseHandle (hObject=0x488) returned 1 [0140.207] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.207] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.id_1622540890_.your_last_chance")) returned 1 [0140.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x4c005f, dwReserved1=0x530041, cFileName="Solutions.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~2.YOU")) returned 0x5b9770 [0140.208] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.208] GetProcessHeap () returned 0x580000 [0140.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19e1) returned 0x667250 [0140.208] GetProcessHeap () returned 0x580000 [0140.208] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19e1) returned 0x6f77710 [0140.208] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.208] ReadFile (in: hFile=0x488, lpBuffer=0x667250, nNumberOfBytesToRead=0x19c0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x574ff14*=0x19c0, lpOverlapped=0x0) returned 1 [0140.301] GetProcessHeap () returned 0x580000 [0140.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.301] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] WriteFile (in: hFile=0x488, lpBuffer=0x6f77710*, nNumberOfBytesToWrite=0x19c0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f77710*, lpNumberOfBytesWritten=0x574ff14*=0x19c0, lpOverlapped=0x0) returned 1 [0140.301] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] WriteFile (in: hFile=0x488, lpBuffer=0x6f790cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f790cf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.301] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.301] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.301] CloseHandle (hObject=0x488) returned 1 [0140.301] GetProcessHeap () returned 0x580000 [0140.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f77710 | out: hHeap=0x580000) returned 1 [0140.301] GetProcessHeap () returned 0x580000 [0140.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0140.301] GetProcessHeap () returned 0x580000 [0140.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3cd760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19f0, dwReserved0=0x574fd28, dwReserved1=0x667250, cFileName="Solutions.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~2.YOU")) returned 0x5b9770 [0140.663] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.673] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", len=0x43 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned 1 [0140.673] GetProcessHeap () returned 0x580000 [0140.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d94) returned 0x6f14048 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.777] CloseHandle (hObject=0x490) returned 1 [0140.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1476~1.YOU")) returned 0x5b9730 [0140.779] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.779] GetProcessHeap () returned 0x580000 [0140.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6dd20e8 [0140.779] GetProcessHeap () returned 0x580000 [0140.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6dd22c0 [0140.779] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.779] ReadFile (in: hFile=0x490, lpBuffer=0x6dd20e8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20e8*, lpNumberOfBytesRead=0x574ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.781] GetProcessHeap () returned 0x580000 [0140.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.781] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x490, lpBuffer=0x6dd22c0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd22c0*, lpNumberOfBytesWritten=0x574ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.781] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x490, lpBuffer=0x6dd245f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd245f*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.781] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.781] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.782] CloseHandle (hObject=0x490) returned 1 [0140.782] GetProcessHeap () returned 0x580000 [0140.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd22c0 | out: hHeap=0x580000) returned 1 [0140.782] GetProcessHeap () returned 0x580000 [0140.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20e8 | out: hHeap=0x580000) returned 1 [0140.782] GetProcessHeap () returned 0x580000 [0140.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b86a200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cb, dwReserved0=0x574fd28, dwReserved1=0x6dd20e8, cFileName="BD14768_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1476~1.YOU")) returned 0x5b9730 [0141.856] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.867] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS", len=0x3b | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS") returned 1 [0141.867] GetProcessHeap () returned 0x580000 [0141.867] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee4) returned 0x6f14048 [0141.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0141.868] CloseHandle (hObject=0x454) returned 1 [0141.868] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.868] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.id_1622540890_.your_last_chance")) returned 1 [0141.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRIMAR~1.YOU")) returned 0x5b9730 [0141.869] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\primary.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0141.869] GetProcessHeap () returned 0x580000 [0141.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0141.869] GetProcessHeap () returned 0x580000 [0141.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0141.870] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.870] ReadFile (in: hFile=0x454, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x574ff14*=0xd60, lpOverlapped=0x0) returned 1 [0141.883] GetProcessHeap () returned 0x580000 [0141.883] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.883] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.883] WriteFile (in: hFile=0x454, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x574ff14*=0xd60, lpOverlapped=0x0) returned 1 [0141.883] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.883] WriteFile (in: hFile=0x454, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.883] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.883] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.883] CloseHandle (hObject=0x454) returned 1 [0141.883] GetProcessHeap () returned 0x580000 [0141.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0141.884] GetProcessHeap () returned 0x580000 [0141.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0141.884] GetProcessHeap () returned 0x580000 [0141.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8c2fa3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x574fd28, dwReserved1=0x635768, cFileName="PRIMARY.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PRIMAR~1.YOU")) returned 0x5b9730 [0141.884] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.898] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL", len=0x43 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 1 [0141.898] GetProcessHeap () returned 0x580000 [0141.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee0) returned 0x6f14048 [0141.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0141.899] CloseHandle (hObject=0x454) returned 1 [0141.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0141.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x22180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPINTL~1.YOU")) returned 0x5b9730 [0141.900] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0141.901] GetProcessHeap () returned 0x580000 [0141.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0141.902] GetProcessHeap () returned 0x580000 [0141.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0141.902] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.902] ReadFile (in: hFile=0x454, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0144.008] GetProcessHeap () returned 0x580000 [0144.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.008] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.009] WriteFile (in: hFile=0x454, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0144.009] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.009] WriteFile (in: hFile=0x454, lpBuffer=0x6d33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33077*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.009] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.009] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.009] CloseHandle (hObject=0x454) returned 1 [0144.039] GetProcessHeap () returned 0x580000 [0144.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0144.066] GetProcessHeap () returned 0x580000 [0144.066] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0144.067] GetProcessHeap () returned 0x580000 [0144.067] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8d735ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x221a4, dwReserved0=0x574fd28, dwReserved1=0x6d10048, cFileName="PPINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PPINTL~1.YOU")) returned 0x5b96f0 [0146.863] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.877] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", len=0x44 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned 1 [0146.877] GetProcessHeap () returned 0x580000 [0146.877] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.384] CloseHandle (hObject=0x448) returned 1 [0152.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1985, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR26~1.YOU")) returned 0x5b9730 [0152.385] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.385] GetProcessHeap () returned 0x580000 [0152.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x6f42f08 [0152.385] GetProcessHeap () returned 0x580000 [0152.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19a1) returned 0x667250 [0152.385] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.385] ReadFile (in: hFile=0x448, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x1980, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x574ff14*=0x1980, lpOverlapped=0x0) returned 1 [0152.410] GetProcessHeap () returned 0x580000 [0152.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.410] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.410] WriteFile (in: hFile=0x448, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x1980, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x574ff14*=0x1980, lpOverlapped=0x0) returned 1 [0152.410] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.410] WriteFile (in: hFile=0x448, lpBuffer=0x668bcf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x668bcf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.410] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.410] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.410] CloseHandle (hObject=0x448) returned 1 [0152.410] GetProcessHeap () returned 0x580000 [0152.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0152.410] GetProcessHeap () returned 0x580000 [0152.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0152.410] GetProcessHeap () returned 0x580000 [0152.410] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92740260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a9, dwReserved0=0x574fd28, dwReserved1=0x6f42f08, cFileName="PDIR26F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR26~1.YOU")) returned 0x5b9630 [0153.653] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.653] Sleep (dwMilliseconds=0x1) [0153.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0153.670] CloseHandle (hObject=0x39c) returned 1 [0153.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id_1622540890_.your_last_chance")) returned 1 [0153.670] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b9630 [0153.671] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0153.671] GetProcessHeap () returned 0x580000 [0153.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc581) returned 0x6fcf1b8 [0153.672] GetProcessHeap () returned 0x580000 [0153.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc581) returned 0x6fdb748 [0153.672] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.672] ReadFile (in: hFile=0x39c, lpBuffer=0x6fcf1b8, nNumberOfBytesToRead=0xc560, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fcf1b8*, lpNumberOfBytesRead=0x574ff14*=0xc560, lpOverlapped=0x0) returned 1 [0157.117] GetProcessHeap () returned 0x580000 [0157.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0157.117] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.117] WriteFile (in: hFile=0x39c, lpBuffer=0x6fdb748*, nNumberOfBytesToWrite=0xc560, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdb748*, lpNumberOfBytesWritten=0x574ff14*=0xc560, lpOverlapped=0x0) returned 1 [0157.118] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.118] WriteFile (in: hFile=0x39c, lpBuffer=0x6fe7ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7ca7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0157.118] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.118] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0157.118] CloseHandle (hObject=0x39c) returned 1 [0157.118] GetProcessHeap () returned 0x580000 [0157.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fdb748 | out: hHeap=0x580000) returned 1 [0157.118] GetProcessHeap () returned 0x580000 [0157.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fcf1b8 | out: hHeap=0x580000) returned 1 [0157.118] GetProcessHeap () returned 0x580000 [0157.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0157.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9542e1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5a0, dwReserved0=0x574fd28, dwReserved1=0x6fcf1b8, cFileName="MSO.ACL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOACL~1.YOU")) returned 0x5b9630 [0157.118] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0157.736] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", len=0x3d | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 1 [0157.737] GetProcessHeap () returned 0x580000 [0157.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0157.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.623] CloseHandle (hObject=0x3b4) returned 1 [0158.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.624] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSDE61~1.YOU")) returned 0x5b9630 [0158.624] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0158.624] GetProcessHeap () returned 0x580000 [0158.624] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e01) returned 0x6ea1008 [0158.625] GetProcessHeap () returned 0x580000 [0158.625] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e01) returned 0x6ea8e18 [0158.625] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.625] ReadFile (in: hFile=0x3b4, lpBuffer=0x6ea1008, nNumberOfBytesToRead=0x7de0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesRead=0x574ff14*=0x7de0, lpOverlapped=0x0) returned 1 [0161.427] GetProcessHeap () returned 0x580000 [0161.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0161.427] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.427] WriteFile (in: hFile=0x3b4, lpBuffer=0x6ea8e18*, nNumberOfBytesToWrite=0x7de0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea8e18*, lpNumberOfBytesWritten=0x574ff14*=0x7de0, lpOverlapped=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.427] WriteFile (in: hFile=0x3b4, lpBuffer=0x6eb0bf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb0bf7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0161.427] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.428] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0161.428] CloseHandle (hObject=0x3b4) returned 1 [0162.834] GetProcessHeap () returned 0x580000 [0162.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea8e18 | out: hHeap=0x580000) returned 1 [0162.834] GetProcessHeap () returned 0x580000 [0162.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0162.834] GetProcessHeap () returned 0x580000 [0162.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0166.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97d3dd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e1a, dwReserved0=0x574fd28, dwReserved1=0x6ea1008, cFileName="MSART1.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSDE61~1.YOU")) returned 0x5b9730 [0166.177] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.205] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", len=0x3c | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 1 [0166.205] GetProcessHeap () returned 0x580000 [0166.205] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0166.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0166.295] CloseHandle (hObject=0x49c) returned 1 [0166.295] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id_1622540890_.your_last_chance")) returned 1 [0166.296] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.296] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORG97S~1.YOU")) returned 0x5b9730 [0166.296] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0166.296] GetProcessHeap () returned 0x580000 [0166.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc5a1) returned 0x7166e38 [0166.296] GetProcessHeap () returned 0x580000 [0166.296] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc5a1) returned 0x71733e8 [0166.297] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.297] ReadFile (in: hFile=0x49c, lpBuffer=0x7166e38, nNumberOfBytesToRead=0xc580, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7166e38*, lpNumberOfBytesRead=0x574ff14*=0xc580, lpOverlapped=0x0) returned 1 [0168.780] GetProcessHeap () returned 0x580000 [0168.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0168.780] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.780] WriteFile (in: hFile=0x49c, lpBuffer=0x71733e8*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x71733e8*, lpNumberOfBytesWritten=0x574ff14*=0xc580, lpOverlapped=0x0) returned 1 [0168.781] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.781] WriteFile (in: hFile=0x49c, lpBuffer=0x717f967*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x717f967*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0168.781] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.781] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0168.781] CloseHandle (hObject=0x49c) returned 1 [0168.781] GetProcessHeap () returned 0x580000 [0168.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71733e8 | out: hHeap=0x580000) returned 1 [0168.787] GetProcessHeap () returned 0x580000 [0168.788] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7166e38 | out: hHeap=0x580000) returned 1 [0168.788] GetProcessHeap () returned 0x580000 [0168.788] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0170.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c376620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5ac, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="ORG97.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORG97S~1.YOU")) returned 0x5b96b0 [0170.242] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.245] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", len=0x41 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 1 [0170.245] GetProcessHeap () returned 0x580000 [0170.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x229c) returned 0x6f14048 [0170.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0170.270] CloseHandle (hObject=0x4a0) returned 1 [0170.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.271] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id_1622540890_.your_last_chance")) returned 1 [0170.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~3.YOU")) returned 0x5b96b0 [0170.272] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0170.272] GetProcessHeap () returned 0x580000 [0170.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0170.272] GetProcessHeap () returned 0x580000 [0170.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0170.272] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.272] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0170.309] GetProcessHeap () returned 0x580000 [0170.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.309] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.309] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.309] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.309] CloseHandle (hObject=0x4a0) returned 1 [0170.309] GetProcessHeap () returned 0x580000 [0170.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0170.309] GetProcessHeap () returned 0x580000 [0170.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0170.309] GetProcessHeap () returned 0x580000 [0170.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d20ace0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x574fd28, dwReserved1=0x6c59120, cFileName="TASKDEC.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~3.YOU")) returned 0x5b9770 [0173.018] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.254] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", len=0x40 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 1 [0173.254] GetProcessHeap () returned 0x580000 [0173.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0173.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0173.270] CloseHandle (hObject=0x390) returned 1 [0173.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~2.YOU")) returned 0x5b9770 [0173.271] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0173.271] GetProcessHeap () returned 0x580000 [0173.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0173.271] GetProcessHeap () returned 0x580000 [0173.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0173.271] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.271] ReadFile (in: hFile=0x390, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x574ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.309] GetProcessHeap () returned 0x580000 [0173.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.309] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.309] WriteFile (in: hFile=0x390, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x574ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.309] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.309] WriteFile (in: hFile=0x390, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.309] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.309] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.309] CloseHandle (hObject=0x390) returned 1 [0173.309] GetProcessHeap () returned 0x580000 [0173.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0173.309] GetProcessHeap () returned 0x580000 [0173.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0173.309] GetProcessHeap () returned 0x580000 [0173.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ee9b4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x574fd28, dwReserved1=0x6df6780, cFileName="REMOTE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~2.YOU")) returned 0x5b9770 [0173.310] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.358] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", len=0x40 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 1 [0173.358] GetProcessHeap () returned 0x580000 [0173.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0173.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0173.359] CloseHandle (hObject=0x48c) returned 1 [0173.359] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.359] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~3.YOU")) returned 0x5b9770 [0173.360] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0173.360] GetProcessHeap () returned 0x580000 [0173.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0173.360] GetProcessHeap () returned 0x580000 [0173.360] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0173.360] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.360] ReadFile (in: hFile=0x48c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x574ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.386] GetProcessHeap () returned 0x580000 [0173.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.386] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x574ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.387] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.387] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.387] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.387] CloseHandle (hObject=0x48c) returned 1 [0173.387] GetProcessHeap () returned 0x580000 [0173.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0173.387] GetProcessHeap () returned 0x580000 [0173.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0173.387] GetProcessHeap () returned 0x580000 [0173.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef59bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32d, dwReserved0=0x574fd28, dwReserved1=0x6df6780, cFileName="POSTIT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POSTIT~3.YOU")) returned 0x5b9770 [0173.388] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.660] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", len=0x48 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned 1 [0174.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0174.663] CloseHandle (hObject=0x488) returned 1 [0174.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.id_1622540890_.your_last_chance")) returned 1 [0174.664] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa412, dwReserved0=0x0, dwReserved1=0x0, cFileName="HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORNWA~1.YOU")) returned 0x5b96f0 [0174.664] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0174.664] GetProcessHeap () returned 0x580000 [0174.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa421) returned 0x6d10048 [0174.665] GetProcessHeap () returned 0x580000 [0174.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa421) returned 0x6d1a478 [0174.665] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.665] ReadFile (in: hFile=0x488, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x574ff14*=0xa400, lpOverlapped=0x0) returned 1 [0176.587] GetProcessHeap () returned 0x580000 [0176.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.587] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.587] WriteFile (in: hFile=0x488, lpBuffer=0x6d1a478*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1a478*, lpNumberOfBytesWritten=0x574ff14*=0xa400, lpOverlapped=0x0) returned 1 [0176.587] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.588] WriteFile (in: hFile=0x488, lpBuffer=0x6d24877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d24877*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.588] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.588] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.588] CloseHandle (hObject=0x488) returned 1 [0176.588] GetProcessHeap () returned 0x580000 [0176.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1a478 | out: hHeap=0x580000) returned 1 [0176.588] GetProcessHeap () returned 0x580000 [0176.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0176.588] GetProcessHeap () returned 0x580000 [0176.588] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0dd95a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa436, dwReserved0=0x574fd28, dwReserved1=0x6d10048, cFileName="HORN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORNWA~1.YOU")) returned 0x5b96f0 [0179.054] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.071] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", len=0x48 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx") returned 1 [0179.071] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0179.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0181.074] CloseHandle (hObject=0x49c) returned 1 [0181.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.id_1622540890_.your_last_chance")) returned 1 [0181.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0181.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x222a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ELEGAN~1.YOU")) returned 0x5b96b0 [0181.075] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0181.075] GetProcessHeap () returned 0x580000 [0181.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2241) returned 0x6dcb1d0 [0181.075] GetProcessHeap () returned 0x580000 [0181.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2241) returned 0x6dec6e0 [0181.075] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.075] ReadFile (in: hFile=0x49c, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x2220, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x574ff14*=0x2220, lpOverlapped=0x0) returned 1 [0181.104] GetProcessHeap () returned 0x580000 [0181.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.105] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.105] WriteFile (in: hFile=0x49c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x574ff14*=0x2220, lpOverlapped=0x0) returned 1 [0181.105] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.105] WriteFile (in: hFile=0x49c, lpBuffer=0x6dee8ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee8ff*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.105] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.105] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.105] CloseHandle (hObject=0x49c) returned 1 [0181.105] GetProcessHeap () returned 0x580000 [0181.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0181.105] GetProcessHeap () returned 0x580000 [0181.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0181.105] GetProcessHeap () returned 0x580000 [0181.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa38fe460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x574fd28, dwReserved1=0x6dcb1d0, cFileName="Elegant.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ELEGAN~1.YOU")) returned 0x5b9770 [0182.214] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.597] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", len=0x68 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned 1 [0183.597] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0183.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.626] CloseHandle (hObject=0x488) returned 1 [0183.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.id_1622540890_.your_last_chance")) returned 1 [0183.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x15fc, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b9770 [0183.627] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.627] GetProcessHeap () returned 0x580000 [0183.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x706ecb0 [0183.627] GetProcessHeap () returned 0x580000 [0183.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x70703b8 [0183.627] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.627] ReadFile (in: hFile=0x488, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x15e0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x574ff14*=0x15e0, lpOverlapped=0x0) returned 1 [0183.678] GetProcessHeap () returned 0x580000 [0183.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.678] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.678] WriteFile (in: hFile=0x488, lpBuffer=0x70703b8*, nNumberOfBytesToWrite=0x15e0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x70703b8*, lpNumberOfBytesWritten=0x574ff14*=0x15e0, lpOverlapped=0x0) returned 1 [0183.678] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.678] WriteFile (in: hFile=0x488, lpBuffer=0x7071997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7071997*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.678] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.678] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.678] CloseHandle (hObject=0x488) returned 1 [0183.679] GetProcessHeap () returned 0x580000 [0183.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70703b8 | out: hHeap=0x580000) returned 1 [0183.679] GetProcessHeap () returned 0x580000 [0183.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0183.679] GetProcessHeap () returned 0x580000 [0183.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa518a740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1620, dwReserved0=0x574fd28, dwReserved1=0x706ecb0, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b9770 [0183.679] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.700] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", len=0x5a | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 1 [0183.700] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0183.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.700] CloseHandle (hObject=0x490) returned 1 [0183.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id_1622540890_.your_last_chance")) returned 1 [0183.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b9770 [0183.701] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0183.701] GetProcessHeap () returned 0x580000 [0183.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5aa990 [0183.701] GetProcessHeap () returned 0x580000 [0183.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0183.701] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.702] ReadFile (in: hFile=0x490, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x574ff14*=0x120, lpOverlapped=0x0) returned 1 [0183.703] GetProcessHeap () returned 0x580000 [0183.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.703] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.703] WriteFile (in: hFile=0x490, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x574ff14*=0x120, lpOverlapped=0x0) returned 1 [0183.703] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.703] WriteFile (in: hFile=0x490, lpBuffer=0x65f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f1cf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.704] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.704] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.704] CloseHandle (hObject=0x490) returned 1 [0183.704] GetProcessHeap () returned 0x580000 [0183.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0183.704] GetProcessHeap () returned 0x580000 [0183.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0183.704] GetProcessHeap () returned 0x580000 [0183.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa51b08a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x574fd28, dwReserved1=0x5aa990, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b9770 [0183.704] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.734] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", len=0x71 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned 1 [0183.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0183.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0186.127] CloseHandle (hObject=0x448) returned 1 [0186.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a7, dwReserved0=0x780065, dwReserved1=0x2e0074, cFileName="StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATIC~1.YOU")) returned 0x5b96b0 [0186.134] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0186.134] GetProcessHeap () returned 0x580000 [0186.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x37c1) returned 0x6d173a8 [0186.134] GetProcessHeap () returned 0x580000 [0186.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x37c1) returned 0x6d1ab78 [0186.134] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.134] ReadFile (in: hFile=0x448, lpBuffer=0x6d173a8, nNumberOfBytesToRead=0x37a0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d173a8*, lpNumberOfBytesRead=0x574ff14*=0x37a0, lpOverlapped=0x0) returned 1 [0187.479] GetProcessHeap () returned 0x580000 [0187.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce468 [0187.479] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.479] WriteFile (in: hFile=0x448, lpBuffer=0x6d1ab78*, nNumberOfBytesToWrite=0x37a0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1ab78*, lpNumberOfBytesWritten=0x574ff14*=0x37a0, lpOverlapped=0x0) returned 1 [0187.479] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.479] WriteFile (in: hFile=0x448, lpBuffer=0x6d1e317*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1e317*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.480] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.480] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.480] CloseHandle (hObject=0x448) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1ab78 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d173a8 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce468 | out: hHeap=0x580000) returned 1 [0188.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa75b1560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x37cb, dwReserved0=0x574fd28, dwReserved1=0x6d173a8, cFileName="StaticText.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATIC~1.YOU")) returned 0x5b9770 [0188.059] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.077] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", len=0x45 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned 1 [0188.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x207c) returned 0x6f14048 [0188.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0191.916] CloseHandle (hObject=0x450) returned 1 [0191.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.916] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP3FBA~1.YOU")) returned 0x5b97b0 [0194.779] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0194.779] GetProcessHeap () returned 0x580000 [0194.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6cbc098 [0194.779] GetProcessHeap () returned 0x580000 [0194.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6cbdda0 [0194.779] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.779] ReadFile (in: hFile=0x450, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1cc0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x574ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0194.806] GetProcessHeap () returned 0x580000 [0194.806] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.806] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x450, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x574ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0194.806] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x450, lpBuffer=0x6cbfa5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbfa5f*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.806] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.806] CloseHandle (hObject=0x450) returned 1 [0194.806] GetProcessHeap () returned 0x580000 [0194.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0194.806] GetProcessHeap () returned 0x580000 [0194.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0194.806] GetProcessHeap () returned 0x580000 [0194.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabb9dba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cfb, dwReserved0=0x574fd28, dwReserved1=0x6cbc098, cFileName="ZPDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP3FBA~1.YOU")) returned 0x5b97b0 [0194.807] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.813] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0194.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0194.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0195.938] CloseHandle (hObject=0x3e4) returned 1 [0195.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.938] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x46004f, dwReserved1=0x2e0046, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0196.413] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0196.413] GetProcessHeap () returned 0x580000 [0196.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60aea8 [0196.414] GetProcessHeap () returned 0x580000 [0196.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x609f90 [0196.414] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.414] ReadFile (in: hFile=0x3e4, lpBuffer=0x60aea8, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x60aea8*, lpNumberOfBytesRead=0x574ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0196.416] GetProcessHeap () returned 0x580000 [0196.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.416] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x3e4, lpBuffer=0x609f90*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x609f90*, lpNumberOfBytesWritten=0x574ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0196.416] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x3e4, lpBuffer=0x60a16f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x60a16f*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.416] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.417] CloseHandle (hObject=0x3e4) returned 1 [0196.417] GetProcessHeap () returned 0x580000 [0196.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x609f90 | out: hHeap=0x580000) returned 1 [0196.417] GetProcessHeap () returned 0x580000 [0196.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60aea8 | out: hHeap=0x580000) returned 1 [0196.417] GetProcessHeap () returned 0x580000 [0196.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacaf0940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x574fd28, dwReserved1=0x60aea8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0199.023] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.655] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned 1 [0199.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0199.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.774] CloseHandle (hObject=0x450) returned 1 [0201.774] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.774] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.id_1622540890_.your_last_chance")) returned 1 [0201.775] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.775] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b97b0 [0201.775] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.776] GetProcessHeap () returned 0x580000 [0201.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.776] GetProcessHeap () returned 0x580000 [0201.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0201.776] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.776] ReadFile (in: hFile=0x450, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x574ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.780] GetProcessHeap () returned 0x580000 [0201.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.780] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.780] WriteFile (in: hFile=0x450, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x574ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.780] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.780] WriteFile (in: hFile=0x450, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.780] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.780] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.781] CloseHandle (hObject=0x450) returned 1 [0201.781] GetProcessHeap () returned 0x580000 [0201.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0201.781] GetProcessHeap () returned 0x580000 [0201.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.781] GetProcessHeap () returned 0x580000 [0201.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafe1e240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x381, dwReserved0=0x574fd28, dwReserved1=0x6dcfb90, cFileName="rtf_increaseindent.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IN~1.YOU")) returned 0x5b9770 [0202.700] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.764] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS", len=0x45 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS") returned 1 [0202.764] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0202.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0202.765] CloseHandle (hObject=0x418) returned 1 [0202.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.765] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css.id_1622540890_.your_last_chance")) returned 1 [0202.765] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC45D5~1.YOU")) returned 0x5b9770 [0202.766] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0202.766] GetProcessHeap () returned 0x580000 [0202.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x725c088 [0202.766] GetProcessHeap () returned 0x580000 [0202.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x726d8b8 [0202.767] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.767] ReadFile (in: hFile=0x418, lpBuffer=0x725c088, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x725c088*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.230] GetProcessHeap () returned 0x580000 [0209.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.230] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.230] WriteFile (in: hFile=0x418, lpBuffer=0x726d8b8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x726d8b8*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.231] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.231] WriteFile (in: hFile=0x418, lpBuffer=0x727f0b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x727f0b7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.231] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.231] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.231] CloseHandle (hObject=0x418) returned 1 [0209.231] GetProcessHeap () returned 0x580000 [0209.231] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x726d8b8 | out: hHeap=0x580000) returned 1 [0209.610] GetProcessHeap () returned 0x580000 [0209.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x725c088 | out: hHeap=0x580000) returned 1 [0209.610] GetProcessHeap () returned 0x580000 [0209.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0209.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb453b380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e0ac, dwReserved0=0x574fd28, dwReserved1=0x725c088, cFileName="SCHEME27.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC45D5~1.YOU")) returned 0x5b97f0 [0209.610] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.651] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", len=0x76 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned 1 [0209.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0209.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.651] CloseHandle (hObject=0x3b8) returned 1 [0209.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0209.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5c0065, dwReserved1=0x410054, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.653] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.653] GetProcessHeap () returned 0x580000 [0209.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0209.653] GetProcessHeap () returned 0x580000 [0209.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0209.653] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.653] ReadFile (in: hFile=0x3b8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x574ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.654] GetProcessHeap () returned 0x580000 [0209.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.654] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.654] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x574ff14*=0xc0, lpOverlapped=0x0) returned 1 [0209.655] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.655] WriteFile (in: hFile=0x3b8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.655] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.655] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.655] CloseHandle (hObject=0x3b8) returned 1 [0209.655] GetProcessHeap () returned 0x580000 [0209.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0209.655] GetProcessHeap () returned 0x580000 [0209.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0209.655] GetProcessHeap () returned 0x580000 [0209.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0209.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb493f8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x574fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0209.655] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.680] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", len=0x6b | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned 1 [0209.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0209.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.681] CloseHandle (hObject=0x428) returned 1 [0209.681] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance")) returned 1 [0209.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100d, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b97f0 [0209.682] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.682] GetProcessHeap () returned 0x580000 [0209.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6c9a390 [0209.683] GetProcessHeap () returned 0x580000 [0209.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6c9b498 [0209.683] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.683] ReadFile (in: hFile=0x428, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x574ff14*=0x1000, lpOverlapped=0x0) returned 1 [0209.729] GetProcessHeap () returned 0x580000 [0209.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0209.729] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.729] WriteFile (in: hFile=0x428, lpBuffer=0x6c9b498*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b498*, lpNumberOfBytesWritten=0x574ff14*=0x1000, lpOverlapped=0x0) returned 1 [0209.730] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.730] WriteFile (in: hFile=0x428, lpBuffer=0x6c9c497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9c497*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.730] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.730] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.730] CloseHandle (hObject=0x428) returned 1 [0209.730] GetProcessHeap () returned 0x580000 [0209.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b498 | out: hHeap=0x580000) returned 1 [0209.730] GetProcessHeap () returned 0x580000 [0209.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0209.730] GetProcessHeap () returned 0x580000 [0209.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0209.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49fdf80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1031, dwReserved0=0x574fd28, dwReserved1=0x6c9a390, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b97f0 [0209.730] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.777] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", len=0x61 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned 1 [0209.777] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f08) returned 0x6f14048 [0209.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.778] CloseHandle (hObject=0x458) returned 1 [0209.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.id_1622540890_.your_last_chance")) returned 1 [0209.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b97f0 [0209.779] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.779] GetProcessHeap () returned 0x580000 [0209.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0209.779] GetProcessHeap () returned 0x580000 [0209.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0209.779] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.779] ReadFile (in: hFile=0x458, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x574ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.780] GetProcessHeap () returned 0x580000 [0209.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0209.780] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.780] WriteFile (in: hFile=0x458, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x574ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.781] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.781] WriteFile (in: hFile=0x458, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.781] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.781] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.781] CloseHandle (hObject=0x458) returned 1 [0209.781] GetProcessHeap () returned 0x580000 [0209.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0209.781] GetProcessHeap () returned 0x580000 [0209.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0209.781] GetProcessHeap () returned 0x580000 [0209.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0209.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a703a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x574fd28, dwReserved1=0x60e8a8, cFileName="button_mid.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~4.YOU")) returned 0x5b97f0 [0209.781] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.823] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", len=0x67 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned 1 [0209.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0209.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.076] CloseHandle (hObject=0x450) returned 1 [0210.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.id_1622540890_.your_last_chance")) returned 1 [0210.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b97b0 [0210.757] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.757] GetProcessHeap () returned 0x580000 [0210.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a1) returned 0x6efb008 [0210.757] GetProcessHeap () returned 0x580000 [0210.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a1) returned 0x7461878 [0210.758] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] ReadFile (in: hFile=0x450, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x1080, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x574ff14*=0x1080, lpOverlapped=0x0) returned 1 [0210.773] GetProcessHeap () returned 0x580000 [0210.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0210.773] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.773] WriteFile (in: hFile=0x450, lpBuffer=0x7461878*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461878*, lpNumberOfBytesWritten=0x574ff14*=0x1080, lpOverlapped=0x0) returned 1 [0210.774] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x450, lpBuffer=0x74628f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x74628f7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.774] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.774] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.774] CloseHandle (hObject=0x450) returned 1 [0210.774] GetProcessHeap () returned 0x580000 [0210.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7461878 | out: hHeap=0x580000) returned 1 [0210.774] GetProcessHeap () returned 0x580000 [0210.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0210.774] GetProcessHeap () returned 0x580000 [0210.774] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0214.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb53f5ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10b5, dwReserved0=0x574fd28, dwReserved1=0x6efb008, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b97b0 [0214.612] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.644] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x6f | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0214.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0214.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.645] CloseHandle (hObject=0x438) returned 1 [0214.645] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.645] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0214.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x2e004e, dwReserved1=0x490047, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.698] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0214.698] GetProcessHeap () returned 0x580000 [0214.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0214.698] GetProcessHeap () returned 0x580000 [0214.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0214.698] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.698] ReadFile (in: hFile=0x438, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x574ff14*=0x400, lpOverlapped=0x0) returned 1 [0214.766] GetProcessHeap () returned 0x580000 [0214.766] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0214.766] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.766] WriteFile (in: hFile=0x438, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x574ff14*=0x400, lpOverlapped=0x0) returned 1 [0214.766] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.766] WriteFile (in: hFile=0x438, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.767] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.767] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.767] CloseHandle (hObject=0x438) returned 1 [0214.767] GetProcessHeap () returned 0x580000 [0214.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0214.767] GetProcessHeap () returned 0x580000 [0214.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0214.767] GetProcessHeap () returned 0x580000 [0214.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0214.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7a0bba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x574fd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.767] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.922] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", len=0x3c | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT") returned 1 [0214.922] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0214.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0214.923] CloseHandle (hObject=0x47c) returned 1 [0214.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.923] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.id_1622540890_.your_last_chance")) returned 1 [0214.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e7da00, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHK~1.YOU")) returned 0x5b97b0 [0214.925] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0214.925] GetProcessHeap () returned 0x580000 [0214.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0214.926] GetProcessHeap () returned 0x580000 [0214.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0214.926] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.926] ReadFile (in: hFile=0x47c, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.228] GetProcessHeap () returned 0x580000 [0220.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0220.228] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.228] WriteFile (in: hFile=0x47c, lpBuffer=0x6fc4768*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.229] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.229] WriteFile (in: hFile=0x47c, lpBuffer=0x6fd5f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f67*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.679] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.679] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.679] CloseHandle (hObject=0x47c) returned 1 [0220.679] GetProcessHeap () returned 0x580000 [0220.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0220.679] GetProcessHeap () returned 0x580000 [0220.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0220.679] GetProcessHeap () returned 0x580000 [0220.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb26e4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f79b, dwReserved0=0x574fd28, dwReserved1=0x6fb2f38, cFileName="PSRCHKEY.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHK~1.YOU")) returned 0x5b9730 [0221.817] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.865] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", len=0x65 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned 1 [0221.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0221.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.865] CloseHandle (hObject=0x460) returned 1 [0221.865] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICONIM~1.YOU")) returned 0x5b9730 [0221.867] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.867] GetProcessHeap () returned 0x580000 [0221.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c11570 [0221.867] GetProcessHeap () returned 0x580000 [0221.867] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c11ff8 [0221.867] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.867] ReadFile (in: hFile=0x460, lpBuffer=0x6c11570, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11570*, lpNumberOfBytesRead=0x574ff14*=0xa20, lpOverlapped=0x0) returned 1 [0221.877] GetProcessHeap () returned 0x580000 [0221.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0221.877] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.877] WriteFile (in: hFile=0x460, lpBuffer=0x6c11ff8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11ff8*, lpNumberOfBytesWritten=0x574ff14*=0xa20, lpOverlapped=0x0) returned 1 [0221.877] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.877] WriteFile (in: hFile=0x460, lpBuffer=0x6c12a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c12a17*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.877] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.877] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.878] CloseHandle (hObject=0x460) returned 1 [0221.878] GetProcessHeap () returned 0x580000 [0221.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11ff8 | out: hHeap=0x580000) returned 1 [0221.878] GetProcessHeap () returned 0x580000 [0221.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11570 | out: hHeap=0x580000) returned 1 [0221.878] GetProcessHeap () returned 0x580000 [0221.878] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0221.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbdbcd40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x574fd28, dwReserved1=0x6c11570, cFileName="IconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICONIM~1.YOU")) returned 0x5b9730 [0221.878] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.882] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", len=0x6c | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned 1 [0221.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0221.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.905] CloseHandle (hObject=0x460) returned 1 [0221.905] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.905] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.906] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x70006d, dwReserved1=0x69002e, cFileName="ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZOOMIC~1.YOU")) returned 0x5b9730 [0221.906] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.907] GetProcessHeap () returned 0x580000 [0221.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0221.907] GetProcessHeap () returned 0x580000 [0221.907] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0221.907] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.907] ReadFile (in: hFile=0x460, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x574ff14*=0x620, lpOverlapped=0x0) returned 1 [0221.914] GetProcessHeap () returned 0x580000 [0221.914] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0221.914] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.914] WriteFile (in: hFile=0x460, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x574ff14*=0x620, lpOverlapped=0x0) returned 1 [0221.914] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.914] WriteFile (in: hFile=0x460, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.914] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.914] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.914] CloseHandle (hObject=0x460) returned 1 [0221.914] GetProcessHeap () returned 0x580000 [0221.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0221.914] GetProcessHeap () returned 0x580000 [0221.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0221.915] GetProcessHeap () returned 0x580000 [0221.915] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0221.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbe2f160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x574fd28, dwReserved1=0x626d30, cFileName="ZoomIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZOOMIC~1.YOU")) returned 0x5b9730 [0221.915] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.926] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", len=0x6e | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned 1 [0221.926] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0221.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0221.927] CloseHandle (hObject=0x42c) returned 1 [0221.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.928] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x62002e, dwReserved1=0x70006d, cFileName="SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~1.YOU")) returned 0x5b9730 [0221.928] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0221.928] GetProcessHeap () returned 0x580000 [0221.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f9c488 [0221.928] GetProcessHeap () returned 0x580000 [0221.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0221.929] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.929] ReadFile (in: hFile=0x42c, lpBuffer=0x6f9c488, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9c488*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0223.186] GetProcessHeap () returned 0x580000 [0223.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.187] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.187] WriteFile (in: hFile=0x42c, lpBuffer=0x72f0208*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0223.187] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.187] WriteFile (in: hFile=0x42c, lpBuffer=0x7301a07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a07*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.187] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.187] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.187] CloseHandle (hObject=0x42c) returned 1 [0223.195] GetProcessHeap () returned 0x580000 [0223.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0223.237] GetProcessHeap () returned 0x580000 [0223.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9c488 | out: hHeap=0x580000) returned 1 [0223.237] GetProcessHeap () returned 0x580000 [0223.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbca3c0c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1409c, dwReserved0=0x574fd28, dwReserved1=0x6f9c488, cFileName="SplashImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~1.YOU")) returned 0x5b9630 [0225.883] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.920] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", len=0x73 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned 1 [0225.920] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0225.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.921] CloseHandle (hObject=0x44c) returned 1 [0225.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0225.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x6f0072, dwReserved1=0x6e0075, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9630 [0225.922] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.922] GetProcessHeap () returned 0x580000 [0225.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0225.922] GetProcessHeap () returned 0x580000 [0225.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d07028 [0225.922] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.922] ReadFile (in: hFile=0x44c, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0225.974] GetProcessHeap () returned 0x580000 [0225.974] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.974] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.974] WriteFile (in: hFile=0x44c, lpBuffer=0x6d07028*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07028*, lpNumberOfBytesWritten=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0225.974] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.974] WriteFile (in: hFile=0x44c, lpBuffer=0x6d07347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07347*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.974] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.974] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.974] CloseHandle (hObject=0x44c) returned 1 [0225.974] GetProcessHeap () returned 0x580000 [0225.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07028 | out: hHeap=0x580000) returned 1 [0225.974] GetProcessHeap () returned 0x580000 [0225.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0225.974] GetProcessHeap () returned 0x580000 [0225.974] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe360920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x353, dwReserved0=0x574fd28, dwReserved1=0x6d06cc0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9630 [0225.975] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.015] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK", len=0x48 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 1 [0226.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dcc) returned 0x6dee6e0 [0226.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.057] CloseHandle (hObject=0x454) returned 1 [0226.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0226.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INE501~1.YOU")) returned 0x5b9630 [0226.061] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.061] GetProcessHeap () returned 0x580000 [0226.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0226.062] GetProcessHeap () returned 0x580000 [0226.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0226.062] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.062] ReadFile (in: hFile=0x454, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x574ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.063] GetProcessHeap () returned 0x580000 [0226.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.063] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.063] WriteFile (in: hFile=0x454, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x574ff14*=0x60, lpOverlapped=0x0) returned 1 [0226.063] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.063] WriteFile (in: hFile=0x454, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.063] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.063] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.063] CloseHandle (hObject=0x454) returned 1 [0226.063] GetProcessHeap () returned 0x580000 [0226.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0226.064] GetProcessHeap () returned 0x580000 [0226.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0226.064] GetProcessHeap () returned 0x580000 [0226.064] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe445160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x574fd28, dwReserved1=0x61b540, cFileName="INFOPATHEDITOR_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INE501~1.YOU")) returned 0x5b9630 [0226.489] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.544] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned 1 [0226.544] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d88) returned 0x6dee6e0 [0226.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0234.641] CloseHandle (hObject=0x428) returned 1 [0234.641] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0234.642] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0239.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96f0 [0239.345] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0239.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0239.347] GetProcessHeap () returned 0x580000 [0239.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dece50 [0239.347] GetProcessHeap () returned 0x580000 [0239.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6decfc8 [0239.347] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.347] ReadFile (in: hFile=0x428, lpBuffer=0x6dece50, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dece50*, lpNumberOfBytesRead=0x574ff14*=0x140, lpOverlapped=0x0) returned 1 [0239.349] GetProcessHeap () returned 0x580000 [0239.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0239.349] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.349] WriteFile (in: hFile=0x428, lpBuffer=0x6decfc8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6decfc8*, lpNumberOfBytesWritten=0x574ff14*=0x140, lpOverlapped=0x0) returned 1 [0239.349] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.349] WriteFile (in: hFile=0x428, lpBuffer=0x6ded107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ded107*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.349] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.349] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.349] CloseHandle (hObject=0x428) returned 1 [0239.349] GetProcessHeap () returned 0x580000 [0239.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6decfc8 | out: hHeap=0x580000) returned 1 [0239.349] GetProcessHeap () returned 0x580000 [0239.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dece50 | out: hHeap=0x580000) returned 1 [0239.349] GetProcessHeap () returned 0x580000 [0239.349] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0240.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x574fd28, dwReserved1=0x6dece50, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9730 [0240.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.654] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML", len=0x4f | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned 1 [0240.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0240.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0240.717] CloseHandle (hObject=0x478) returned 1 [0240.717] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml.id_1622540890_.your_last_chance")) returned 1 [0240.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.718] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA4153~1.YOU")) returned 0x5b9730 [0240.718] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0240.718] GetProcessHeap () returned 0x580000 [0240.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c61ec0 [0240.718] GetProcessHeap () returned 0x580000 [0240.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c62228 [0240.718] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.718] ReadFile (in: hFile=0x478, lpBuffer=0x6c61ec0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61ec0*, lpNumberOfBytesRead=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.776] GetProcessHeap () returned 0x580000 [0240.776] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.776] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.776] WriteFile (in: hFile=0x478, lpBuffer=0x6c62228*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62228*, lpNumberOfBytesWritten=0x574ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.776] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.776] WriteFile (in: hFile=0x478, lpBuffer=0x6c62547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62547*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.776] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.776] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.776] CloseHandle (hObject=0x478) returned 1 [0240.776] GetProcessHeap () returned 0x580000 [0240.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c62228 | out: hHeap=0x580000) returned 1 [0240.776] GetProcessHeap () returned 0x580000 [0240.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61ec0 | out: hHeap=0x580000) returned 1 [0240.776] GetProcessHeap () returned 0x580000 [0240.776] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7090200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x574fd28, dwReserved1=0x6c61ec0, cFileName="YAHOO.COM.HK.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA4153~1.YOU")) returned 0x5b9730 [0240.777] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.808] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd", len=0x49 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 1 [0240.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0240.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.899] CloseHandle (hObject=0x470) returned 1 [0241.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.id_1622540890_.your_last_chance")) returned 1 [0241.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~3.YOU")) returned 0x5b9630 [0241.901] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.901] GetProcessHeap () returned 0x580000 [0241.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x6e35a00 [0241.901] GetProcessHeap () returned 0x580000 [0241.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1cc1) returned 0x7002420 [0241.901] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.901] ReadFile (in: hFile=0x470, lpBuffer=0x6e35a00, nNumberOfBytesToRead=0x1ca0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e35a00*, lpNumberOfBytesRead=0x574ff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0241.928] GetProcessHeap () returned 0x580000 [0241.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.928] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.928] WriteFile (in: hFile=0x470, lpBuffer=0x7002420*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7002420*, lpNumberOfBytesWritten=0x574ff14*=0x1ca0, lpOverlapped=0x0) returned 1 [0241.928] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.928] WriteFile (in: hFile=0x470, lpBuffer=0x70040bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x70040bf*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.928] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.928] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.928] CloseHandle (hObject=0x470) returned 1 [0241.929] GetProcessHeap () returned 0x580000 [0241.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7002420 | out: hHeap=0x580000) returned 1 [0241.929] GetProcessHeap () returned 0x580000 [0241.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e35a00 | out: hHeap=0x580000) returned 1 [0241.929] GetProcessHeap () returned 0x580000 [0241.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7b927c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cc6, dwReserved0=0x574fd28, dwReserved1=0x6e35a00, cFileName="SendToOneNoteNames.gpd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~3.YOU")) returned 0x5b9630 [0241.929] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.970] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML", len=0x40 | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned 1 [0241.970] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0241.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0244.827] CloseHandle (hObject=0x428) returned 1 [0244.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.827] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml.id_1622540890_.your_last_chance")) returned 1 [0244.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf61dc500, ftLastWriteTime.dwHighDateTime=0x1ca1702, nFileSizeHigh=0x0, nFileSizeLow=0x1fcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~4.YOU")) returned 0x5b96f0 [0244.828] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0244.828] GetProcessHeap () returned 0x580000 [0244.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0244.829] GetProcessHeap () returned 0x580000 [0244.829] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0244.829] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.829] ReadFile (in: hFile=0x428, lpBuffer=0x72c5008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.051] GetProcessHeap () returned 0x580000 [0248.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0248.052] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.052] WriteFile (in: hFile=0x428, lpBuffer=0x72d6838*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.052] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.052] WriteFile (in: hFile=0x428, lpBuffer=0x72e8037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e8037*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.052] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.052] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.053] CloseHandle (hObject=0x428) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0248.214] GetProcessHeap () returned 0x580000 [0248.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0253.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb5e42c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fd16, dwReserved0=0x574fd28, dwReserved1=0x72c5008, cFileName="PGLBL104.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~4.YOU")) returned 0x5b9730 [0253.021] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.071] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC", len=0x3e | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 1 [0253.071] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0253.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0253.073] CloseHandle (hObject=0x46c) returned 1 [0253.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.id_1622540890_.your_last_chance")) returned 1 [0253.074] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd88300, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600165d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd88300, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3f046, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCH98~1.YOU")) returned 0x5b9730 [0253.074] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0253.075] GetProcessHeap () returned 0x580000 [0253.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0253.075] GetProcessHeap () returned 0x580000 [0253.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0253.076] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.076] ReadFile (in: hFile=0x46c, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.875] GetProcessHeap () returned 0x580000 [0257.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0257.875] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.875] WriteFile (in: hFile=0x46c, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x574ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.876] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.876] WriteFile (in: hFile=0x46c, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.876] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.876] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.876] CloseHandle (hObject=0x46c) returned 1 [0258.303] GetProcessHeap () returned 0x580000 [0258.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0258.303] GetProcessHeap () returned 0x580000 [0258.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0258.303] GetProcessHeap () returned 0x580000 [0258.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0259.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fccc | out: lpFindFileData=0x574fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd88300, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600165d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd139e500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3f06a, dwReserved0=0x574fd28, dwReserved1=0x6d21878, cFileName="BRCH98SP.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCH98~1.YOU")) returned 0x5b9630 [0259.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.232] SysReAllocStringLen (in: pbstr=0x574ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC", len=0x3d | out: pbstr=0x574ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC") returned 1 [0259.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c8) returned 0x72e5948 [0259.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0259.393] CloseHandle (hObject=0x438) returned 1 [0259.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc.id_1622540890_.your_last_chance")) returned 1 [0259.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x574ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x574fc74 | out: lpFindFileData=0x574fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x34a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBLINK.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBLIN~1.YOU")) returned 0x5b9630 [0259.394] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0259.394] GetProcessHeap () returned 0x580000 [0259.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34c1) returned 0x7308eb8 [0259.395] GetProcessHeap () returned 0x580000 [0259.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34c1) returned 0x730c388 [0259.395] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.395] ReadFile (in: hFile=0x438, lpBuffer=0x7308eb8, nNumberOfBytesToRead=0x34a0, lpNumberOfBytesRead=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x7308eb8*, lpNumberOfBytesRead=0x574ff14*=0x34a0, lpOverlapped=0x0) returned 1 [0261.876] GetProcessHeap () returned 0x580000 [0261.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0261.876] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.876] WriteFile (in: hFile=0x438, lpBuffer=0x730c388*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x730c388*, lpNumberOfBytesWritten=0x574ff14*=0x34a0, lpOverlapped=0x0) returned 1 [0261.876] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.876] WriteFile (in: hFile=0x438, lpBuffer=0x730f827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x730f827*, lpNumberOfBytesWritten=0x574ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.876] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.876] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x574ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x574ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.876] CloseHandle (hObject=0x438) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x730c388 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7308eb8 | out: hHeap=0x580000) returned 1 [0264.704] GetProcessHeap () returned 0x580000 [0264.704] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 Thread: id = 47 os_tid = 0xab4 [0039.068] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.577] Sleep (dwMilliseconds=0x1) [0039.613] Sleep (dwMilliseconds=0x1) [0039.679] Sleep (dwMilliseconds=0x1) [0039.727] Sleep (dwMilliseconds=0x1) [0039.747] Sleep (dwMilliseconds=0x1) [0039.757] Sleep (dwMilliseconds=0x1) [0039.818] Sleep (dwMilliseconds=0x1) [0039.841] Sleep (dwMilliseconds=0x1) [0039.869] Sleep (dwMilliseconds=0x1) [0039.924] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.392] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.540] Sleep (dwMilliseconds=0x1) [0040.555] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.468] Sleep (dwMilliseconds=0x1) [0042.511] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.791] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.197] Sleep (dwMilliseconds=0x1) [0043.277] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.306] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.337] Sleep (dwMilliseconds=0x1) [0043.353] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.384] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.431] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.462] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.493] Sleep (dwMilliseconds=0x1) [0043.509] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.556] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.694] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.795] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.543] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.652] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.886] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.510] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.723] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.901] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.932] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.025] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.057] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.104] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.135] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.244] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.277] Sleep (dwMilliseconds=0x1) [0046.291] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.368] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.447] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.603] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.681] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.728] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.915] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.022] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.070] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.382] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.724] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] Sleep (dwMilliseconds=0x1) [0047.772] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.834] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.958] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.036] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.100] Sleep (dwMilliseconds=0x1) [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.146] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.270] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] Sleep (dwMilliseconds=0x1) [0048.349] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.403] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.426] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.582] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.660] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.816] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.894] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.196] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.347] Sleep (dwMilliseconds=0x1) [0049.363] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.463] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.488] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.519] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.618] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.675] Sleep (dwMilliseconds=0x1) [0049.690] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.753] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.987] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.143] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.298] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.376] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.486] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.550] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.610] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.642] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.689] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.766] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.798] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.876] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.939] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.096] Sleep (dwMilliseconds=0x1) [0051.110] Sleep (dwMilliseconds=0x1) [0051.126] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.266] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.312] Sleep (dwMilliseconds=0x1) [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.438] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.468] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.578] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.634] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.700] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.778] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.262] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.402] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.948] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.151] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.182] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.307] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.416] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.619] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.524] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.649] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.711] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.070] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.199] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.430] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.491] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.452] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", len=0x4b | out: pbstr=0x588ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 1 [0058.452] GetProcessHeap () returned 0x580000 [0058.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x615348 [0058.453] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.453] CloseHandle (hObject=0x424) returned 1 [0058.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.453] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id_1622540890_.your_last_chance")) returned 1 [0058.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.454] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x45, dwReserved1=0x0, cFileName="Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~2.YOU")) returned 0x5b9630 [0058.454] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.454] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0058.454] GetProcessHeap () returned 0x580000 [0058.454] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d57110 [0058.455] GetProcessHeap () returned 0x580000 [0058.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d68940 [0058.455] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.455] ReadFile (in: hFile=0x424, lpBuffer=0x6d57110, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d57110*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0063.652] GetProcessHeap () returned 0x580000 [0063.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0063.653] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.653] WriteFile (in: hFile=0x424, lpBuffer=0x6d68940*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d68940*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0064.770] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.770] WriteFile (in: hFile=0x424, lpBuffer=0x6d7a13f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7a13f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0066.428] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.428] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0066.428] CloseHandle (hObject=0x424) returned 1 [0067.360] GetProcessHeap () returned 0x580000 [0067.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d68940 | out: hHeap=0x580000) returned 1 [0067.360] GetProcessHeap () returned 0x580000 [0067.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d57110 | out: hHeap=0x580000) returned 1 [0067.360] GetProcessHeap () returned 0x580000 [0067.360] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0067.360] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5fe38d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd4224, dwReserved0=0x588fd28, dwReserved1=0x6d57110, cFileName="Proofing.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~2.YOU")) returned 0x5b9630 [0067.360] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.633] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", len=0x59 | out: pbstr=0x588ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 1 [0068.633] GetProcessHeap () returned 0x580000 [0068.633] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x20) returned 0x5e9710 [0068.633] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0068.637] CloseHandle (hObject=0x448) returned 1 [0068.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.637] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id_1622540890_.your_last_chance")) returned 1 [0068.638] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.638] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b96b0 [0068.638] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0068.638] GetProcessHeap () returned 0x580000 [0068.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dfaac0 [0068.638] GetProcessHeap () returned 0x580000 [0068.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0c2f0 [0068.638] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.638] ReadFile (in: hFile=0x448, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.333] GetProcessHeap () returned 0x580000 [0073.333] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0073.334] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.334] WriteFile (in: hFile=0x448, lpBuffer=0x6e0c2f0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c2f0*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.921] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.921] WriteFile (in: hFile=0x448, lpBuffer=0x6e1daef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1daef*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.366] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.366] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.366] CloseHandle (hObject=0x448) returned 1 [0074.366] GetProcessHeap () returned 0x580000 [0074.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c2f0 | out: hHeap=0x580000) returned 1 [0074.366] GetProcessHeap () returned 0x580000 [0074.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0074.366] GetProcessHeap () returned 0x580000 [0074.366] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0074.939] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x63f62760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x266a24, dwReserved0=0x588fd28, dwReserved1=0x6dfaac0, cFileName="AccessMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCESS~2.YOU")) returned 0x5b96b0 [0074.939] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.949] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", len=0x50 | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 1 [0074.949] GetProcessHeap () returned 0x580000 [0074.949] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x34) returned 0x5b5d08 [0074.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.965] Sleep (dwMilliseconds=0x1) [0079.335] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", len=0x3d | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 1 [0079.335] GetProcessHeap () returned 0x580000 [0079.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x80) returned 0x5f76f0 [0079.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.336] Sleep (dwMilliseconds=0x1) [0079.352] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", len=0x58 | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 1 [0079.352] GetProcessHeap () returned 0x580000 [0079.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x28) returned 0x5f76f0 [0079.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.353] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.958] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", len=0x47 | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 1 [0085.959] GetProcessHeap () returned 0x580000 [0085.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb4) returned 0x614a48 [0085.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.959] Sleep (dwMilliseconds=0x1) [0085.975] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", len=0x48 | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 1 [0085.975] GetProcessHeap () returned 0x580000 [0085.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x4c) returned 0x614a48 [0085.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.975] Sleep (dwMilliseconds=0x1) [0086.324] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 1 [0086.325] GetProcessHeap () returned 0x580000 [0086.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0090.606] CloseHandle (hObject=0x49c) returned 1 [0090.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0090.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0095.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0095.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0095.065] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0095.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0095.066] GetProcessHeap () returned 0x580000 [0095.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x62a1) returned 0x6c5efb8 [0095.066] GetProcessHeap () returned 0x580000 [0095.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x62a1) returned 0x6f240b8 [0095.066] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.066] ReadFile (in: hFile=0x49c, lpBuffer=0x6c5efb8, nNumberOfBytesToRead=0x6280, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5efb8*, lpNumberOfBytesRead=0x588ff14*=0x6280, lpOverlapped=0x0) returned 1 [0097.807] GetProcessHeap () returned 0x580000 [0097.807] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.807] WriteFile (in: hFile=0x49c, lpBuffer=0x6f240b8*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f240b8*, lpNumberOfBytesWritten=0x588ff14*=0x6280, lpOverlapped=0x0) returned 1 [0097.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.807] WriteFile (in: hFile=0x49c, lpBuffer=0x6f2a337*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2a337*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.807] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.807] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.807] CloseHandle (hObject=0x49c) returned 1 [0097.808] GetProcessHeap () returned 0x580000 [0097.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f240b8 | out: hHeap=0x580000) returned 1 [0097.808] GetProcessHeap () returned 0x580000 [0097.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5efb8 | out: hHeap=0x580000) returned 1 [0097.808] GetProcessHeap () returned 0x580000 [0097.808] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e8b5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x588fd28, dwReserved1=0x6c5efb8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0097.808] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0104.043] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", len=0x47 | out: pbstr=0x588ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 1 [0104.043] GetProcessHeap () returned 0x580000 [0104.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e92e8 [0104.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0104.070] CloseHandle (hObject=0x474) returned 1 [0104.070] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.070] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id_1622540890_.your_last_chance")) returned 1 [0104.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WT61FR~1.YOU")) returned 0x5b9630 [0104.071] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0104.071] GetProcessHeap () returned 0x580000 [0104.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f1bea8 [0104.072] GetProcessHeap () returned 0x580000 [0104.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f2d6d8 [0104.072] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.072] ReadFile (in: hFile=0x474, lpBuffer=0x6f1bea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.578] GetProcessHeap () returned 0x580000 [0106.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0106.578] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.578] WriteFile (in: hFile=0x474, lpBuffer=0x6f2d6d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f2d6d8*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.579] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.579] WriteFile (in: hFile=0x474, lpBuffer=0x6f3eed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3eed7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.768] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.768] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.768] CloseHandle (hObject=0x474) returned 1 [0106.768] GetProcessHeap () returned 0x580000 [0106.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f2d6d8 | out: hHeap=0x580000) returned 1 [0106.769] GetProcessHeap () returned 0x580000 [0106.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0106.769] GetProcessHeap () returned 0x580000 [0106.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0106.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77416c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96a24, dwReserved0=0x588fd28, dwReserved1=0x6f1bea8, cFileName="WT61FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WT61FR~1.YOU")) returned 0x5b9730 [0106.769] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.079] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", len=0x4b | out: pbstr=0x588ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 1 [0112.079] GetProcessHeap () returned 0x580000 [0112.079] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.092] Sleep (dwMilliseconds=0x1) [0112.121] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", len=0x3f | out: pbstr=0x588ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned 1 [0112.121] GetProcessHeap () returned 0x580000 [0112.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b208, Size=0x68) returned 0x6f09508 [0112.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.121] Sleep (dwMilliseconds=0x1) [0112.221] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", len=0x42 | out: pbstr=0x588ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png") returned 1 [0112.221] GetProcessHeap () returned 0x580000 [0112.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.221] Sleep (dwMilliseconds=0x1) [0112.241] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", len=0x42 | out: pbstr=0x588ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 1 [0112.241] GetProcessHeap () returned 0x580000 [0112.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.248] Sleep (dwMilliseconds=0x1) [0112.361] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv", len=0x43 | out: pbstr=0x588ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv") returned 1 [0112.361] GetProcessHeap () returned 0x580000 [0112.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.361] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.385] Sleep (dwMilliseconds=0x1) [0112.480] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", len=0x4c | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 1 [0112.480] GetProcessHeap () returned 0x580000 [0112.480] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0xc) returned 0x5e92d0 [0112.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0113.601] CloseHandle (hObject=0x3fc) returned 1 [0113.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id_1622540890_.your_last_chance")) returned 1 [0113.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x450043, dwReserved1=0x0, cFileName="as90.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AS90XS~1.YOU")) returned 0x5b9630 [0113.602] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0113.602] GetProcessHeap () returned 0x580000 [0113.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4941) returned 0x6c6e488 [0113.602] GetProcessHeap () returned 0x580000 [0113.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4941) returned 0x6c72dd8 [0113.602] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.602] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c6e488, nNumberOfBytesToRead=0x4920, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e488*, lpNumberOfBytesRead=0x588ff14*=0x4920, lpOverlapped=0x0) returned 1 [0113.763] GetProcessHeap () returned 0x580000 [0113.763] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.763] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.763] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c72dd8*, nNumberOfBytesToWrite=0x4920, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c72dd8*, lpNumberOfBytesWritten=0x588ff14*=0x4920, lpOverlapped=0x0) returned 1 [0113.763] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.764] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c776f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c776f7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.764] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.764] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.764] CloseHandle (hObject=0x3fc) returned 1 [0113.764] GetProcessHeap () returned 0x580000 [0113.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c72dd8 | out: hHeap=0x580000) returned 1 [0113.764] GetProcessHeap () returned 0x580000 [0113.764] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e488 | out: hHeap=0x580000) returned 1 [0113.766] GetProcessHeap () returned 0x580000 [0113.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b6bd480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4956, dwReserved0=0x580000, dwReserved1=0x6c64570, cFileName="as90.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AS90XS~1.YOU")) returned 0x5b9630 [0113.911] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.959] CloseHandle (hObject=0x488) returned 1 [0113.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HH0068~1.YOU")) returned 0x5b9630 [0113.960] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0113.960] GetProcessHeap () returned 0x580000 [0113.960] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfe1) returned 0x6f19958 [0113.961] GetProcessHeap () returned 0x580000 [0113.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfe1) returned 0x6d035f8 [0113.961] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.961] ReadFile (in: hFile=0x488, lpBuffer=0x6f19958, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x588ff14*=0xfc0, lpOverlapped=0x0) returned 1 [0113.976] GetProcessHeap () returned 0x580000 [0113.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.976] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.976] WriteFile (in: hFile=0x488, lpBuffer=0x6d035f8*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesWritten=0x588ff14*=0xfc0, lpOverlapped=0x0) returned 1 [0113.983] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.983] WriteFile (in: hFile=0x488, lpBuffer=0x6d045b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045b7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.983] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.983] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.983] CloseHandle (hObject=0x488) returned 1 [0113.983] GetProcessHeap () returned 0x580000 [0113.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0113.983] GetProcessHeap () returned 0x580000 [0113.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0113.983] GetProcessHeap () returned 0x580000 [0113.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b8d27c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x588fd28, dwReserved1=0x6f19958, cFileName="HH00685_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HH0068~1.YOU")) returned 0x5b9630 [0113.983] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0114.022] CloseHandle (hObject=0x3fc) returned 1 [0114.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01053~1.YOU")) returned 0x5b9630 [0114.023] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0114.023] GetProcessHeap () returned 0x580000 [0114.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b21) returned 0x62a108 [0114.023] GetProcessHeap () returned 0x580000 [0114.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b21) returned 0x62cc38 [0114.023] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.023] ReadFile (in: hFile=0x3fc, lpBuffer=0x62a108, nNumberOfBytesToRead=0x2b00, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x62a108*, lpNumberOfBytesRead=0x588ff14*=0x2b00, lpOverlapped=0x0) returned 1 [0115.262] GetProcessHeap () returned 0x580000 [0115.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.262] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.262] WriteFile (in: hFile=0x3fc, lpBuffer=0x62cc38*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x62cc38*, lpNumberOfBytesWritten=0x588ff14*=0x2b00, lpOverlapped=0x0) returned 1 [0115.262] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.262] WriteFile (in: hFile=0x3fc, lpBuffer=0x62f737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f737*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.262] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.262] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.263] CloseHandle (hObject=0x3fc) returned 1 [0115.263] GetProcessHeap () returned 0x580000 [0115.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62cc38 | out: hHeap=0x580000) returned 1 [0115.263] GetProcessHeap () returned 0x580000 [0115.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62a108 | out: hHeap=0x580000) returned 1 [0115.263] GetProcessHeap () returned 0x580000 [0115.263] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c505880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b28, dwReserved0=0x588fd28, dwReserved1=0x62a108, cFileName="J0105396.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01053~1.YOU")) returned 0x5b9630 [0116.433] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.581] CloseHandle (hObject=0x410) returned 1 [0116.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id_1622540890_.your_last_chance")) returned 1 [0116.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHOL_~1.YOU")) returned 0x5b9630 [0116.582] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0116.582] GetProcessHeap () returned 0x580000 [0116.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6f19958 [0116.582] GetProcessHeap () returned 0x580000 [0116.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13e1) returned 0x6d06ca8 [0116.582] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.582] ReadFile (in: hFile=0x410, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x13c0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x588ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0116.602] GetProcessHeap () returned 0x580000 [0116.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.602] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.602] WriteFile (in: hFile=0x410, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x588ff14*=0x13c0, lpOverlapped=0x0) returned 1 [0116.603] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.603] WriteFile (in: hFile=0x410, lpBuffer=0x6d08067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08067*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.603] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.603] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.603] CloseHandle (hObject=0x410) returned 1 [0116.603] GetProcessHeap () returned 0x580000 [0116.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0116.603] GetProcessHeap () returned 0x580000 [0116.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0116.603] GetProcessHeap () returned 0x580000 [0116.603] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0117.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d1d0ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13e6, dwReserved0=0x588fd28, dwReserved1=0x6f19958, cFileName="SCHOL_02.MID.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHOL_~1.YOU")) returned 0x5b9630 [0117.984] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0118.834] CloseHandle (hObject=0x470) returned 1 [0118.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.835] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0286~1.YOU")) returned 0x5b9730 [0118.835] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0118.835] GetProcessHeap () returned 0x580000 [0118.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0118.836] GetProcessHeap () returned 0x580000 [0118.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0118.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.836] ReadFile (in: hFile=0x470, lpBuffer=0x6c10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0119.905] GetProcessHeap () returned 0x580000 [0119.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.905] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.905] WriteFile (in: hFile=0x470, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0119.905] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.905] WriteFile (in: hFile=0x470, lpBuffer=0x6cf6ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ca7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.905] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.905] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.906] CloseHandle (hObject=0x470) returned 1 [0119.954] GetProcessHeap () returned 0x580000 [0119.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0119.990] GetProcessHeap () returned 0x580000 [0119.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0119.990] GetProcessHeap () returned 0x580000 [0119.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f15b240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12652, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="SO02862_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0286~1.YOU")) returned 0x5b96f0 [0120.135] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.159] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", len=0x4c | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 1 [0120.159] GetProcessHeap () returned 0x580000 [0120.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1774) returned 0x6d06ca8 [0120.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.710] CloseHandle (hObject=0x48c) returned 1 [0120.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.id_1622540890_.your_last_chance")) returned 1 [0120.711] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.711] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~3.YOU")) returned 0x5b9630 [0120.711] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.711] GetProcessHeap () returned 0x580000 [0120.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61120 [0120.711] GetProcessHeap () returned 0x580000 [0120.711] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61428 [0120.711] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.711] ReadFile (in: hFile=0x48c, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x588ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.715] GetProcessHeap () returned 0x580000 [0120.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.715] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.715] WriteFile (in: hFile=0x48c, lpBuffer=0x6c61428*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61428*, lpNumberOfBytesWritten=0x588ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.715] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.715] WriteFile (in: hFile=0x48c, lpBuffer=0x6c616e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c616e7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.715] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.715] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.716] CloseHandle (hObject=0x48c) returned 1 [0120.716] GetProcessHeap () returned 0x580000 [0120.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61428 | out: hHeap=0x580000) returned 1 [0120.716] GetProcessHeap () returned 0x580000 [0120.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0120.716] GetProcessHeap () returned 0x580000 [0120.716] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f9179c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x301, dwReserved0=0x588fd28, dwReserved1=0x6c61120, cFileName="J0143745.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01437~3.YOU")) returned 0x5b9630 [0120.716] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.729] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", len=0x4e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned 1 [0120.729] GetProcessHeap () returned 0x580000 [0120.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1850) returned 0x6e00ac0 [0120.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.672] CloseHandle (hObject=0x3fc) returned 1 [0122.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.id_1622540890_.your_last_chance")) returned 1 [0122.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0122.673] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.673] GetProcessHeap () returned 0x580000 [0122.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.673] GetProcessHeap () returned 0x580000 [0122.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.673] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.673] ReadFile (in: hFile=0x3fc, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x588ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.677] GetProcessHeap () returned 0x580000 [0122.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.678] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.678] WriteFile (in: hFile=0x3fc, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x588ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.678] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.678] WriteFile (in: hFile=0x3fc, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.678] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.678] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.678] CloseHandle (hObject=0x3fc) returned 1 [0122.678] GetProcessHeap () returned 0x580000 [0122.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.678] GetProcessHeap () returned 0x580000 [0122.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.678] GetProcessHeap () returned 0x580000 [0122.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bb05a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x588fd28, dwReserved1=0x678958, cFileName="Solstice.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLSTI~1.YOU")) returned 0x5b9730 [0124.559] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.589] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", len=0x4a | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned 1 [0124.590] GetProcessHeap () returned 0x580000 [0124.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d8) returned 0x6f42f08 [0124.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0124.771] CloseHandle (hObject=0x488) returned 1 [0124.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.id_1622540890_.your_last_chance")) returned 1 [0124.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIVICX~1.YOU")) returned 0x5b9730 [0124.772] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0124.773] GetProcessHeap () returned 0x580000 [0124.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.773] GetProcessHeap () returned 0x580000 [0124.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.773] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.773] ReadFile (in: hFile=0x488, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x588ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.786] GetProcessHeap () returned 0x580000 [0124.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.786] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.786] WriteFile (in: hFile=0x488, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x588ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.786] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.787] WriteFile (in: hFile=0x488, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.787] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.787] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.787] CloseHandle (hObject=0x488) returned 1 [0124.787] GetProcessHeap () returned 0x580000 [0124.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.787] GetProcessHeap () returned 0x580000 [0124.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.787] GetProcessHeap () returned 0x580000 [0124.787] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81fec0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe43, dwReserved0=0x588fd28, dwReserved1=0x6f69420, cFileName="Civic.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIVICX~1.YOU")) returned 0x5b9730 [0125.345] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.361] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", len=0x3d | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned 1 [0125.361] GetProcessHeap () returned 0x580000 [0125.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b0) returned 0x6f42f08 [0125.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0128.613] CloseHandle (hObject=0x4ac) returned 1 [0128.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.id_1622540890_.your_last_chance")) returned 1 [0130.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02952~1.YOU")) returned 0x5b9730 [0130.461] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0130.461] GetProcessHeap () returned 0x580000 [0130.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a01) returned 0x6d78248 [0130.461] GetProcessHeap () returned 0x580000 [0130.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a01) returned 0x6ef9658 [0130.461] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.461] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d78248, nNumberOfBytesToRead=0x29e0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d78248*, lpNumberOfBytesRead=0x588ff14*=0x29e0, lpOverlapped=0x0) returned 1 [0131.641] GetProcessHeap () returned 0x580000 [0131.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0131.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ef9658*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef9658*, lpNumberOfBytesWritten=0x588ff14*=0x29e0, lpOverlapped=0x0) returned 1 [0131.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x6efc037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc037*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.641] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.641] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.641] CloseHandle (hObject=0x4ac) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef9658 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d78248 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0135.291] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.291] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8613bc40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x588fd28, dwReserved1=0x6d78248, cFileName="J0295241.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02952~1.YOU")) returned 0x5b96f0 [0135.292] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.292] Sleep (dwMilliseconds=0x1) [0135.300] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", len=0x37 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 1 [0135.300] GetProcessHeap () returned 0x580000 [0135.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0135.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.306] CloseHandle (hObject=0x4ac) returned 1 [0135.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.307] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id_1622540890_.your_last_chance")) returned 1 [0135.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AECVSL~1.YOU")) returned 0x5b96f0 [0135.308] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0135.308] GetProcessHeap () returned 0x580000 [0135.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10f81) returned 0x6e29430 [0135.308] GetProcessHeap () returned 0x580000 [0135.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10f81) returned 0x6e3a3c0 [0135.308] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.308] ReadFile (in: hFile=0x4ac, lpBuffer=0x6e29430, nNumberOfBytesToRead=0x10f60, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e29430*, lpNumberOfBytesRead=0x588ff14*=0x10f60, lpOverlapped=0x0) returned 1 [0138.297] GetProcessHeap () returned 0x580000 [0138.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0138.298] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.298] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e3a3c0*, nNumberOfBytesToWrite=0x10f60, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3a3c0*, lpNumberOfBytesWritten=0x588ff14*=0x10f60, lpOverlapped=0x0) returned 1 [0138.511] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.511] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e4b31f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4b31f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.511] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.511] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.511] CloseHandle (hObject=0x4ac) returned 1 [0138.566] GetProcessHeap () returned 0x580000 [0138.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3a3c0 | out: hHeap=0x580000) returned 1 [0138.567] GetProcessHeap () returned 0x580000 [0138.567] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e29430 | out: hHeap=0x580000) returned 1 [0138.567] GetProcessHeap () returned 0x580000 [0138.567] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0139.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8a2b1940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10f9c, dwReserved0=0x588fd28, dwReserved1=0x6e29430, cFileName="AEC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AECVSL~1.YOU")) returned 0x5b9770 [0139.877] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.903] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", len=0x5b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned 1 [0139.903] GetProcessHeap () returned 0x580000 [0139.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0139.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.309] CloseHandle (hObject=0x3a8) returned 1 [0140.309] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.id_1622540890_.your_last_chance")) returned 1 [0140.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79023600, ftCreationTime.dwHighDateTime=0x1ca2b70, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79023600, ftLastWriteTime.dwHighDateTime=0x1ca2b70, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9770 [0140.310] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.310] GetProcessHeap () returned 0x580000 [0140.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4e820 [0140.310] GetProcessHeap () returned 0x580000 [0140.310] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4ebc8 [0140.310] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x3a8, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x588ff14*=0x360, lpOverlapped=0x0) returned 1 [0140.315] GetProcessHeap () returned 0x580000 [0140.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.315] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.315] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c4ebc8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ebc8*, lpNumberOfBytesWritten=0x588ff14*=0x360, lpOverlapped=0x0) returned 1 [0140.315] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.315] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c4ef27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ef27*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.315] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.315] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.315] CloseHandle (hObject=0x3a8) returned 1 [0140.315] GetProcessHeap () returned 0x580000 [0140.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4ebc8 | out: hHeap=0x580000) returned 1 [0140.315] GetProcessHeap () returned 0x580000 [0140.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0140.315] GetProcessHeap () returned 0x580000 [0140.315] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79023600, ftCreationTime.dwHighDateTime=0x1ca2b70, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3f38c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x588fd28, dwReserved1=0x6c4e820, cFileName="rtf_choosefont.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CH~1.YOU")) returned 0x5b9770 [0140.663] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.673] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", len=0x43 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned 1 [0140.673] GetProcessHeap () returned 0x580000 [0140.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d8c) returned 0x6f14048 [0140.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0141.013] CloseHandle (hObject=0x448) returned 1 [0141.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.014] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1471~2.YOU")) returned 0x5b9730 [0141.017] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0141.017] GetProcessHeap () returned 0x580000 [0141.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0141.017] GetProcessHeap () returned 0x580000 [0141.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6df6780 [0141.017] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.017] ReadFile (in: hFile=0x448, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x588ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0141.021] GetProcessHeap () returned 0x580000 [0141.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.021] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.021] WriteFile (in: hFile=0x448, lpBuffer=0x6df6780*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesWritten=0x588ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0141.021] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.021] WriteFile (in: hFile=0x448, lpBuffer=0x6df6a5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a5f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.021] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.021] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.021] CloseHandle (hObject=0x448) returned 1 [0141.022] GetProcessHeap () returned 0x580000 [0141.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0141.022] GetProcessHeap () returned 0x580000 [0141.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0141.022] GetProcessHeap () returned 0x580000 [0141.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.944] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8baa56a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x588fd28, dwReserved1=0x67c940, cFileName="BD14710_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1471~2.YOU")) returned 0x5b9730 [0141.944] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.035] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK", len=0x41 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 1 [0142.035] GetProcessHeap () returned 0x580000 [0142.035] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea0) returned 0x6f14048 [0142.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.118] CloseHandle (hObject=0x4a4) returned 1 [0144.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0144.119] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.119] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b96f0 [0144.119] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.120] GetProcessHeap () returned 0x580000 [0144.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0144.120] GetProcessHeap () returned 0x580000 [0144.120] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0144.120] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.120] ReadFile (in: hFile=0x4a4, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x588ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.121] GetProcessHeap () returned 0x580000 [0144.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.121] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x588ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.121] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.121] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.121] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.121] CloseHandle (hObject=0x4a4) returned 1 [0144.121] GetProcessHeap () returned 0x580000 [0144.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0144.121] GetProcessHeap () returned 0x580000 [0144.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0144.121] GetProcessHeap () returned 0x580000 [0144.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d840840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x588fd28, dwReserved1=0x61b540, cFileName="OUTLOOK_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~1.YOU")) returned 0x5b96f0 [0146.863] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.877] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", len=0x44 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned 1 [0146.877] GetProcessHeap () returned 0x580000 [0146.877] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0146.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.459] CloseHandle (hObject=0x448) returned 1 [0152.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR24~1.YOU")) returned 0x5b9730 [0152.460] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0152.460] GetProcessHeap () returned 0x580000 [0152.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16c1) returned 0x6c6e0f8 [0152.460] GetProcessHeap () returned 0x580000 [0152.461] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16c1) returned 0x6f16198 [0152.461] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.461] ReadFile (in: hFile=0x448, lpBuffer=0x6c6e0f8, nNumberOfBytesToRead=0x16a0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesRead=0x588ff14*=0x16a0, lpOverlapped=0x0) returned 1 [0152.482] GetProcessHeap () returned 0x580000 [0152.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.482] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.482] WriteFile (in: hFile=0x448, lpBuffer=0x6f16198*, nNumberOfBytesToWrite=0x16a0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f16198*, lpNumberOfBytesWritten=0x588ff14*=0x16a0, lpOverlapped=0x0) returned 1 [0152.482] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.482] WriteFile (in: hFile=0x448, lpBuffer=0x6f17837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f17837*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0152.482] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.482] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0152.482] CloseHandle (hObject=0x448) returned 1 [0152.482] GetProcessHeap () returned 0x580000 [0152.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f16198 | out: hHeap=0x580000) returned 1 [0152.482] GetProcessHeap () returned 0x580000 [0152.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0152.482] GetProcessHeap () returned 0x580000 [0152.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x927fe940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16d1, dwReserved0=0x588fd28, dwReserved1=0x6c6e0f8, cFileName="PDIR24F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR24~1.YOU")) returned 0x5b9630 [0153.708] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0153.744] CloseHandle (hObject=0x44c) returned 1 [0153.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.744] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.id_1622540890_.your_last_chance")) returned 1 [0153.745] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SERVWR~1.YOU")) returned 0x5b9630 [0153.745] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0153.745] GetProcessHeap () returned 0x580000 [0153.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6107d8 [0153.746] GetProcessHeap () returned 0x580000 [0153.746] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x610bc0 [0153.746] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.746] ReadFile (in: hFile=0x44c, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x588ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0153.750] GetProcessHeap () returned 0x580000 [0153.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.750] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.751] WriteFile (in: hFile=0x44c, lpBuffer=0x610bc0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x610bc0*, lpNumberOfBytesWritten=0x588ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0153.751] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.751] WriteFile (in: hFile=0x44c, lpBuffer=0x610f5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x610f5f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.751] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.751] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.751] CloseHandle (hObject=0x44c) returned 1 [0153.751] GetProcessHeap () returned 0x580000 [0153.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610bc0 | out: hHeap=0x580000) returned 1 [0153.751] GetProcessHeap () returned 0x580000 [0153.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0153.751] GetProcessHeap () returned 0x580000 [0153.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9340b8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x588fd28, dwReserved1=0x6107d8, cFileName="SERVWRAP.ASP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SERVWR~1.YOU")) returned 0x5b9630 [0153.751] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.097] CloseHandle (hObject=0x448) returned 1 [0159.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id_1622540890_.your_last_chance")) returned 1 [0159.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.098] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XFUNCV~1.YOU")) returned 0x5b9630 [0159.098] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.099] GetProcessHeap () returned 0x580000 [0159.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcda1) returned 0x6d4be78 [0159.099] GetProcessHeap () returned 0x580000 [0159.099] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcda1) returned 0x6fb2f38 [0159.100] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.100] ReadFile (in: hFile=0x448, lpBuffer=0x6d4be78, nNumberOfBytesToRead=0xcd80, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4be78*, lpNumberOfBytesRead=0x588ff14*=0xcd80, lpOverlapped=0x0) returned 1 [0163.563] GetProcessHeap () returned 0x580000 [0163.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0163.563] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.563] WriteFile (in: hFile=0x448, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0xcd80, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x588ff14*=0xcd80, lpOverlapped=0x0) returned 1 [0163.563] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.563] WriteFile (in: hFile=0x448, lpBuffer=0x6fbfcb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbfcb7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0163.563] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.563] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0163.564] CloseHandle (hObject=0x448) returned 1 [0163.564] GetProcessHeap () returned 0x580000 [0163.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0163.564] GetProcessHeap () returned 0x580000 [0163.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d4be78 | out: hHeap=0x580000) returned 1 [0163.565] GetProcessHeap () returned 0x580000 [0163.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9919f980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcdb4, dwReserved0=0x588fd28, dwReserved1=0x6d4be78, cFileName="XFUNC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XFUNCV~1.YOU")) returned 0x5b9630 [0166.201] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0166.236] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 1 [0166.237] GetProcessHeap () returned 0x580000 [0166.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2270) returned 0x6f14048 [0166.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.344] CloseHandle (hObject=0x390) returned 1 [0166.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id_1622540890_.your_last_chance")) returned 1 [0166.345] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7feec00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMSSIC~1.YOU")) returned 0x5b9730 [0166.345] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.345] GetProcessHeap () returned 0x580000 [0166.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6c79898 [0166.345] GetProcessHeap () returned 0x580000 [0166.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8c1) returned 0x6d330c0 [0166.346] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.346] ReadFile (in: hFile=0x390, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x8a0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x588ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0166.355] GetProcessHeap () returned 0x580000 [0166.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.355] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.355] WriteFile (in: hFile=0x390, lpBuffer=0x6d330c0*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330c0*, lpNumberOfBytesWritten=0x588ff14*=0x8a0, lpOverlapped=0x0) returned 1 [0166.355] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.355] WriteFile (in: hFile=0x390, lpBuffer=0x6d3395f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3395f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.355] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.355] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.356] CloseHandle (hObject=0x390) returned 1 [0166.356] GetProcessHeap () returned 0x580000 [0166.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330c0 | out: hHeap=0x580000) returned 1 [0166.356] GetProcessHeap () returned 0x580000 [0166.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0166.356] GetProcessHeap () returned 0x580000 [0166.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.356] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ac40fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e2, dwReserved0=0x588fd28, dwReserved1=0x6c79898, cFileName="MMSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MMSSIC~1.YOU")) returned 0x5b9730 [0166.356] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.359] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 1 [0166.359] GetProcessHeap () returned 0x580000 [0166.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2268) returned 0x6f14048 [0166.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.360] CloseHandle (hObject=0x390) returned 1 [0166.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.360] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id_1622540890_.your_last_chance")) returned 1 [0166.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMSIC~1.YOU")) returned 0x5b9730 [0166.361] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.361] GetProcessHeap () returned 0x580000 [0166.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0166.361] GetProcessHeap () returned 0x580000 [0166.361] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0166.361] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.361] ReadFile (in: hFile=0x390, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x588ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.373] GetProcessHeap () returned 0x580000 [0166.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.373] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.373] WriteFile (in: hFile=0x390, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x588ff14*=0xba0, lpOverlapped=0x0) returned 1 [0166.374] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.374] WriteFile (in: hFile=0x390, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.374] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.374] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.374] CloseHandle (hObject=0x390) returned 1 [0166.374] GetProcessHeap () returned 0x580000 [0166.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0166.374] GetProcessHeap () returned 0x580000 [0166.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0166.374] GetProcessHeap () returned 0x580000 [0166.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ac67100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x588fd28, dwReserved1=0x65f268, cFileName="IPMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMSIC~1.YOU")) returned 0x5b9730 [0166.374] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.390] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 1 [0166.390] GetProcessHeap () returned 0x580000 [0166.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2264) returned 0x6f14048 [0166.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.391] CloseHandle (hObject=0x390) returned 1 [0166.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id_1622540890_.your_last_chance")) returned 1 [0166.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMLIC~1.YOU")) returned 0x5b9730 [0166.392] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.392] GetProcessHeap () returned 0x580000 [0166.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0166.392] GetProcessHeap () returned 0x580000 [0166.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0166.392] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.392] ReadFile (in: hFile=0x390, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x588ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.397] GetProcessHeap () returned 0x580000 [0166.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.397] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.397] WriteFile (in: hFile=0x390, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x588ff14*=0x420, lpOverlapped=0x0) returned 1 [0166.398] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.398] WriteFile (in: hFile=0x390, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.398] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.398] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.398] CloseHandle (hObject=0x390) returned 1 [0166.398] GetProcessHeap () returned 0x580000 [0166.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0166.398] GetProcessHeap () returned 0x580000 [0166.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0166.398] GetProcessHeap () returned 0x580000 [0166.398] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9acb33c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x588fd28, dwReserved1=0x5cf780, cFileName="IPML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMLIC~1.YOU")) returned 0x5b9730 [0166.398] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.046] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", len=0x40 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 1 [0170.046] GetProcessHeap () returned 0x580000 [0170.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0170.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0171.127] CloseHandle (hObject=0x464) returned 1 [0171.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0171.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x142d2200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMSMMS~1.YOU")) returned 0x5b9770 [0172.238] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0172.239] GetProcessHeap () returned 0x580000 [0172.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0172.239] GetProcessHeap () returned 0x580000 [0172.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0172.239] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.239] ReadFile (in: hFile=0x464, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x588ff14*=0x260, lpOverlapped=0x0) returned 1 [0172.243] GetProcessHeap () returned 0x580000 [0172.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.243] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x464, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x588ff14*=0x260, lpOverlapped=0x0) returned 1 [0172.243] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x464, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.243] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.243] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.243] CloseHandle (hObject=0x464) returned 1 [0172.243] GetProcessHeap () returned 0x580000 [0172.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0172.243] GetProcessHeap () returned 0x580000 [0172.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0172.243] GetProcessHeap () returned 0x580000 [0172.243] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e47d760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x588fd28, dwReserved1=0x6df2798, cFileName="OMSMMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMSMMS~1.YOU")) returned 0x5b9770 [0173.182] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.196] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", len=0x40 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 1 [0173.201] GetProcessHeap () returned 0x580000 [0173.201] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0173.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.201] CloseHandle (hObject=0x490) returned 1 [0173.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.201] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.202] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~3.YOU")) returned 0x5b9770 [0173.202] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.202] GetProcessHeap () returned 0x580000 [0173.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0173.202] GetProcessHeap () returned 0x580000 [0173.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0173.203] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.203] ReadFile (in: hFile=0x490, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x588ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.207] GetProcessHeap () returned 0x580000 [0173.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.207] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.207] WriteFile (in: hFile=0x490, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x588ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.207] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.207] WriteFile (in: hFile=0x490, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.207] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.207] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.207] CloseHandle (hObject=0x490) returned 1 [0173.207] GetProcessHeap () returned 0x580000 [0173.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0173.207] GetProcessHeap () returned 0x580000 [0173.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0173.207] GetProcessHeap () returned 0x580000 [0173.207] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9edb6ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x588fd28, dwReserved1=0x6df6780, cFileName="RESEND.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~3.YOU")) returned 0x5b9770 [0173.208] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.337] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", len=0x71 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 1 [0174.337] GetProcessHeap () returned 0x580000 [0174.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0174.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.338] CloseHandle (hObject=0x440) returned 1 [0174.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.id_1622540890_.your_last_chance")) returned 1 [0174.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x740063, dwReserved1=0x2e0073, cFileName="SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNED~1.YOU")) returned 0x5b9770 [0174.339] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.339] GetProcessHeap () returned 0x580000 [0174.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4a820 [0174.339] GetProcessHeap () returned 0x580000 [0174.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4aae8 [0174.339] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.339] ReadFile (in: hFile=0x440, lpBuffer=0x6c4a820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a820*, lpNumberOfBytesRead=0x588ff14*=0x280, lpOverlapped=0x0) returned 1 [0174.343] GetProcessHeap () returned 0x580000 [0174.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.343] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.343] WriteFile (in: hFile=0x440, lpBuffer=0x6c4aae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4aae8*, lpNumberOfBytesWritten=0x588ff14*=0x280, lpOverlapped=0x0) returned 1 [0174.343] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.343] WriteFile (in: hFile=0x440, lpBuffer=0x6c4ad67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ad67*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.343] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.343] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.343] CloseHandle (hObject=0x440) returned 1 [0174.343] GetProcessHeap () returned 0x580000 [0174.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4aae8 | out: hHeap=0x580000) returned 1 [0174.343] GetProcessHeap () returned 0x580000 [0174.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a820 | out: hHeap=0x580000) returned 1 [0174.344] GetProcessHeap () returned 0x580000 [0174.344] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f86cfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x588fd28, dwReserved1=0x6c4a820, cFileName="SignedManagedObjects.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIGNED~1.YOU")) returned 0x5b9770 [0174.344] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.351] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", len=0x3c | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 1 [0174.351] GetProcessHeap () returned 0x580000 [0174.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0174.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.351] CloseHandle (hObject=0x484) returned 1 [0174.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id_1622540890_.your_last_chance")) returned 1 [0174.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FAXEXT~1.YOU")) returned 0x5b9770 [0174.352] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.353] GetProcessHeap () returned 0x580000 [0174.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0174.353] GetProcessHeap () returned 0x580000 [0174.353] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0174.353] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.353] ReadFile (in: hFile=0x484, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0174.357] GetProcessHeap () returned 0x580000 [0174.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.357] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.357] WriteFile (in: hFile=0x484, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0174.357] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.357] WriteFile (in: hFile=0x484, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.357] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.357] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.357] CloseHandle (hObject=0x484) returned 1 [0174.358] GetProcessHeap () returned 0x580000 [0174.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0174.358] GetProcessHeap () returned 0x580000 [0174.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0174.358] GetProcessHeap () returned 0x580000 [0174.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f893100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x588fd28, dwReserved1=0x6c59120, cFileName="FAXEXT.ECF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FAXEXT~1.YOU")) returned 0x5b9770 [0174.358] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.367] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", len=0x44 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 1 [0174.367] GetProcessHeap () returned 0x580000 [0174.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.375] CloseHandle (hObject=0x4ac) returned 1 [0174.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id_1622540890_.your_last_chance")) returned 1 [0174.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISFIL~1.YOU")) returned 0x5b9770 [0174.376] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.376] GetProcessHeap () returned 0x580000 [0174.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd00e8 [0174.376] GetProcessHeap () returned 0x580000 [0174.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd0198 [0174.376] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.376] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dd00e8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd00e8*, lpNumberOfBytesRead=0x588ff14*=0x80, lpOverlapped=0x0) returned 1 [0174.379] GetProcessHeap () returned 0x580000 [0174.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.379] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.383] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dd0198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0198*, lpNumberOfBytesWritten=0x588ff14*=0x80, lpOverlapped=0x0) returned 1 [0174.384] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.384] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dd0217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0217*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.393] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.393] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.393] CloseHandle (hObject=0x4ac) returned 1 [0174.393] GetProcessHeap () returned 0x580000 [0174.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd0198 | out: hHeap=0x580000) returned 1 [0174.393] GetProcessHeap () returned 0x580000 [0174.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd00e8 | out: hHeap=0x580000) returned 1 [0174.393] GetProcessHeap () returned 0x580000 [0174.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f905520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x588fd28, dwReserved1=0x6dd00e8, cFileName="Visfilem.vsdir.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISFIL~1.YOU")) returned 0x5b9770 [0174.393] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0176.809] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT", len=0x41 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 1 [0176.809] GetProcessHeap () returned 0x580000 [0176.809] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0176.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.809] CloseHandle (hObject=0x49c) returned 1 [0176.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.810] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0176.810] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be72800, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5be72800, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIA0D2~1.YOU")) returned 0x5b96f0 [0176.811] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.811] GetProcessHeap () returned 0x580000 [0176.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0176.811] GetProcessHeap () returned 0x580000 [0176.811] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0176.811] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.811] ReadFile (in: hFile=0x49c, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x588ff14*=0xc0, lpOverlapped=0x0) returned 1 [0176.813] GetProcessHeap () returned 0x580000 [0176.813] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.813] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.813] WriteFile (in: hFile=0x49c, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x588ff14*=0xc0, lpOverlapped=0x0) returned 1 [0176.813] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.813] WriteFile (in: hFile=0x49c, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.813] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.813] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.813] CloseHandle (hObject=0x49c) returned 1 [0176.813] GetProcessHeap () returned 0x580000 [0176.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0176.813] GetProcessHeap () returned 0x580000 [0176.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0176.813] GetProcessHeap () returned 0x580000 [0176.813] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.814] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be72800, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa1014a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x588fd28, dwReserved1=0x5ad8a0, cFileName="VISIO_PRM_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIA0D2~1.YOU")) returned 0x5b96f0 [0176.814] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.889] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", len=0x38 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS") returned 1 [0176.889] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0176.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.170] CloseHandle (hObject=0x3fc) returned 1 [0179.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.id_1622540890_.your_last_chance")) returned 1 [0179.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ROSECS~1.YOU")) returned 0x5b96f0 [0179.171] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\rose.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.171] GetProcessHeap () returned 0x580000 [0179.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0179.171] GetProcessHeap () returned 0x580000 [0179.171] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0179.171] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.171] ReadFile (in: hFile=0x3fc, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x588ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.184] GetProcessHeap () returned 0x580000 [0179.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.184] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.184] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x588ff14*=0xd60, lpOverlapped=0x0) returned 1 [0179.184] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.185] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.185] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.185] CloseHandle (hObject=0x3fc) returned 1 [0179.185] GetProcessHeap () returned 0x580000 [0179.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0179.185] GetProcessHeap () returned 0x580000 [0179.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0179.185] GetProcessHeap () returned 0x580000 [0179.185] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa26b1b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x588fd28, dwReserved1=0x635768, cFileName="ROSE.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ROSECS~1.YOU")) returned 0x5b96b0 [0180.187] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.305] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", len=0x69 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned 1 [0180.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0180.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.306] CloseHandle (hObject=0x43c) returned 1 [0180.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~1.YOU")) returned 0x5b96b0 [0180.307] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.307] GetProcessHeap () returned 0x580000 [0180.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21890 [0180.307] GetProcessHeap () returned 0x580000 [0180.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21e98 [0180.307] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.307] ReadFile (in: hFile=0x43c, lpBuffer=0x6c21890, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesRead=0x588ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0180.351] GetProcessHeap () returned 0x580000 [0180.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.351] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] WriteFile (in: hFile=0x43c, lpBuffer=0x6c21e98*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21e98*, lpNumberOfBytesWritten=0x588ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.351] WriteFile (in: hFile=0x43c, lpBuffer=0x6c22437*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c22437*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.351] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.352] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.352] CloseHandle (hObject=0x43c) returned 1 [0180.352] GetProcessHeap () returned 0x580000 [0180.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21e98 | out: hHeap=0x580000) returned 1 [0180.352] GetProcessHeap () returned 0x580000 [0180.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0180.352] GetProcessHeap () returned 0x580000 [0180.352] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa31b4100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5c8, dwReserved0=0x588fd28, dwReserved1=0x6c21890, cFileName="UnreadIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~1.YOU")) returned 0x5b96b0 [0180.352] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.392] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", len=0x6c | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned 1 [0180.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0180.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.393] CloseHandle (hObject=0x3fc) returned 1 [0180.393] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.394] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x670070, dwReserved1=0x69002e, cFileName="CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~1.YOU")) returned 0x5b96b0 [0180.394] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.394] GetProcessHeap () returned 0x580000 [0180.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1de1) returned 0x6fad568 [0180.394] GetProcessHeap () returned 0x580000 [0180.394] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1de1) returned 0x6d28168 [0180.394] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.395] ReadFile (in: hFile=0x3fc, lpBuffer=0x6fad568, nNumberOfBytesToRead=0x1dc0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad568*, lpNumberOfBytesRead=0x588ff14*=0x1dc0, lpOverlapped=0x0) returned 1 [0181.347] GetProcessHeap () returned 0x580000 [0181.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.347] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d28168*, nNumberOfBytesToWrite=0x1dc0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d28168*, lpNumberOfBytesWritten=0x588ff14*=0x1dc0, lpOverlapped=0x0) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.347] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d29f27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29f27*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.347] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.348] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.348] CloseHandle (hObject=0x3fc) returned 1 [0181.348] GetProcessHeap () returned 0x580000 [0181.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d28168 | out: hHeap=0x580000) returned 1 [0181.348] GetProcessHeap () returned 0x580000 [0181.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fad568 | out: hHeap=0x580000) returned 1 [0181.348] GetProcessHeap () returned 0x580000 [0181.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.176] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3b39900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dfb, dwReserved0=0x588fd28, dwReserved1=0x6fad568, cFileName="CommsOutgoingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~1.YOU")) returned 0x5b9770 [0183.176] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.197] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", len=0x4b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned 1 [0183.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0183.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0183.198] CloseHandle (hObject=0x430) returned 1 [0183.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x45, dwReserved1=0x0, cFileName="QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUESTI~2.YOU")) returned 0x5b9770 [0183.199] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0183.199] GetProcessHeap () returned 0x580000 [0183.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x677cd0 [0183.199] GetProcessHeap () returned 0x580000 [0183.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x706e008 [0183.199] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.199] ReadFile (in: hFile=0x430, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x588ff14*=0xc00, lpOverlapped=0x0) returned 1 [0183.256] GetProcessHeap () returned 0x580000 [0183.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0183.256] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.256] WriteFile (in: hFile=0x430, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x588ff14*=0xc00, lpOverlapped=0x0) returned 1 [0183.256] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.256] WriteFile (in: hFile=0x430, lpBuffer=0x706ec07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ec07*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.256] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.256] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.256] CloseHandle (hObject=0x430) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0183.257] GetProcessHeap () returned 0x580000 [0183.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0183.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d86220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc3f, dwReserved0=0x588fd28, dwReserved1=0x677cd0, cFileName="QuestionIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="QUESTI~2.YOU")) returned 0x5b9770 [0183.309] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.326] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", len=0x52 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned 1 [0183.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.327] CloseHandle (hObject=0x3fc) returned 1 [0183.327] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.327] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTOFS~2.YOU")) returned 0x5b9770 [0183.328] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0183.328] GetProcessHeap () returned 0x580000 [0183.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfa1) returned 0x6def670 [0183.328] GetProcessHeap () returned 0x580000 [0183.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfa1) returned 0x6f468f0 [0183.330] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.330] ReadFile (in: hFile=0x3fc, lpBuffer=0x6def670, nNumberOfBytesToRead=0xf80, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def670*, lpNumberOfBytesRead=0x588ff14*=0xf80, lpOverlapped=0x0) returned 1 [0183.345] GetProcessHeap () returned 0x580000 [0183.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0183.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f468f0*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468f0*, lpNumberOfBytesWritten=0x588ff14*=0xf80, lpOverlapped=0x0) returned 1 [0183.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f4786f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f4786f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.345] CloseHandle (hObject=0x3fc) returned 1 [0183.345] GetProcessHeap () returned 0x580000 [0183.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468f0 | out: hHeap=0x580000) returned 1 [0183.345] GetProcessHeap () returned 0x580000 [0183.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6def670 | out: hHeap=0x580000) returned 1 [0183.345] GetProcessHeap () returned 0x580000 [0183.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e44900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfb1, dwReserved0=0x588fd28, dwReserved1=0x6def670, cFileName="OutofSyncIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTOFS~2.YOU")) returned 0x5b9770 [0183.346] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.317] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", len=0x5f | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned 1 [0184.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0184.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.312] CloseHandle (hObject=0x450) returned 1 [0185.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.id_1622540890_.your_last_chance")) returned 1 [0185.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b9770 [0185.313] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.313] GetProcessHeap () returned 0x580000 [0185.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6d035f8 [0185.313] GetProcessHeap () returned 0x580000 [0185.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1621) returned 0x6de8f50 [0185.313] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.313] ReadFile (in: hFile=0x450, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x588ff14*=0x1600, lpOverlapped=0x0) returned 1 [0185.332] GetProcessHeap () returned 0x580000 [0185.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.333] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.333] WriteFile (in: hFile=0x450, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x588ff14*=0x1600, lpOverlapped=0x0) returned 1 [0185.333] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.333] WriteFile (in: hFile=0x450, lpBuffer=0x6dea54f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea54f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.333] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.333] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.333] CloseHandle (hObject=0x450) returned 1 [0185.333] GetProcessHeap () returned 0x580000 [0185.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0185.333] GetProcessHeap () returned 0x580000 [0185.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0185.333] GetProcessHeap () returned 0x580000 [0185.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.535] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa614f900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1641, dwReserved0=0x588fd28, dwReserved1=0x6d035f8, cFileName="bg_Casual.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_CAS~1.YOU")) returned 0x5b9770 [0185.535] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.583] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", len=0x53 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned 1 [0185.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0185.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.937] CloseHandle (hObject=0x4a8) returned 1 [0186.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0186.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf78, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CREATE~2.YOU")) returned 0x5b96b0 [0186.938] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0186.938] GetProcessHeap () returned 0x580000 [0186.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c29878 [0186.938] GetProcessHeap () returned 0x580000 [0186.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x67ec60 [0186.938] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.938] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x588ff14*=0xf60, lpOverlapped=0x0) returned 1 [0186.953] GetProcessHeap () returned 0x580000 [0186.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0186.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x588ff14*=0xf60, lpOverlapped=0x0) returned 1 [0186.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x67fbbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fbbf*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0186.953] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.953] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0186.953] CloseHandle (hObject=0x4a8) returned 1 [0186.953] GetProcessHeap () returned 0x580000 [0186.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0186.954] GetProcessHeap () returned 0x580000 [0186.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0186.954] GetProcessHeap () returned 0x580000 [0186.954] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0186.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa70c8800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf9c, dwReserved0=0x588fd28, dwReserved1=0x6c29878, cFileName="CreateSpaceImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CREATE~2.YOU")) returned 0x5b96b0 [0186.954] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.977] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", len=0x69 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned 1 [0186.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0186.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.470] CloseHandle (hObject=0x4a0) returned 1 [0188.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.id_1622540890_.your_last_chance")) returned 1 [0188.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167d1, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b9770 [0188.471] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0188.471] GetProcessHeap () returned 0x580000 [0188.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0188.471] GetProcessHeap () returned 0x580000 [0188.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70b3528 [0188.472] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.472] ReadFile (in: hFile=0x4a0, lpBuffer=0x70a1cf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.019] GetProcessHeap () returned 0x580000 [0191.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0191.019] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.019] WriteFile (in: hFile=0x4a0, lpBuffer=0x70b3528*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.020] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.020] WriteFile (in: hFile=0x4a0, lpBuffer=0x70c4d27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4d27*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.020] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.020] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.020] CloseHandle (hObject=0x4a0) returned 1 [0191.020] GetProcessHeap () returned 0x580000 [0191.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0191.020] GetProcessHeap () returned 0x580000 [0191.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0191.020] GetProcessHeap () returned 0x580000 [0191.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9776d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167f5, dwReserved0=0x588fd28, dwReserved1=0x70a1cf8, cFileName="GrooveFormsMetaData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b9770 [0193.218] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.321] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", len=0x5b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 1 [0193.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2060) returned 0x6f14048 [0193.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.322] CloseHandle (hObject=0x44c) returned 1 [0193.322] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.322] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id_1622540890_.your_last_chance")) returned 1 [0193.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.323] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b97b0 [0193.323] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.323] GetProcessHeap () returned 0x580000 [0193.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x6dcda40 [0193.323] GetProcessHeap () returned 0x580000 [0193.323] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x6363f8 [0193.323] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.323] ReadFile (in: hFile=0x44c, lpBuffer=0x6dcda40, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcda40*, lpNumberOfBytesRead=0x588ff14*=0x120, lpOverlapped=0x0) returned 1 [0193.325] GetProcessHeap () returned 0x580000 [0193.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.325] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.325] WriteFile (in: hFile=0x44c, lpBuffer=0x6363f8*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6363f8*, lpNumberOfBytesWritten=0x588ff14*=0x120, lpOverlapped=0x0) returned 1 [0193.325] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.325] WriteFile (in: hFile=0x44c, lpBuffer=0x636517*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x636517*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.325] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.326] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.326] CloseHandle (hObject=0x44c) returned 1 [0193.326] GetProcessHeap () returned 0x580000 [0193.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6363f8 | out: hHeap=0x580000) returned 1 [0193.326] GetProcessHeap () returned 0x580000 [0193.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcda40 | out: hHeap=0x580000) returned 1 [0193.326] GetProcessHeap () returned 0x580000 [0193.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaad7b900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x588fd28, dwReserved1=0x6dcda40, cFileName="FORM.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMIC~1.YOU")) returned 0x5b97b0 [0193.326] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.420] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", len=0x5d | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned 1 [0193.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0193.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0193.421] CloseHandle (hObject=0x170) returned 1 [0193.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.id_1622540890_.your_last_chance")) returned 1 [0193.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b97b0 [0193.440] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0193.440] GetProcessHeap () returned 0x580000 [0193.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0193.440] GetProcessHeap () returned 0x580000 [0193.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0193.440] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.440] ReadFile (in: hFile=0x170, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x588ff14*=0x260, lpOverlapped=0x0) returned 1 [0193.469] GetProcessHeap () returned 0x580000 [0193.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0193.469] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] WriteFile (in: hFile=0x170, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x588ff14*=0x260, lpOverlapped=0x0) returned 1 [0193.469] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] WriteFile (in: hFile=0x170, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.469] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.469] CloseHandle (hObject=0x170) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0193.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaed2560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x588fd28, dwReserved1=0x6df2798, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b97f0 [0193.909] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.954] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", len=0x6b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned 1 [0193.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0193.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.957] CloseHandle (hObject=0x468) returned 1 [0193.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.957] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance")) returned 1 [0193.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b97b0 [0193.958] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.959] GetProcessHeap () returned 0x580000 [0193.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x677cd0 [0193.959] GetProcessHeap () returned 0x580000 [0193.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x635768 [0193.959] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.959] ReadFile (in: hFile=0x468, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x588ff14*=0xc40, lpOverlapped=0x0) returned 1 [0193.970] GetProcessHeap () returned 0x580000 [0193.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.970] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.970] WriteFile (in: hFile=0x468, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x588ff14*=0xc40, lpOverlapped=0x0) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.971] WriteFile (in: hFile=0x468, lpBuffer=0x6363a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6363a7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.971] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.971] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.971] CloseHandle (hObject=0x468) returned 1 [0193.971] GetProcessHeap () returned 0x580000 [0193.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0193.971] GetProcessHeap () returned 0x580000 [0193.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0193.971] GetProcessHeap () returned 0x580000 [0193.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab3bb2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc73, dwReserved0=0x588fd28, dwReserved1=0x677cd0, cFileName="BabyBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BABYBL~1.YOU")) returned 0x5b97b0 [0193.971] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.986] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", len=0x6f | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned 1 [0193.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0193.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.988] CloseHandle (hObject=0x4b0) returned 1 [0193.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.988] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance")) returned 1 [0193.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x2e0065, dwReserved1=0x730063, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b97f0 [0193.989] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0193.989] GetProcessHeap () returned 0x580000 [0193.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x635768 [0193.989] GetProcessHeap () returned 0x580000 [0193.989] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd61) returned 0x6f668d8 [0193.989] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.989] ReadFile (in: hFile=0x4b0, lpBuffer=0x635768, nNumberOfBytesToRead=0xd40, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x588ff14*=0xd40, lpOverlapped=0x0) returned 1 [0194.002] GetProcessHeap () returned 0x580000 [0194.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0194.002] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.002] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x588ff14*=0xd40, lpOverlapped=0x0) returned 1 [0194.002] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.002] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f67617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67617*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.002] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.002] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.002] CloseHandle (hObject=0x4b0) returned 1 [0194.002] GetProcessHeap () returned 0x580000 [0194.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0194.002] GetProcessHeap () returned 0x580000 [0194.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0194.002] GetProcessHeap () returned 0x580000 [0194.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0194.002] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab407580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x588fd28, dwReserved1=0x635768, cFileName="BrightOrange.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~1.YOU")) returned 0x5b97f0 [0194.003] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.018] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", len=0x6a | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned 1 [0194.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0194.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0194.018] CloseHandle (hObject=0x47c) returned 1 [0194.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.id_1622540890_.your_last_chance")) returned 1 [0194.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="Country.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUNTR~1.YOU")) returned 0x5b97f0 [0194.019] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0194.019] GetProcessHeap () returned 0x580000 [0194.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0194.019] GetProcessHeap () returned 0x580000 [0194.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0194.020] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.020] ReadFile (in: hFile=0x47c, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x588ff14*=0x360, lpOverlapped=0x0) returned 1 [0195.356] GetProcessHeap () returned 0x580000 [0195.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.356] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.356] WriteFile (in: hFile=0x47c, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x588ff14*=0x360, lpOverlapped=0x0) returned 1 [0195.356] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.356] WriteFile (in: hFile=0x47c, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.356] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.357] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.357] CloseHandle (hObject=0x47c) returned 1 [0195.357] GetProcessHeap () returned 0x580000 [0195.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0195.357] GetProcessHeap () returned 0x580000 [0195.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0195.357] GetProcessHeap () returned 0x580000 [0195.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac0d2bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x588fd28, dwReserved1=0x6eef020, cFileName="Country.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUNTR~1.YOU")) returned 0x5b97b0 [0196.205] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.506] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", len=0x5b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 1 [0199.506] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0199.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.556] CloseHandle (hObject=0x450) returned 1 [0199.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.556] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id_1622540890_.your_last_chance")) returned 1 [0199.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b96b0 [0199.557] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0199.557] GetProcessHeap () returned 0x580000 [0199.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0199.557] GetProcessHeap () returned 0x580000 [0199.557] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5b8df0 [0199.557] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.557] ReadFile (in: hFile=0x450, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x588ff14*=0x120, lpOverlapped=0x0) returned 1 [0199.559] GetProcessHeap () returned 0x580000 [0199.559] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0199.559] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.559] WriteFile (in: hFile=0x450, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x588ff14*=0x120, lpOverlapped=0x0) returned 1 [0199.559] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.559] WriteFile (in: hFile=0x450, lpBuffer=0x5b8f0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f0f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.559] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.559] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.559] CloseHandle (hObject=0x450) returned 1 [0199.559] GetProcessHeap () returned 0x580000 [0199.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0199.560] GetProcessHeap () returned 0x580000 [0199.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0199.560] GetProcessHeap () returned 0x580000 [0199.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0199.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae8fdf00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x588fd28, dwReserved1=0x65f0b0, cFileName="VIEW.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWIC~1.YOU")) returned 0x5b9770 [0200.946] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.021] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0202.021] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0202.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.021] CloseHandle (hObject=0x4ac) returned 1 [0202.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0202.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x460046, dwReserved1=0x47002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0202.022] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.023] GetProcessHeap () returned 0x580000 [0202.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60a608 [0202.023] GetProcessHeap () returned 0x580000 [0202.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x608a00 [0202.023] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.023] ReadFile (in: hFile=0x4ac, lpBuffer=0x60a608, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x60a608*, lpNumberOfBytesRead=0x588ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0202.025] GetProcessHeap () returned 0x580000 [0202.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.025] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.025] WriteFile (in: hFile=0x4ac, lpBuffer=0x608a00*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x608a00*, lpNumberOfBytesWritten=0x588ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0202.025] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.025] WriteFile (in: hFile=0x4ac, lpBuffer=0x608bdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x608bdf*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0202.025] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.026] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0202.026] CloseHandle (hObject=0x4ac) returned 1 [0202.026] GetProcessHeap () returned 0x580000 [0202.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x608a00 | out: hHeap=0x580000) returned 1 [0202.026] GetProcessHeap () returned 0x580000 [0202.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60a608 | out: hHeap=0x580000) returned 1 [0202.026] GetProcessHeap () returned 0x580000 [0202.026] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb007f840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x588fd28, dwReserved1=0x60a608, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0202.026] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.081] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", len=0x44 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned 1 [0202.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0202.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0202.082] CloseHandle (hObject=0x3e4) returned 1 [0202.082] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.082] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.id_1622540890_.your_last_chance")) returned 1 [0203.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR36~1.YOU")) returned 0x5b97b0 [0203.553] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0203.554] GetProcessHeap () returned 0x580000 [0203.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8fe1) returned 0x70b3528 [0203.554] GetProcessHeap () returned 0x580000 [0203.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8fe1) returned 0x6ebeed0 [0203.554] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.554] ReadFile (in: hFile=0x3e4, lpBuffer=0x70b3528, nNumberOfBytesToRead=0x8fc0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesRead=0x588ff14*=0x8fc0, lpOverlapped=0x0) returned 1 [0206.307] GetProcessHeap () returned 0x580000 [0206.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0206.307] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.307] WriteFile (in: hFile=0x3e4, lpBuffer=0x6ebeed0*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebeed0*, lpNumberOfBytesWritten=0x588ff14*=0x8fc0, lpOverlapped=0x0) returned 1 [0206.308] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.308] WriteFile (in: hFile=0x3e4, lpBuffer=0x6ec7e8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec7e8f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0206.308] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0206.308] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0206.308] CloseHandle (hObject=0x3e4) returned 1 [0206.308] GetProcessHeap () returned 0x580000 [0206.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebeed0 | out: hHeap=0x580000) returned 1 [0206.308] GetProcessHeap () returned 0x580000 [0206.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0206.308] GetProcessHeap () returned 0x580000 [0206.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0209.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2943100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8ffb, dwReserved0=0x588fd28, dwReserved1=0x70b3528, cFileName="PDIR36F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR36~1.YOU")) returned 0x5b97f0 [0209.619] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.670] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", len=0x69 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned 1 [0209.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0209.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.671] CloseHandle (hObject=0x3b8) returned 1 [0209.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.id_1622540890_.your_last_chance")) returned 1 [0209.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b97f0 [0209.672] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.672] GetProcessHeap () returned 0x580000 [0209.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1121) returned 0x6de8f50 [0209.672] GetProcessHeap () returned 0x580000 [0209.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1121) returned 0x6c6e0f8 [0209.672] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.672] ReadFile (in: hFile=0x3b8, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x1100, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x588ff14*=0x1100, lpOverlapped=0x0) returned 1 [0209.700] GetProcessHeap () returned 0x580000 [0209.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0209.700] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.700] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x588ff14*=0x1100, lpOverlapped=0x0) returned 1 [0209.700] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.700] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c6f1f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f1f7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.700] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.700] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.700] CloseHandle (hObject=0x3b8) returned 1 [0209.700] GetProcessHeap () returned 0x580000 [0209.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0209.700] GetProcessHeap () returned 0x580000 [0209.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0209.700] GetProcessHeap () returned 0x580000 [0209.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0209.701] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49b1cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1127, dwReserved0=0x588fd28, dwReserved1=0x6de8f50, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b97f0 [0209.701] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.757] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", len=0x68 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned 1 [0209.757] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0209.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.758] CloseHandle (hObject=0x3b8) returned 1 [0209.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.758] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.id_1622540890_.your_last_chance")) returned 1 [0209.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75f, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b97f0 [0209.759] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.759] GetProcessHeap () returned 0x580000 [0209.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4e820 [0209.759] GetProcessHeap () returned 0x580000 [0209.759] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4efa8 [0209.760] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.760] ReadFile (in: hFile=0x3b8, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x588ff14*=0x740, lpOverlapped=0x0) returned 1 [0209.805] GetProcessHeap () returned 0x580000 [0209.805] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0209.805] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.805] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x588ff14*=0x740, lpOverlapped=0x0) returned 1 [0209.805] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.805] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c4f6e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6e7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.805] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.805] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.805] CloseHandle (hObject=0x3b8) returned 1 [0209.805] GetProcessHeap () returned 0x580000 [0209.805] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0209.805] GetProcessHeap () returned 0x580000 [0209.805] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0209.806] GetProcessHeap () returned 0x580000 [0209.806] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0209.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4abc660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x783, dwReserved0=0x588fd28, dwReserved1=0x6c4e820, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b97f0 [0209.806] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0210.091] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", len=0x6b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned 1 [0210.091] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0210.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.092] CloseHandle (hObject=0x3b8) returned 1 [0210.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.id_1622540890_.your_last_chance")) returned 1 [0210.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x762, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b97b0 [0210.093] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.093] GetProcessHeap () returned 0x580000 [0210.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0210.093] GetProcessHeap () returned 0x580000 [0210.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0210.093] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.093] ReadFile (in: hFile=0x3b8, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x588ff14*=0x760, lpOverlapped=0x0) returned 1 [0210.104] GetProcessHeap () returned 0x580000 [0210.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0210.104] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.104] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x588ff14*=0x760, lpOverlapped=0x0) returned 1 [0210.104] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.104] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.105] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.105] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.105] CloseHandle (hObject=0x3b8) returned 1 [0210.105] GetProcessHeap () returned 0x580000 [0210.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0210.105] GetProcessHeap () returned 0x580000 [0210.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0210.105] GetProcessHeap () returned 0x580000 [0210.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4d90080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x588fd28, dwReserved1=0x6ef3020, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b97b0 [0210.105] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.153] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS", len=0x45 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS") returned 1 [0210.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0210.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0210.154] CloseHandle (hObject=0x42c) returned 1 [0210.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css.id_1622540890_.your_last_chance")) returned 1 [0210.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c175e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c175e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eada, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3E78~1.YOU")) returned 0x5b97b0 [0210.155] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0210.155] GetProcessHeap () returned 0x580000 [0210.155] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0210.156] GetProcessHeap () returned 0x580000 [0210.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0210.156] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.156] ReadFile (in: hFile=0x42c, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.031] GetProcessHeap () returned 0x580000 [0214.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.031] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] WriteFile (in: hFile=0x42c, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] WriteFile (in: hFile=0x42c, lpBuffer=0x70a1cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cc7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.032] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.032] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.032] CloseHandle (hObject=0x42c) returned 1 [0214.314] GetProcessHeap () returned 0x580000 [0214.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0214.314] GetProcessHeap () returned 0x580000 [0214.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0214.319] GetProcessHeap () returned 0x580000 [0214.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0215.186] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c175e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb72e79a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eafe, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="SCHEME17.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3E78~1.YOU")) returned 0x5b97b0 [0215.186] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.307] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned 1 [0217.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0217.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.308] CloseHandle (hObject=0x48c) returned 1 [0217.308] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.321] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.id_1622540890_.your_last_chance")) returned 1 [0217.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b9770 [0217.322] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.322] GetProcessHeap () returned 0x580000 [0217.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706ecb0 [0217.322] GetProcessHeap () returned 0x580000 [0217.322] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706f538 [0217.322] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.322] ReadFile (in: hFile=0x48c, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x588ff14*=0x840, lpOverlapped=0x0) returned 1 [0217.402] GetProcessHeap () returned 0x580000 [0217.402] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.402] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.402] WriteFile (in: hFile=0x48c, lpBuffer=0x706f538*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706f538*, lpNumberOfBytesWritten=0x588ff14*=0x840, lpOverlapped=0x0) returned 1 [0217.403] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.403] WriteFile (in: hFile=0x48c, lpBuffer=0x706fd77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fd77*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.403] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.403] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.403] CloseHandle (hObject=0x48c) returned 1 [0217.437] GetProcessHeap () returned 0x580000 [0217.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706f538 | out: hHeap=0x580000) returned 1 [0217.442] GetProcessHeap () returned 0x580000 [0217.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0217.442] GetProcessHeap () returned 0x580000 [0217.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9330400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x87c, dwReserved0=0x588fd28, dwReserved1=0x706ecb0, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b9770 [0221.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.112] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned 1 [0221.112] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0221.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.112] CloseHandle (hObject=0x414) returned 1 [0221.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.id_1622540890_.your_last_chance")) returned 1 [0221.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b9770 [0221.114] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.114] GetProcessHeap () returned 0x580000 [0221.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.114] GetProcessHeap () returned 0x580000 [0221.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.114] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.114] ReadFile (in: hFile=0x414, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x588ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.143] GetProcessHeap () returned 0x580000 [0221.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.143] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.143] WriteFile (in: hFile=0x414, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x588ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.144] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.144] WriteFile (in: hFile=0x414, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.144] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.144] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.144] CloseHandle (hObject=0x414) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0222.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb6beca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x374, dwReserved0=0x588fd28, dwReserved1=0x6dcfb90, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b96f0 [0222.679] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.755] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", len=0x71 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned 1 [0222.755] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0222.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.756] CloseHandle (hObject=0x49c) returned 1 [0222.756] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.756] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.id_1622540890_.your_last_chance")) returned 1 [0222.757] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.757] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19e9, dwReserved0=0x6e006f, dwReserved1=0x2e0073, cFileName="ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR619C~1.YOU")) returned 0x5b96f0 [0222.757] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0222.757] GetProcessHeap () returned 0x580000 [0222.757] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x667250 [0222.757] GetProcessHeap () returned 0x580000 [0222.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x6f1bec0 [0222.758] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.758] ReadFile (in: hFile=0x49c, lpBuffer=0x667250, nNumberOfBytesToRead=0x19e0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x588ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0222.801] GetProcessHeap () returned 0x580000 [0222.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0222.801] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.801] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x588ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0222.801] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.801] WriteFile (in: hFile=0x49c, lpBuffer=0x6f1d89f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1d89f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.801] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.801] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.801] CloseHandle (hObject=0x49c) returned 1 [0222.816] GetProcessHeap () returned 0x580000 [0222.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0222.816] GetProcessHeap () returned 0x580000 [0222.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0222.816] GetProcessHeap () returned 0x580000 [0222.816] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc6a9fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a0d, dwReserved0=0x588fd28, dwReserved1=0x667250, cFileName="ProjectStatusIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR619C~1.YOU")) returned 0x5b9630 [0225.415] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.454] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", len=0x61 | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned 1 [0225.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0225.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0225.749] CloseHandle (hObject=0x478) returned 1 [0225.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.750] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance")) returned 1 [0229.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0229.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0229.072] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0229.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0229.072] GetProcessHeap () returned 0x580000 [0229.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0229.072] GetProcessHeap () returned 0x580000 [0229.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0229.073] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0229.073] ReadFile (in: hFile=0x478, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.204] GetProcessHeap () returned 0x580000 [0238.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0238.204] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.204] WriteFile (in: hFile=0x478, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x588ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.325] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.325] WriteFile (in: hFile=0x478, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.325] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.325] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.325] CloseHandle (hObject=0x478) returned 1 [0239.325] GetProcessHeap () returned 0x580000 [0239.325] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0239.326] GetProcessHeap () returned 0x580000 [0239.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0239.326] GetProcessHeap () returned 0x580000 [0239.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0240.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62ba220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3de03, dwReserved0=0x588fd28, dwReserved1=0x6d630a8, cFileName="Microsoft.Office.InfoPath.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0240.640] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.652] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML", len=0x4f | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned 1 [0240.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0240.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.686] CloseHandle (hObject=0x170) returned 1 [0240.686] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml.id_1622540890_.your_last_chance")) returned 1 [0240.687] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA18B7~1.YOU")) returned 0x5b9730 [0240.688] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0240.688] GetProcessHeap () returned 0x580000 [0240.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.688] GetProcessHeap () returned 0x580000 [0240.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.688] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.688] ReadFile (in: hFile=0x170, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.735] GetProcessHeap () returned 0x580000 [0240.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.735] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.735] WriteFile (in: hFile=0x170, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.735] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.735] WriteFile (in: hFile=0x170, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.735] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.735] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.736] CloseHandle (hObject=0x170) returned 1 [0240.736] GetProcessHeap () returned 0x580000 [0240.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.736] GetProcessHeap () returned 0x580000 [0240.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.736] GetProcessHeap () returned 0x580000 [0240.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc701dde0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x588fd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.COM.MY.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA18B7~1.YOU")) returned 0x5b9730 [0240.736] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.791] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML", len=0x4b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned 1 [0240.791] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0240.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.792] CloseHandle (hObject=0x264) returned 1 [0240.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.793] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x45, dwReserved1=0x0, cFileName="SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SNETNE~1.YOU")) returned 0x5b9730 [0240.793] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.793] GetProcessHeap () returned 0x580000 [0240.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09c70 [0240.793] GetProcessHeap () returned 0x580000 [0240.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09fd8 [0240.793] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.793] ReadFile (in: hFile=0x264, lpBuffer=0x6d09c70, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09c70*, lpNumberOfBytesRead=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.816] GetProcessHeap () returned 0x580000 [0240.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0240.816] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.816] WriteFile (in: hFile=0x264, lpBuffer=0x6d09fd8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09fd8*, lpNumberOfBytesWritten=0x588ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.816] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.816] WriteFile (in: hFile=0x264, lpBuffer=0x6d0a2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a2f7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.816] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.817] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.817] CloseHandle (hObject=0x264) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09fd8 | out: hHeap=0x580000) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09c70 | out: hHeap=0x580000) returned 1 [0240.850] GetProcessHeap () returned 0x580000 [0240.850] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0241.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc70dc4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x588fd28, dwReserved1=0x6d09c70, cFileName="SNET.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SNETNE~1.YOU")) returned 0x5b9630 [0241.848] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.867] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML", len=0x3f | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned 1 [0241.867] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0241.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0245.385] CloseHandle (hObject=0x4ac) returned 1 [0245.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml.id_1622540890_.your_last_chance")) returned 1 [0248.525] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x5e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~4.YOU")) returned 0x5b96f0 [0248.526] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0248.526] GetProcessHeap () returned 0x580000 [0248.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6f04558 [0248.526] GetProcessHeap () returned 0x580000 [0248.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x601) returned 0x6d045f8 [0248.526] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.526] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x5e0, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x588ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0248.532] GetProcessHeap () returned 0x580000 [0248.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0248.533] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.533] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x588ff14*=0x5e0, lpOverlapped=0x0) returned 1 [0248.533] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.533] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d04bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04bd7*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.533] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.533] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.533] CloseHandle (hObject=0x4ac) returned 1 [0248.533] GetProcessHeap () returned 0x580000 [0248.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0248.533] GetProcessHeap () returned 0x580000 [0248.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0248.533] GetProcessHeap () returned 0x580000 [0248.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcba80d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x606, dwReserved0=0x588fd28, dwReserved1=0x6f04558, cFileName="PGMN027.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN02~4.YOU")) returned 0x5b9730 [0253.516] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.552] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 1 [0253.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0253.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0253.552] CloseHandle (hObject=0x268) returned 1 [0253.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.id_1622540890_.your_last_chance")) returned 1 [0253.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADRESP~1.YOU")) returned 0x5b9730 [0253.554] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0253.554] GetProcessHeap () returned 0x580000 [0253.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706ecb0 [0253.554] GetProcessHeap () returned 0x580000 [0253.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706f538 [0253.554] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.554] ReadFile (in: hFile=0x268, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x588ff14*=0x840, lpOverlapped=0x0) returned 1 [0253.602] GetProcessHeap () returned 0x580000 [0253.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.602] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.602] WriteFile (in: hFile=0x268, lpBuffer=0x706f538*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706f538*, lpNumberOfBytesWritten=0x588ff14*=0x840, lpOverlapped=0x0) returned 1 [0253.602] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.602] WriteFile (in: hFile=0x268, lpBuffer=0x706fd77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fd77*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0253.602] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.602] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0253.602] CloseHandle (hObject=0x268) returned 1 [0253.602] GetProcessHeap () returned 0x580000 [0253.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706f538 | out: hHeap=0x580000) returned 1 [0253.602] GetProcessHeap () returned 0x580000 [0253.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0253.602] GetProcessHeap () returned 0x580000 [0253.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceadac40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x588fd28, dwReserved1=0x706ecb0, cFileName="ADRESPEL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADRESP~1.YOU")) returned 0x5b9730 [0253.603] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.664] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML") returned 1 [0253.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f1c) returned 0x6dee6e0 [0253.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.708] CloseHandle (hObject=0x48c) returned 1 [0253.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml.id_1622540890_.your_last_chance")) returned 1 [0253.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCHKB~1.YOU")) returned 0x5b9730 [0253.710] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0253.710] GetProcessHeap () returned 0x580000 [0253.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4e820 [0253.710] GetProcessHeap () returned 0x580000 [0253.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4eae8 [0253.710] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.710] ReadFile (in: hFile=0x48c, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x588ff14*=0x280, lpOverlapped=0x0) returned 1 [0253.714] GetProcessHeap () returned 0x580000 [0253.714] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.714] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] WriteFile (in: hFile=0x48c, lpBuffer=0x6c4eae8*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4eae8*, lpNumberOfBytesWritten=0x588ff14*=0x280, lpOverlapped=0x0) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] WriteFile (in: hFile=0x48c, lpBuffer=0x6c4ed67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ed67*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0253.714] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.714] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0253.714] CloseHandle (hObject=0x48c) returned 1 [0253.714] GetProcessHeap () returned 0x580000 [0253.714] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4eae8 | out: hHeap=0x580000) returned 1 [0253.714] GetProcessHeap () returned 0x580000 [0253.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0253.715] GetProcessHeap () returned 0x580000 [0253.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcebe55e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c2, dwReserved0=0x588fd28, dwReserved1=0x6c4e820, cFileName="DGCHKBRD.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGCHKB~1.YOU")) returned 0x5b9730 [0254.938] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.956] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML", len=0x3b | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML") returned 1 [0254.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd0) returned 0x72e5948 [0254.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0254.957] CloseHandle (hObject=0x428) returned 1 [0254.957] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0254.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml.id_1622540890_.your_last_chance")) returned 1 [0254.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0254.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8393c00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8393c00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd066, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILX~1.YOU")) returned 0x5b9730 [0254.959] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0254.959] GetProcessHeap () returned 0x580000 [0254.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd081) returned 0x6e44580 [0254.959] GetProcessHeap () returned 0x580000 [0254.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd081) returned 0x6e51610 [0254.959] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0254.959] ReadFile (in: hFile=0x428, lpBuffer=0x6e44580, nNumberOfBytesToRead=0xd060, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesRead=0x588ff14*=0xd060, lpOverlapped=0x0) returned 1 [0257.954] GetProcessHeap () returned 0x580000 [0257.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0257.955] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.955] WriteFile (in: hFile=0x428, lpBuffer=0x6e51610*, nNumberOfBytesToWrite=0xd060, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e51610*, lpNumberOfBytesWritten=0x588ff14*=0xd060, lpOverlapped=0x0) returned 1 [0257.955] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.955] WriteFile (in: hFile=0x428, lpBuffer=0x6e5e66f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5e66f*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.955] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.956] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.956] CloseHandle (hObject=0x428) returned 1 [0258.290] GetProcessHeap () returned 0x580000 [0258.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e51610 | out: hHeap=0x580000) returned 1 [0258.300] GetProcessHeap () returned 0x580000 [0258.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e44580 | out: hHeap=0x580000) returned 1 [0258.300] GetProcessHeap () returned 0x580000 [0258.301] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0259.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fccc | out: lpFindFileData=0x588fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8393c00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd145cbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd08a, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="EMAIL.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMAILX~1.YOU")) returned 0x5b9630 [0259.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.231] SysReAllocStringLen (in: pbstr=0x588ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV", len=0x3e | out: pbstr=0x588ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV") returned 1 [0259.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d4) returned 0x72e5948 [0259.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0259.421] CloseHandle (hObject=0x440) returned 1 [0259.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.422] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x588ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x588fc74 | out: lpFindFileData=0x588fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2274ed00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2274ed00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xba14, dwReserved0=0x0, dwReserved1=0x0, cFileName="WITHCOMP.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WITHCO~2.YOU")) returned 0x5b9630 [0259.422] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0259.422] GetProcessHeap () returned 0x580000 [0259.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba21) returned 0x72206f8 [0259.423] GetProcessHeap () returned 0x580000 [0259.423] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba21) returned 0x722c128 [0259.423] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.423] ReadFile (in: hFile=0x440, lpBuffer=0x72206f8, nNumberOfBytesToRead=0xba00, lpNumberOfBytesRead=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x72206f8*, lpNumberOfBytesRead=0x588ff14*=0xba00, lpOverlapped=0x0) returned 1 [0264.925] GetProcessHeap () returned 0x580000 [0264.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0264.925] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.925] WriteFile (in: hFile=0x440, lpBuffer=0x722c128*, nNumberOfBytesToWrite=0xba00, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x722c128*, lpNumberOfBytesWritten=0x588ff14*=0xba00, lpOverlapped=0x0) returned 1 [0264.925] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.925] WriteFile (in: hFile=0x440, lpBuffer=0x7237b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x7237b27*, lpNumberOfBytesWritten=0x588ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.926] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.926] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x588ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x588ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.926] CloseHandle (hObject=0x440) returned 1 [0264.926] GetProcessHeap () returned 0x580000 [0264.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x722c128 | out: hHeap=0x580000) returned 1 [0264.926] GetProcessHeap () returned 0x580000 [0264.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72206f8 | out: hHeap=0x580000) returned 1 [0264.926] GetProcessHeap () returned 0x580000 [0264.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 Thread: id = 48 os_tid = 0xab8 [0039.068] Sleep (dwMilliseconds=0x1) [0039.091] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.673] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.740] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.812] Sleep (dwMilliseconds=0x1) [0039.833] Sleep (dwMilliseconds=0x1) [0039.863] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.392] Sleep (dwMilliseconds=0x1) [0040.511] Sleep (dwMilliseconds=0x1) [0040.540] Sleep (dwMilliseconds=0x1) [0040.555] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.315] Sleep (dwMilliseconds=0x1) [0042.345] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.791] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.847] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.082] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.140] Sleep (dwMilliseconds=0x1) [0043.197] Sleep (dwMilliseconds=0x1) [0043.277] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.306] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.337] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.384] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.431] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.462] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.493] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.556] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.694] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.716] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.748] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.826] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.935] Sleep (dwMilliseconds=0x1) [0043.951] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.621] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.699] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.808] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.011] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.042] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.167] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.276] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.479] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.677] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.854] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.901] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.932] Sleep (dwMilliseconds=0x1) [0045.947] Sleep (dwMilliseconds=0x1) [0045.963] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.994] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.026] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.057] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.104] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.135] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.212] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.244] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.278] Sleep (dwMilliseconds=0x1) [0046.291] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.346] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.369] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.447] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.493] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.571] Sleep (dwMilliseconds=0x1) [0046.588] Sleep (dwMilliseconds=0x1) [0046.603] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.649] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.681] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.728] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.805] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.915] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.961] Sleep (dwMilliseconds=0x1) [0046.976] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.023] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.070] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.147] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.334] Sleep (dwMilliseconds=0x1) [0047.357] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.382] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.490] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.725] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] Sleep (dwMilliseconds=0x1) [0047.772] Sleep (dwMilliseconds=0x1) [0047.787] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.834] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.959] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.037] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.101] Sleep (dwMilliseconds=0x1) [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.146] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.271] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] Sleep (dwMilliseconds=0x1) [0048.349] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.403] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.427] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.583] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.661] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.738] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.817] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.895] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] Sleep (dwMilliseconds=0x1) [0049.144] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.197] Sleep (dwMilliseconds=0x1) [0049.206] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.331] Sleep (dwMilliseconds=0x1) [0049.348] Sleep (dwMilliseconds=0x1) [0049.363] Sleep (dwMilliseconds=0x1) [0049.378] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.463] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.488] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.519] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.618] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.675] Sleep (dwMilliseconds=0x1) [0049.691] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.753] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.893] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.955] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.987] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.143] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.194] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.299] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.377] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.486] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.550] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.611] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.642] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.689] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.767] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.798] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.848] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.876] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.940] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.000] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.096] Sleep (dwMilliseconds=0x1) [0051.110] Sleep (dwMilliseconds=0x1) [0051.126] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.234] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.266] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.313] Sleep (dwMilliseconds=0x1) [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.438] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.469] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.546] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.578] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.635] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.701] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.747] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.856] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.934] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.012] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.059] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.137] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.168] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.324] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.527] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.824] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.260] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.363] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.978] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.023] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.101] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.148] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.413] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.457] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", len=0x51 | out: pbstr=0x59cff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 1 [0058.457] GetProcessHeap () returned 0x580000 [0058.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615348, Size=0x1c) returned 0x615320 [0058.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0061.480] CloseHandle (hObject=0x468) returned 1 [0061.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.481] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id_1622540890_.your_last_chance")) returned 1 [0061.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.481] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b9630 [0061.481] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.482] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0061.482] GetProcessHeap () returned 0x580000 [0061.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ef2380 [0061.482] GetProcessHeap () returned 0x580000 [0061.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f10048 [0061.483] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.484] ReadFile (in: hFile=0x468, lpBuffer=0x6ef2380, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef2380*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.662] GetProcessHeap () returned 0x580000 [0066.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0066.662] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.662] WriteFile (in: hFile=0x468, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0067.559] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.559] WriteFile (in: hFile=0x468, lpBuffer=0x6f21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21847*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0067.930] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.930] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0067.930] CloseHandle (hObject=0x468) returned 1 [0067.986] GetProcessHeap () returned 0x580000 [0067.986] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0067.990] GetProcessHeap () returned 0x580000 [0067.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef2380 | out: hHeap=0x580000) returned 1 [0067.990] GetProcessHeap () returned 0x580000 [0067.990] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0068.828] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x60452580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd8424, dwReserved0=0x580000, dwReserved1=0x6f69930, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b96b0 [0068.828] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.847] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", len=0x43 | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 1 [0068.847] GetProcessHeap () returned 0x580000 [0068.847] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a8a0 [0068.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0068.855] CloseHandle (hObject=0x410) returned 1 [0068.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0068.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id_1622540890_.your_last_chance")) returned 1 [0068.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0068.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPGIMP~1.YOU")) returned 0x5b96f0 [0068.856] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0068.856] GetProcessHeap () returned 0x580000 [0068.856] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c10048 [0068.856] GetProcessHeap () returned 0x580000 [0068.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c21878 [0068.857] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.857] ReadFile (in: hFile=0x410, lpBuffer=0x6c10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.424] GetProcessHeap () returned 0x580000 [0073.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0073.424] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.424] WriteFile (in: hFile=0x410, lpBuffer=0x6c21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21878*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0073.425] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.425] WriteFile (in: hFile=0x410, lpBuffer=0x6c33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c33077*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0073.930] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.930] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0073.930] CloseHandle (hObject=0x410) returned 1 [0073.930] GetProcessHeap () returned 0x580000 [0073.930] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21878 | out: hHeap=0x580000) returned 1 [0073.933] GetProcessHeap () returned 0x580000 [0073.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0073.933] GetProcessHeap () returned 0x580000 [0073.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0073.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x63bd0660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x447a4, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="WPGIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPGIMP~1.YOU")) returned 0x5b9730 [0074.604] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.340] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", len=0x3d | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 1 [0079.340] GetProcessHeap () returned 0x580000 [0079.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x64) returned 0x5f76f0 [0079.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.340] Sleep (dwMilliseconds=0x1) [0079.358] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", len=0x43 | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 1 [0079.358] GetProcessHeap () returned 0x580000 [0079.358] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f76f0 | out: hHeap=0x580000) returned 1 [0079.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.363] CloseHandle (hObject=0x440) returned 1 [0079.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id_1622540890_.your_last_chance")) returned 1 [0079.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~2.YOU")) returned 0x5b96f0 [0079.364] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0079.364] GetProcessHeap () returned 0x580000 [0079.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1aa1) returned 0x6d0e508 [0079.364] GetProcessHeap () returned 0x580000 [0079.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1aa1) returned 0x6f094f0 [0079.365] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.365] ReadFile (in: hFile=0x440, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1a80, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x59cff14*=0x1a80, lpOverlapped=0x0) returned 1 [0079.391] GetProcessHeap () returned 0x580000 [0079.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0079.391] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.391] WriteFile (in: hFile=0x440, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x59cff14*=0x1a80, lpOverlapped=0x0) returned 1 [0079.391] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.391] WriteFile (in: hFile=0x440, lpBuffer=0x6f0af6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0af6f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0079.391] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.391] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0079.391] CloseHandle (hObject=0x440) returned 1 [0079.392] GetProcessHeap () returned 0x580000 [0079.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0079.392] GetProcessHeap () returned 0x580000 [0079.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0079.392] GetProcessHeap () returned 0x580000 [0079.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0079.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66efdf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1abf, dwReserved0=0x59cfd28, dwReserved1=0x6d0e508, cFileName="CGMIMP32.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CGMIMP~2.YOU")) returned 0x5b96f0 [0079.392] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.451] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", len=0x4b | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 1 [0079.451] GetProcessHeap () returned 0x580000 [0079.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0079.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.452] Sleep (dwMilliseconds=0x1) [0079.473] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", len=0x42 | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 1 [0079.473] GetProcessHeap () returned 0x580000 [0079.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0079.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.877] CloseHandle (hObject=0x478) returned 1 [0079.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id_1622540890_.your_last_chance")) returned 1 [0079.921] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MUAUTH~1.YOU")) returned 0x5b96f0 [0079.922] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.922] GetProcessHeap () returned 0x580000 [0079.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a61) returned 0x6d0e508 [0079.922] GetProcessHeap () returned 0x580000 [0079.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a61) returned 0x66fcd0 [0079.923] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.923] ReadFile (in: hFile=0x478, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1a40, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x59cff14*=0x1a40, lpOverlapped=0x0) returned 1 [0079.948] GetProcessHeap () returned 0x580000 [0079.948] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0079.948] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.948] WriteFile (in: hFile=0x478, lpBuffer=0x66fcd0*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x66fcd0*, lpNumberOfBytesWritten=0x59cff14*=0x1a40, lpOverlapped=0x0) returned 1 [0079.948] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.948] WriteFile (in: hFile=0x478, lpBuffer=0x67170f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x67170f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0079.948] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.948] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0079.948] CloseHandle (hObject=0x478) returned 1 [0079.948] GetProcessHeap () returned 0x580000 [0079.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x66fcd0 | out: hHeap=0x580000) returned 1 [0079.949] GetProcessHeap () returned 0x580000 [0079.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0079.949] GetProcessHeap () returned 0x580000 [0079.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0079.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x67432f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a7f, dwReserved0=0x59cfd28, dwReserved1=0x6d0e508, cFileName="MUAUTH.CAB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MUAUTH~1.YOU")) returned 0x5b9730 [0079.949] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.590] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", len=0x6e | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 1 [0081.590] GetProcessHeap () returned 0x580000 [0081.590] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.598] CloseHandle (hObject=0x488) returned 1 [0081.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id_1622540890_.your_last_chance")) returned 1 [0081.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x58002e, dwReserved1=0x4c004d, cFileName="Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0081.608] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.608] GetProcessHeap () returned 0x580000 [0081.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6f06bb8 [0081.609] GetProcessHeap () returned 0x580000 [0081.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6f0c4f8 [0081.609] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.609] ReadFile (in: hFile=0x444, lpBuffer=0x6f06bb8, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesRead=0x59cff14*=0x560, lpOverlapped=0x0) returned 1 [0081.620] GetProcessHeap () returned 0x580000 [0081.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.620] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.620] WriteFile (in: hFile=0x444, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x59cff14*=0x560, lpOverlapped=0x0) returned 1 [0081.620] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.620] WriteFile (in: hFile=0x444, lpBuffer=0x6f0ca57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ca57*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0081.623] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.623] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0081.623] CloseHandle (hObject=0x444) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0081.623] GetProcessHeap () returned 0x580000 [0081.623] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68444400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x58b, dwReserved0=0x59cfd28, dwReserved1=0x6f06bb8, cFileName="Office32MUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0081.624] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.971] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", len=0x4b | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 1 [0085.971] GetProcessHeap () returned 0x580000 [0085.971] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x68) returned 0x614a48 [0085.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.971] Sleep (dwMilliseconds=0x1) [0086.367] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", len=0x4a | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 1 [0086.367] GetProcessHeap () returned 0x580000 [0086.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0086.384] CloseHandle (hObject=0x170) returned 1 [0086.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0086.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0086.385] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0086.386] GetProcessHeap () returned 0x580000 [0086.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x634a18 [0086.386] GetProcessHeap () returned 0x580000 [0086.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x6355e8 [0086.386] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.386] ReadFile (in: hFile=0x170, lpBuffer=0x634a18, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x634a18*, lpNumberOfBytesRead=0x59cff14*=0xba0, lpOverlapped=0x0) returned 1 [0086.481] GetProcessHeap () returned 0x580000 [0086.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0086.481] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.482] WriteFile (in: hFile=0x170, lpBuffer=0x6355e8*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6355e8*, lpNumberOfBytesWritten=0x59cff14*=0xba0, lpOverlapped=0x0) returned 1 [0086.482] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.482] WriteFile (in: hFile=0x170, lpBuffer=0x636187*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x636187*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0086.482] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.482] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0086.482] CloseHandle (hObject=0x170) returned 1 [0086.482] GetProcessHeap () returned 0x580000 [0086.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6355e8 | out: hHeap=0x580000) returned 1 [0086.482] GetProcessHeap () returned 0x580000 [0086.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x634a18 | out: hHeap=0x580000) returned 1 [0086.482] GetProcessHeap () returned 0x580000 [0086.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0086.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b288fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x59cfd28, dwReserved1=0x634a18, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0086.482] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.361] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", len=0x4d | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 1 [0088.362] GetProcessHeap () returned 0x580000 [0088.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0088.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0095.473] CloseHandle (hObject=0x42c) returned 1 [0095.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0095.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id_1622540890_.your_last_chance")) returned 1 [0096.929] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0096.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCRE~2.YOU")) returned 0x5b96f0 [0098.374] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0099.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x424 [0099.693] GetProcessHeap () returned 0x580000 [0099.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60a608 [0099.693] GetProcessHeap () returned 0x580000 [0099.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60aea8 [0099.693] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.693] ReadFile (in: hFile=0x424, lpBuffer=0x60a608, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x60a608*, lpNumberOfBytesRead=0x59cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0099.696] GetProcessHeap () returned 0x580000 [0099.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0099.696] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.696] WriteFile (in: hFile=0x424, lpBuffer=0x60aea8*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x60aea8*, lpNumberOfBytesWritten=0x59cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0099.696] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.696] WriteFile (in: hFile=0x424, lpBuffer=0x60b087*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x60b087*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0099.696] SetFilePointerEx (in: hFile=0x424, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.696] WriteFile (in: hFile=0x424, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0099.696] CloseHandle (hObject=0x424) returned 1 [0099.696] GetProcessHeap () returned 0x580000 [0099.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60aea8 | out: hHeap=0x580000) returned 1 [0099.697] GetProcessHeap () returned 0x580000 [0099.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60a608 | out: hHeap=0x580000) returned 1 [0099.697] GetProcessHeap () returned 0x580000 [0099.697] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0099.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7308bc40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x204, dwReserved0=0x59cfd28, dwReserved1=0x60a608, cFileName="CONCRETE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONCRE~2.YOU")) returned 0x5b96f0 [0100.574] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.876] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", len=0x4c | out: pbstr=0x59cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 1 [0106.883] GetProcessHeap () returned 0x580000 [0106.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x18) returned 0x5a58e8 [0106.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0107.850] CloseHandle (hObject=0x448) returned 1 [0107.850] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.851] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id_1622540890_.your_last_chance")) returned 1 [0107.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x450043, dwReserved1=0x0, cFileName="IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IC-TXT~1.YOU")) returned 0x5b9730 [0107.923] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0107.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0107.923] GetProcessHeap () returned 0x580000 [0107.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b21) returned 0x6f3ef08 [0107.923] GetProcessHeap () returned 0x580000 [0107.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2b21) returned 0x6f41a38 [0107.923] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.923] ReadFile (in: hFile=0x448, lpBuffer=0x6f3ef08, nNumberOfBytesToRead=0x2b00, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef08*, lpNumberOfBytesRead=0x59cff14*=0x2b00, lpOverlapped=0x0) returned 1 [0107.991] GetProcessHeap () returned 0x580000 [0107.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0107.992] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.992] WriteFile (in: hFile=0x448, lpBuffer=0x6f41a38*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f41a38*, lpNumberOfBytesWritten=0x59cff14*=0x2b00, lpOverlapped=0x0) returned 1 [0107.992] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.992] WriteFile (in: hFile=0x448, lpBuffer=0x6f44537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f44537*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0107.992] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.992] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0107.992] CloseHandle (hObject=0x448) returned 1 [0107.993] GetProcessHeap () returned 0x580000 [0107.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f41a38 | out: hHeap=0x580000) returned 1 [0107.993] GetProcessHeap () returned 0x580000 [0107.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef08 | out: hHeap=0x580000) returned 1 [0107.993] GetProcessHeap () returned 0x580000 [0107.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0107.993] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x77fb17c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b25, dwReserved0=0x59cfd28, dwReserved1=0x6f3ef08, cFileName="IC-TXT.SHX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IC-TXT~1.YOU")) returned 0x5b9730 [0107.993] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.080] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", len=0x41 | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 1 [0112.080] GetProcessHeap () returned 0x580000 [0112.080] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.092] Sleep (dwMilliseconds=0x1) [0112.122] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", len=0x50 | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.122] GetProcessHeap () returned 0x580000 [0112.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c563f8 [0112.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.122] Sleep (dwMilliseconds=0x1) [0112.263] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", len=0x4a | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned 1 [0112.263] GetProcessHeap () returned 0x580000 [0112.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x28) returned 0x5dc550 [0112.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.263] Sleep (dwMilliseconds=0x1) [0112.276] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", len=0x47 | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned 1 [0112.276] GetProcessHeap () returned 0x580000 [0112.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.276] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.277] Sleep (dwMilliseconds=0x1) [0112.303] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", len=0x51 | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 1 [0112.303] GetProcessHeap () returned 0x580000 [0112.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61dbd8, Size=0x88) returned 0x61b540 [0112.303] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.325] Sleep (dwMilliseconds=0x1) [0112.392] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x59cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned 1 [0112.392] GetProcessHeap () returned 0x580000 [0112.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.392] Sleep (dwMilliseconds=0x1) [0113.319] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", len=0x3f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 1 [0113.320] GetProcessHeap () returned 0x580000 [0113.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xd0) returned 0x6f0ceb8 [0113.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0113.488] CloseHandle (hObject=0x44c) returned 1 [0113.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.488] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0125~1.YOU")) returned 0x5b9630 [0114.823] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0114.823] GetProcessHeap () returned 0x580000 [0114.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x677cd0 [0114.823] GetProcessHeap () returned 0x580000 [0114.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x635768 [0114.823] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.823] ReadFile (in: hFile=0x44c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xac0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x59cff14*=0xac0, lpOverlapped=0x0) returned 1 [0114.834] GetProcessHeap () returned 0x580000 [0114.834] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.834] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] WriteFile (in: hFile=0x44c, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x59cff14*=0xac0, lpOverlapped=0x0) returned 1 [0114.834] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] WriteFile (in: hFile=0x44c, lpBuffer=0x636227*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x636227*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.834] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.834] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.834] CloseHandle (hObject=0x44c) returned 1 [0114.834] GetProcessHeap () returned 0x580000 [0114.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0114.834] GetProcessHeap () returned 0x580000 [0114.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0114.834] GetProcessHeap () returned 0x580000 [0114.834] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c101360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x59cfd28, dwReserved1=0x677cd0, cFileName="AN01251_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0125~1.YOU")) returned 0x5b9630 [0115.834] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0115.873] CloseHandle (hObject=0x4b0) returned 1 [0115.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0017~2.YOU")) returned 0x5b9630 [0115.874] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0115.874] GetProcessHeap () returned 0x580000 [0115.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x6ef7f38 [0115.874] GetProcessHeap () returned 0x580000 [0115.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x6f151b8 [0115.874] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.874] ReadFile (in: hFile=0x4b0, lpBuffer=0x6ef7f38, nNumberOfBytesToRead=0x2240, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7f38*, lpNumberOfBytesRead=0x59cff14*=0x2240, lpOverlapped=0x0) returned 1 [0115.939] GetProcessHeap () returned 0x580000 [0115.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.939] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.939] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f151b8*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f151b8*, lpNumberOfBytesWritten=0x59cff14*=0x2240, lpOverlapped=0x0) returned 1 [0115.939] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.939] WriteFile (in: hFile=0x4b0, lpBuffer=0x6f173f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f173f7*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0115.939] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.939] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0115.939] CloseHandle (hObject=0x4b0) returned 1 [0115.939] GetProcessHeap () returned 0x580000 [0115.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f151b8 | out: hHeap=0x580000) returned 1 [0115.939] GetProcessHeap () returned 0x580000 [0115.939] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef7f38 | out: hHeap=0x580000) returned 1 [0115.939] GetProcessHeap () returned 0x580000 [0115.940] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0118.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cb6b3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2266, dwReserved0=0x59cfd28, dwReserved1=0x6ef7f38, cFileName="SO00170_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0017~2.YOU")) returned 0x5b9630 [0118.369] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.126] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", len=0x3f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF") returned 1 [0120.126] GetProcessHeap () returned 0x580000 [0120.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x176c) returned 0x6d06ca8 [0120.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.127] CloseHandle (hObject=0x170) returned 1 [0120.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0B2C~1.YOU")) returned 0x5b96f0 [0120.128] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.128] GetProcessHeap () returned 0x580000 [0120.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0120.128] GetProcessHeap () returned 0x580000 [0120.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x67fc68 [0120.128] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.128] ReadFile (in: hFile=0x170, lpBuffer=0x6f0c8f8, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesRead=0x59cff14*=0x300, lpOverlapped=0x0) returned 1 [0120.132] GetProcessHeap () returned 0x580000 [0120.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.132] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.132] WriteFile (in: hFile=0x170, lpBuffer=0x67fc68*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesWritten=0x59cff14*=0x300, lpOverlapped=0x0) returned 1 [0120.132] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] WriteFile (in: hFile=0x170, lpBuffer=0x67ff67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x67ff67*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.133] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.133] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.133] CloseHandle (hObject=0x170) returned 1 [0120.133] GetProcessHeap () returned 0x580000 [0120.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0120.133] GetProcessHeap () returned 0x580000 [0120.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0120.133] GetProcessHeap () returned 0x580000 [0120.133] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f370580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x59cfd28, dwReserved1=0x6f0c8f8, cFileName="WB01744_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0B2C~1.YOU")) returned 0x5b96f0 [0120.133] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.155] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", len=0x4c | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 1 [0120.155] GetProcessHeap () returned 0x580000 [0120.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x179c) returned 0x6d06ca8 [0120.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.490] CloseHandle (hObject=0x460) returned 1 [0120.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.id_1622540890_.your_last_chance")) returned 1 [0120.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0053~1.YOU")) returned 0x5b9630 [0120.491] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0120.491] GetProcessHeap () returned 0x580000 [0120.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x6f14048 [0120.491] GetProcessHeap () returned 0x580000 [0120.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x6df2780 [0120.491] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.492] ReadFile (in: hFile=0x460, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x59cff14*=0x2000, lpOverlapped=0x0) returned 1 [0120.568] GetProcessHeap () returned 0x580000 [0120.568] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.568] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.568] WriteFile (in: hFile=0x460, lpBuffer=0x6df2780*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2780*, lpNumberOfBytesWritten=0x59cff14*=0x2000, lpOverlapped=0x0) returned 1 [0120.568] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.569] WriteFile (in: hFile=0x460, lpBuffer=0x6df477f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df477f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.569] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.569] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.569] CloseHandle (hObject=0x460) returned 1 [0120.569] GetProcessHeap () returned 0x580000 [0120.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2780 | out: hHeap=0x580000) returned 1 [0120.569] GetProcessHeap () returned 0x580000 [0120.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0120.569] GetProcessHeap () returned 0x580000 [0120.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.569] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f79ac00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x203b, dwReserved0=0x59cfd28, dwReserved1=0x6f14048, cFileName="WB00531L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0053~1.YOU")) returned 0x5b9630 [0120.569] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0121.701] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", len=0x4f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 1 [0121.701] GetProcessHeap () returned 0x580000 [0121.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1830) returned 0x6e00ac0 [0121.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.701] CloseHandle (hObject=0x484) returned 1 [0122.701] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.701] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.id_1622540890_.your_last_chance")) returned 1 [0122.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0122.702] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.702] GetProcessHeap () returned 0x580000 [0122.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.702] GetProcessHeap () returned 0x580000 [0122.702] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.702] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.702] ReadFile (in: hFile=0x484, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x59cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.707] GetProcessHeap () returned 0x580000 [0122.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.707] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.707] WriteFile (in: hFile=0x484, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x59cff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.707] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.707] WriteFile (in: hFile=0x484, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.707] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.707] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.707] CloseHandle (hObject=0x484) returned 1 [0122.707] GetProcessHeap () returned 0x580000 [0122.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.707] GetProcessHeap () returned 0x580000 [0122.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.707] GetProcessHeap () returned 0x580000 [0122.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0125.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80bfc860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x59cfd28, dwReserved1=0x678958, cFileName="Newsprint.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSPR~1.YOU")) returned 0x5b9730 [0125.318] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.342] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", len=0x3d | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned 1 [0125.343] GetProcessHeap () returned 0x580000 [0125.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1950) returned 0x6f42f08 [0125.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0128.880] CloseHandle (hObject=0x46c) returned 1 [0128.880] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02342~1.YOU")) returned 0x5b9730 [0130.112] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0130.112] GetProcessHeap () returned 0x580000 [0130.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa881) returned 0x6d1a838 [0130.112] GetProcessHeap () returned 0x580000 [0130.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa881) returned 0x6d250c8 [0130.113] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.113] ReadFile (in: hFile=0x46c, lpBuffer=0x6d1a838, nNumberOfBytesToRead=0xa860, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1a838*, lpNumberOfBytesRead=0x59cff14*=0xa860, lpOverlapped=0x0) returned 1 [0133.188] GetProcessHeap () returned 0x580000 [0133.188] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0133.188] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.188] WriteFile (in: hFile=0x46c, lpBuffer=0x6d250c8*, nNumberOfBytesToWrite=0xa860, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d250c8*, lpNumberOfBytesWritten=0x59cff14*=0xa860, lpOverlapped=0x0) returned 1 [0133.188] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.188] WriteFile (in: hFile=0x46c, lpBuffer=0x6d2f927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f927*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0133.188] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.188] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0133.189] CloseHandle (hObject=0x46c) returned 1 [0134.145] GetProcessHeap () returned 0x580000 [0134.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d250c8 | out: hHeap=0x580000) returned 1 [0134.145] GetProcessHeap () returned 0x580000 [0134.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1a838 | out: hHeap=0x580000) returned 1 [0134.145] GetProcessHeap () returned 0x580000 [0134.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x86ff6460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa8a2, dwReserved0=0x59cfd28, dwReserved1=0x6d1a838, cFileName="J0234266.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02342~1.YOU")) returned 0x5b96b0 [0135.855] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.378] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x61 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0136.378] GetProcessHeap () returned 0x580000 [0136.382] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0136.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.383] CloseHandle (hObject=0x484) returned 1 [0136.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.383] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0136.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0136.384] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.384] GetProcessHeap () returned 0x580000 [0136.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0136.384] GetProcessHeap () returned 0x580000 [0136.384] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0136.384] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.384] ReadFile (in: hFile=0x484, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0136.386] GetProcessHeap () returned 0x580000 [0136.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.386] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.386] WriteFile (in: hFile=0x484, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0136.386] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.386] WriteFile (in: hFile=0x484, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0136.386] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.386] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0136.386] CloseHandle (hObject=0x484) returned 1 [0136.387] GetProcessHeap () returned 0x580000 [0136.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0136.387] GetProcessHeap () returned 0x580000 [0136.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0136.387] GetProcessHeap () returned 0x580000 [0136.387] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0136.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e75e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x59cfd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0136.387] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.392] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x5d | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0136.392] GetProcessHeap () returned 0x580000 [0136.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0136.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.529] CloseHandle (hObject=0x3a8) returned 1 [0138.529] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0138.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.530] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0138.530] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.530] GetProcessHeap () returned 0x580000 [0138.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0138.530] GetProcessHeap () returned 0x580000 [0138.530] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0138.530] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.530] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0138.532] GetProcessHeap () returned 0x580000 [0138.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0138.532] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.532] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0138.532] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.533] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.533] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.533] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.533] CloseHandle (hObject=0x3a8) returned 1 [0138.533] GetProcessHeap () returned 0x580000 [0138.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0138.533] GetProcessHeap () returned 0x580000 [0138.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0138.533] GetProcessHeap () returned 0x580000 [0138.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0138.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x59cfd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0138.653] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.901] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", len=0x5a | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned 1 [0139.902] GetProcessHeap () returned 0x580000 [0139.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0139.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.115] CloseHandle (hObject=0x170) returned 1 [0140.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.id_1622540890_.your_last_chance")) returned 1 [0140.116] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.116] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b9770 [0140.116] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.116] GetProcessHeap () returned 0x580000 [0140.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0140.117] GetProcessHeap () returned 0x580000 [0140.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0140.117] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.117] ReadFile (in: hFile=0x170, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x59cff14*=0x340, lpOverlapped=0x0) returned 1 [0140.121] GetProcessHeap () returned 0x580000 [0140.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.121] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.121] WriteFile (in: hFile=0x170, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x59cff14*=0x340, lpOverlapped=0x0) returned 1 [0140.121] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.121] WriteFile (in: hFile=0x170, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.121] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.121] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.121] CloseHandle (hObject=0x170) returned 1 [0140.121] GetProcessHeap () returned 0x580000 [0140.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0140.121] GetProcessHeap () returned 0x580000 [0140.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0140.121] GetProcessHeap () returned 0x580000 [0140.122] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b22a840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x59cfd28, dwReserved1=0x6dcfb90, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b9770 [0140.409] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.450] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", len=0x43 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned 1 [0140.450] GetProcessHeap () returned 0x580000 [0140.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db8) returned 0x6f14048 [0140.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.484] CloseHandle (hObject=0x488) returned 1 [0140.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.484] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1499~1.YOU")) returned 0x5b9770 [0140.657] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.657] GetProcessHeap () returned 0x580000 [0140.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673ce8 [0140.657] GetProcessHeap () returned 0x580000 [0140.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673fd0 [0140.657] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.657] ReadFile (in: hFile=0x488, lpBuffer=0x673ce8, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x673ce8*, lpNumberOfBytesRead=0x59cff14*=0x2a0, lpOverlapped=0x0) returned 1 [0140.660] GetProcessHeap () returned 0x580000 [0140.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.661] WriteFile (in: hFile=0x488, lpBuffer=0x673fd0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x673fd0*, lpNumberOfBytesWritten=0x59cff14*=0x2a0, lpOverlapped=0x0) returned 1 [0140.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.661] WriteFile (in: hFile=0x488, lpBuffer=0x67426f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x67426f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.661] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.661] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.661] CloseHandle (hObject=0x488) returned 1 [0140.661] GetProcessHeap () returned 0x580000 [0140.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673fd0 | out: hHeap=0x580000) returned 1 [0140.661] GetProcessHeap () returned 0x580000 [0140.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673ce8 | out: hHeap=0x580000) returned 1 [0140.661] GetProcessHeap () returned 0x580000 [0140.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b739700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2d2, dwReserved0=0x59cfd28, dwReserved1=0x673ce8, cFileName="BD14997_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1499~1.YOU")) returned 0x5b9730 [0141.012] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.541] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD", len=0x39 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 1 [0144.541] GetProcessHeap () returned 0x580000 [0144.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0144.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0144.591] CloseHandle (hObject=0x4a0) returned 1 [0144.591] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id_1622540890_.your_last_chance")) returned 1 [0144.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGCHV~1.YOU")) returned 0x5b9730 [0144.592] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0144.592] GetProcessHeap () returned 0x580000 [0144.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x6fe77c8 [0144.592] GetProcessHeap () returned 0x580000 [0144.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x661) returned 0x626d30 [0144.592] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.593] ReadFile (in: hFile=0x4a0, lpBuffer=0x6fe77c8, nNumberOfBytesToRead=0x640, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe77c8*, lpNumberOfBytesRead=0x59cff14*=0x640, lpOverlapped=0x0) returned 1 [0144.658] GetProcessHeap () returned 0x580000 [0144.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0144.658] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.658] WriteFile (in: hFile=0x4a0, lpBuffer=0x626d30*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesWritten=0x59cff14*=0x640, lpOverlapped=0x0) returned 1 [0144.658] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.658] WriteFile (in: hFile=0x4a0, lpBuffer=0x62736f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x62736f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0144.658] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.658] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0144.658] CloseHandle (hObject=0x4a0) returned 1 [0145.143] GetProcessHeap () returned 0x580000 [0145.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0145.144] GetProcessHeap () returned 0x580000 [0145.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe77c8 | out: hHeap=0x580000) returned 1 [0145.144] GetProcessHeap () returned 0x580000 [0145.144] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0146.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8dd4f700, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x59cfd28, dwReserved1=0x6fe77c8, cFileName="ORGCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORGCHV~1.YOU")) returned 0x5b96f0 [0146.865] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.880] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", len=0x44 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned 1 [0146.880] GetProcessHeap () returned 0x580000 [0146.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0146.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0152.620] CloseHandle (hObject=0x454) returned 1 [0152.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR17~1.YOU")) returned 0x5b9730 [0152.621] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0152.621] GetProcessHeap () returned 0x580000 [0152.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x6dbf1d0 [0152.621] GetProcessHeap () returned 0x580000 [0152.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x6dc1da0 [0152.621] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.622] ReadFile (in: hFile=0x454, lpBuffer=0x6dbf1d0, nNumberOfBytesToRead=0x2ba0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesRead=0x59cff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0152.661] GetProcessHeap () returned 0x580000 [0152.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.661] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.661] WriteFile (in: hFile=0x454, lpBuffer=0x6dc1da0*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc1da0*, lpNumberOfBytesWritten=0x59cff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0152.662] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.662] WriteFile (in: hFile=0x454, lpBuffer=0x6dc493f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc493f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0152.662] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.662] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0152.662] CloseHandle (hObject=0x454) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc1da0 | out: hHeap=0x580000) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0153.933] GetProcessHeap () returned 0x580000 [0153.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x935d4920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bdb, dwReserved0=0x59cfd28, dwReserved1=0x6dbf1d0, cFileName="PDIR17F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR17~1.YOU")) returned 0x5b9630 [0153.934] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.677] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", len=0x3f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE") returned 1 [0154.677] GetProcessHeap () returned 0x580000 [0154.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0154.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0156.330] CloseHandle (hObject=0x3fc) returned 1 [0156.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0156.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id_1622540890_.your_last_chance")) returned 1 [0160.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0160.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZLI~1.YOU")) returned 0x5b9630 [0160.478] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0160.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0160.478] GetProcessHeap () returned 0x580000 [0160.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71a1148 [0160.479] GetProcessHeap () returned 0x580000 [0160.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71b2978 [0160.480] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.480] ReadFile (in: hFile=0x3fc, lpBuffer=0x71a1148, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x71a1148*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.110] GetProcessHeap () returned 0x580000 [0165.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0165.110] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.110] WriteFile (in: hFile=0x3fc, lpBuffer=0x71b2978*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x71b2978*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.111] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.111] WriteFile (in: hFile=0x3fc, lpBuffer=0x71c4177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x71c4177*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0165.114] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.114] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0165.114] CloseHandle (hObject=0x3fc) returned 1 [0165.114] GetProcessHeap () returned 0x580000 [0165.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71b2978 | out: hHeap=0x580000) returned 1 [0165.114] GetProcessHeap () returned 0x580000 [0165.114] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71a1148 | out: hHeap=0x580000) returned 1 [0165.114] GetProcessHeap () returned 0x580000 [0165.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0166.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a080300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x204024, dwReserved0=0x59cfd28, dwReserved1=0x71a1148, cFileName="ACWZLIB.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZLI~1.YOU")) returned 0x5b9730 [0166.652] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.857] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", len=0x3b | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 1 [0169.857] GetProcessHeap () returned 0x580000 [0169.857] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0169.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0169.858] CloseHandle (hObject=0x470) returned 1 [0169.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id_1622540890_.your_last_chance")) returned 1 [0169.858] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACT3SA~1.YOU")) returned 0x5b9730 [0169.859] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0169.859] GetProcessHeap () returned 0x580000 [0169.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7024968 [0169.859] GetProcessHeap () returned 0x580000 [0169.860] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7036198 [0169.860] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.860] ReadFile (in: hFile=0x470, lpBuffer=0x7024968, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7024968*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.085] GetProcessHeap () returned 0x580000 [0174.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0174.085] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.085] WriteFile (in: hFile=0x470, lpBuffer=0x7036198*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7036198*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0174.086] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.086] WriteFile (in: hFile=0x470, lpBuffer=0x7047997*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7047997*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.086] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.086] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.086] CloseHandle (hObject=0x470) returned 1 [0174.086] GetProcessHeap () returned 0x580000 [0174.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7036198 | out: hHeap=0x580000) returned 1 [0174.086] GetProcessHeap () returned 0x580000 [0174.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7024968 | out: hHeap=0x580000) returned 1 [0174.086] GetProcessHeap () returned 0x580000 [0174.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0176.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f60b9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1619c, dwReserved0=0x59cfd28, dwReserved1=0x7024968, cFileName="ACT3.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACT3SA~1.YOU")) returned 0x5b96f0 [0176.796] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.821] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK", len=0x3f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 1 [0176.821] GetProcessHeap () returned 0x580000 [0176.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0176.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0176.821] CloseHandle (hObject=0x480) returned 1 [0176.821] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0176.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI574F~1.YOU")) returned 0x5b96f0 [0176.823] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0176.823] GetProcessHeap () returned 0x580000 [0176.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0176.823] GetProcessHeap () returned 0x580000 [0176.823] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0176.823] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.823] ReadFile (in: hFile=0x480, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x59cff14*=0x60, lpOverlapped=0x0) returned 1 [0176.824] GetProcessHeap () returned 0x580000 [0176.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.824] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.824] WriteFile (in: hFile=0x480, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x59cff14*=0x60, lpOverlapped=0x0) returned 1 [0176.824] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.824] WriteFile (in: hFile=0x480, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0176.825] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.825] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0176.825] CloseHandle (hObject=0x480) returned 1 [0176.825] GetProcessHeap () returned 0x580000 [0176.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0176.825] GetProcessHeap () returned 0x580000 [0176.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0176.825] GetProcessHeap () returned 0x580000 [0176.825] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa1014a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x59cfd28, dwReserved1=0x61b540, cFileName="VISIO_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI574F~1.YOU")) returned 0x5b96f0 [0176.825] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.890] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", len=0x48 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn") returned 1 [0176.890] GetProcessHeap () returned 0x580000 [0176.890] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0176.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.186] CloseHandle (hObject=0x3fc) returned 1 [0179.186] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.186] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.id_1622540890_.your_last_chance")) returned 1 [0179.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ed7300, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63ed7300, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x482d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REVIEW~1.YOU")) returned 0x5b96f0 [0179.187] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.187] GetProcessHeap () returned 0x580000 [0179.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4841) returned 0x6d763c8 [0179.187] GetProcessHeap () returned 0x580000 [0179.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4841) returned 0x6e0bec0 [0179.187] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.188] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d763c8, nNumberOfBytesToRead=0x4820, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d763c8*, lpNumberOfBytesRead=0x59cff14*=0x4820, lpOverlapped=0x0) returned 1 [0179.827] GetProcessHeap () returned 0x580000 [0179.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.827] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x3fc, lpBuffer=0x6e0bec0*, nNumberOfBytesToWrite=0x4820, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0bec0*, lpNumberOfBytesWritten=0x59cff14*=0x4820, lpOverlapped=0x0) returned 1 [0179.828] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.828] WriteFile (in: hFile=0x3fc, lpBuffer=0x6e106df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e106df*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0179.828] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.828] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0179.828] CloseHandle (hObject=0x3fc) returned 1 [0179.828] GetProcessHeap () returned 0x580000 [0179.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0bec0 | out: hHeap=0x580000) returned 1 [0179.828] GetProcessHeap () returned 0x580000 [0179.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d763c8 | out: hHeap=0x580000) returned 1 [0179.828] GetProcessHeap () returned 0x580000 [0179.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0181.349] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ed7300, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2ccb3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4851, dwReserved0=0x59cfd28, dwReserved1=0x6d763c8, cFileName="ReviewRouting_Review.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REVIEW~1.YOU")) returned 0x5b9770 [0181.349] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.359] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", len=0x6e | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned 1 [0181.359] GetProcessHeap () returned 0x580000 [0181.359] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0181.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.476] CloseHandle (hObject=0x430) returned 1 [0182.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x62002e, dwReserved1=0x70006d, cFileName="AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL0B62~1.YOU")) returned 0x5b9770 [0182.477] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0182.477] GetProcessHeap () returned 0x580000 [0182.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0182.477] GetProcessHeap () returned 0x580000 [0182.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0182.477] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.477] ReadFile (in: hFile=0x430, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x59cff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.553] GetProcessHeap () returned 0x580000 [0182.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0182.553] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] WriteFile (in: hFile=0x430, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x59cff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.553] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] WriteFile (in: hFile=0x430, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0182.553] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.553] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0182.554] CloseHandle (hObject=0x430) returned 1 [0182.554] GetProcessHeap () returned 0x580000 [0182.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0182.554] GetProcessHeap () returned 0x580000 [0182.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0182.554] GetProcessHeap () returned 0x580000 [0182.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.800] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa46d4440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x59cfd28, dwReserved1=0x6cbc098, cFileName="AlertImage_ContactLowMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AL0B62~1.YOU")) returned 0x5b9770 [0183.800] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.816] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", len=0x73 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned 1 [0183.816] GetProcessHeap () returned 0x580000 [0183.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0183.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.990] CloseHandle (hObject=0x43c) returned 1 [0185.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.991] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x560064, dwReserved1=0x650069, cFileName="EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMBEDD~1.YOU")) returned 0x5b96b0 [0185.992] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0185.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.992] GetProcessHeap () returned 0x580000 [0185.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1bec0 [0185.992] GetProcessHeap () returned 0x580000 [0185.992] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1e0c8 [0185.992] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.992] ReadFile (in: hFile=0x43c, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x59cff14*=0x20e0, lpOverlapped=0x0) returned 1 [0186.021] GetProcessHeap () returned 0x580000 [0186.021] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0186.021] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] WriteFile (in: hFile=0x43c, lpBuffer=0x6f1e0c8*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e0c8*, lpNumberOfBytesWritten=0x59cff14*=0x20e0, lpOverlapped=0x0) returned 1 [0186.021] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] WriteFile (in: hFile=0x43c, lpBuffer=0x6f201a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f201a7*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0186.021] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.021] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0186.021] CloseHandle (hObject=0x43c) returned 1 [0186.022] GetProcessHeap () returned 0x580000 [0186.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1e0c8 | out: hHeap=0x580000) returned 1 [0186.022] GetProcessHeap () returned 0x580000 [0186.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0186.022] GetProcessHeap () returned 0x580000 [0186.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0186.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa67db580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x59cfd28, dwReserved1=0x6f1bec0, cFileName="EmbeddedView.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EMBEDD~1.YOU")) returned 0x5b96b0 [0186.022] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.445] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", len=0x77 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 1 [0187.445] GetProcessHeap () returned 0x580000 [0187.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a8) returned 0x6f14048 [0187.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.655] CloseHandle (hObject=0x478) returned 1 [0188.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.656] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x248db, dwReserved0=0x750071, dwReserved1=0x730069, cFileName="Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIRING~2.YOU")) returned 0x5b9770 [0188.657] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0188.657] GetProcessHeap () returned 0x580000 [0188.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70c4d58 [0188.657] GetProcessHeap () returned 0x580000 [0188.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70d6588 [0188.658] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.658] ReadFile (in: hFile=0x478, lpBuffer=0x70c4d58, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4d58*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0192.565] GetProcessHeap () returned 0x580000 [0192.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0192.565] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.565] WriteFile (in: hFile=0x478, lpBuffer=0x70d6588*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x70d6588*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0192.566] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.566] WriteFile (in: hFile=0x478, lpBuffer=0x70e7d87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x70e7d87*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0192.566] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.566] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0192.566] CloseHandle (hObject=0x478) returned 1 [0192.566] GetProcessHeap () returned 0x580000 [0192.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70d6588 | out: hHeap=0x580000) returned 1 [0192.566] GetProcessHeap () returned 0x580000 [0192.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c4d58 | out: hHeap=0x580000) returned 1 [0192.566] GetProcessHeap () returned 0x580000 [0192.566] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0193.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa6315a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x248ff, dwReserved0=0x59cfd28, dwReserved1=0x70c4d58, cFileName="Hiring Requisition.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIRING~2.YOU")) returned 0x5b97b0 [0193.419] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.459] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", len=0x61 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned 1 [0193.459] GetProcessHeap () returned 0x580000 [0193.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0193.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.475] CloseHandle (hObject=0x3b8) returned 1 [0193.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.id_1622540890_.your_last_chance")) returned 1 [0193.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b97b0 [0193.476] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0193.476] GetProcessHeap () returned 0x580000 [0193.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6f1bec0 [0193.476] GetProcessHeap () returned 0x580000 [0193.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6f1d7c8 [0193.476] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.476] ReadFile (in: hFile=0x3b8, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x59cff14*=0x1840, lpOverlapped=0x0) returned 1 [0193.499] GetProcessHeap () returned 0x580000 [0193.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.499] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.499] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f1d7c8*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1d7c8*, lpNumberOfBytesWritten=0x59cff14*=0x1840, lpOverlapped=0x0) returned 1 [0193.499] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.499] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f1f007*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1f007*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0193.499] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.499] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0193.499] CloseHandle (hObject=0x3b8) returned 1 [0193.500] GetProcessHeap () returned 0x580000 [0193.500] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1d7c8 | out: hHeap=0x580000) returned 1 [0193.500] GetProcessHeap () returned 0x580000 [0193.500] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0193.500] GetProcessHeap () returned 0x580000 [0193.500] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaf1e820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1869, dwReserved0=0x59cfd28, dwReserved1=0x6f1bec0, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b97f0 [0193.923] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.924] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", len=0x65 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned 1 [0193.924] GetProcessHeap () returned 0x580000 [0193.924] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0193.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.925] CloseHandle (hObject=0x468) returned 1 [0193.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.925] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0193.926] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b97f0 [0193.926] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0193.926] GetProcessHeap () returned 0x580000 [0193.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0193.926] GetProcessHeap () returned 0x580000 [0193.926] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x635768 [0193.926] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.926] ReadFile (in: hFile=0x468, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x59cff14*=0xbe0, lpOverlapped=0x0) returned 1 [0193.937] GetProcessHeap () returned 0x580000 [0193.938] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.938] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.938] WriteFile (in: hFile=0x468, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x59cff14*=0xbe0, lpOverlapped=0x0) returned 1 [0193.938] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.938] WriteFile (in: hFile=0x468, lpBuffer=0x636347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x636347*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0193.938] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.938] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0193.938] CloseHandle (hObject=0x468) returned 1 [0193.938] GetProcessHeap () returned 0x580000 [0193.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0193.938] GetProcessHeap () returned 0x580000 [0193.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0193.938] GetProcessHeap () returned 0x580000 [0193.938] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab348ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc0c, dwReserved0=0x59cfd28, dwReserved1=0x677cd0, cFileName="AddToViewArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDTOV~2.YOU")) returned 0x5b97f0 [0193.938] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0195.348] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0195.349] GetProcessHeap () returned 0x580000 [0195.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0195.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.205] CloseHandle (hObject=0x4a0) returned 1 [0196.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.206] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0196.577] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5c0077, dwReserved1=0x410054, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0196.577] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.577] GetProcessHeap () returned 0x580000 [0196.577] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0196.578] GetProcessHeap () returned 0x580000 [0196.578] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0196.578] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.578] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0196.580] GetProcessHeap () returned 0x580000 [0196.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.580] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.580] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x59cff14*=0x140, lpOverlapped=0x0) returned 1 [0196.580] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.580] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.580] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.580] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.580] CloseHandle (hObject=0x4a0) returned 1 [0196.580] GetProcessHeap () returned 0x580000 [0196.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0196.581] GetProcessHeap () returned 0x580000 [0196.581] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0196.581] GetProcessHeap () returned 0x580000 [0196.581] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacc93860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x59cfd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0199.127] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.139] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", len=0x44 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned 1 [0199.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0199.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0199.259] CloseHandle (hObject=0x3e4) returned 1 [0199.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10f19, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR40~1.YOU")) returned 0x5b97b0 [0199.260] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0199.261] GetProcessHeap () returned 0x580000 [0199.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10f21) returned 0x6e0fcf0 [0199.261] GetProcessHeap () returned 0x580000 [0199.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10f21) returned 0x6e20c20 [0199.261] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.261] ReadFile (in: hFile=0x3e4, lpBuffer=0x6e0fcf0, nNumberOfBytesToRead=0x10f00, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesRead=0x59cff14*=0x10f00, lpOverlapped=0x0) returned 1 [0201.235] GetProcessHeap () returned 0x580000 [0201.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0201.236] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.236] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e20c20*, nNumberOfBytesToWrite=0x10f00, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e20c20*, lpNumberOfBytesWritten=0x59cff14*=0x10f00, lpOverlapped=0x0) returned 1 [0201.236] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.236] WriteFile (in: hFile=0x3e4, lpBuffer=0x6e31b1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e31b1f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.236] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.236] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.236] CloseHandle (hObject=0x3e4) returned 1 [0201.236] GetProcessHeap () returned 0x580000 [0201.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e20c20 | out: hHeap=0x580000) returned 1 [0201.237] GetProcessHeap () returned 0x580000 [0201.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0201.237] GetProcessHeap () returned 0x580000 [0201.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0202.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf8e9220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10f3d, dwReserved0=0x59cfd28, dwReserved1=0x6e0fcf0, cFileName="PDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR40~1.YOU")) returned 0x5b9770 [0202.026] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.083] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", len=0x44 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned 1 [0202.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0202.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0202.255] CloseHandle (hObject=0x480) returned 1 [0202.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.255] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.id_1622540890_.your_last_chance")) returned 1 [0202.256] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x23e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR36~2.YOU")) returned 0x5b9770 [0202.256] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0202.257] GetProcessHeap () returned 0x580000 [0202.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x71629b8 [0202.257] GetProcessHeap () returned 0x580000 [0202.257] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2401) returned 0x7114b18 [0202.257] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.257] ReadFile (in: hFile=0x480, lpBuffer=0x71629b8, nNumberOfBytesToRead=0x23e0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x71629b8*, lpNumberOfBytesRead=0x59cff14*=0x23e0, lpOverlapped=0x0) returned 1 [0202.347] GetProcessHeap () returned 0x580000 [0202.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0202.347] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.347] WriteFile (in: hFile=0x480, lpBuffer=0x7114b18*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7114b18*, lpNumberOfBytesWritten=0x59cff14*=0x23e0, lpOverlapped=0x0) returned 1 [0202.347] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.347] WriteFile (in: hFile=0x480, lpBuffer=0x7116ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7116ef7*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0202.347] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.347] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0202.347] CloseHandle (hObject=0x480) returned 1 [0202.347] GetProcessHeap () returned 0x580000 [0202.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7114b18 | out: hHeap=0x580000) returned 1 [0202.348] GetProcessHeap () returned 0x580000 [0202.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71629b8 | out: hHeap=0x580000) returned 1 [0202.348] GetProcessHeap () returned 0x580000 [0202.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0202.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb03793c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2405, dwReserved0=0x59cfd28, dwReserved1=0x71629b8, cFileName="PDIR36B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR36~2.YOU")) returned 0x5b9770 [0202.348] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.799] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x70 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0203.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0203.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0209.935] CloseHandle (hObject=0x450) returned 1 [0209.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.936] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0210.039] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.039] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x4e004f, dwReserved1=0x47002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0210.039] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0210.040] GetProcessHeap () returned 0x580000 [0210.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0210.040] GetProcessHeap () returned 0x580000 [0210.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0210.040] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.040] ReadFile (in: hFile=0x450, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x59cff14*=0x400, lpOverlapped=0x0) returned 1 [0210.044] GetProcessHeap () returned 0x580000 [0210.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.044] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.044] WriteFile (in: hFile=0x450, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x59cff14*=0x400, lpOverlapped=0x0) returned 1 [0210.045] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.045] WriteFile (in: hFile=0x450, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0210.045] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.045] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0210.045] CloseHandle (hObject=0x450) returned 1 [0210.045] GetProcessHeap () returned 0x580000 [0210.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0210.045] GetProcessHeap () returned 0x580000 [0210.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0210.045] GetProcessHeap () returned 0x580000 [0210.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cf7b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x59cfd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.537] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.556] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x6f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0214.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0214.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0214.557] CloseHandle (hObject=0x44c) returned 1 [0214.557] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.557] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0214.561] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x2e004e, dwReserved1=0x490047, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0214.561] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0214.562] GetProcessHeap () returned 0x580000 [0214.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0214.562] GetProcessHeap () returned 0x580000 [0214.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0214.562] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.562] ReadFile (in: hFile=0x44c, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x59cff14*=0x160, lpOverlapped=0x0) returned 1 [0214.564] GetProcessHeap () returned 0x580000 [0214.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.564] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.564] WriteFile (in: hFile=0x44c, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x59cff14*=0x160, lpOverlapped=0x0) returned 1 [0214.564] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.564] WriteFile (in: hFile=0x44c, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0214.564] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.564] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0214.564] CloseHandle (hObject=0x44c) returned 1 [0214.564] GetProcessHeap () returned 0x580000 [0214.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0214.564] GetProcessHeap () returned 0x580000 [0214.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0214.565] GetProcessHeap () returned 0x580000 [0214.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0214.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb781c9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x59cfd28, dwReserved1=0x5b8df0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0214.565] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.153] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK", len=0x43 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 1 [0217.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0217.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.155] CloseHandle (hObject=0x3a8) returned 1 [0217.155] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0217.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.156] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~1.YOU")) returned 0x5b97b0 [0217.156] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0217.157] GetProcessHeap () returned 0x580000 [0217.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0217.157] GetProcessHeap () returned 0x580000 [0217.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0217.157] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.157] ReadFile (in: hFile=0x3a8, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x59cff14*=0x60, lpOverlapped=0x0) returned 1 [0217.158] GetProcessHeap () returned 0x580000 [0217.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.158] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.158] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x59cff14*=0x60, lpOverlapped=0x0) returned 1 [0217.161] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.161] WriteFile (in: hFile=0x3a8, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0217.161] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.161] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0217.162] CloseHandle (hObject=0x3a8) returned 1 [0217.162] GetProcessHeap () returned 0x580000 [0217.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0217.162] GetProcessHeap () returned 0x580000 [0217.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0217.162] GetProcessHeap () returned 0x580000 [0217.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0217.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90cee00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x59cfd28, dwReserved1=0x61b540, cFileName="MSPUB.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~1.YOU")) returned 0x5b97b0 [0217.162] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.171] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", len=0x6e | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned 1 [0217.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0217.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.183] CloseHandle (hObject=0x4a4) returned 1 [0217.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance")) returned 1 [0217.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x63002e, dwReserved1=0x730073, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b97b0 [0217.184] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.184] GetProcessHeap () returned 0x580000 [0217.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfe1) returned 0x7309ff8 [0217.184] GetProcessHeap () returned 0x580000 [0217.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfe1) returned 0x6f468f0 [0217.184] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.184] ReadFile (in: hFile=0x4a4, lpBuffer=0x7309ff8, nNumberOfBytesToRead=0xfc0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7309ff8*, lpNumberOfBytesRead=0x59cff14*=0xfc0, lpOverlapped=0x0) returned 1 [0217.201] GetProcessHeap () returned 0x580000 [0217.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.201] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.201] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f468f0*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468f0*, lpNumberOfBytesWritten=0x59cff14*=0xfc0, lpOverlapped=0x0) returned 1 [0217.201] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.201] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f478af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f478af*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0217.201] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.201] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0217.201] CloseHandle (hObject=0x4a4) returned 1 [0217.201] GetProcessHeap () returned 0x580000 [0217.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468f0 | out: hHeap=0x580000) returned 1 [0217.201] GetProcessHeap () returned 0x580000 [0217.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7309ff8 | out: hHeap=0x580000) returned 1 [0217.202] GetProcessHeap () returned 0x580000 [0217.202] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0217.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9141220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x59cfd28, dwReserved1=0x7309ff8, cFileName="SpringGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b97b0 [0217.202] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.215] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", len=0x6e | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned 1 [0217.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0217.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.346] CloseHandle (hObject=0x4a4) returned 1 [0217.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0217.346] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x47002e, dwReserved1=0x460049, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0217.347] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0217.347] GetProcessHeap () returned 0x580000 [0217.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x70bfa28 [0217.347] GetProcessHeap () returned 0x580000 [0217.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0217.347] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.347] ReadFile (in: hFile=0x4a4, lpBuffer=0x70bfa28, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x70bfa28*, lpNumberOfBytesRead=0x59cff14*=0xca0, lpOverlapped=0x0) returned 1 [0218.543] GetProcessHeap () returned 0x580000 [0218.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.543] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.543] WriteFile (in: hFile=0x4a4, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x59cff14*=0xca0, lpOverlapped=0x0) returned 1 [0218.543] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.543] WriteFile (in: hFile=0x4a4, lpBuffer=0x636407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x636407*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0218.543] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.543] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0218.543] CloseHandle (hObject=0x4a4) returned 1 [0218.543] GetProcessHeap () returned 0x580000 [0218.543] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0218.543] GetProcessHeap () returned 0x580000 [0218.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70bfa28 | out: hHeap=0x580000) returned 1 [0218.544] GetProcessHeap () returned 0x580000 [0218.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9e0c860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xce1, dwReserved0=0x59cfd28, dwReserved1=0x70bfa28, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0221.338] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.390] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", len=0x72 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned 1 [0221.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0221.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0221.421] CloseHandle (hObject=0x460) returned 1 [0221.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0221.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x61004d, dwReserved1=0x6b0073, cFileName="ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b9730 [0221.440] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0221.440] GetProcessHeap () returned 0x580000 [0221.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef3020 [0221.440] GetProcessHeap () returned 0x580000 [0221.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef37e8 [0221.440] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.440] ReadFile (in: hFile=0x46c, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x59cff14*=0x780, lpOverlapped=0x0) returned 1 [0221.450] GetProcessHeap () returned 0x580000 [0221.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.450] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.450] WriteFile (in: hFile=0x46c, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x59cff14*=0x780, lpOverlapped=0x0) returned 1 [0221.450] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.450] WriteFile (in: hFile=0x46c, lpBuffer=0x6ef3f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f67*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.450] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.451] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.451] CloseHandle (hObject=0x46c) returned 1 [0221.451] GetProcessHeap () returned 0x580000 [0221.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0221.451] GetProcessHeap () returned 0x580000 [0221.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0221.451] GetProcessHeap () returned 0x580000 [0221.451] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb9b8820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7c0, dwReserved0=0x59cfd28, dwReserved1=0x6ef3020, cFileName="ProjectTaskIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b9730 [0221.451] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.481] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", len=0x52 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 1 [0221.482] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f4c) returned 0x6dee6e0 [0221.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.482] CloseHandle (hObject=0x3e4) returned 1 [0221.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id_1622540890_.your_last_chance")) returned 1 [0221.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~2.YOU")) returned 0x5b9730 [0221.484] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.484] GetProcessHeap () returned 0x580000 [0221.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35358 [0221.484] GetProcessHeap () returned 0x580000 [0221.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb41) returned 0x6d35ee0 [0221.484] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.484] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d35358, nNumberOfBytesToRead=0xb20, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35358*, lpNumberOfBytesRead=0x59cff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.599] GetProcessHeap () returned 0x580000 [0221.599] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.599] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.599] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d35ee0*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d35ee0*, lpNumberOfBytesWritten=0x59cff14*=0xb20, lpOverlapped=0x0) returned 1 [0221.599] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.599] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d369ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d369ff*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.599] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.599] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.599] CloseHandle (hObject=0x3e4) returned 1 [0221.599] GetProcessHeap () returned 0x580000 [0221.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35ee0 | out: hHeap=0x580000) returned 1 [0221.599] GetProcessHeap () returned 0x580000 [0221.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d35358 | out: hHeap=0x580000) returned 1 [0221.599] GetProcessHeap () returned 0x580000 [0221.599] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbb355e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb52, dwReserved0=0x59cfd28, dwReserved1=0x6d35358, cFileName="StatusDoNotDisturb.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STATUS~2.YOU")) returned 0x5b9730 [0221.600] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.638] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", len=0x48 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 1 [0221.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f30) returned 0x6dee6e0 [0221.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.675] CloseHandle (hObject=0x3e4) returned 1 [0221.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id_1622540890_.your_last_chance")) returned 1 [0221.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTGOI~1.YOU")) returned 0x5b9730 [0221.676] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.676] GetProcessHeap () returned 0x580000 [0221.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0221.676] GetProcessHeap () returned 0x580000 [0221.676] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0221.676] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.676] ReadFile (in: hFile=0x3e4, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x59cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.722] GetProcessHeap () returned 0x580000 [0221.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.722] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.722] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x59cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0221.722] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.722] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0221.722] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.722] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0221.722] CloseHandle (hObject=0x3e4) returned 1 [0221.722] GetProcessHeap () returned 0x580000 [0221.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0221.722] GetProcessHeap () returned 0x580000 [0221.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0221.722] GetProcessHeap () returned 0x580000 [0221.722] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.723] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbc3ff80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6da, dwReserved0=0x59cfd28, dwReserved1=0x6c79898, cFileName="OUTGOING.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTGOI~1.YOU")) returned 0x5b9730 [0221.723] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.782] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", len=0x44 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 1 [0221.782] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0221.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.783] CloseHandle (hObject=0x47c) returned 1 [0221.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id_1622540890_.your_last_chance")) returned 1 [0221.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAILIC~1.YOU")) returned 0x5b9730 [0221.786] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.786] GetProcessHeap () returned 0x580000 [0221.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10060 [0221.786] GetProcessHeap () returned 0x580000 [0221.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10ae8 [0221.786] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.786] ReadFile (in: hFile=0x47c, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x59cff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.194] GetProcessHeap () returned 0x580000 [0222.194] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0222.194] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.194] WriteFile (in: hFile=0x47c, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x59cff14*=0xa20, lpOverlapped=0x0) returned 1 [0222.194] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.194] WriteFile (in: hFile=0x47c, lpBuffer=0x6c11507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11507*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.194] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.194] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.195] CloseHandle (hObject=0x47c) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0222.441] GetProcessHeap () returned 0x580000 [0222.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0225.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0dca20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa52, dwReserved0=0x59cfd28, dwReserved1=0x6c10060, cFileName="MAIL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAILIC~1.YOU")) returned 0x5b9630 [0225.412] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.427] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", len=0x37 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 1 [0225.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0225.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0225.428] CloseHandle (hObject=0x440) returned 1 [0225.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.429] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.id_1622540890_.your_last_chance")) returned 1 [0225.429] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.430] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXGENE~1.YOU")) returned 0x5b9630 [0225.430] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0225.430] GetProcessHeap () returned 0x580000 [0225.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7166de8 [0225.430] GetProcessHeap () returned 0x580000 [0225.430] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7178618 [0225.430] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.430] ReadFile (in: hFile=0x440, lpBuffer=0x7166de8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7166de8*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.870] GetProcessHeap () returned 0x580000 [0233.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0233.870] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.870] WriteFile (in: hFile=0x440, lpBuffer=0x7178618*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7178618*, lpNumberOfBytesWritten=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.870] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.870] WriteFile (in: hFile=0x440, lpBuffer=0x7189e17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e17*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0233.871] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.871] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0233.871] CloseHandle (hObject=0x440) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7178618 | out: hHeap=0x580000) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7166de8 | out: hHeap=0x580000) returned 1 [0235.461] GetProcessHeap () returned 0x580000 [0235.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0239.575] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2ea80e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16dd4, dwReserved0=0x59cfd28, dwReserved1=0x7166de8, cFileName="IXGENERC.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXGENE~1.YOU")) returned 0x5b9730 [0239.575] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.591] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", len=0x33 | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned 1 [0239.592] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0239.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0239.592] CloseHandle (hObject=0x48c) returned 1 [0239.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0239.593] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.id_1622540890_.your_last_chance")) returned 1 [0239.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0239.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPVB~1.YOU")) returned 0x5b9630 [0239.594] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ospp.vbs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0239.594] GetProcessHeap () returned 0x580000 [0239.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc121) returned 0x7061928 [0239.595] GetProcessHeap () returned 0x580000 [0239.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc121) returned 0x6d21878 [0239.595] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.595] ReadFile (in: hFile=0x48c, lpBuffer=0x7061928, nNumberOfBytesToRead=0xc100, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x59cff14*=0xc100, lpOverlapped=0x0) returned 1 [0241.249] GetProcessHeap () returned 0x580000 [0241.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.250] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.250] WriteFile (in: hFile=0x48c, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0xc100, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x59cff14*=0xc100, lpOverlapped=0x0) returned 1 [0241.250] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.250] WriteFile (in: hFile=0x48c, lpBuffer=0x6d2d977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2d977*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0241.250] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.250] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0241.250] CloseHandle (hObject=0x48c) returned 1 [0241.252] GetProcessHeap () returned 0x580000 [0241.252] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0241.252] GetProcessHeap () returned 0x580000 [0241.253] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0241.253] GetProcessHeap () returned 0x580000 [0241.253] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7506b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc13d, dwReserved0=0x59cfd28, dwReserved1=0x7061928, cFileName="OSPP.VBS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPVB~1.YOU")) returned 0x5b9630 [0241.850] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.868] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML", len=0x3f | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned 1 [0241.868] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0241.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0245.280] CloseHandle (hObject=0x45c) returned 1 [0245.280] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.281] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml.id_1622540890_.your_last_chance")) returned 1 [0245.282] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.282] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN01~1.YOU")) returned 0x5b96f0 [0245.282] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0245.282] GetProcessHeap () returned 0x580000 [0245.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1be1) returned 0x7111f48 [0245.282] GetProcessHeap () returned 0x580000 [0245.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1be1) returned 0x7113b38 [0245.282] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.283] ReadFile (in: hFile=0x45c, lpBuffer=0x7111f48, nNumberOfBytesToRead=0x1bc0, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesRead=0x59cff14*=0x1bc0, lpOverlapped=0x0) returned 1 [0245.309] GetProcessHeap () returned 0x580000 [0245.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0245.309] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.309] WriteFile (in: hFile=0x45c, lpBuffer=0x7113b38*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7113b38*, lpNumberOfBytesWritten=0x59cff14*=0x1bc0, lpOverlapped=0x0) returned 1 [0245.309] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.309] WriteFile (in: hFile=0x45c, lpBuffer=0x71156f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x71156f7*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0245.309] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.309] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0245.309] CloseHandle (hObject=0x45c) returned 1 [0245.309] GetProcessHeap () returned 0x580000 [0245.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7113b38 | out: hHeap=0x580000) returned 1 [0245.309] GetProcessHeap () returned 0x580000 [0245.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0245.309] GetProcessHeap () returned 0x580000 [0245.309] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.275] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9bb50c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1be8, dwReserved0=0x59cfd28, dwReserved1=0x7111f48, cFileName="PGMN010.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN01~1.YOU")) returned 0x5b9730 [0249.276] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.391] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML", len=0x3e | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned 1 [0249.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0249.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0253.752] CloseHandle (hObject=0x44c) returned 1 [0253.752] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml.id_1622540890_.your_last_chance")) returned 1 [0253.753] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181eda00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x181eda00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x757a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BROCHU~2.YOU")) returned 0x5b9730 [0253.753] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0253.754] GetProcessHeap () returned 0x580000 [0253.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7581) returned 0x6fde770 [0253.754] GetProcessHeap () returned 0x580000 [0253.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7581) returned 0x6fe5d00 [0253.754] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.754] ReadFile (in: hFile=0x44c, lpBuffer=0x6fde770, nNumberOfBytesToRead=0x7560, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fde770*, lpNumberOfBytesRead=0x59cff14*=0x7560, lpOverlapped=0x0) returned 1 [0255.603] GetProcessHeap () returned 0x580000 [0255.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0255.603] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.603] WriteFile (in: hFile=0x44c, lpBuffer=0x6fe5d00*, nNumberOfBytesToWrite=0x7560, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe5d00*, lpNumberOfBytesWritten=0x59cff14*=0x7560, lpOverlapped=0x0) returned 1 [0255.603] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.603] WriteFile (in: hFile=0x44c, lpBuffer=0x6fed25f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fed25f*, lpNumberOfBytesWritten=0x59cff14*=0x20, lpOverlapped=0x0) returned 1 [0255.603] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.603] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x59cff14*=0x4, lpOverlapped=0x0) returned 1 [0255.604] CloseHandle (hObject=0x44c) returned 1 [0256.750] GetProcessHeap () returned 0x580000 [0256.750] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fe5d00 | out: hHeap=0x580000) returned 1 [0256.750] GetProcessHeap () returned 0x580000 [0256.750] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fde770 | out: hHeap=0x580000) returned 1 [0256.750] GetProcessHeap () returned 0x580000 [0256.750] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0258.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfccc | out: lpFindFileData=0x59cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181eda00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfde5c40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x759e, dwReserved0=0x59cfd28, dwReserved1=0x6fde770, cFileName="BROCHURE.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BROCHU~2.YOU")) returned 0x5b9730 [0258.986] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.003] SysReAllocStringLen (in: pbstr=0x59cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC", len=0x3d | out: pbstr=0x59cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC") returned 1 [0259.004] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fac) returned 0x72e5948 [0259.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0259.004] CloseHandle (hObject=0x46c) returned 1 [0259.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x59cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x59cfc74 | out: lpFindFileData=0x59cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x27842, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LABEL9~1.YOU")) returned 0x5b9730 [0259.006] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0259.006] GetProcessHeap () returned 0x580000 [0259.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7166de8 [0259.007] GetProcessHeap () returned 0x580000 [0259.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7178618 [0259.007] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.007] ReadFile (in: hFile=0x46c, lpBuffer=0x7166de8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x59cff14, lpOverlapped=0x0 | out: lpBuffer=0x7166de8*, lpNumberOfBytesRead=0x59cff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 49 os_tid = 0xabc [0039.068] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.149] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.673] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.740] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.812] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.392] Sleep (dwMilliseconds=0x1) [0040.512] Sleep (dwMilliseconds=0x1) [0040.540] Sleep (dwMilliseconds=0x1) [0040.555] Sleep (dwMilliseconds=0x1) [0040.595] Sleep (dwMilliseconds=0x1) [0042.316] Sleep (dwMilliseconds=0x1) [0042.346] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.646] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.791] Sleep (dwMilliseconds=0x1) [0042.815] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.848] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.197] Sleep (dwMilliseconds=0x1) [0043.277] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.384] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.431] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.462] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.556] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.694] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.734] Sleep (dwMilliseconds=0x1) [0043.749] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.780] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.827] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.936] Sleep (dwMilliseconds=0x1) [0043.952] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.030] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.434] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.465] Sleep (dwMilliseconds=0x1) [0044.481] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.512] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.622] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.700] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.809] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.012] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.043] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.105] Sleep (dwMilliseconds=0x1) [0045.120] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.168] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.277] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.323] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.354] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.417] Sleep (dwMilliseconds=0x1) [0045.432] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.480] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.557] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.807] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.855] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.901] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.932] Sleep (dwMilliseconds=0x1) [0045.948] Sleep (dwMilliseconds=0x1) [0045.964] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.995] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.026] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.057] Sleep (dwMilliseconds=0x1) [0046.072] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.104] Sleep (dwMilliseconds=0x1) [0046.119] Sleep (dwMilliseconds=0x1) [0046.135] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.181] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.213] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.244] Sleep (dwMilliseconds=0x1) [0046.259] Sleep (dwMilliseconds=0x1) [0046.278] Sleep (dwMilliseconds=0x1) [0046.291] Sleep (dwMilliseconds=0x1) [0046.306] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.347] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.369] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.447] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.494] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.572] Sleep (dwMilliseconds=0x1) [0046.589] Sleep (dwMilliseconds=0x1) [0046.603] Sleep (dwMilliseconds=0x1) [0046.618] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.650] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.681] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.728] Sleep (dwMilliseconds=0x1) [0046.743] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.806] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] Sleep (dwMilliseconds=0x1) [0046.852] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.883] Sleep (dwMilliseconds=0x1) [0046.899] Sleep (dwMilliseconds=0x1) [0046.915] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.962] Sleep (dwMilliseconds=0x1) [0046.977] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.023] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.070] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.148] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.225] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.319] Sleep (dwMilliseconds=0x1) [0047.335] Sleep (dwMilliseconds=0x1) [0047.358] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.382] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] Sleep (dwMilliseconds=0x1) [0047.459] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.491] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.725] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] Sleep (dwMilliseconds=0x1) [0047.772] Sleep (dwMilliseconds=0x1) [0047.788] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.834] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.959] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.037] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] Sleep (dwMilliseconds=0x1) [0048.083] Sleep (dwMilliseconds=0x1) [0048.101] Sleep (dwMilliseconds=0x1) [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.146] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.239] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.271] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] Sleep (dwMilliseconds=0x1) [0048.349] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.403] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.427] Sleep (dwMilliseconds=0x1) [0048.442] Sleep (dwMilliseconds=0x1) [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.551] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.583] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.661] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.739] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.817] Sleep (dwMilliseconds=0x1) [0048.832] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.863] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.895] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] Sleep (dwMilliseconds=0x1) [0049.145] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.175] Sleep (dwMilliseconds=0x1) [0049.197] Sleep (dwMilliseconds=0x1) [0049.207] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.332] Sleep (dwMilliseconds=0x1) [0049.348] Sleep (dwMilliseconds=0x1) [0049.363] Sleep (dwMilliseconds=0x1) [0049.379] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.463] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.488] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.519] Sleep (dwMilliseconds=0x1) [0049.534] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.618] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.643] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.675] Sleep (dwMilliseconds=0x1) [0049.691] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.753] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.846] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.894] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.956] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.987] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.111] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.143] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.195] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.299] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.377] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.486] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.550] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.595] Sleep (dwMilliseconds=0x1) [0050.611] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.642] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.689] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.767] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.798] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.849] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.876] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.922] Sleep (dwMilliseconds=0x1) [0050.940] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.001] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.078] Sleep (dwMilliseconds=0x1) [0051.096] Sleep (dwMilliseconds=0x1) [0051.110] Sleep (dwMilliseconds=0x1) [0051.126] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] Sleep (dwMilliseconds=0x1) [0051.172] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.235] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.266] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.313] Sleep (dwMilliseconds=0x1) [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.438] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.469] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.547] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.578] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.635] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.701] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.028] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.480] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.636] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.073] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.202] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.385] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.432] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.697] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.744] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.009] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.134] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.165] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.212] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.368] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.477] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.789] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.836] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.945] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.257] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.460] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.485] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", len=0x51 | out: pbstr=0x5b0ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 1 [0058.485] GetProcessHeap () returned 0x580000 [0058.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615320, Size=0x18) returned 0x5a58e8 [0058.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0060.592] CloseHandle (hObject=0x428) returned 1 [0060.592] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.592] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id_1622540890_.your_last_chance")) returned 1 [0060.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.628] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b9630 [0060.628] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0060.628] GetProcessHeap () returned 0x580000 [0060.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c7a388 [0060.628] GetProcessHeap () returned 0x580000 [0060.628] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c8bbb8 [0060.628] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.628] ReadFile (in: hFile=0x428, lpBuffer=0x6c7a388, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a388*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.552] GetProcessHeap () returned 0x580000 [0066.552] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0066.552] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.552] WriteFile (in: hFile=0x428, lpBuffer=0x6c8bbb8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c8bbb8*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0067.503] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.503] WriteFile (in: hFile=0x428, lpBuffer=0x6c9d3b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9d3b7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.830] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.830] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.831] CloseHandle (hObject=0x428) returned 1 [0076.020] GetProcessHeap () returned 0x580000 [0076.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c8bbb8 | out: hHeap=0x580000) returned 1 [0076.021] GetProcessHeap () returned 0x580000 [0076.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a388 | out: hHeap=0x580000) returned 1 [0076.021] GetProcessHeap () returned 0x580000 [0076.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0079.342] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x64e69240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1416b78, dwReserved0=0x5b0fd28, dwReserved1=0x6c7a388, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b96f0 [0079.342] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.497] Sleep (dwMilliseconds=0x1) [0086.391] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 1 [0086.391] GetProcessHeap () returned 0x580000 [0086.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0086.392] CloseHandle (hObject=0x498) returned 1 [0086.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0087.517] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0087.517] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0087.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8881) returned 0x6efb338 [0087.518] GetProcessHeap () returned 0x580000 [0087.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8881) returned 0x6c20e18 [0087.518] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.518] ReadFile (in: hFile=0x498, lpBuffer=0x6efb338, nNumberOfBytesToRead=0x8860, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb338*, lpNumberOfBytesRead=0x5b0ff14*=0x8860, lpOverlapped=0x0) returned 1 [0088.925] GetProcessHeap () returned 0x580000 [0088.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0088.925] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.925] WriteFile (in: hFile=0x498, lpBuffer=0x6c20e18*, nNumberOfBytesToWrite=0x8860, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c20e18*, lpNumberOfBytesWritten=0x5b0ff14*=0x8860, lpOverlapped=0x0) returned 1 [0088.926] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.926] WriteFile (in: hFile=0x498, lpBuffer=0x6c29677*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29677*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.926] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.926] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.926] CloseHandle (hObject=0x498) returned 1 [0088.927] GetProcessHeap () returned 0x580000 [0088.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c20e18 | out: hHeap=0x580000) returned 1 [0088.927] GetProcessHeap () returned 0x580000 [0088.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb338 | out: hHeap=0x580000) returned 1 [0088.927] GetProcessHeap () returned 0x580000 [0088.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0088.927] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c9e4780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8888, dwReserved0=0x5b0fd28, dwReserved1=0x6efb338, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0088.927] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.670] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x5b0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 1 [0091.670] GetProcessHeap () returned 0x580000 [0091.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0091.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.777] CloseHandle (hObject=0x4a0) returned 1 [0091.777] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0091.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x45, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0091.778] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0091.778] GetProcessHeap () returned 0x580000 [0091.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f0c4f8 [0091.778] GetProcessHeap () returned 0x580000 [0091.778] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6d06ca8 [0091.778] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.778] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x5b0ff14*=0x540, lpOverlapped=0x0) returned 1 [0091.785] GetProcessHeap () returned 0x580000 [0091.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.785] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x5b0ff14*=0x540, lpOverlapped=0x0) returned 1 [0091.785] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.785] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d071e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d071e7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.785] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.786] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.786] CloseHandle (hObject=0x4a0) returned 1 [0091.786] GetProcessHeap () returned 0x580000 [0091.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0091.786] GetProcessHeap () returned 0x580000 [0091.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0091.786] GetProcessHeap () returned 0x580000 [0091.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e51e320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x5b0fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0091.786] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.791] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x5b0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 1 [0091.791] GetProcessHeap () returned 0x580000 [0091.791] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0091.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0091.791] CloseHandle (hObject=0x42c) returned 1 [0091.791] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.792] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0091.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.794] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0091.794] GetProcessHeap () returned 0x580000 [0091.794] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7ec1) returned 0x636970 [0091.795] GetProcessHeap () returned 0x580000 [0091.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7ec1) returned 0x63e840 [0091.795] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.795] ReadFile (in: hFile=0x42c, lpBuffer=0x636970, nNumberOfBytesToRead=0x7ea0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x5b0ff14*=0x7ea0, lpOverlapped=0x0) returned 1 [0095.403] GetProcessHeap () returned 0x580000 [0095.403] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0095.403] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x42c, lpBuffer=0x63e840*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x63e840*, lpNumberOfBytesWritten=0x5b0ff14*=0x7ea0, lpOverlapped=0x0) returned 1 [0095.404] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x42c, lpBuffer=0x6466df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6466df*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0095.404] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.404] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0095.404] CloseHandle (hObject=0x42c) returned 1 [0095.404] GetProcessHeap () returned 0x580000 [0095.404] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63e840 | out: hHeap=0x580000) returned 1 [0095.404] GetProcessHeap () returned 0x580000 [0095.404] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0095.405] GetProcessHeap () returned 0x580000 [0095.405] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0095.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x707a2220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7ed5, dwReserved0=0x5b0fd28, dwReserved1=0x636970, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0095.405] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0096.854] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x5b0ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 1 [0096.854] GetProcessHeap () returned 0x580000 [0096.854] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0096.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0096.855] CloseHandle (hObject=0x454) returned 1 [0096.855] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0096.855] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0102.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0102.042] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0102.042] GetProcessHeap () returned 0x580000 [0102.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4181) returned 0x631f48 [0102.042] GetProcessHeap () returned 0x580000 [0102.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4181) returned 0x6609a0 [0102.042] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.042] ReadFile (in: hFile=0x454, lpBuffer=0x631f48, nNumberOfBytesToRead=0x4160, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x631f48*, lpNumberOfBytesRead=0x5b0ff14*=0x4160, lpOverlapped=0x0) returned 1 [0102.820] GetProcessHeap () returned 0x580000 [0102.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.820] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.820] WriteFile (in: hFile=0x454, lpBuffer=0x6609a0*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6609a0*, lpNumberOfBytesWritten=0x5b0ff14*=0x4160, lpOverlapped=0x0) returned 1 [0102.821] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x454, lpBuffer=0x664aff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x664aff*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.821] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.821] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.821] CloseHandle (hObject=0x454) returned 1 [0102.821] GetProcessHeap () returned 0x580000 [0102.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6609a0 | out: hHeap=0x580000) returned 1 [0102.821] GetProcessHeap () returned 0x580000 [0102.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x631f48 | out: hHeap=0x580000) returned 1 [0102.821] GetProcessHeap () returned 0x580000 [0102.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74e730a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4186, dwReserved0=0x5b0fd28, dwReserved1=0x631f48, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0102.822] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.076] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", len=0x45 | out: pbstr=0x5b0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned 1 [0112.076] GetProcessHeap () returned 0x580000 [0112.076] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f880 [0112.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.091] Sleep (dwMilliseconds=0x1) [0112.121] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", len=0x46 | out: pbstr=0x5b0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 1 [0112.121] GetProcessHeap () returned 0x580000 [0112.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x6c) returned 0x6f1b208 [0112.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.121] Sleep (dwMilliseconds=0x1) [0112.221] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", len=0x42 | out: pbstr=0x5b0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 1 [0112.221] GetProcessHeap () returned 0x580000 [0112.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.221] Sleep (dwMilliseconds=0x1) [0112.240] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", len=0x4c | out: pbstr=0x5b0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 1 [0112.241] GetProcessHeap () returned 0x580000 [0112.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x28) returned 0x5dc550 [0112.241] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.248] Sleep (dwMilliseconds=0x1) [0112.360] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv", len=0x47 | out: pbstr=0x5b0ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv") returned 1 [0112.361] GetProcessHeap () returned 0x580000 [0112.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.361] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.385] Sleep (dwMilliseconds=0x1) [0112.480] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", len=0x50 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 1 [0112.480] GetProcessHeap () returned 0x580000 [0112.480] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92e8 [0112.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0113.253] CloseHandle (hObject=0x45c) returned 1 [0113.253] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id_1622540890_.your_last_chance")) returned 1 [0113.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~1.YOU")) returned 0x5b9730 [0113.254] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0113.254] GetProcessHeap () returned 0x580000 [0113.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7901) returned 0x6f10048 [0113.254] GetProcessHeap () returned 0x580000 [0113.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7901) returned 0x6dfaac0 [0113.255] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.255] ReadFile (in: hFile=0x45c, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x78e0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x5b0ff14*=0x78e0, lpOverlapped=0x0) returned 1 [0113.825] GetProcessHeap () returned 0x580000 [0113.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.825] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.825] WriteFile (in: hFile=0x45c, lpBuffer=0x6dfaac0*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesWritten=0x5b0ff14*=0x78e0, lpOverlapped=0x0) returned 1 [0113.826] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.826] WriteFile (in: hFile=0x45c, lpBuffer=0x6e0239f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0239f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.826] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.826] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.826] CloseHandle (hObject=0x45c) returned 1 [0113.826] GetProcessHeap () returned 0x580000 [0113.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0113.826] GetProcessHeap () returned 0x580000 [0113.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0113.828] GetProcessHeap () returned 0x580000 [0113.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b755a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7908, dwReserved0=0x580000, dwReserved1=0x6f19950, cFileName="Informix.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFORM~1.YOU")) returned 0x5b9630 [0113.913] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0114.038] CloseHandle (hObject=0x4ac) returned 1 [0114.038] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN0023~1.YOU")) returned 0x5b9630 [0114.076] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0114.077] GetProcessHeap () returned 0x580000 [0114.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x6c6a0f8 [0114.077] GetProcessHeap () returned 0x580000 [0114.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x6c6ccc8 [0114.077] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.077] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c6a0f8, nNumberOfBytesToRead=0x2ba0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesRead=0x5b0ff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0115.266] GetProcessHeap () returned 0x580000 [0115.266] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.266] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.266] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6ccc8*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6ccc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.266] WriteFile (in: hFile=0x4ac, lpBuffer=0x6c6f867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f867*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.266] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.266] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.266] CloseHandle (hObject=0x4ac) returned 1 [0115.266] GetProcessHeap () returned 0x580000 [0115.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6ccc8 | out: hHeap=0x580000) returned 1 [0115.266] GetProcessHeap () returned 0x580000 [0115.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0115.266] GetProcessHeap () returned 0x580000 [0115.266] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c505880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bda, dwReserved0=0x5b0fd28, dwReserved1=0x6c6a0f8, cFileName="IN00233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IN0023~1.YOU")) returned 0x5b9630 [0117.324] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.009] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", len=0x3c | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF") returned 1 [0120.009] GetProcessHeap () returned 0x580000 [0120.009] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b4) returned 0x6d06ca8 [0120.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.009] CloseHandle (hObject=0x4a0) returned 1 [0120.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.id_1622540890_.your_last_chance")) returned 1 [0120.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WING2W~1.YOU")) returned 0x5b96f0 [0120.010] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.011] GetProcessHeap () returned 0x580000 [0120.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6c676b8 [0120.011] GetProcessHeap () returned 0x580000 [0120.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6c10060 [0120.011] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.011] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x5b0ff14*=0x960, lpOverlapped=0x0) returned 1 [0120.076] GetProcessHeap () returned 0x580000 [0120.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.076] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.076] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c10060*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesWritten=0x5b0ff14*=0x960, lpOverlapped=0x0) returned 1 [0120.076] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.076] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c109bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c109bf*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.076] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.077] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.077] CloseHandle (hObject=0x4a0) returned 1 [0120.077] GetProcessHeap () returned 0x580000 [0120.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0120.077] GetProcessHeap () returned 0x580000 [0120.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0120.077] GetProcessHeap () returned 0x580000 [0120.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f2fe160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x99a, dwReserved0=0x5b0fd28, dwReserved1=0x6c676b8, cFileName="WING2.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WING2W~1.YOU")) returned 0x5b96f0 [0120.077] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.093] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF") returned 1 [0120.093] GetProcessHeap () returned 0x580000 [0120.093] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x177c) returned 0x6d06ca8 [0120.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.093] CloseHandle (hObject=0x438) returned 1 [0120.093] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.093] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.094] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~2.YOU")) returned 0x5b96f0 [0120.094] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.094] GetProcessHeap () returned 0x580000 [0120.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x67c940 [0120.094] GetProcessHeap () returned 0x580000 [0120.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61120 [0120.095] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.095] ReadFile (in: hFile=0x438, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x5b0ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.105] GetProcessHeap () returned 0x580000 [0120.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.105] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.105] WriteFile (in: hFile=0x438, lpBuffer=0x6c61120*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesWritten=0x5b0ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.105] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.105] WriteFile (in: hFile=0x438, lpBuffer=0x6c613df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613df*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.106] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.106] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.106] CloseHandle (hObject=0x438) returned 1 [0120.116] GetProcessHeap () returned 0x580000 [0120.116] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0120.122] GetProcessHeap () returned 0x580000 [0120.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0120.123] GetProcessHeap () returned 0x580000 [0120.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.179] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f34a420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x5b0fd28, dwReserved1=0x67c940, cFileName="WB01748_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~2.YOU")) returned 0x5b9630 [0120.180] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.185] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF") returned 1 [0120.185] GetProcessHeap () returned 0x580000 [0120.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1760) returned 0x6d06ca8 [0120.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.185] CloseHandle (hObject=0x4a0) returned 1 [0120.185] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.185] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WBD6ED~1.YOU")) returned 0x5b9630 [0120.187] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.187] GetProcessHeap () returned 0x580000 [0120.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61120 [0120.187] GetProcessHeap () returned 0x580000 [0120.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6c61428 [0120.187] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.187] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x5b0ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.192] GetProcessHeap () returned 0x580000 [0120.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.192] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c61428*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61428*, lpNumberOfBytesWritten=0x5b0ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0120.193] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c616e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c616e7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.193] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.193] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.193] CloseHandle (hObject=0x4a0) returned 1 [0120.193] GetProcessHeap () returned 0x580000 [0120.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61428 | out: hHeap=0x580000) returned 1 [0120.193] GetProcessHeap () returned 0x580000 [0120.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0120.193] GetProcessHeap () returned 0x580000 [0120.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f408b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2e7, dwReserved0=0x5b0fd28, dwReserved1=0x6c61120, cFileName="WB01740_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WBD6ED~1.YOU")) returned 0x5b9630 [0120.193] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.198] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF") returned 1 [0120.198] GetProcessHeap () returned 0x580000 [0120.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x175c) returned 0x6d06ca8 [0120.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.199] CloseHandle (hObject=0x470) returned 1 [0120.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.199] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0173~1.YOU")) returned 0x5b9630 [0120.209] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.209] GetProcessHeap () returned 0x580000 [0120.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6c79898 [0120.210] GetProcessHeap () returned 0x580000 [0120.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a1) returned 0x6ce54c0 [0120.211] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.211] ReadFile (in: hFile=0x470, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x880, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5b0ff14*=0x880, lpOverlapped=0x0) returned 1 [0120.220] GetProcessHeap () returned 0x580000 [0120.220] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.220] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.220] WriteFile (in: hFile=0x470, lpBuffer=0x6ce54c0*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesWritten=0x5b0ff14*=0x880, lpOverlapped=0x0) returned 1 [0120.220] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.220] WriteFile (in: hFile=0x470, lpBuffer=0x6ce5d3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5d3f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.220] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.220] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.220] CloseHandle (hObject=0x470) returned 1 [0120.220] GetProcessHeap () returned 0x580000 [0120.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0120.220] GetProcessHeap () returned 0x580000 [0120.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0120.220] GetProcessHeap () returned 0x580000 [0120.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0120.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f454dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8bd, dwReserved0=0x5b0fd28, dwReserved1=0x6c79898, cFileName="WB01734_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0173~1.YOU")) returned 0x5b9630 [0120.220] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.231] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF") returned 1 [0120.231] GetProcessHeap () returned 0x580000 [0120.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1758) returned 0x6d06ca8 [0120.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.232] CloseHandle (hObject=0x4a0) returned 1 [0120.232] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.233] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0133~1.YOU")) returned 0x5b9630 [0120.233] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.233] GetProcessHeap () returned 0x580000 [0120.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0120.233] GetProcessHeap () returned 0x580000 [0120.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0120.233] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.233] ReadFile (in: hFile=0x4a0, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x5b0ff14*=0x160, lpOverlapped=0x0) returned 1 [0120.256] GetProcessHeap () returned 0x580000 [0120.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.256] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.256] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b8df0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesWritten=0x5b0ff14*=0x160, lpOverlapped=0x0) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.256] WriteFile (in: hFile=0x4a0, lpBuffer=0x5b8f4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8f4f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.256] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.257] CloseHandle (hObject=0x4a0) returned 1 [0120.257] GetProcessHeap () returned 0x580000 [0120.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0120.257] GetProcessHeap () returned 0x580000 [0120.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0120.257] GetProcessHeap () returned 0x580000 [0120.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f4a1080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x196, dwReserved0=0x5b0fd28, dwReserved1=0x5aa990, cFileName="WB01330_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0133~1.YOU")) returned 0x5b9630 [0120.257] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.261] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF") returned 1 [0120.262] GetProcessHeap () returned 0x580000 [0120.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1750) returned 0x6d06ca8 [0120.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.328] CloseHandle (hObject=0x4a0) returned 1 [0120.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0130~2.YOU")) returned 0x5b9730 [0121.696] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0121.696] GetProcessHeap () returned 0x580000 [0121.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673ce8 [0121.696] GetProcessHeap () returned 0x580000 [0121.696] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c1) returned 0x673fd0 [0121.696] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.696] ReadFile (in: hFile=0x460, lpBuffer=0x673ce8, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x673ce8*, lpNumberOfBytesRead=0x5b0ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0121.699] GetProcessHeap () returned 0x580000 [0121.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0121.700] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.700] WriteFile (in: hFile=0x460, lpBuffer=0x673fd0*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x673fd0*, lpNumberOfBytesWritten=0x5b0ff14*=0x2a0, lpOverlapped=0x0) returned 1 [0121.700] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.700] WriteFile (in: hFile=0x460, lpBuffer=0x67426f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x67426f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.700] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.700] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.700] CloseHandle (hObject=0x460) returned 1 [0121.700] GetProcessHeap () returned 0x580000 [0121.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673fd0 | out: hHeap=0x580000) returned 1 [0121.700] GetProcessHeap () returned 0x580000 [0121.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673ce8 | out: hHeap=0x580000) returned 1 [0121.700] GetProcessHeap () returned 0x580000 [0121.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0122.239] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80277060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x5b0fd28, dwReserved1=0x673ce8, cFileName="WB01301_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0130~2.YOU")) returned 0x5b9730 [0122.239] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.251] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", len=0x50 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 1 [0122.252] GetProcessHeap () returned 0x580000 [0122.252] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c4) returned 0x6e00ac0 [0122.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0122.254] CloseHandle (hObject=0x4a8) returned 1 [0122.254] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.254] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id_1622540890_.your_last_chance")) returned 1 [0122.255] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0122.255] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0122.255] GetProcessHeap () returned 0x580000 [0122.255] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de0f50 [0122.256] GetProcessHeap () returned 0x580000 [0122.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6eef008 [0122.256] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.256] ReadFile (in: hFile=0x4a8, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.231] GetProcessHeap () returned 0x580000 [0124.231] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.231] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.231] WriteFile (in: hFile=0x4a8, lpBuffer=0x6eef008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.232] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.232] WriteFile (in: hFile=0x4a8, lpBuffer=0x6f00807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f00807*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.232] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.232] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.232] CloseHandle (hObject=0x4a8) returned 1 [0124.232] GetProcessHeap () returned 0x580000 [0124.232] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0124.238] GetProcessHeap () returned 0x580000 [0124.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0124.238] GetProcessHeap () returned 0x580000 [0124.238] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81a90f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b79c, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="Waveform.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0124.988] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.003] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", len=0x4f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 1 [0125.003] GetProcessHeap () returned 0x580000 [0125.003] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a4) returned 0x6f42f08 [0125.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0125.004] CloseHandle (hObject=0x438) returned 1 [0125.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.004] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.005] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0125.005] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0125.005] GetProcessHeap () returned 0x580000 [0125.005] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x63d620 [0125.005] GetProcessHeap () returned 0x580000 [0125.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0125.006] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.006] ReadFile (in: hFile=0x438, lpBuffer=0x63d620, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x63d620*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.449] GetProcessHeap () returned 0x580000 [0127.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0127.450] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.450] WriteFile (in: hFile=0x438, lpBuffer=0x6daf1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0127.450] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.450] WriteFile (in: hFile=0x438, lpBuffer=0x6dc09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc09cf*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0127.827] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.828] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0127.828] CloseHandle (hObject=0x438) returned 1 [0127.828] GetProcessHeap () returned 0x580000 [0127.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0127.829] GetProcessHeap () returned 0x580000 [0127.829] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63d620 | out: hHeap=0x580000) returned 1 [0127.835] GetProcessHeap () returned 0x580000 [0127.835] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0127.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83ceecc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbef4d, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="Pushpin.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUSHPI~1.YOU")) returned 0x5b9730 [0127.835] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.049] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", len=0x3d | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned 1 [0128.049] GetProcessHeap () returned 0x580000 [0128.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b4) returned 0x667250 [0128.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0128.665] CloseHandle (hObject=0x454) returned 1 [0128.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.id_1622540890_.your_last_chance")) returned 1 [0128.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02988~1.YOU")) returned 0x5b96f0 [0128.666] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0128.667] GetProcessHeap () returned 0x580000 [0128.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19c1) returned 0x6f42f08 [0128.667] GetProcessHeap () returned 0x580000 [0128.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19c1) returned 0x667250 [0128.667] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.667] ReadFile (in: hFile=0x454, lpBuffer=0x6f42f08, nNumberOfBytesToRead=0x19a0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f42f08*, lpNumberOfBytesRead=0x5b0ff14*=0x19a0, lpOverlapped=0x0) returned 1 [0128.691] GetProcessHeap () returned 0x580000 [0128.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0128.691] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.691] WriteFile (in: hFile=0x454, lpBuffer=0x667250*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesWritten=0x5b0ff14*=0x19a0, lpOverlapped=0x0) returned 1 [0128.693] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.693] WriteFile (in: hFile=0x454, lpBuffer=0x668bef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x668bef*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.693] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.693] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.693] CloseHandle (hObject=0x454) returned 1 [0128.693] GetProcessHeap () returned 0x580000 [0128.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0128.694] GetProcessHeap () returned 0x580000 [0128.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f42f08 | out: hHeap=0x580000) returned 1 [0128.694] GetProcessHeap () returned 0x580000 [0128.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0128.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8451d860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x5b0fd28, dwReserved1=0x6f42f08, cFileName="J0298897.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02988~1.YOU")) returned 0x5b96f0 [0128.694] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.733] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", len=0x45 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned 1 [0128.733] GetProcessHeap () returned 0x580000 [0128.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c50) returned 0x6f3bea8 [0128.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.974] CloseHandle (hObject=0x41c) returned 1 [0128.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.id_1622540890_.your_last_chance")) returned 1 [0128.975] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2129~1.YOU")) returned 0x5b96f0 [0128.975] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.976] GetProcessHeap () returned 0x580000 [0128.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd00e8 [0128.976] GetProcessHeap () returned 0x580000 [0128.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa1) returned 0x6dd0198 [0128.976] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.976] ReadFile (in: hFile=0x41c, lpBuffer=0x6dd00e8, nNumberOfBytesToRead=0x80, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd00e8*, lpNumberOfBytesRead=0x5b0ff14*=0x80, lpOverlapped=0x0) returned 1 [0128.977] GetProcessHeap () returned 0x580000 [0128.977] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0128.977] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.977] WriteFile (in: hFile=0x41c, lpBuffer=0x6dd0198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0198*, lpNumberOfBytesWritten=0x5b0ff14*=0x80, lpOverlapped=0x0) returned 1 [0128.977] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.977] WriteFile (in: hFile=0x41c, lpBuffer=0x6dd0217*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd0217*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.977] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.977] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.977] CloseHandle (hObject=0x41c) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd0198 | out: hHeap=0x580000) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd00e8 | out: hHeap=0x580000) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0129.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x847cb120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba, dwReserved0=0x5b0fd28, dwReserved1=0x6dd00e8, cFileName="BD21295_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2129~1.YOU")) returned 0x5b96f0 [0129.447] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.473] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", len=0x43 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned 1 [0129.473] GetProcessHeap () returned 0x580000 [0129.473] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0129.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.477] CloseHandle (hObject=0x4a4) returned 1 [0129.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.id_1622540890_.your_last_chance")) returned 1 [0129.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~2.YOU")) returned 0x5b9730 [0129.478] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.478] GetProcessHeap () returned 0x580000 [0129.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0129.478] GetProcessHeap () returned 0x580000 [0129.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0129.479] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.479] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x5b0ff14*=0x100, lpOverlapped=0x0) returned 1 [0129.480] GetProcessHeap () returned 0x580000 [0129.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.481] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.481] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x5b0ff14*=0x100, lpOverlapped=0x0) returned 1 [0129.481] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.481] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.481] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.481] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.481] CloseHandle (hObject=0x4a4) returned 1 [0129.481] GetProcessHeap () returned 0x580000 [0129.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0129.481] GetProcessHeap () returned 0x580000 [0129.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0129.481] GetProcessHeap () returned 0x580000 [0129.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84cb3e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x5b0fd28, dwReserved1=0x6f0a9f0, cFileName="J0115855.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~2.YOU")) returned 0x5b9730 [0129.481] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.588] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM", len=0x39 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM") returned 1 [0129.588] GetProcessHeap () returned 0x580000 [0129.588] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0129.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.589] CloseHandle (hObject=0x4a0) returned 1 [0129.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.589] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.id_1622540890_.your_last_chance")) returned 1 [0129.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BASICH~1.YOU")) returned 0x5b9730 [0129.590] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.590] GetProcessHeap () returned 0x580000 [0129.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0129.590] GetProcessHeap () returned 0x580000 [0129.590] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0129.590] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.591] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x5b0ff14*=0x100, lpOverlapped=0x0) returned 1 [0129.592] GetProcessHeap () returned 0x580000 [0129.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.592] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.592] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x5b0ff14*=0x100, lpOverlapped=0x0) returned 1 [0129.592] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.592] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.593] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.593] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.593] CloseHandle (hObject=0x4a0) returned 1 [0129.593] GetProcessHeap () returned 0x580000 [0129.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0129.593] GetProcessHeap () returned 0x580000 [0129.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0129.593] GetProcessHeap () returned 0x580000 [0129.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84dbe820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x5b0fd28, dwReserved1=0x6f0a9f0, cFileName="BASIC.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BASICH~1.YOU")) returned 0x5b9730 [0129.593] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.605] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn", len=0x4a | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn") returned 1 [0129.605] GetProcessHeap () returned 0x580000 [0129.605] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0129.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.606] CloseHandle (hObject=0x458) returned 1 [0129.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.id_1622540890_.your_last_chance")) returned 1 [0129.607] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COLLEC~2.YOU")) returned 0x5b9730 [0129.607] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.607] GetProcessHeap () returned 0x580000 [0129.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x6dd20d0 [0129.607] GetProcessHeap () returned 0x580000 [0129.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x35c1) returned 0x6d8e818 [0129.607] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.607] ReadFile (in: hFile=0x458, lpBuffer=0x6dd20d0, nNumberOfBytesToRead=0x35a0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesRead=0x5b0ff14*=0x35a0, lpOverlapped=0x0) returned 1 [0131.091] GetProcessHeap () returned 0x580000 [0131.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0131.091] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.091] WriteFile (in: hFile=0x458, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x35a0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x5b0ff14*=0x35a0, lpOverlapped=0x0) returned 1 [0131.092] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.092] WriteFile (in: hFile=0x458, lpBuffer=0x6d91db7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d91db7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.092] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.092] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.092] CloseHandle (hObject=0x458) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0132.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x85c06c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35e2, dwReserved0=0x5b0fd28, dwReserved1=0x6dd20d0, cFileName="CollectSignatures_Init.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COLLEC~2.YOU")) returned 0x5b9730 [0132.642] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0135.081] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", len=0x3a | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 1 [0135.081] GetProcessHeap () returned 0x580000 [0135.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0135.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0138.608] CloseHandle (hObject=0x488) returned 1 [0138.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id_1622540890_.your_last_chance")) returned 1 [0138.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DWGCNV~1.YOU")) returned 0x5b9770 [0138.609] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0138.610] GetProcessHeap () returned 0x580000 [0138.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9781) returned 0x6de0f50 [0138.610] GetProcessHeap () returned 0x580000 [0138.610] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9781) returned 0x6f976f8 [0138.611] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.611] ReadFile (in: hFile=0x488, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x9760, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x5b0ff14*=0x9760, lpOverlapped=0x0) returned 1 [0139.399] GetProcessHeap () returned 0x580000 [0139.399] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.399] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.399] WriteFile (in: hFile=0x488, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x9760, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x5b0ff14*=0x9760, lpOverlapped=0x0) returned 1 [0139.399] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.399] WriteFile (in: hFile=0x488, lpBuffer=0x6fa0e57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa0e57*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.400] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.400] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.400] CloseHandle (hObject=0x488) returned 1 [0139.400] GetProcessHeap () returned 0x580000 [0139.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0139.400] GetProcessHeap () returned 0x580000 [0139.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0139.400] GetProcessHeap () returned 0x580000 [0139.400] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8ab2c7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9784, dwReserved0=0x5b0fd28, dwReserved1=0x6de0f50, cFileName="DWGCNV.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DWGCNV~1.YOU")) returned 0x5b9770 [0140.123] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.168] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", len=0x5f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css") returned 1 [0140.168] GetProcessHeap () returned 0x580000 [0140.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0140.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.613] CloseHandle (hObject=0x428) returned 1 [0140.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.id_1622540890_.your_last_chance")) returned 1 [0140.614] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.614] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~3.YOU")) returned 0x5b9770 [0140.614] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.614] GetProcessHeap () returned 0x580000 [0140.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0140.614] GetProcessHeap () returned 0x580000 [0140.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0140.614] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.614] ReadFile (in: hFile=0x428, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x5b0ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.616] GetProcessHeap () returned 0x580000 [0140.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0140.616] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.616] WriteFile (in: hFile=0x428, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x5b0ff14*=0xa0, lpOverlapped=0x0) returned 1 [0140.616] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.616] WriteFile (in: hFile=0x428, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.616] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.616] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.616] CloseHandle (hObject=0x428) returned 1 [0140.616] GetProcessHeap () returned 0x580000 [0140.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0140.616] GetProcessHeap () returned 0x580000 [0140.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0140.616] GetProcessHeap () returned 0x580000 [0140.616] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0141.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b6c72e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x5b0fd28, dwReserved1=0x60e978, cFileName="Solutions_Response.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLUTI~3.YOU")) returned 0x5b9730 [0141.011] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.275] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL", len=0x3b | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 1 [0144.276] GetProcessHeap () returned 0x580000 [0144.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0144.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.276] CloseHandle (hObject=0x478) returned 1 [0144.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id_1622540890_.your_last_chance")) returned 1 [0144.277] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3475b500, ftLastWriteTime.dwHighDateTime=0x1ca95bc, nFileSizeHigh=0x0, nFileSizeLow=0x13a57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU9605~1.YOU")) returned 0x5b9730 [0144.277] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.277] GetProcessHeap () returned 0x580000 [0144.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0144.277] GetProcessHeap () returned 0x580000 [0144.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0144.277] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.277] ReadFile (in: hFile=0x478, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0146.277] GetProcessHeap () returned 0x580000 [0146.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0146.277] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.277] WriteFile (in: hFile=0x478, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0146.277] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.277] WriteFile (in: hFile=0x478, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0147.105] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.105] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0147.105] CloseHandle (hObject=0x478) returned 1 [0147.106] GetProcessHeap () returned 0x580000 [0147.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0147.106] GetProcessHeap () returned 0x580000 [0147.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0147.106] GetProcessHeap () returned 0x580000 [0147.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0147.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f4aaee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13a5a0, dwReserved0=0x5b0fd28, dwReserved1=0x636970, cFileName="OUTLOOK.HOL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OU9605~1.YOU")) returned 0x5b96f0 [0147.106] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0147.764] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", len=0x43 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI") returned 1 [0147.764] GetProcessHeap () returned 0x580000 [0147.764] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0148.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0148.269] CloseHandle (hObject=0x4a4) returned 1 [0148.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini.id_1622540890_.your_last_chance")) returned 1 [0148.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.270] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x182b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERS~1.YOU")) returned 0x5b96f0 [0148.271] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0148.271] GetProcessHeap () returned 0x580000 [0148.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1841) returned 0x6d06ca8 [0148.271] GetProcessHeap () returned 0x580000 [0148.271] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1841) returned 0x6c54808 [0148.271] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.272] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x5b0ff14*=0x1820, lpOverlapped=0x0) returned 1 [0148.335] GetProcessHeap () returned 0x580000 [0148.335] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0148.336] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.336] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c54808*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c54808*, lpNumberOfBytesWritten=0x5b0ff14*=0x1820, lpOverlapped=0x0) returned 1 [0148.336] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.336] WriteFile (in: hFile=0x4a4, lpBuffer=0x6c56027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56027*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0148.336] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.336] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0148.336] CloseHandle (hObject=0x4a4) returned 1 [0148.336] GetProcessHeap () returned 0x580000 [0148.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c54808 | out: hHeap=0x580000) returned 1 [0148.336] GetProcessHeap () returned 0x580000 [0148.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0148.336] GetProcessHeap () returned 0x580000 [0148.336] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0148.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9006bb80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x184f, dwReserved0=0x5b0fd28, dwReserved1=0x6d06ca8, cFileName="PAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PAPERS~1.YOU")) returned 0x5b96f0 [0148.336] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.374] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS", len=0x45 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS") returned 1 [0148.374] GetProcessHeap () returned 0x580000 [0148.374] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f10) returned 0x6f14048 [0148.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0148.419] CloseHandle (hObject=0x410) returned 1 [0148.419] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.419] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css.id_1622540890_.your_last_chance")) returned 1 [0148.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a38500, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a38500, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCBBD5~1.YOU")) returned 0x5b96f0 [0148.420] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0148.420] GetProcessHeap () returned 0x580000 [0148.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x636970 [0148.421] GetProcessHeap () returned 0x580000 [0148.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0148.421] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.421] ReadFile (in: hFile=0x410, lpBuffer=0x636970, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0152.303] GetProcessHeap () returned 0x580000 [0153.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.896] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.896] WriteFile (in: hFile=0x410, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0153.896] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.897] WriteFile (in: hFile=0x410, lpBuffer=0x65999f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65999f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.897] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.897] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.897] CloseHandle (hObject=0x410) returned 1 [0153.897] GetProcessHeap () returned 0x580000 [0153.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0153.897] GetProcessHeap () returned 0x580000 [0153.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0153.897] GetProcessHeap () returned 0x580000 [0153.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a38500, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93588660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b4, dwReserved0=0x5b0fd28, dwReserved1=0x636970, cFileName="SCHEME47.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCBBD5~1.YOU")) returned 0x5b9630 [0153.897] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.675] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", len=0x41 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 1 [0154.675] GetProcessHeap () returned 0x580000 [0154.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0154.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0160.665] CloseHandle (hObject=0x428) returned 1 [0160.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0160.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id_1622540890_.your_last_chance")) returned 1 [0160.666] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0160.666] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZUS~1.YOU")) returned 0x5b9630 [0160.666] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0160.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0160.666] GetProcessHeap () returned 0x580000 [0160.666] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71e7208 [0160.667] GetProcessHeap () returned 0x580000 [0160.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71f8a38 [0160.667] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.667] ReadFile (in: hFile=0x428, lpBuffer=0x71e7208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x71e7208*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.365] GetProcessHeap () returned 0x580000 [0165.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0165.365] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.365] WriteFile (in: hFile=0x428, lpBuffer=0x71f8a38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x71f8a38*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.366] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.366] WriteFile (in: hFile=0x428, lpBuffer=0x720a237*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x720a237*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.367] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.367] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.367] CloseHandle (hObject=0x428) returned 1 [0165.367] GetProcessHeap () returned 0x580000 [0165.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71f8a38 | out: hHeap=0x580000) returned 1 [0165.367] GetProcessHeap () returned 0x580000 [0165.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71e7208 | out: hHeap=0x580000) returned 1 [0165.367] GetProcessHeap () returned 0x580000 [0165.367] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0166.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a2e1900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x348024, dwReserved0=0x5b0fd28, dwReserved1=0x71e7208, cFileName="ACWZUSR12.ACCDU.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZUS~1.YOU")) returned 0x5b9730 [0166.654] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.870] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", len=0x43 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 1 [0169.871] GetProcessHeap () returned 0x580000 [0169.871] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0169.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0170.041] CloseHandle (hObject=0x41c) returned 1 [0170.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id_1622540890_.your_last_chance")) returned 1 [0170.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x25b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLNOTE~1.YOU")) returned 0x5b9730 [0170.044] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0170.044] GetProcessHeap () returned 0x580000 [0170.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25c1) returned 0x6faccd8 [0170.044] GetProcessHeap () returned 0x580000 [0170.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x25c1) returned 0x704b778 [0170.045] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.045] ReadFile (in: hFile=0x41c, lpBuffer=0x6faccd8, nNumberOfBytesToRead=0x25a0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6faccd8*, lpNumberOfBytesRead=0x5b0ff14*=0x25a0, lpOverlapped=0x0) returned 1 [0170.082] GetProcessHeap () returned 0x580000 [0170.082] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.082] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.082] WriteFile (in: hFile=0x41c, lpBuffer=0x704b778*, nNumberOfBytesToWrite=0x25a0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x704b778*, lpNumberOfBytesWritten=0x5b0ff14*=0x25a0, lpOverlapped=0x0) returned 1 [0170.082] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.082] WriteFile (in: hFile=0x41c, lpBuffer=0x704dd17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x704dd17*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.082] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.083] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.083] CloseHandle (hObject=0x41c) returned 1 [0170.083] GetProcessHeap () returned 0x580000 [0170.083] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704b778 | out: hHeap=0x580000) returned 1 [0170.083] GetProcessHeap () returned 0x580000 [0170.083] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6faccd8 | out: hHeap=0x580000) returned 1 [0170.083] GetProcessHeap () returned 0x580000 [0170.083] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cfcf840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x25d4, dwReserved0=0x5b0fd28, dwReserved1=0x6faccd8, cFileName="OLNOTER.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLNOTE~1.YOU")) returned 0x5b9730 [0170.083] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0173.046] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", len=0x42 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 1 [0173.046] GetProcessHeap () returned 0x580000 [0173.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x223c) returned 0x6f14048 [0173.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.065] CloseHandle (hObject=0x46c) returned 1 [0173.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~4.YOU")) returned 0x5b9770 [0173.066] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.066] GetProcessHeap () returned 0x580000 [0173.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0173.066] GetProcessHeap () returned 0x580000 [0173.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0173.066] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.066] ReadFile (in: hFile=0x46c, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x5b0ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.094] GetProcessHeap () returned 0x580000 [0173.094] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.094] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.094] WriteFile (in: hFile=0x46c, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x5b0ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.095] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x46c, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.095] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.095] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.095] CloseHandle (hObject=0x46c) returned 1 [0173.099] GetProcessHeap () returned 0x580000 [0173.099] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0173.099] GetProcessHeap () returned 0x580000 [0173.099] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0173.099] GetProcessHeap () returned 0x580000 [0173.103] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec861a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5b0fd28, dwReserved1=0x5d09a0, cFileName="SCDRESTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~4.YOU")) returned 0x5b9770 [0174.236] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0176.891] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", len=0x4c | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx") returned 1 [0176.891] GetProcessHeap () returned 0x580000 [0176.891] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0176.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.892] CloseHandle (hObject=0x49c) returned 1 [0176.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.id_1622540890_.your_last_chance")) returned 1 [0177.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TRADIT~1.YOU")) returned 0x5b96f0 [0177.406] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0177.406] GetProcessHeap () returned 0x580000 [0177.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2201) returned 0x6dcb1d0 [0177.406] GetProcessHeap () returned 0x580000 [0177.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2201) returned 0x6f64a18 [0177.407] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.407] ReadFile (in: hFile=0x49c, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x21e0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x5b0ff14*=0x21e0, lpOverlapped=0x0) returned 1 [0177.436] GetProcessHeap () returned 0x580000 [0177.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0177.437] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.437] WriteFile (in: hFile=0x49c, lpBuffer=0x6f64a18*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f64a18*, lpNumberOfBytesWritten=0x5b0ff14*=0x21e0, lpOverlapped=0x0) returned 1 [0177.437] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.437] WriteFile (in: hFile=0x49c, lpBuffer=0x6f66bf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66bf7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.437] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.437] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.437] CloseHandle (hObject=0x49c) returned 1 [0177.437] GetProcessHeap () returned 0x580000 [0177.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f64a18 | out: hHeap=0x580000) returned 1 [0177.437] GetProcessHeap () returned 0x580000 [0177.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0177.437] GetProcessHeap () returned 0x580000 [0177.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1608140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2214, dwReserved0=0x5b0fd28, dwReserved1=0x6dcb1d0, cFileName="Traditional.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TRADIT~1.YOU")) returned 0x5b96f0 [0180.027] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0183.807] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", len=0x6e | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned 1 [0183.807] GetProcessHeap () returned 0x580000 [0183.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0183.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0186.303] CloseHandle (hObject=0x440) returned 1 [0186.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.304] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b3f, dwReserved0=0x4a002e, dwReserved1=0x470050, cFileName="LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LISTBO~1.YOU")) returned 0x5b96b0 [0186.304] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0186.304] GetProcessHeap () returned 0x580000 [0186.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b41) returned 0x6d2d888 [0186.304] GetProcessHeap () returned 0x580000 [0186.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b41) returned 0x7066b08 [0186.305] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.305] ReadFile (in: hFile=0x440, lpBuffer=0x6d2d888, nNumberOfBytesToRead=0x3b20, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2d888*, lpNumberOfBytesRead=0x5b0ff14*=0x3b20, lpOverlapped=0x0) returned 1 [0187.517] GetProcessHeap () returned 0x580000 [0187.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0187.517] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.517] WriteFile (in: hFile=0x440, lpBuffer=0x7066b08*, nNumberOfBytesToWrite=0x3b20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesWritten=0x5b0ff14*=0x3b20, lpOverlapped=0x0) returned 1 [0187.517] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.517] WriteFile (in: hFile=0x440, lpBuffer=0x706a627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x706a627*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.517] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.517] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.517] CloseHandle (hObject=0x440) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2d888 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0188.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7623980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b63, dwReserved0=0x5b0fd28, dwReserved1=0x6d2d888, cFileName="LISTBOX.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LISTBO~1.YOU")) returned 0x5b9770 [0188.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.079] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", len=0x45 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned 1 [0188.079] GetProcessHeap () returned 0x580000 [0188.079] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2070) returned 0x6f14048 [0188.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0191.913] CloseHandle (hObject=0x440) returned 1 [0191.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.id_1622540890_.your_last_chance")) returned 1 [0194.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x539e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5B9A~1.YOU")) returned 0x5b97b0 [0194.659] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0194.659] GetProcessHeap () returned 0x580000 [0194.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x53a1) returned 0x6fffbe8 [0194.659] GetProcessHeap () returned 0x580000 [0194.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x53a1) returned 0x6e063d0 [0194.659] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.659] ReadFile (in: hFile=0x440, lpBuffer=0x6fffbe8, nNumberOfBytesToRead=0x5380, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fffbe8*, lpNumberOfBytesRead=0x5b0ff14*=0x5380, lpOverlapped=0x0) returned 1 [0195.699] GetProcessHeap () returned 0x580000 [0195.699] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.699] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.700] WriteFile (in: hFile=0x440, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x5380, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x5b0ff14*=0x5380, lpOverlapped=0x0) returned 1 [0195.700] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.700] WriteFile (in: hFile=0x440, lpBuffer=0x6e0b74f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0b74f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.700] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.700] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.700] CloseHandle (hObject=0x440) returned 1 [0195.700] GetProcessHeap () returned 0x580000 [0195.700] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0195.707] GetProcessHeap () returned 0x580000 [0195.707] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fffbe8 | out: hHeap=0x580000) returned 1 [0195.708] GetProcessHeap () returned 0x580000 [0195.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.015] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac418a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x53c2, dwReserved0=0x580000, dwReserved1=0x6dca1b8, cFileName="ZPDIR47F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5B9A~1.YOU")) returned 0x5b97b0 [0197.015] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.028] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", len=0x44 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned 1 [0197.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fac) returned 0x6f14048 [0197.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.029] CloseHandle (hObject=0x440) returned 1 [0197.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.029] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.id_1622540890_.your_last_chance")) returned 1 [0197.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR0~1.YOU")) returned 0x5b97b0 [0197.030] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.030] GetProcessHeap () returned 0x580000 [0197.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596cd8 [0197.030] GetProcessHeap () returned 0x580000 [0197.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596828 [0197.030] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.030] ReadFile (in: hFile=0x440, lpBuffer=0x596cd8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x596cd8*, lpNumberOfBytesRead=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.031] GetProcessHeap () returned 0x580000 [0197.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0197.031] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.032] WriteFile (in: hFile=0x440, lpBuffer=0x596828*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x596828*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.032] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.032] WriteFile (in: hFile=0x440, lpBuffer=0x596847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x596847*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.032] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.032] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.032] CloseHandle (hObject=0x440) returned 1 [0197.032] GetProcessHeap () returned 0x580000 [0197.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596828 | out: hHeap=0x580000) returned 1 [0197.032] GetProcessHeap () returned 0x580000 [0197.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596cd8 | out: hHeap=0x580000) returned 1 [0197.032] GetProcessHeap () returned 0x580000 [0197.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad0e4040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x5b0fd28, dwReserved1=0x596cd8, cFileName="ZPDIR00.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR0~1.YOU")) returned 0x5b97b0 [0197.032] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.044] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", len=0x44 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI") returned 1 [0197.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa8) returned 0x6f14048 [0197.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.045] CloseHandle (hObject=0x440) returned 1 [0197.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini.id_1622540890_.your_last_chance")) returned 1 [0197.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x189e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAPER~1.YOU")) returned 0x5b97b0 [0197.046] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.046] GetProcessHeap () returned 0x580000 [0197.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18a1) returned 0x6c54808 [0197.046] GetProcessHeap () returned 0x580000 [0197.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x18a1) returned 0x6e00ac0 [0197.047] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.047] ReadFile (in: hFile=0x440, lpBuffer=0x6c54808, nNumberOfBytesToRead=0x1880, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c54808*, lpNumberOfBytesRead=0x5b0ff14*=0x1880, lpOverlapped=0x0) returned 1 [0197.068] GetProcessHeap () returned 0x580000 [0197.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce238 [0197.068] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.068] WriteFile (in: hFile=0x440, lpBuffer=0x6e00ac0*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesWritten=0x5b0ff14*=0x1880, lpOverlapped=0x0) returned 1 [0197.069] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.069] WriteFile (in: hFile=0x440, lpBuffer=0x6e0233f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0233f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.069] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.069] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.069] CloseHandle (hObject=0x440) returned 1 [0197.069] GetProcessHeap () returned 0x580000 [0197.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0197.069] GetProcessHeap () returned 0x580000 [0197.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c54808 | out: hHeap=0x580000) returned 1 [0197.069] GetProcessHeap () returned 0x580000 [0197.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce238 | out: hHeap=0x580000) returned 1 [0197.069] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad130300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x18c2, dwReserved0=0x5b0fd28, dwReserved1=0x6c54808, cFileName="ZPAPERS.INI.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAPER~1.YOU")) returned 0x5b97b0 [0197.069] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.075] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", len=0x43 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned 1 [0197.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0197.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.076] CloseHandle (hObject=0x440) returned 1 [0197.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR9F~1.YOU")) returned 0x5b97b0 [0197.077] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0197.078] GetProcessHeap () returned 0x580000 [0197.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b01) returned 0x6d630a8 [0197.078] GetProcessHeap () returned 0x580000 [0197.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5b01) returned 0x6d68bb8 [0197.078] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.078] ReadFile (in: hFile=0x440, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x5ae0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x5b0ff14*=0x5ae0, lpOverlapped=0x0) returned 1 [0197.725] GetProcessHeap () returned 0x580000 [0197.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0197.725] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.725] WriteFile (in: hFile=0x440, lpBuffer=0x6d68bb8*, nNumberOfBytesToWrite=0x5ae0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d68bb8*, lpNumberOfBytesWritten=0x5b0ff14*=0x5ae0, lpOverlapped=0x0) returned 1 [0197.725] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.725] WriteFile (in: hFile=0x440, lpBuffer=0x6d6e697*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6e697*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.726] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.726] CloseHandle (hObject=0x440) returned 1 [0197.790] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d68bb8 | out: hHeap=0x580000) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0197.791] GetProcessHeap () returned 0x580000 [0197.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0199.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad76fcc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5b10, dwReserved0=0x5b0fd28, dwReserved1=0x6d630a8, cFileName="PDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR9F~1.YOU")) returned 0x5b96b0 [0199.651] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.956] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", len=0x65 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned 1 [0200.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fdc) returned 0x6f14048 [0200.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0200.987] CloseHandle (hObject=0x488) returned 1 [0200.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.987] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.id_1622540890_.your_last_chance")) returned 1 [0200.988] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.988] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b9770 [0200.988] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0200.988] GetProcessHeap () returned 0x580000 [0200.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6f67710 [0200.988] GetProcessHeap () returned 0x580000 [0200.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1021) returned 0x6f68818 [0200.988] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.988] ReadFile (in: hFile=0x488, lpBuffer=0x6f67710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesRead=0x5b0ff14*=0x1000, lpOverlapped=0x0) returned 1 [0201.127] GetProcessHeap () returned 0x580000 [0201.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0201.127] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.127] WriteFile (in: hFile=0x488, lpBuffer=0x6f68818*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f68818*, lpNumberOfBytesWritten=0x5b0ff14*=0x1000, lpOverlapped=0x0) returned 1 [0201.127] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.127] WriteFile (in: hFile=0x488, lpBuffer=0x6f69817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69817*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.128] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.128] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.128] CloseHandle (hObject=0x488) returned 1 [0201.303] GetProcessHeap () returned 0x580000 [0201.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f68818 | out: hHeap=0x580000) returned 1 [0201.303] GetProcessHeap () returned 0x580000 [0201.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0201.303] GetProcessHeap () returned 0x580000 [0201.303] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0202.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf7de880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x103c, dwReserved0=0x5b0fd28, dwReserved1=0x6f67710, cFileName="PublicFunctions.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PUBLIC~1.YOU")) returned 0x5b9770 [0202.027] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.083] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", len=0x44 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned 1 [0202.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0202.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0202.217] CloseHandle (hObject=0x4a0) returned 1 [0202.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.217] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.id_1622540890_.your_last_chance")) returned 1 [0202.218] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.218] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR35~1.YOU")) returned 0x5b9770 [0202.218] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0202.218] GetProcessHeap () returned 0x580000 [0202.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x6dc71d0 [0202.218] GetProcessHeap () returned 0x580000 [0202.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2bc1) returned 0x7111f48 [0202.218] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.219] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x2ba0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x5b0ff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0203.764] GetProcessHeap () returned 0x580000 [0203.764] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0203.764] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.764] WriteFile (in: hFile=0x4a0, lpBuffer=0x7111f48*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f48*, lpNumberOfBytesWritten=0x5b0ff14*=0x2ba0, lpOverlapped=0x0) returned 1 [0203.764] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.765] WriteFile (in: hFile=0x4a0, lpBuffer=0x7114ae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7114ae7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.765] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.765] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.765] CloseHandle (hObject=0x4a0) returned 1 [0203.765] GetProcessHeap () returned 0x580000 [0203.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7111f48 | out: hHeap=0x580000) returned 1 [0203.765] GetProcessHeap () returned 0x580000 [0203.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0203.765] GetProcessHeap () returned 0x580000 [0203.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0203.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb11030e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2bda, dwReserved0=0x5b0fd28, dwReserved1=0x6dc71d0, cFileName="PDIR35F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR35~1.YOU")) returned 0x5b97b0 [0203.765] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0209.158] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", len=0x69 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned 1 [0209.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0209.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.581] CloseHandle (hObject=0x3b8) returned 1 [0209.581] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.id_1622540890_.your_last_chance")) returned 1 [0209.582] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.582] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b97f0 [0209.582] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.582] GetProcessHeap () returned 0x580000 [0209.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0209.582] GetProcessHeap () returned 0x580000 [0209.582] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0209.582] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.582] ReadFile (in: hFile=0x3b8, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x5b0ff14*=0x760, lpOverlapped=0x0) returned 1 [0209.617] GetProcessHeap () returned 0x580000 [0209.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0209.617] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.617] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x5b0ff14*=0x760, lpOverlapped=0x0) returned 1 [0209.618] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.618] WriteFile (in: hFile=0x3b8, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.618] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.618] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.618] CloseHandle (hObject=0x3b8) returned 1 [0209.618] GetProcessHeap () returned 0x580000 [0209.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0209.618] GetProcessHeap () returned 0x580000 [0209.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0209.618] GetProcessHeap () returned 0x580000 [0209.619] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0209.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48f35e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x784, dwReserved0=0x5b0fd28, dwReserved1=0x6ef3020, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b97f0 [0209.619] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.661] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", len=0x76 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned 1 [0209.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0209.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.661] CloseHandle (hObject=0x3b8) returned 1 [0209.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0209.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x5c0065, dwReserved1=0x550042, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97f0 [0209.662] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.662] GetProcessHeap () returned 0x580000 [0209.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0209.662] GetProcessHeap () returned 0x580000 [0209.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0209.663] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.663] ReadFile (in: hFile=0x3b8, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x5b0ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.664] GetProcessHeap () returned 0x580000 [0209.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0209.664] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.664] WriteFile (in: hFile=0x3b8, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x5b0ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.664] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.664] WriteFile (in: hFile=0x3b8, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.664] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.665] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.665] CloseHandle (hObject=0x3b8) returned 1 [0209.665] GetProcessHeap () returned 0x580000 [0209.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0209.665] GetProcessHeap () returned 0x580000 [0209.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0209.665] GetProcessHeap () returned 0x580000 [0209.665] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0209.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4965a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5b0fd28, dwReserved1=0x60e8a8, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b97f0 [0209.665] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.702] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x72 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0209.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0209.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.058] CloseHandle (hObject=0x3b8) returned 1 [0210.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.058] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0210.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.083] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x440041, dwReserved1=0x520045, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9830 [0210.083] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0210.083] GetProcessHeap () returned 0x580000 [0210.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f0a228 [0210.083] GetProcessHeap () returned 0x580000 [0210.083] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09968 [0210.083] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.083] ReadFile (in: hFile=0x3b8, lpBuffer=0x6f0a228, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a228*, lpNumberOfBytesRead=0x5b0ff14*=0xe0, lpOverlapped=0x0) returned 1 [0210.085] GetProcessHeap () returned 0x580000 [0210.085] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0210.085] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.085] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f09968*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09968*, lpNumberOfBytesWritten=0x5b0ff14*=0xe0, lpOverlapped=0x0) returned 1 [0210.085] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.085] WriteFile (in: hFile=0x3b8, lpBuffer=0x6f09a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09a47*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.085] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.085] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.085] CloseHandle (hObject=0x3b8) returned 1 [0210.086] GetProcessHeap () returned 0x580000 [0210.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0210.086] GetProcessHeap () returned 0x580000 [0210.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.086] GetProcessHeap () returned 0x580000 [0210.086] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0214.558] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4d43dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x5b0fd28, dwReserved1=0x6f0a228, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0214.558] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0216.362] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS", len=0x39 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 1 [0216.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0216.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0216.363] CloseHandle (hObject=0x49c) returned 1 [0216.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0216.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id_1622540890_.your_last_chance")) returned 1 [0216.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0216.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1cc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBH~1.YOU")) returned 0x5b97b0 [0216.364] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0216.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0216.365] GetProcessHeap () returned 0x580000 [0216.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e9be70 [0216.365] GetProcessHeap () returned 0x580000 [0216.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead6a0 [0216.366] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.366] ReadFile (in: hFile=0x49c, lpBuffer=0x6e9be70, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be70*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.827] GetProcessHeap () returned 0x580000 [0220.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0220.828] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.828] WriteFile (in: hFile=0x49c, lpBuffer=0x6ead6a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead6a0*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.828] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.828] WriteFile (in: hFile=0x49c, lpBuffer=0x6ebee9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebee9f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.922] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.922] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.922] CloseHandle (hObject=0x49c) returned 1 [0220.922] GetProcessHeap () returned 0x580000 [0220.922] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead6a0 | out: hHeap=0x580000) returned 1 [0220.923] GetProcessHeap () returned 0x580000 [0220.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9be70 | out: hHeap=0x580000) returned 1 [0220.927] GetProcessHeap () returned 0x580000 [0220.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0221.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb4a9960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cc95a, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="MSPUB.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBH~1.YOU")) returned 0x5b9730 [0221.879] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.884] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", len=0x64 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned 1 [0221.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0221.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0221.945] CloseHandle (hObject=0x428) returned 1 [0221.945] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABONJ~1.YOU")) returned 0x5b9730 [0221.946] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0221.946] GetProcessHeap () returned 0x580000 [0221.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c11570 [0221.947] GetProcessHeap () returned 0x580000 [0221.947] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6c11ff8 [0221.947] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.947] ReadFile (in: hFile=0x428, lpBuffer=0x6c11570, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11570*, lpNumberOfBytesRead=0x5b0ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0222.039] GetProcessHeap () returned 0x580000 [0222.039] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0222.039] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.039] WriteFile (in: hFile=0x428, lpBuffer=0x6c11ff8*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11ff8*, lpNumberOfBytesWritten=0x5b0ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0222.040] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.040] WriteFile (in: hFile=0x428, lpBuffer=0x6c129d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c129d7*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.040] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.040] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.040] CloseHandle (hObject=0x428) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11ff8 | out: hHeap=0x580000) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c11570 | out: hHeap=0x580000) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0223.721] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbf5fc60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa13, dwReserved0=0x5b0fd28, dwReserved1=0x6c11570, cFileName="TABON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TABONJ~1.YOU")) returned 0x5b9730 [0223.721] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.746] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", len=0x55 | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned 1 [0223.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0223.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0223.800] CloseHandle (hObject=0x3e4) returned 1 [0223.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd.id_1622540890_.your_last_chance")) returned 1 [0223.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUILTI~1.YOU")) returned 0x5b96f0 [0223.801] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0223.801] GetProcessHeap () returned 0x580000 [0223.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6f04558 [0223.801] GetProcessHeap () returned 0x580000 [0223.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6d045f8 [0223.801] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.801] ReadFile (in: hFile=0x3e4, lpBuffer=0x6f04558, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04558*, lpNumberOfBytesRead=0x5b0ff14*=0x480, lpOverlapped=0x0) returned 1 [0223.849] GetProcessHeap () returned 0x580000 [0223.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.849] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.849] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d045f8*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d045f8*, lpNumberOfBytesWritten=0x5b0ff14*=0x480, lpOverlapped=0x0) returned 1 [0223.849] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.849] WriteFile (in: hFile=0x3e4, lpBuffer=0x6d04a77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04a77*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.849] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.849] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.849] CloseHandle (hObject=0x3e4) returned 1 [0223.849] GetProcessHeap () returned 0x580000 [0223.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d045f8 | out: hHeap=0x580000) returned 1 [0223.849] GetProcessHeap () returned 0x580000 [0223.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04558 | out: hHeap=0x580000) returned 1 [0223.849] GetProcessHeap () returned 0x580000 [0223.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd0a1be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4ab, dwReserved0=0x5b0fd28, dwReserved1=0x6f04558, cFileName="builtincontrolsschema.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUILTI~1.YOU")) returned 0x5b9630 [0226.545] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.237] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", len=0x5a | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned 1 [0230.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0230.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0230.304] CloseHandle (hObject=0x170) returned 1 [0230.304] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.304] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.id_1622540890_.your_last_chance")) returned 1 [0230.307] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~2.YOU")) returned 0x5b9630 [0230.307] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0230.308] GetProcessHeap () returned 0x580000 [0230.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0230.308] GetProcessHeap () returned 0x580000 [0230.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0230.308] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.308] ReadFile (in: hFile=0x170, lpBuffer=0x7018958, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.742] GetProcessHeap () returned 0x580000 [0237.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0237.743] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.743] WriteFile (in: hFile=0x170, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.266] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.266] WriteFile (in: hFile=0x170, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.341] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.342] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.342] CloseHandle (hObject=0x170) returned 1 [0239.482] GetProcessHeap () returned 0x580000 [0239.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0239.523] GetProcessHeap () returned 0x580000 [0239.523] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0239.524] GetProcessHeap () returned 0x580000 [0239.524] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc5289, dwReserved0=0x5b0fd28, dwReserved1=0x7018958, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~2.YOU")) returned 0x5b9730 [0241.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.433] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML", len=0x3f | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned 1 [0241.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0241.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0241.434] CloseHandle (hObject=0x264) returned 1 [0241.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml.id_1622540890_.your_last_chance")) returned 1 [0241.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~2.YOU")) returned 0x5b9630 [0241.435] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0241.435] GetProcessHeap () returned 0x580000 [0241.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x72bb898 [0241.435] GetProcessHeap () returned 0x580000 [0241.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x34e1) returned 0x6d748d8 [0241.435] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.436] ReadFile (in: hFile=0x264, lpBuffer=0x72bb898, nNumberOfBytesToRead=0x34c0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bb898*, lpNumberOfBytesRead=0x5b0ff14*=0x34c0, lpOverlapped=0x0) returned 1 [0242.448] GetProcessHeap () returned 0x580000 [0242.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0242.448] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.448] WriteFile (in: hFile=0x264, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x34c0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x5b0ff14*=0x34c0, lpOverlapped=0x0) returned 1 [0242.449] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.449] WriteFile (in: hFile=0x264, lpBuffer=0x6d77d97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d77d97*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0242.449] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0242.449] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0242.449] CloseHandle (hObject=0x264) returned 1 [0243.189] GetProcessHeap () returned 0x580000 [0243.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0243.189] GetProcessHeap () returned 0x580000 [0243.189] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72bb898 | out: hHeap=0x580000) returned 1 [0243.190] GetProcessHeap () returned 0x580000 [0243.190] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0243.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc807b520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34fc, dwReserved0=0x5b0fd28, dwReserved1=0x72bb898, cFileName="PGMN108.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN10~2.YOU")) returned 0x5b9730 [0244.418] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.281] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML", len=0x3e | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned 1 [0249.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0249.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0249.283] CloseHandle (hObject=0x470) returned 1 [0249.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.284] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml.id_1622540890_.your_last_chance")) returned 1 [0249.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f308b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f308b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x2614, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b9730 [0249.336] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0249.337] GetProcessHeap () returned 0x580000 [0249.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2621) returned 0x72ba208 [0249.337] GetProcessHeap () returned 0x580000 [0249.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2621) returned 0x72bc838 [0249.337] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.337] ReadFile (in: hFile=0x470, lpBuffer=0x72ba208, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72ba208*, lpNumberOfBytesRead=0x5b0ff14*=0x2600, lpOverlapped=0x0) returned 1 [0250.314] GetProcessHeap () returned 0x580000 [0250.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0250.314] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.314] WriteFile (in: hFile=0x470, lpBuffer=0x72bc838*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bc838*, lpNumberOfBytesWritten=0x5b0ff14*=0x2600, lpOverlapped=0x0) returned 1 [0250.314] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.314] WriteFile (in: hFile=0x470, lpBuffer=0x72bee37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bee37*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0250.314] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.315] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0250.315] CloseHandle (hObject=0x470) returned 1 [0251.473] GetProcessHeap () returned 0x580000 [0251.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72bc838 | out: hHeap=0x580000) returned 1 [0251.473] GetProcessHeap () returned 0x580000 [0251.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72ba208 | out: hHeap=0x580000) returned 1 [0251.473] GetProcessHeap () returned 0x580000 [0251.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f308b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccb76a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2638, dwReserved0=0x5b0fd28, dwReserved1=0x72ba208, cFileName="CALENDAR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b9730 [0254.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.065] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML", len=0x3e | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML") returned 1 [0255.065] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb8) returned 0x72e5948 [0255.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0255.066] CloseHandle (hObject=0x48c) returned 1 [0255.066] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml.id_1622540890_.your_last_chance")) returned 1 [0255.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a9ff00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57a9ff00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBS~1.YOU")) returned 0x5b9730 [0255.067] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0255.068] GetProcessHeap () returned 0x580000 [0255.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0255.068] GetProcessHeap () returned 0x580000 [0255.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0255.068] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.068] ReadFile (in: hFile=0x48c, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x5b0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0255.079] GetProcessHeap () returned 0x580000 [0255.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.079] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.079] WriteFile (in: hFile=0x48c, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x5b0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0255.080] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.080] WriteFile (in: hFile=0x48c, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.080] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.080] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.080] CloseHandle (hObject=0x48c) returned 1 [0255.080] GetProcessHeap () returned 0x580000 [0255.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0255.080] GetProcessHeap () returned 0x580000 [0255.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0255.080] GetProcessHeap () returned 0x580000 [0255.080] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a9ff00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf8fcee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x5b0fd28, dwReserved1=0x662288, cFileName="DGWEBSBR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBS~1.YOU")) returned 0x5b9730 [0255.080] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.097] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML", len=0x3e | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML") returned 1 [0255.097] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb0) returned 0x72e5948 [0255.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.098] CloseHandle (hObject=0x3b4) returned 1 [0255.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml.id_1622540890_.your_last_chance")) returned 1 [0255.101] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.101] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67294800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67294800, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBR~1.YOU")) returned 0x5b9730 [0255.101] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.101] GetProcessHeap () returned 0x580000 [0255.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x678958 [0255.101] GetProcessHeap () returned 0x580000 [0255.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x241) returned 0x678bc0 [0255.101] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.101] ReadFile (in: hFile=0x3b4, lpBuffer=0x678958, nNumberOfBytesToRead=0x220, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x5b0ff14*=0x220, lpOverlapped=0x0) returned 1 [0255.104] GetProcessHeap () returned 0x580000 [0255.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x678bc0*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678bc0*, lpNumberOfBytesWritten=0x5b0ff14*=0x220, lpOverlapped=0x0) returned 1 [0255.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x678ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x678ddf*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.105] CloseHandle (hObject=0x3b4) returned 1 [0255.105] GetProcessHeap () returned 0x580000 [0255.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678bc0 | out: hHeap=0x580000) returned 1 [0255.105] GetProcessHeap () returned 0x580000 [0255.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0255.105] GetProcessHeap () returned 0x580000 [0255.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.105] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67294800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf923040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5b0fd28, dwReserved1=0x678958, cFileName="DGWEBREF.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBR~1.YOU")) returned 0x5b9730 [0255.106] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.107] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML", len=0x3e | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML") returned 1 [0255.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fac) returned 0x72e5948 [0255.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.108] CloseHandle (hObject=0x3b4) returned 1 [0255.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml.id_1622540890_.your_last_chance")) returned 1 [0255.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326ac000, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x326ac000, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBP~1.YOU")) returned 0x5b9730 [0255.109] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0255.109] GetProcessHeap () returned 0x580000 [0255.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0255.110] GetProcessHeap () returned 0x580000 [0255.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0255.110] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.110] ReadFile (in: hFile=0x3b4, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x5b0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0255.121] GetProcessHeap () returned 0x580000 [0255.121] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.121] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.121] WriteFile (in: hFile=0x3b4, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x5b0ff14*=0xba0, lpOverlapped=0x0) returned 1 [0255.121] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.121] WriteFile (in: hFile=0x3b4, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x5b0ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.121] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.121] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5b0ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.121] CloseHandle (hObject=0x3b4) returned 1 [0255.121] GetProcessHeap () returned 0x580000 [0255.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0255.121] GetProcessHeap () returned 0x580000 [0255.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0255.121] GetProcessHeap () returned 0x580000 [0255.121] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fccc | out: lpFindFileData=0x5b0fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326ac000, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf9491a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x5b0fd28, dwReserved1=0x65f268, cFileName="DGWEBPQT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBP~1.YOU")) returned 0x5b9730 [0255.122] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0256.113] SysReAllocStringLen (in: pbstr=0x5b0ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC", len=0x3c | out: pbstr=0x5b0ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC") returned 1 [0256.113] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f74) returned 0x72e5948 [0256.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.771] CloseHandle (hObject=0x3b4) returned 1 [0258.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.771] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc.id_1622540890_.your_last_chance")) returned 1 [0258.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5b0ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5b0fc74 | out: lpFindFileData=0x5b0fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x8c952, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM98~1.YOU")) returned 0x5b96f0 [0258.772] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0258.773] GetProcessHeap () returned 0x580000 [0258.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0258.773] GetProcessHeap () returned 0x580000 [0258.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0258.774] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.774] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5b0ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x5b0ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 50 os_tid = 0xac0 [0039.069] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.673] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.812] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.347] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.505] Sleep (dwMilliseconds=0x1) [0040.534] Sleep (dwMilliseconds=0x1) [0040.549] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.325] Sleep (dwMilliseconds=0x1) [0042.351] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.791] Sleep (dwMilliseconds=0x1) [0042.816] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.848] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.011] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.101] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.197] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.431] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.462] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.556] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.694] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.742] Sleep (dwMilliseconds=0x1) [0043.749] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.781] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.827] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.936] Sleep (dwMilliseconds=0x1) [0043.952] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.020] Sleep (dwMilliseconds=0x1) [0044.031] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.435] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.466] Sleep (dwMilliseconds=0x1) [0044.482] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.513] Sleep (dwMilliseconds=0x1) [0044.528] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.590] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.622] Sleep (dwMilliseconds=0x1) [0044.637] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.684] Sleep (dwMilliseconds=0x1) [0044.700] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.777] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.809] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.964] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.012] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.043] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.106] Sleep (dwMilliseconds=0x1) [0045.121] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.168] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.205] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.245] Sleep (dwMilliseconds=0x1) [0045.261] Sleep (dwMilliseconds=0x1) [0045.277] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.324] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.355] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.418] Sleep (dwMilliseconds=0x1) [0045.433] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.480] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.558] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.729] Sleep (dwMilliseconds=0x1) [0045.793] Sleep (dwMilliseconds=0x1) [0045.808] Sleep (dwMilliseconds=0x1) [0045.824] Sleep (dwMilliseconds=0x1) [0045.838] Sleep (dwMilliseconds=0x1) [0045.855] Sleep (dwMilliseconds=0x1) [0045.869] Sleep (dwMilliseconds=0x1) [0045.887] Sleep (dwMilliseconds=0x1) [0045.901] Sleep (dwMilliseconds=0x1) [0045.916] Sleep (dwMilliseconds=0x1) [0045.932] Sleep (dwMilliseconds=0x1) [0045.948] Sleep (dwMilliseconds=0x1) [0045.964] Sleep (dwMilliseconds=0x1) [0045.979] Sleep (dwMilliseconds=0x1) [0045.995] Sleep (dwMilliseconds=0x1) [0046.010] Sleep (dwMilliseconds=0x1) [0046.026] Sleep (dwMilliseconds=0x1) [0046.041] Sleep (dwMilliseconds=0x1) [0046.057] Sleep (dwMilliseconds=0x1) [0046.073] Sleep (dwMilliseconds=0x1) [0046.088] Sleep (dwMilliseconds=0x1) [0046.104] Sleep (dwMilliseconds=0x1) [0046.120] Sleep (dwMilliseconds=0x1) [0046.135] Sleep (dwMilliseconds=0x1) [0046.150] Sleep (dwMilliseconds=0x1) [0046.166] Sleep (dwMilliseconds=0x1) [0046.182] Sleep (dwMilliseconds=0x1) [0046.203] Sleep (dwMilliseconds=0x1) [0046.213] Sleep (dwMilliseconds=0x1) [0046.228] Sleep (dwMilliseconds=0x1) [0046.244] Sleep (dwMilliseconds=0x1) [0046.260] Sleep (dwMilliseconds=0x1) [0046.278] Sleep (dwMilliseconds=0x1) [0046.291] Sleep (dwMilliseconds=0x1) [0046.307] Sleep (dwMilliseconds=0x1) [0046.322] Sleep (dwMilliseconds=0x1) [0046.347] Sleep (dwMilliseconds=0x1) [0046.353] Sleep (dwMilliseconds=0x1) [0046.369] Sleep (dwMilliseconds=0x1) [0046.384] Sleep (dwMilliseconds=0x1) [0046.400] Sleep (dwMilliseconds=0x1) [0046.416] Sleep (dwMilliseconds=0x1) [0046.431] Sleep (dwMilliseconds=0x1) [0046.447] Sleep (dwMilliseconds=0x1) [0046.462] Sleep (dwMilliseconds=0x1) [0046.480] Sleep (dwMilliseconds=0x1) [0046.494] Sleep (dwMilliseconds=0x1) [0046.509] Sleep (dwMilliseconds=0x1) [0046.532] Sleep (dwMilliseconds=0x1) [0046.541] Sleep (dwMilliseconds=0x1) [0046.556] Sleep (dwMilliseconds=0x1) [0046.572] Sleep (dwMilliseconds=0x1) [0046.589] Sleep (dwMilliseconds=0x1) [0046.603] Sleep (dwMilliseconds=0x1) [0046.619] Sleep (dwMilliseconds=0x1) [0046.634] Sleep (dwMilliseconds=0x1) [0046.650] Sleep (dwMilliseconds=0x1) [0046.665] Sleep (dwMilliseconds=0x1) [0046.681] Sleep (dwMilliseconds=0x1) [0046.696] Sleep (dwMilliseconds=0x1) [0046.712] Sleep (dwMilliseconds=0x1) [0046.728] Sleep (dwMilliseconds=0x1) [0046.744] Sleep (dwMilliseconds=0x1) [0046.759] Sleep (dwMilliseconds=0x1) [0046.774] Sleep (dwMilliseconds=0x1) [0046.790] Sleep (dwMilliseconds=0x1) [0046.806] Sleep (dwMilliseconds=0x1) [0046.821] Sleep (dwMilliseconds=0x1) [0046.837] Sleep (dwMilliseconds=0x1) [0046.853] Sleep (dwMilliseconds=0x1) [0046.868] Sleep (dwMilliseconds=0x1) [0046.884] Sleep (dwMilliseconds=0x1) [0046.900] Sleep (dwMilliseconds=0x1) [0046.915] Sleep (dwMilliseconds=0x1) [0046.935] Sleep (dwMilliseconds=0x1) [0046.946] Sleep (dwMilliseconds=0x1) [0046.962] Sleep (dwMilliseconds=0x1) [0046.977] Sleep (dwMilliseconds=0x1) [0046.991] Sleep (dwMilliseconds=0x1) [0047.007] Sleep (dwMilliseconds=0x1) [0047.023] Sleep (dwMilliseconds=0x1) [0047.038] Sleep (dwMilliseconds=0x1) [0047.054] Sleep (dwMilliseconds=0x1) [0047.070] Sleep (dwMilliseconds=0x1) [0047.085] Sleep (dwMilliseconds=0x1) [0047.101] Sleep (dwMilliseconds=0x1) [0047.116] Sleep (dwMilliseconds=0x1) [0047.132] Sleep (dwMilliseconds=0x1) [0047.148] Sleep (dwMilliseconds=0x1) [0047.163] Sleep (dwMilliseconds=0x1) [0047.179] Sleep (dwMilliseconds=0x1) [0047.200] Sleep (dwMilliseconds=0x1) [0047.210] Sleep (dwMilliseconds=0x1) [0047.226] Sleep (dwMilliseconds=0x1) [0047.241] Sleep (dwMilliseconds=0x1) [0047.257] Sleep (dwMilliseconds=0x1) [0047.272] Sleep (dwMilliseconds=0x1) [0047.288] Sleep (dwMilliseconds=0x1) [0047.303] Sleep (dwMilliseconds=0x1) [0047.320] Sleep (dwMilliseconds=0x1) [0047.335] Sleep (dwMilliseconds=0x1) [0047.358] Sleep (dwMilliseconds=0x1) [0047.366] Sleep (dwMilliseconds=0x1) [0047.382] Sleep (dwMilliseconds=0x1) [0047.397] Sleep (dwMilliseconds=0x1) [0047.413] Sleep (dwMilliseconds=0x1) [0047.428] Sleep (dwMilliseconds=0x1) [0047.444] Sleep (dwMilliseconds=0x1) [0047.460] Sleep (dwMilliseconds=0x1) [0047.475] Sleep (dwMilliseconds=0x1) [0047.491] Sleep (dwMilliseconds=0x1) [0047.506] Sleep (dwMilliseconds=0x1) [0047.522] Sleep (dwMilliseconds=0x1) [0047.539] Sleep (dwMilliseconds=0x1) [0047.553] Sleep (dwMilliseconds=0x1) [0047.569] Sleep (dwMilliseconds=0x1) [0047.585] Sleep (dwMilliseconds=0x1) [0047.600] Sleep (dwMilliseconds=0x1) [0047.667] Sleep (dwMilliseconds=0x1) [0047.685] Sleep (dwMilliseconds=0x1) [0047.693] Sleep (dwMilliseconds=0x1) [0047.709] Sleep (dwMilliseconds=0x1) [0047.725] Sleep (dwMilliseconds=0x1) [0047.740] Sleep (dwMilliseconds=0x1) [0047.756] Sleep (dwMilliseconds=0x1) [0047.772] Sleep (dwMilliseconds=0x1) [0047.788] Sleep (dwMilliseconds=0x1) [0047.806] Sleep (dwMilliseconds=0x1) [0047.818] Sleep (dwMilliseconds=0x1) [0047.834] Sleep (dwMilliseconds=0x1) [0047.850] Sleep (dwMilliseconds=0x1) [0047.898] Sleep (dwMilliseconds=0x1) [0047.912] Sleep (dwMilliseconds=0x1) [0047.927] Sleep (dwMilliseconds=0x1) [0047.943] Sleep (dwMilliseconds=0x1) [0047.959] Sleep (dwMilliseconds=0x1) [0047.974] Sleep (dwMilliseconds=0x1) [0047.990] Sleep (dwMilliseconds=0x1) [0048.006] Sleep (dwMilliseconds=0x1) [0048.021] Sleep (dwMilliseconds=0x1) [0048.037] Sleep (dwMilliseconds=0x1) [0048.052] Sleep (dwMilliseconds=0x1) [0048.068] Sleep (dwMilliseconds=0x1) [0048.084] Sleep (dwMilliseconds=0x1) [0048.101] Sleep (dwMilliseconds=0x1) [0048.115] Sleep (dwMilliseconds=0x1) [0048.130] Sleep (dwMilliseconds=0x1) [0048.146] Sleep (dwMilliseconds=0x1) [0048.162] Sleep (dwMilliseconds=0x1) [0048.177] Sleep (dwMilliseconds=0x1) [0048.198] Sleep (dwMilliseconds=0x1) [0048.208] Sleep (dwMilliseconds=0x1) [0048.224] Sleep (dwMilliseconds=0x1) [0048.240] Sleep (dwMilliseconds=0x1) [0048.255] Sleep (dwMilliseconds=0x1) [0048.271] Sleep (dwMilliseconds=0x1) [0048.286] Sleep (dwMilliseconds=0x1) [0048.302] Sleep (dwMilliseconds=0x1) [0048.318] Sleep (dwMilliseconds=0x1) [0048.335] Sleep (dwMilliseconds=0x1) [0048.349] Sleep (dwMilliseconds=0x1) [0048.364] Sleep (dwMilliseconds=0x1) [0048.380] Sleep (dwMilliseconds=0x1) [0048.403] Sleep (dwMilliseconds=0x1) [0048.411] Sleep (dwMilliseconds=0x1) [0048.427] Sleep (dwMilliseconds=0x1) [0048.443] Sleep (dwMilliseconds=0x1) [0048.458] Sleep (dwMilliseconds=0x1) [0048.474] Sleep (dwMilliseconds=0x1) [0048.489] Sleep (dwMilliseconds=0x1) [0048.505] Sleep (dwMilliseconds=0x1) [0048.520] Sleep (dwMilliseconds=0x1) [0048.536] Sleep (dwMilliseconds=0x1) [0048.552] Sleep (dwMilliseconds=0x1) [0048.567] Sleep (dwMilliseconds=0x1) [0048.583] Sleep (dwMilliseconds=0x1) [0048.598] Sleep (dwMilliseconds=0x1) [0048.614] Sleep (dwMilliseconds=0x1) [0048.630] Sleep (dwMilliseconds=0x1) [0048.645] Sleep (dwMilliseconds=0x1) [0048.661] Sleep (dwMilliseconds=0x1) [0048.676] Sleep (dwMilliseconds=0x1) [0048.692] Sleep (dwMilliseconds=0x1) [0048.707] Sleep (dwMilliseconds=0x1) [0048.725] Sleep (dwMilliseconds=0x1) [0048.739] Sleep (dwMilliseconds=0x1) [0048.754] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0048.786] Sleep (dwMilliseconds=0x1) [0048.801] Sleep (dwMilliseconds=0x1) [0048.817] Sleep (dwMilliseconds=0x1) [0048.833] Sleep (dwMilliseconds=0x1) [0048.848] Sleep (dwMilliseconds=0x1) [0048.864] Sleep (dwMilliseconds=0x1) [0048.879] Sleep (dwMilliseconds=0x1) [0048.895] Sleep (dwMilliseconds=0x1) [0048.910] Sleep (dwMilliseconds=0x1) [0048.926] Sleep (dwMilliseconds=0x1) [0048.942] Sleep (dwMilliseconds=0x1) [0048.957] Sleep (dwMilliseconds=0x1) [0048.973] Sleep (dwMilliseconds=0x1) [0048.988] Sleep (dwMilliseconds=0x1) [0049.004] Sleep (dwMilliseconds=0x1) [0049.019] Sleep (dwMilliseconds=0x1) [0049.035] Sleep (dwMilliseconds=0x1) [0049.051] Sleep (dwMilliseconds=0x1) [0049.066] Sleep (dwMilliseconds=0x1) [0049.082] Sleep (dwMilliseconds=0x1) [0049.098] Sleep (dwMilliseconds=0x1) [0049.115] Sleep (dwMilliseconds=0x1) [0049.129] Sleep (dwMilliseconds=0x1) [0049.145] Sleep (dwMilliseconds=0x1) [0049.160] Sleep (dwMilliseconds=0x1) [0049.176] Sleep (dwMilliseconds=0x1) [0049.197] Sleep (dwMilliseconds=0x1) [0049.207] Sleep (dwMilliseconds=0x1) [0049.222] Sleep (dwMilliseconds=0x1) [0049.238] Sleep (dwMilliseconds=0x1) [0049.254] Sleep (dwMilliseconds=0x1) [0049.269] Sleep (dwMilliseconds=0x1) [0049.285] Sleep (dwMilliseconds=0x1) [0049.300] Sleep (dwMilliseconds=0x1) [0049.316] Sleep (dwMilliseconds=0x1) [0049.332] Sleep (dwMilliseconds=0x1) [0049.348] Sleep (dwMilliseconds=0x1) [0049.363] Sleep (dwMilliseconds=0x1) [0049.379] Sleep (dwMilliseconds=0x1) [0049.394] Sleep (dwMilliseconds=0x1) [0049.410] Sleep (dwMilliseconds=0x1) [0049.425] Sleep (dwMilliseconds=0x1) [0049.443] Sleep (dwMilliseconds=0x1) [0049.463] Sleep (dwMilliseconds=0x1) [0049.472] Sleep (dwMilliseconds=0x1) [0049.488] Sleep (dwMilliseconds=0x1) [0049.503] Sleep (dwMilliseconds=0x1) [0049.519] Sleep (dwMilliseconds=0x1) [0049.535] Sleep (dwMilliseconds=0x1) [0049.550] Sleep (dwMilliseconds=0x1) [0049.566] Sleep (dwMilliseconds=0x1) [0049.581] Sleep (dwMilliseconds=0x1) [0049.597] Sleep (dwMilliseconds=0x1) [0049.618] Sleep (dwMilliseconds=0x1) [0049.628] Sleep (dwMilliseconds=0x1) [0049.644] Sleep (dwMilliseconds=0x1) [0049.659] Sleep (dwMilliseconds=0x1) [0049.675] Sleep (dwMilliseconds=0x1) [0049.691] Sleep (dwMilliseconds=0x1) [0049.706] Sleep (dwMilliseconds=0x1) [0049.722] Sleep (dwMilliseconds=0x1) [0049.737] Sleep (dwMilliseconds=0x1) [0049.753] Sleep (dwMilliseconds=0x1) [0049.768] Sleep (dwMilliseconds=0x1) [0049.784] Sleep (dwMilliseconds=0x1) [0049.800] Sleep (dwMilliseconds=0x1) [0049.815] Sleep (dwMilliseconds=0x1) [0049.833] Sleep (dwMilliseconds=0x1) [0049.847] Sleep (dwMilliseconds=0x1) [0049.862] Sleep (dwMilliseconds=0x1) [0049.878] Sleep (dwMilliseconds=0x1) [0049.894] Sleep (dwMilliseconds=0x1) [0049.909] Sleep (dwMilliseconds=0x1) [0049.924] Sleep (dwMilliseconds=0x1) [0049.940] Sleep (dwMilliseconds=0x1) [0049.956] Sleep (dwMilliseconds=0x1) [0049.971] Sleep (dwMilliseconds=0x1) [0049.987] Sleep (dwMilliseconds=0x1) [0050.002] Sleep (dwMilliseconds=0x1) [0050.018] Sleep (dwMilliseconds=0x1) [0050.034] Sleep (dwMilliseconds=0x1) [0050.049] Sleep (dwMilliseconds=0x1) [0050.065] Sleep (dwMilliseconds=0x1) [0050.080] Sleep (dwMilliseconds=0x1) [0050.096] Sleep (dwMilliseconds=0x1) [0050.112] Sleep (dwMilliseconds=0x1) [0050.127] Sleep (dwMilliseconds=0x1) [0050.143] Sleep (dwMilliseconds=0x1) [0050.158] Sleep (dwMilliseconds=0x1) [0050.174] Sleep (dwMilliseconds=0x1) [0050.195] Sleep (dwMilliseconds=0x1) [0050.205] Sleep (dwMilliseconds=0x1) [0050.223] Sleep (dwMilliseconds=0x1) [0050.236] Sleep (dwMilliseconds=0x1) [0050.252] Sleep (dwMilliseconds=0x1) [0050.267] Sleep (dwMilliseconds=0x1) [0050.283] Sleep (dwMilliseconds=0x1) [0050.299] Sleep (dwMilliseconds=0x1) [0050.314] Sleep (dwMilliseconds=0x1) [0050.330] Sleep (dwMilliseconds=0x1) [0050.346] Sleep (dwMilliseconds=0x1) [0050.361] Sleep (dwMilliseconds=0x1) [0050.377] Sleep (dwMilliseconds=0x1) [0050.392] Sleep (dwMilliseconds=0x1) [0050.408] Sleep (dwMilliseconds=0x1) [0050.423] Sleep (dwMilliseconds=0x1) [0050.439] Sleep (dwMilliseconds=0x1) [0050.456] Sleep (dwMilliseconds=0x1) [0050.480] Sleep (dwMilliseconds=0x1) [0050.486] Sleep (dwMilliseconds=0x1) [0050.502] Sleep (dwMilliseconds=0x1) [0050.517] Sleep (dwMilliseconds=0x1) [0050.533] Sleep (dwMilliseconds=0x1) [0050.550] Sleep (dwMilliseconds=0x1) [0050.564] Sleep (dwMilliseconds=0x1) [0050.579] Sleep (dwMilliseconds=0x1) [0050.596] Sleep (dwMilliseconds=0x1) [0050.611] Sleep (dwMilliseconds=0x1) [0050.626] Sleep (dwMilliseconds=0x1) [0050.642] Sleep (dwMilliseconds=0x1) [0050.658] Sleep (dwMilliseconds=0x1) [0050.673] Sleep (dwMilliseconds=0x1) [0050.689] Sleep (dwMilliseconds=0x1) [0050.704] Sleep (dwMilliseconds=0x1) [0050.720] Sleep (dwMilliseconds=0x1) [0050.735] Sleep (dwMilliseconds=0x1) [0050.751] Sleep (dwMilliseconds=0x1) [0050.767] Sleep (dwMilliseconds=0x1) [0050.782] Sleep (dwMilliseconds=0x1) [0050.798] Sleep (dwMilliseconds=0x1) [0050.814] Sleep (dwMilliseconds=0x1) [0050.829] Sleep (dwMilliseconds=0x1) [0050.849] Sleep (dwMilliseconds=0x1) [0050.860] Sleep (dwMilliseconds=0x1) [0050.876] Sleep (dwMilliseconds=0x1) [0050.891] Sleep (dwMilliseconds=0x1) [0050.907] Sleep (dwMilliseconds=0x1) [0050.923] Sleep (dwMilliseconds=0x1) [0050.940] Sleep (dwMilliseconds=0x1) [0050.959] Sleep (dwMilliseconds=0x1) [0050.970] Sleep (dwMilliseconds=0x1) [0050.985] Sleep (dwMilliseconds=0x1) [0051.001] Sleep (dwMilliseconds=0x1) [0051.016] Sleep (dwMilliseconds=0x1) [0051.032] Sleep (dwMilliseconds=0x1) [0051.047] Sleep (dwMilliseconds=0x1) [0051.063] Sleep (dwMilliseconds=0x1) [0051.079] Sleep (dwMilliseconds=0x1) [0051.096] Sleep (dwMilliseconds=0x1) [0051.110] Sleep (dwMilliseconds=0x1) [0051.126] Sleep (dwMilliseconds=0x1) [0051.141] Sleep (dwMilliseconds=0x1) [0051.157] Sleep (dwMilliseconds=0x1) [0051.173] Sleep (dwMilliseconds=0x1) [0051.194] Sleep (dwMilliseconds=0x1) [0051.203] Sleep (dwMilliseconds=0x1) [0051.219] Sleep (dwMilliseconds=0x1) [0051.235] Sleep (dwMilliseconds=0x1) [0051.250] Sleep (dwMilliseconds=0x1) [0051.266] Sleep (dwMilliseconds=0x1) [0051.282] Sleep (dwMilliseconds=0x1) [0051.297] Sleep (dwMilliseconds=0x1) [0051.313] Sleep (dwMilliseconds=0x1) [0051.330] Sleep (dwMilliseconds=0x1) [0051.344] Sleep (dwMilliseconds=0x1) [0051.359] Sleep (dwMilliseconds=0x1) [0051.375] Sleep (dwMilliseconds=0x1) [0051.391] Sleep (dwMilliseconds=0x1) [0051.406] Sleep (dwMilliseconds=0x1) [0051.422] Sleep (dwMilliseconds=0x1) [0051.438] Sleep (dwMilliseconds=0x1) [0051.453] Sleep (dwMilliseconds=0x1) [0051.469] Sleep (dwMilliseconds=0x1) [0051.484] Sleep (dwMilliseconds=0x1) [0051.507] Sleep (dwMilliseconds=0x1) [0051.515] Sleep (dwMilliseconds=0x1) [0051.531] Sleep (dwMilliseconds=0x1) [0051.547] Sleep (dwMilliseconds=0x1) [0051.562] Sleep (dwMilliseconds=0x1) [0051.578] Sleep (dwMilliseconds=0x1) [0051.594] Sleep (dwMilliseconds=0x1) [0051.609] Sleep (dwMilliseconds=0x1) [0051.635] Sleep (dwMilliseconds=0x1) [0051.645] Sleep (dwMilliseconds=0x1) [0051.658] Sleep (dwMilliseconds=0x1) [0051.671] Sleep (dwMilliseconds=0x1) [0051.701] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.794] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.981] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.153] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.293] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.574] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.917] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.964] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.822] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.900] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.056] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.290] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.415] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.727] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.992] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.382] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.593] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.486] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", len=0x51 | out: pbstr=0x5c4ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 1 [0058.486] GetProcessHeap () returned 0x580000 [0058.486] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0058.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0058.486] CloseHandle (hObject=0x428) returned 1 [0058.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.486] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0061.807] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.807] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9630 [0061.807] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0063.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0065.644] GetProcessHeap () returned 0x580000 [0065.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0065.644] GetProcessHeap () returned 0x580000 [0065.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x67eff0 [0065.644] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.644] ReadFile (in: hFile=0x46c, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x5c4ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0067.192] GetProcessHeap () returned 0x580000 [0067.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0067.192] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.192] WriteFile (in: hFile=0x46c, lpBuffer=0x67eff0*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67eff0*, lpNumberOfBytesWritten=0x5c4ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0067.193] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.193] WriteFile (in: hFile=0x46c, lpBuffer=0x67f58f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f58f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.193] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.193] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.193] CloseHandle (hObject=0x46c) returned 1 [0067.194] GetProcessHeap () returned 0x580000 [0067.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67eff0 | out: hHeap=0x580000) returned 1 [0067.194] GetProcessHeap () returned 0x580000 [0067.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0067.194] GetProcessHeap () returned 0x580000 [0067.194] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0067.194] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5fcbbf60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x5c4fd28, dwReserved1=0x5f3908, cFileName="Proof.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9630 [0067.194] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.361] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", len=0x44 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 1 [0067.361] GetProcessHeap () returned 0x580000 [0067.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x28) returned 0x5e9710 [0067.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0069.062] CloseHandle (hObject=0x45c) returned 1 [0069.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0069.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id_1622540890_.your_last_chance")) returned 1 [0072.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0072.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQNEDT~2.YOU")) returned 0x5b9770 [0072.011] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0072.011] GetProcessHeap () returned 0x580000 [0072.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6d0f510 [0072.012] GetProcessHeap () returned 0x580000 [0072.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa01) returned 0x6f06d58 [0072.012] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.012] ReadFile (in: hFile=0x45c, lpBuffer=0x6d0f510, nNumberOfBytesToRead=0x9e0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f510*, lpNumberOfBytesRead=0x5c4ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0072.022] GetProcessHeap () returned 0x580000 [0072.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0072.022] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.022] WriteFile (in: hFile=0x45c, lpBuffer=0x6f06d58*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06d58*, lpNumberOfBytesWritten=0x5c4ff14*=0x9e0, lpOverlapped=0x0) returned 1 [0072.022] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.022] WriteFile (in: hFile=0x45c, lpBuffer=0x6f07737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f07737*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0072.022] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.022] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0072.022] CloseHandle (hObject=0x45c) returned 1 [0072.023] GetProcessHeap () returned 0x580000 [0072.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06d58 | out: hHeap=0x580000) returned 1 [0072.023] GetProcessHeap () returned 0x580000 [0072.023] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0f510 | out: hHeap=0x580000) returned 1 [0072.024] GetProcessHeap () returned 0x580000 [0072.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0072.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62a68580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x5c4fd28, dwReserved1=0x6d0f510, cFileName="EQNEDT32.CNT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EQNEDT~2.YOU")) returned 0x5b9770 [0072.143] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.152] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", len=0x52 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 1 [0072.152] GetProcessHeap () returned 0x580000 [0072.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x54) returned 0x5b5d08 [0072.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.995] Sleep (dwMilliseconds=0x1) [0073.072] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", len=0x4e | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 1 [0073.072] GetProcessHeap () returned 0x580000 [0073.072] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x44) returned 0x5b5d08 [0073.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.076] Sleep (dwMilliseconds=0x1) [0073.088] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 1 [0073.088] GetProcessHeap () returned 0x580000 [0073.088] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x1c) returned 0x5b5d08 [0073.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0074.727] CloseHandle (hObject=0x490) returned 1 [0074.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id_1622540890_.your_last_chance")) returned 1 [0079.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JPEGIM~1.YOU")) returned 0x5b9730 [0079.284] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0079.284] GetProcessHeap () returned 0x580000 [0079.284] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x624d18 [0079.285] GetProcessHeap () returned 0x580000 [0079.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f330a8 [0079.285] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.285] ReadFile (in: hFile=0x490, lpBuffer=0x624d18, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x624d18*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.185] GetProcessHeap () returned 0x580000 [0081.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0081.185] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.185] WriteFile (in: hFile=0x490, lpBuffer=0x6f330a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f330a8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.185] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.185] WriteFile (in: hFile=0x490, lpBuffer=0x6f448a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f448a7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.186] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.186] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.186] CloseHandle (hObject=0x490) returned 1 [0081.186] GetProcessHeap () returned 0x580000 [0081.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f330a8 | out: hHeap=0x580000) returned 1 [0081.186] GetProcessHeap () returned 0x580000 [0081.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x624d18 | out: hHeap=0x580000) returned 1 [0081.186] GetProcessHeap () returned 0x580000 [0081.186] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0081.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x68019d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ada4, dwReserved0=0x5c4fd28, dwReserved1=0x624d18, cFileName="JPEGIM32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JPEGIM~1.YOU")) returned 0x5b9730 [0081.586] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.968] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", len=0x4c | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 1 [0085.968] GetProcessHeap () returned 0x580000 [0085.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x78) returned 0x614a48 [0085.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.970] Sleep (dwMilliseconds=0x1) [0085.984] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 1 [0085.984] GetProcessHeap () returned 0x580000 [0085.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc) returned 0x614a48 [0085.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.988] Sleep (dwMilliseconds=0x1) [0086.219] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 1 [0086.219] GetProcessHeap () returned 0x580000 [0086.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0086.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0086.220] CloseHandle (hObject=0x488) returned 1 [0086.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id_1622540890_.your_last_chance")) returned 1 [0086.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPFT53~1.YOU")) returned 0x5b9630 [0086.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0086.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0086.221] GetProcessHeap () returned 0x580000 [0086.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0086.221] GetProcessHeap () returned 0x580000 [0086.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0086.222] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.222] ReadFile (in: hFile=0x488, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0090.391] GetProcessHeap () returned 0x580000 [0090.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0090.392] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.392] WriteFile (in: hFile=0x488, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0090.762] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.762] WriteFile (in: hFile=0x488, lpBuffer=0x6cf6ca7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6ca7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.438] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.439] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.439] CloseHandle (hObject=0x488) returned 1 [0091.612] GetProcessHeap () returned 0x580000 [0091.612] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0091.612] GetProcessHeap () returned 0x580000 [0091.612] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0091.615] GetProcessHeap () returned 0x580000 [0091.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0091.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x30194, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="WPFT532.CNV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WPFT53~1.YOU")) returned 0x5b96b0 [0091.629] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.334] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", len=0x49 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 1 [0092.334] GetProcessHeap () returned 0x580000 [0092.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x48) returned 0x596c88 [0092.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0094.927] CloseHandle (hObject=0x4b4) returned 1 [0094.927] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id_1622540890_.your_last_chance")) returned 1 [0096.828] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0096.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAYERS~1.YOU")) returned 0x5b9730 [0099.248] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0099.249] GetProcessHeap () returned 0x580000 [0099.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe761) returned 0x6d21878 [0099.249] GetProcessHeap () returned 0x580000 [0099.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe761) returned 0x6ce54a8 [0099.250] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.250] ReadFile (in: hFile=0x480, lpBuffer=0x6d21878, nNumberOfBytesToRead=0xe740, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x5c4ff14*=0xe740, lpOverlapped=0x0) returned 1 [0101.233] GetProcessHeap () returned 0x580000 [0101.233] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.234] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.234] WriteFile (in: hFile=0x480, lpBuffer=0x6ce54a8*, nNumberOfBytesToWrite=0xe740, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesWritten=0x5c4ff14*=0xe740, lpOverlapped=0x0) returned 1 [0101.234] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.234] WriteFile (in: hFile=0x480, lpBuffer=0x6cf3be7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf3be7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.234] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.234] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.234] CloseHandle (hObject=0x480) returned 1 [0101.235] GetProcessHeap () returned 0x580000 [0101.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0101.235] GetProcessHeap () returned 0x580000 [0101.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0101.235] GetProcessHeap () returned 0x580000 [0101.235] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.843] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f46460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe767, dwReserved0=0x5c4fd28, dwReserved1=0x6d21878, cFileName="LAYERS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAYERS~1.YOU")) returned 0x5b96b0 [0101.843] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.666] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", len=0x35 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 1 [0109.666] GetProcessHeap () returned 0x580000 [0109.666] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4140, Size=0x3c) returned 0x5b4020 [0109.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.706] Sleep (dwMilliseconds=0x1) [0109.715] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", len=0x34 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 1 [0109.715] GetProcessHeap () returned 0x580000 [0109.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6150c8, Size=0x18) returned 0x5a58e8 [0109.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.716] Sleep (dwMilliseconds=0x1) [0110.464] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", len=0x37 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned 1 [0110.464] GetProcessHeap () returned 0x580000 [0110.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0xc) returned 0x5e94c8 [0110.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.466] Sleep (dwMilliseconds=0x1) [0111.109] Sleep (dwMilliseconds=0x1) [0111.120] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.791] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", len=0x31 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 1 [0111.791] GetProcessHeap () returned 0x580000 [0111.791] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.791] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.796] Sleep (dwMilliseconds=0x1) [0111.884] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", len=0x53 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 1 [0111.884] GetProcessHeap () returned 0x580000 [0111.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0111.884] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.889] Sleep (dwMilliseconds=0x1) [0111.901] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", len=0x4a | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 1 [0111.901] GetProcessHeap () returned 0x580000 [0111.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b9730 [0111.901] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.906] Sleep (dwMilliseconds=0x1) [0111.916] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", len=0x40 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 1 [0111.916] GetProcessHeap () returned 0x580000 [0111.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.916] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.917] Sleep (dwMilliseconds=0x1) [0111.956] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", len=0x4b | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 1 [0111.956] GetProcessHeap () returned 0x580000 [0111.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa058, Size=0x7c) returned 0x5f9b08 [0111.956] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.956] Sleep (dwMilliseconds=0x1) [0111.965] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", len=0x3e | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned 1 [0111.965] GetProcessHeap () returned 0x580000 [0111.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x60) returned 0x6c56120 [0111.965] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.965] Sleep (dwMilliseconds=0x1) [0112.002] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", len=0x41 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 1 [0112.002] GetProcessHeap () returned 0x580000 [0112.002] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x34) returned 0x5b96b0 [0112.002] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.006] Sleep (dwMilliseconds=0x1) [0112.010] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", len=0x52 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 1 [0112.010] GetProcessHeap () returned 0x580000 [0112.010] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.011] Sleep (dwMilliseconds=0x1) [0112.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.026] Sleep (dwMilliseconds=0x1) [0112.060] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", len=0x42 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png") returned 1 [0112.060] GetProcessHeap () returned 0x580000 [0112.060] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.060] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.062] Sleep (dwMilliseconds=0x1) [0112.119] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", len=0x51 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 1 [0112.119] GetProcessHeap () returned 0x580000 [0112.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x80) returned 0x5f9f48 [0112.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.119] Sleep (dwMilliseconds=0x1) [0112.134] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", len=0x4e | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned 1 [0112.134] GetProcessHeap () returned 0x580000 [0112.134] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.134] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.135] Sleep (dwMilliseconds=0x1) [0112.150] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", len=0x46 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 1 [0112.150] GetProcessHeap () returned 0x580000 [0112.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x4c) returned 0x5e1778 [0112.150] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.154] Sleep (dwMilliseconds=0x1) [0112.165] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", len=0x50 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 1 [0112.165] GetProcessHeap () returned 0x580000 [0112.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.165] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.170] Sleep (dwMilliseconds=0x1) [0112.183] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.185] Sleep (dwMilliseconds=0x1) [0112.198] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.201] Sleep (dwMilliseconds=0x1) [0112.244] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", len=0x5d | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.244] GetProcessHeap () returned 0x580000 [0112.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.244] Sleep (dwMilliseconds=0x1) [0112.260] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", len=0x49 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned 1 [0112.260] GetProcessHeap () returned 0x580000 [0112.260] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x30) returned 0x61f458 [0112.260] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.261] Sleep (dwMilliseconds=0x1) [0112.276] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", len=0x54 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.276] GetProcessHeap () returned 0x580000 [0112.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.276] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.276] Sleep (dwMilliseconds=0x1) [0112.302] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", len=0x47 | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned 1 [0112.302] GetProcessHeap () returned 0x580000 [0112.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61d978, Size=0x8c) returned 0x61dbd8 [0112.302] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.325] Sleep (dwMilliseconds=0x1) [0112.391] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x5c4ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.392] GetProcessHeap () returned 0x580000 [0112.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.392] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.392] Sleep (dwMilliseconds=0x1) [0113.319] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", len=0x3f | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 1 [0113.319] GetProcessHeap () returned 0x580000 [0113.319] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xd4) returned 0x6f0ceb8 [0113.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0113.489] CloseHandle (hObject=0x490) returned 1 [0113.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.489] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0154~1.YOU")) returned 0x5b9630 [0114.835] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0114.835] GetProcessHeap () returned 0x580000 [0114.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6c2a808 [0114.835] GetProcessHeap () returned 0x580000 [0114.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ce1) returned 0x6c2c4f8 [0114.835] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.835] ReadFile (in: hFile=0x490, lpBuffer=0x6c2a808, nNumberOfBytesToRead=0x1cc0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a808*, lpNumberOfBytesRead=0x5c4ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0114.862] GetProcessHeap () returned 0x580000 [0114.862] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.862] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.862] WriteFile (in: hFile=0x490, lpBuffer=0x6c2c4f8*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2c4f8*, lpNumberOfBytesWritten=0x5c4ff14*=0x1cc0, lpOverlapped=0x0) returned 1 [0114.862] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.862] WriteFile (in: hFile=0x490, lpBuffer=0x6c2e1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2e1b7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.862] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.862] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.862] CloseHandle (hObject=0x490) returned 1 [0114.862] GetProcessHeap () returned 0x580000 [0114.862] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2c4f8 | out: hHeap=0x580000) returned 1 [0114.862] GetProcessHeap () returned 0x580000 [0114.862] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a808 | out: hHeap=0x580000) returned 1 [0114.862] GetProcessHeap () returned 0x580000 [0114.862] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c1274c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cf0, dwReserved0=0x5c4fd28, dwReserved1=0x6c2a808, cFileName="AN01545_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0154~1.YOU")) returned 0x5b9630 [0115.870] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0115.942] CloseHandle (hObject=0x4b0) returned 1 [0115.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0016~1.YOU")) returned 0x5b9630 [0115.943] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0115.943] GetProcessHeap () returned 0x580000 [0115.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b41) returned 0x626d18 [0115.943] GetProcessHeap () returned 0x580000 [0115.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3b41) returned 0x62a868 [0115.943] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.943] ReadFile (in: hFile=0x4b0, lpBuffer=0x626d18, nNumberOfBytesToRead=0x3b20, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x5c4ff14*=0x3b20, lpOverlapped=0x0) returned 1 [0117.074] GetProcessHeap () returned 0x580000 [0117.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.075] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.075] WriteFile (in: hFile=0x4b0, lpBuffer=0x62a868*, nNumberOfBytesToWrite=0x3b20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x62a868*, lpNumberOfBytesWritten=0x5c4ff14*=0x3b20, lpOverlapped=0x0) returned 1 [0117.075] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.075] WriteFile (in: hFile=0x4b0, lpBuffer=0x62e387*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x62e387*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.075] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.075] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.075] CloseHandle (hObject=0x4b0) returned 1 [0117.075] GetProcessHeap () returned 0x580000 [0117.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62a868 | out: hHeap=0x580000) returned 1 [0117.075] GetProcessHeap () returned 0x580000 [0117.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0117.075] GetProcessHeap () returned 0x580000 [0117.075] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d647800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b52, dwReserved0=0x5c4fd28, dwReserved1=0x626d18, cFileName="SO00168_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0016~1.YOU")) returned 0x5b9630 [0118.838] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.873] CloseHandle (hObject=0x49c) returned 1 [0118.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~1.YOU")) returned 0x5b9630 [0118.874] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0118.875] GetProcessHeap () returned 0x580000 [0118.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x6037d8 [0118.875] GetProcessHeap () returned 0x580000 [0118.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x521) returned 0x603d20 [0118.875] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.875] ReadFile (in: hFile=0x49c, lpBuffer=0x6037d8, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6037d8*, lpNumberOfBytesRead=0x5c4ff14*=0x500, lpOverlapped=0x0) returned 1 [0118.883] GetProcessHeap () returned 0x580000 [0118.883] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.883] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.883] WriteFile (in: hFile=0x49c, lpBuffer=0x603d20*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x603d20*, lpNumberOfBytesWritten=0x5c4ff14*=0x500, lpOverlapped=0x0) returned 1 [0118.884] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.884] WriteFile (in: hFile=0x49c, lpBuffer=0x60421f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x60421f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.884] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.884] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.884] CloseHandle (hObject=0x49c) returned 1 [0118.884] GetProcessHeap () returned 0x580000 [0118.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x603d20 | out: hHeap=0x580000) returned 1 [0118.884] GetProcessHeap () returned 0x580000 [0118.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6037d8 | out: hHeap=0x580000) returned 1 [0118.884] GetProcessHeap () returned 0x580000 [0118.884] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0118.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e789780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x5c4fd28, dwReserved1=0x6037d8, cFileName="SO02439_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~1.YOU")) returned 0x5b9630 [0118.884] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0118.896] CloseHandle (hObject=0x440) returned 1 [0118.897] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.897] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.898] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0227~1.YOU")) returned 0x5b9630 [0118.898] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0118.898] GetProcessHeap () returned 0x580000 [0118.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3101) returned 0x6599d0 [0118.898] GetProcessHeap () returned 0x580000 [0118.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3101) returned 0x6ef4b98 [0118.898] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.898] ReadFile (in: hFile=0x440, lpBuffer=0x6599d0, nNumberOfBytesToRead=0x30e0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesRead=0x5c4ff14*=0x30e0, lpOverlapped=0x0) returned 1 [0119.478] GetProcessHeap () returned 0x580000 [0119.478] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0119.478] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.478] WriteFile (in: hFile=0x440, lpBuffer=0x6ef4b98*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef4b98*, lpNumberOfBytesWritten=0x5c4ff14*=0x30e0, lpOverlapped=0x0) returned 1 [0119.478] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.478] WriteFile (in: hFile=0x440, lpBuffer=0x6ef7c77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7c77*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.479] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.479] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.479] CloseHandle (hObject=0x440) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef4b98 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0119.684] GetProcessHeap () returned 0x580000 [0119.684] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0120.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ed30bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3108, dwReserved0=0x5c4fd28, dwReserved1=0x6599d0, cFileName="SO02276_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0227~1.YOU")) returned 0x5b96f0 [0120.134] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.156] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", len=0x4c | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 1 [0120.156] GetProcessHeap () returned 0x580000 [0120.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1794) returned 0x6d06ca8 [0120.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0121.156] CloseHandle (hObject=0x4a0) returned 1 [0121.156] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.id_1622540890_.your_last_chance")) returned 1 [0121.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J08640~1.YOU")) returned 0x5b9730 [0121.157] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0121.157] GetProcessHeap () returned 0x580000 [0121.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c79898 [0121.157] GetProcessHeap () returned 0x580000 [0121.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6cf6cf0 [0121.158] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.158] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5c4ff14*=0x680, lpOverlapped=0x0) returned 1 [0121.165] GetProcessHeap () returned 0x580000 [0121.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.165] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cf6cf0*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cf0*, lpNumberOfBytesWritten=0x5c4ff14*=0x680, lpOverlapped=0x0) returned 1 [0121.165] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x6cf736f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf736f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.165] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.165] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0121.165] CloseHandle (hObject=0x4a0) returned 1 [0121.165] GetProcessHeap () returned 0x580000 [0121.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cf0 | out: hHeap=0x580000) returned 1 [0121.165] GetProcessHeap () returned 0x580000 [0121.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0121.165] GetProcessHeap () returned 0x580000 [0121.165] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fd42040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6c3, dwReserved0=0x5c4fd28, dwReserved1=0x6c79898, cFileName="J0143758.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J08640~1.YOU")) returned 0x5b9730 [0121.911] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.360] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", len=0x42 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 1 [0122.360] GetProcessHeap () returned 0x580000 [0122.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0122.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0122.361] CloseHandle (hObject=0x470) returned 1 [0122.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id_1622540890_.your_last_chance")) returned 1 [0122.851] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAGCAT~1.YOU")) returned 0x5b9730 [0122.851] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0122.852] GetProcessHeap () returned 0x580000 [0122.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d330a8 [0122.852] GetProcessHeap () returned 0x580000 [0122.852] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d448d8 [0122.853] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.853] ReadFile (in: hFile=0x470, lpBuffer=0x6d330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.299] GetProcessHeap () returned 0x580000 [0124.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.300] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.300] WriteFile (in: hFile=0x470, lpBuffer=0x6d448d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d448d8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0124.300] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.300] WriteFile (in: hFile=0x470, lpBuffer=0x6d560d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d560d7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.456] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.456] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.456] CloseHandle (hObject=0x470) returned 1 [0124.457] GetProcessHeap () returned 0x580000 [0124.457] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d448d8 | out: hHeap=0x580000) returned 1 [0124.460] GetProcessHeap () returned 0x580000 [0124.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0124.461] GetProcessHeap () returned 0x580000 [0124.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0125.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81ca6260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c474, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="CAGCAT10.MML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAGCAT~1.YOU")) returned 0x5b9730 [0125.088] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.153] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", len=0x4f | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 1 [0125.153] GetProcessHeap () returned 0x580000 [0125.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x187c) returned 0x6f42f08 [0125.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0127.141] CloseHandle (hObject=0x450) returned 1 [0127.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0127.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id_1622540890_.your_last_chance")) returned 1 [0127.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORIZO~1.YOU")) returned 0x5b9730 [0127.142] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0127.142] GetProcessHeap () returned 0x580000 [0127.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0127.142] GetProcessHeap () returned 0x580000 [0127.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0127.142] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.142] ReadFile (in: hFile=0x450, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.468] GetProcessHeap () returned 0x580000 [0128.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0128.469] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.469] WriteFile (in: hFile=0x450, lpBuffer=0x6d7cfe8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.469] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.469] WriteFile (in: hFile=0x450, lpBuffer=0x6d8e7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e7e7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.469] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.469] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.469] CloseHandle (hObject=0x450) returned 1 [0128.469] GetProcessHeap () returned 0x580000 [0128.470] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0128.473] GetProcessHeap () returned 0x580000 [0128.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0128.474] GetProcessHeap () returned 0x580000 [0128.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0128.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84308520, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x338b6, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="Horizon.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORIZO~1.YOU")) returned 0x5b96f0 [0128.474] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.558] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", len=0x45 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned 1 [0128.558] GetProcessHeap () returned 0x580000 [0128.558] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd0) returned 0x6e063d0 [0128.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.967] CloseHandle (hObject=0x41c) returned 1 [0128.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.967] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.id_1622540890_.your_last_chance")) returned 1 [0128.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1498~1.YOU")) returned 0x5b96f0 [0128.968] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.968] GetProcessHeap () returned 0x580000 [0128.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0128.968] GetProcessHeap () returned 0x580000 [0128.968] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0128.968] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.968] ReadFile (in: hFile=0x41c, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0128.970] GetProcessHeap () returned 0x580000 [0128.970] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0128.970] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.970] WriteFile (in: hFile=0x41c, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0128.970] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.970] WriteFile (in: hFile=0x41c, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.970] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.970] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.970] CloseHandle (hObject=0x41c) returned 1 [0128.970] GetProcessHeap () returned 0x580000 [0128.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0128.970] GetProcessHeap () returned 0x580000 [0128.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0128.970] GetProcessHeap () returned 0x580000 [0128.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0129.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x847cb120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x5c4fd28, dwReserved1=0x5ad8a0, cFileName="BD14982_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1498~1.YOU")) returned 0x5b9730 [0129.445] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.472] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned 1 [0129.472] GetProcessHeap () returned 0x580000 [0129.472] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0129.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0131.008] CloseHandle (hObject=0x41c) returned 1 [0131.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0131.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.id_1622540890_.your_last_chance")) returned 1 [0131.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0131.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~4.YOU")) returned 0x5b9730 [0131.009] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0131.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0131.009] GetProcessHeap () returned 0x580000 [0131.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0131.009] GetProcessHeap () returned 0x580000 [0131.009] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04eb8 [0131.009] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.009] ReadFile (in: hFile=0x41c, lpBuffer=0x6d04cc0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesRead=0x5c4ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0131.012] GetProcessHeap () returned 0x580000 [0131.012] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0131.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.012] WriteFile (in: hFile=0x41c, lpBuffer=0x6d04eb8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04eb8*, lpNumberOfBytesWritten=0x5c4ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0131.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.012] WriteFile (in: hFile=0x41c, lpBuffer=0x6d05077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d05077*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.012] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.012] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.012] CloseHandle (hObject=0x41c) returned 1 [0131.012] GetProcessHeap () returned 0x580000 [0131.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04eb8 | out: hHeap=0x580000) returned 1 [0131.012] GetProcessHeap () returned 0x580000 [0131.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0131.012] GetProcessHeap () returned 0x580000 [0131.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0131.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b48540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x5c4fd28, dwReserved1=0x6d04cc0, cFileName="J0115875.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~4.YOU")) returned 0x5b9730 [0131.012] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0134.754] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn", len=0x4b | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn") returned 1 [0134.754] GetProcessHeap () returned 0x580000 [0134.754] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0134.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0134.918] CloseHandle (hObject=0x464) returned 1 [0134.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.918] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.id_1622540890_.your_last_chance")) returned 1 [0134.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.919] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdd9dd600, ftLastWriteTime.dwHighDateTime=0x1cacb3e, nFileSizeHigh=0x0, nFileSizeLow=0xbb9, dwReserved0=0x45, dwReserved1=0x0, cFileName="Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~2.YOU")) returned 0x5b96f0 [0134.919] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0134.920] GetProcessHeap () returned 0x580000 [0134.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x677cd0 [0134.920] GetProcessHeap () returned 0x580000 [0134.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0134.920] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.920] ReadFile (in: hFile=0x464, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x5c4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0134.932] GetProcessHeap () returned 0x580000 [0134.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.932] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.932] WriteFile (in: hFile=0x464, lpBuffer=0x65f268*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesWritten=0x5c4ff14*=0xba0, lpOverlapped=0x0) returned 1 [0134.932] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.932] WriteFile (in: hFile=0x464, lpBuffer=0x65fe07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe07*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.932] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.932] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.933] CloseHandle (hObject=0x464) returned 1 [0134.933] GetProcessHeap () returned 0x580000 [0134.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0134.933] GetProcessHeap () returned 0x580000 [0134.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0134.933] GetProcessHeap () returned 0x580000 [0134.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0134.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8809fe60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbdd, dwReserved0=0x5c4fd28, dwReserved1=0x677cd0, cFileName="Groove Starter Template.xsn.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~2.YOU")) returned 0x5b96f0 [0134.933] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.933] Sleep (dwMilliseconds=0x1) [0134.992] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC", len=0x41 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 1 [0134.992] GetProcessHeap () returned 0x580000 [0134.992] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea8) returned 0x6f14048 [0134.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.993] CloseHandle (hObject=0x3b8) returned 1 [0134.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0134.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0134.996] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~4.YOU")) returned 0x5b96f0 [0134.996] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0134.996] GetProcessHeap () returned 0x580000 [0134.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2798 [0134.996] GetProcessHeap () returned 0x580000 [0134.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2a60 [0134.996] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.997] ReadFile (in: hFile=0x3b8, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x5c4ff14*=0x280, lpOverlapped=0x0) returned 1 [0135.002] GetProcessHeap () returned 0x580000 [0135.002] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.002] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.002] WriteFile (in: hFile=0x3b8, lpBuffer=0x6df2a60*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a60*, lpNumberOfBytesWritten=0x5c4ff14*=0x280, lpOverlapped=0x0) returned 1 [0135.002] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.002] WriteFile (in: hFile=0x3b8, lpBuffer=0x6df2cdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2cdf*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.003] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.003] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.003] CloseHandle (hObject=0x3b8) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a60 | out: hHeap=0x580000) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0135.013] GetProcessHeap () returned 0x580000 [0135.013] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x881383e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a5, dwReserved0=0x5c4fd28, dwReserved1=0x6df2798, cFileName="EXCEL.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EXCELD~4.YOU")) returned 0x5b9770 [0135.816] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.835] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", len=0x60 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned 1 [0135.835] GetProcessHeap () returned 0x580000 [0135.835] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0138.479] CloseHandle (hObject=0x438) returned 1 [0138.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0138.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0138.481] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0138.481] GetProcessHeap () returned 0x580000 [0138.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0138.481] GetProcessHeap () returned 0x580000 [0138.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0138.481] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.481] ReadFile (in: hFile=0x438, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.483] GetProcessHeap () returned 0x580000 [0138.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616c28 [0138.483] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.483] WriteFile (in: hFile=0x438, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.483] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.483] WriteFile (in: hFile=0x438, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.483] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.483] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.483] CloseHandle (hObject=0x438) returned 1 [0138.484] GetProcessHeap () returned 0x580000 [0138.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0138.484] GetProcessHeap () returned 0x580000 [0138.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0138.484] GetProcessHeap () returned 0x580000 [0138.484] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616c28 | out: hHeap=0x580000) returned 1 [0138.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5c4fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0138.484] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.510] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned 1 [0138.510] GetProcessHeap () returned 0x580000 [0138.510] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0138.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.830] CloseHandle (hObject=0x470) returned 1 [0139.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b120100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b120100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~4.YOU")) returned 0x5b97b0 [0139.831] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.831] GetProcessHeap () returned 0x580000 [0139.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a21) returned 0x667250 [0139.831] GetProcessHeap () returned 0x580000 [0139.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a21) returned 0x6d0e508 [0139.831] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.831] ReadFile (in: hFile=0x470, lpBuffer=0x667250, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x5c4ff14*=0x1a00, lpOverlapped=0x0) returned 1 [0139.855] GetProcessHeap () returned 0x580000 [0139.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.855] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.855] WriteFile (in: hFile=0x470, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x5c4ff14*=0x1a00, lpOverlapped=0x0) returned 1 [0139.855] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.855] WriteFile (in: hFile=0x470, lpBuffer=0x6d0ff07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ff07*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.855] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.855] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.855] CloseHandle (hObject=0x470) returned 1 [0139.855] GetProcessHeap () returned 0x580000 [0139.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0139.855] GetProcessHeap () returned 0x580000 [0139.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0139.855] GetProcessHeap () returned 0x580000 [0139.855] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b120100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8afa30e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a39, dwReserved0=0x5c4fd28, dwReserved1=0x667250, cFileName="BD21313_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2131~4.YOU")) returned 0x5b9770 [0140.126] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.176] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0140.176] GetProcessHeap () returned 0x580000 [0140.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.378] CloseHandle (hObject=0x4a0) returned 1 [0140.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.379] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0140.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.639] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0140.639] GetProcessHeap () returned 0x580000 [0140.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0140.639] GetProcessHeap () returned 0x580000 [0140.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0140.639] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.639] ReadFile (in: hFile=0x4a0, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x5c4ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.641] GetProcessHeap () returned 0x580000 [0140.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.641] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.641] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x5c4ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.641] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.641] WriteFile (in: hFile=0x4a0, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.642] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.642] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.642] CloseHandle (hObject=0x4a0) returned 1 [0140.642] GetProcessHeap () returned 0x580000 [0140.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.642] GetProcessHeap () returned 0x580000 [0140.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.642] GetProcessHeap () returned 0x580000 [0140.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0141.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b7135a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x5c4fd28, dwReserved1=0x5aa990, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9730 [0141.012] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.469] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT", len=0x3b | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT") returned 1 [0144.469] GetProcessHeap () returned 0x580000 [0144.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0144.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0144.585] CloseHandle (hObject=0x428) returned 1 [0144.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.id_1622540890_.your_last_chance")) returned 1 [0144.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed8c4100, ftLastWriteTime.dwHighDateTime=0x1c67eda, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTFOR~1.YOU")) returned 0x5b9730 [0144.586] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outform.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0144.586] GetProcessHeap () returned 0x580000 [0144.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d2f848 [0144.586] GetProcessHeap () returned 0x580000 [0144.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d41078 [0144.586] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.586] ReadFile (in: hFile=0x428, lpBuffer=0x6d2f848, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f848*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.227] GetProcessHeap () returned 0x580000 [0147.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0147.227] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.227] WriteFile (in: hFile=0x428, lpBuffer=0x6d41078*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d41078*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0147.228] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.228] WriteFile (in: hFile=0x428, lpBuffer=0x6d52877*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d52877*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0147.228] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.228] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0147.228] CloseHandle (hObject=0x428) returned 1 [0147.228] GetProcessHeap () returned 0x580000 [0147.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d41078 | out: hHeap=0x580000) returned 1 [0147.228] GetProcessHeap () returned 0x580000 [0147.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2f848 | out: hHeap=0x580000) returned 1 [0147.228] GetProcessHeap () returned 0x580000 [0147.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0147.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f5db9e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16e24, dwReserved0=0x5c4fd28, dwReserved1=0x6d2f848, cFileName="OUTFORM.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTFOR~1.YOU")) returned 0x5b96f0 [0147.228] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.310] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS", len=0x45 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS") returned 1 [0148.310] GetProcessHeap () returned 0x580000 [0148.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0148.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0148.311] CloseHandle (hObject=0x3e4) returned 1 [0148.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0148.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css.id_1622540890_.your_last_chance")) returned 1 [0148.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0148.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1922be00, ftCreationTime.dwHighDateTime=0x1c69a7b, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1922be00, ftLastWriteTime.dwHighDateTime=0x1c69a7b, nFileSizeHigh=0x0, nFileSizeLow=0x1df68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC0FF0~1.YOU")) returned 0x5b96f0 [0148.312] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0148.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0148.312] GetProcessHeap () returned 0x580000 [0148.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0148.313] GetProcessHeap () returned 0x580000 [0148.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0148.313] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.313] ReadFile (in: hFile=0x3e4, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.874] GetProcessHeap () returned 0x580000 [0151.874] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0151.875] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x3e4, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0151.875] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x3e4, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.875] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.875] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.875] CloseHandle (hObject=0x3e4) returned 1 [0151.875] GetProcessHeap () returned 0x580000 [0151.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0151.880] GetProcessHeap () returned 0x580000 [0151.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0151.880] GetProcessHeap () returned 0x580000 [0151.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0152.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1922be00, ftCreationTime.dwHighDateTime=0x1c69a7b, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x922313a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1df8c, dwReserved0=0x580000, dwReserved1=0x6f66600, cFileName="SCHEME51.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC0FF0~1.YOU")) returned 0x5b9730 [0152.049] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0153.553] CloseHandle (hObject=0x3fc) returned 1 [0153.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.553] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.id_1622540890_.your_last_chance")) returned 1 [0153.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.554] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae096500, ftCreationTime.dwHighDateTime=0x1c30d4d, ftLastAccessTime.dwLowDateTime=0xfa6bd7f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xae096500, ftLastWriteTime.dwHighDateTime=0x1c30d4d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLMACR~1.YOU")) returned 0x5b9730 [0153.554] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlmacro.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0153.554] GetProcessHeap () returned 0x580000 [0153.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c21) returned 0x6d47d08 [0153.554] GetProcessHeap () returned 0x580000 [0153.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c21) returned 0x6d4a938 [0153.554] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.554] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d47d08, nNumberOfBytesToRead=0x2c00, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d47d08*, lpNumberOfBytesRead=0x5c4ff14*=0x2c00, lpOverlapped=0x0) returned 1 [0153.594] GetProcessHeap () returned 0x580000 [0153.594] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.594] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d4a938*, nNumberOfBytesToWrite=0x2c00, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4a938*, lpNumberOfBytesWritten=0x5c4ff14*=0x2c00, lpOverlapped=0x0) returned 1 [0153.594] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d4d537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d4d537*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.594] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.594] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.594] CloseHandle (hObject=0x3fc) returned 1 [0153.594] GetProcessHeap () returned 0x580000 [0153.594] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d4a938 | out: hHeap=0x580000) returned 1 [0153.594] GetProcessHeap () returned 0x580000 [0153.595] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d47d08 | out: hHeap=0x580000) returned 1 [0153.595] GetProcessHeap () returned 0x580000 [0153.595] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae096500, ftCreationTime.dwHighDateTime=0x1c30d4d, ftLastAccessTime.dwLowDateTime=0xfa6bd7f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9328eae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2c24, dwReserved0=0x5c4fd28, dwReserved1=0x6d47d08, cFileName="XLMACRO.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="XLMACR~1.YOU")) returned 0x5b9730 [0153.595] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0154.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.084] CloseHandle (hObject=0x448) returned 1 [0159.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.084] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0159.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIF76F~1.YOU")) returned 0x5b9630 [0159.085] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.086] GetProcessHeap () returned 0x580000 [0159.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0159.086] GetProcessHeap () returned 0x580000 [0159.086] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0159.086] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.086] ReadFile (in: hFile=0x448, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0159.087] GetProcessHeap () returned 0x580000 [0159.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.087] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.087] WriteFile (in: hFile=0x448, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5c4ff14*=0xc0, lpOverlapped=0x0) returned 1 [0159.087] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.087] WriteFile (in: hFile=0x448, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0159.090] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.090] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0159.090] CloseHandle (hObject=0x448) returned 1 [0159.090] GetProcessHeap () returned 0x580000 [0159.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0159.091] GetProcessHeap () returned 0x580000 [0159.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0159.091] GetProcessHeap () returned 0x580000 [0159.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96713040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5c4fd28, dwReserved1=0x5ad8a0, cFileName="WINPROJ_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIF76F~1.YOU")) returned 0x5b9730 [0164.392] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.429] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", len=0x49 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned 1 [0164.430] GetProcessHeap () returned 0x580000 [0164.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0164.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0164.430] CloseHandle (hObject=0x430) returned 1 [0164.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0164.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.id_1622540890_.your_last_chance")) returned 1 [0164.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0164.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~2.YOU")) returned 0x5b9730 [0164.431] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0164.431] GetProcessHeap () returned 0x580000 [0164.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7941) returned 0x6de0f50 [0164.432] GetProcessHeap () returned 0x580000 [0164.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7941) returned 0x7196f98 [0164.432] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.432] ReadFile (in: hFile=0x430, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x7920, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x5c4ff14*=0x7920, lpOverlapped=0x0) returned 1 [0165.632] GetProcessHeap () returned 0x580000 [0165.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0165.632] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.632] WriteFile (in: hFile=0x430, lpBuffer=0x7196f98*, nNumberOfBytesToWrite=0x7920, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7196f98*, lpNumberOfBytesWritten=0x5c4ff14*=0x7920, lpOverlapped=0x0) returned 1 [0165.632] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.632] WriteFile (in: hFile=0x430, lpBuffer=0x719e8b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x719e8b7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.632] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.632] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.632] CloseHandle (hObject=0x430) returned 1 [0165.633] GetProcessHeap () returned 0x580000 [0165.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7196f98 | out: hHeap=0x580000) returned 1 [0165.633] GetProcessHeap () returned 0x580000 [0165.633] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0165.635] GetProcessHeap () returned 0x580000 [0165.635] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0169.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a569060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7949, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="Author2String.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AUTHOR~2.YOU")) returned 0x5b9730 [0169.535] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.654] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", len=0x39 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 1 [0169.654] GetProcessHeap () returned 0x580000 [0169.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0169.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0169.655] CloseHandle (hObject=0x3fc) returned 1 [0169.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.655] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id_1622540890_.your_last_chance")) returned 1 [0169.655] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLSAMI~1.YOU")) returned 0x5b9730 [0169.656] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0169.656] GetProcessHeap () returned 0x580000 [0169.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x71a1) returned 0x6fd5f98 [0169.656] GetProcessHeap () returned 0x580000 [0169.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x71a1) returned 0x6f58108 [0169.656] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.656] ReadFile (in: hFile=0x3fc, lpBuffer=0x6fd5f98, nNumberOfBytesToRead=0x7180, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesRead=0x5c4ff14*=0x7180, lpOverlapped=0x0) returned 1 [0171.595] GetProcessHeap () returned 0x580000 [0171.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0171.595] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.595] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0x7180, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x5c4ff14*=0x7180, lpOverlapped=0x0) returned 1 [0171.596] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f5f287*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5f287*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.596] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.596] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.596] CloseHandle (hObject=0x3fc) returned 1 [0171.596] GetProcessHeap () returned 0x580000 [0171.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0171.596] GetProcessHeap () returned 0x580000 [0171.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0171.596] GetProcessHeap () returned 0x580000 [0171.596] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0173.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de3dda0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x5c4fd28, dwReserved1=0x6fd5f98, cFileName="OL.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLSAMI~1.YOU")) returned 0x5b9770 [0173.081] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.388] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", len=0x40 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 1 [0173.388] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0173.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0173.389] CloseHandle (hObject=0x48c) returned 1 [0173.389] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id_1622540890_.your_last_chance")) returned 1 [0174.816] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x273ff200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMSSMS~1.YOU")) returned 0x5b96f0 [0174.816] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0174.816] GetProcessHeap () returned 0x580000 [0174.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062b20 [0174.816] GetProcessHeap () returned 0x580000 [0174.816] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062da8 [0174.817] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.817] ReadFile (in: hFile=0x48c, lpBuffer=0x7062b20, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062b20*, lpNumberOfBytesRead=0x5c4ff14*=0x240, lpOverlapped=0x0) returned 1 [0174.827] GetProcessHeap () returned 0x580000 [0174.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0174.827] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.827] WriteFile (in: hFile=0x48c, lpBuffer=0x7062da8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062da8*, lpNumberOfBytesWritten=0x5c4ff14*=0x240, lpOverlapped=0x0) returned 1 [0174.827] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.828] WriteFile (in: hFile=0x48c, lpBuffer=0x7062fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062fe7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.828] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.828] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.828] CloseHandle (hObject=0x48c) returned 1 [0174.828] GetProcessHeap () returned 0x580000 [0174.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062da8 | out: hHeap=0x580000) returned 1 [0174.828] GetProcessHeap () returned 0x580000 [0174.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062b20 | out: hHeap=0x580000) returned 1 [0174.828] GetProcessHeap () returned 0x580000 [0174.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0176.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd09a40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x5c4fd28, dwReserved1=0x7062b20, cFileName="OMSSMS.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OMSSMS~1.YOU")) returned 0x5b96f0 [0176.808] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.845] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", len=0x3f | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 1 [0176.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0176.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.445] CloseHandle (hObject=0x470) returned 1 [0179.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0179.445] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.446] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~4.YOU")) returned 0x5b96f0 [0179.446] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.446] GetProcessHeap () returned 0x580000 [0179.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0179.446] GetProcessHeap () returned 0x580000 [0179.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0179.446] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.446] ReadFile (in: hFile=0x470, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0179.449] GetProcessHeap () returned 0x580000 [0179.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.449] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.449] WriteFile (in: hFile=0x470, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0179.450] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.450] WriteFile (in: hFile=0x470, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.450] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.450] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.450] CloseHandle (hObject=0x470) returned 1 [0179.450] GetProcessHeap () returned 0x580000 [0179.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0179.450] GetProcessHeap () returned 0x580000 [0179.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0179.450] GetProcessHeap () returned 0x580000 [0179.450] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa29392a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5c4fd28, dwReserved1=0x6df2798, cFileName="SETLANG_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~4.YOU")) returned 0x5b96b0 [0180.552] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.573] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", len=0x6a | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned 1 [0180.573] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0180.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0180.633] CloseHandle (hObject=0x490) returned 1 [0180.633] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.633] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.634] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd34e6d00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~2.YOU")) returned 0x5b96b0 [0180.634] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0180.634] GetProcessHeap () returned 0x580000 [0180.634] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x715c008 [0180.635] GetProcessHeap () returned 0x580000 [0180.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cba390 [0180.635] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.635] ReadFile (in: hFile=0x490, lpBuffer=0x715c008, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x5c4ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0180.662] GetProcessHeap () returned 0x580000 [0180.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.662] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.662] WriteFile (in: hFile=0x490, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x5c4ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0180.663] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.663] WriteFile (in: hFile=0x490, lpBuffer=0x6cbbfef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbbfef*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.663] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.663] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.663] CloseHandle (hObject=0x490) returned 1 [0180.663] GetProcessHeap () returned 0x580000 [0180.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0180.663] GetProcessHeap () returned 0x580000 [0180.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0180.663] GetProcessHeap () returned 0x580000 [0180.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0182.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa34adc80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x5c4fd28, dwReserved1=0x715c008, cFileName="AlertImage_MediumMAsk.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~2.YOU")) returned 0x5b9770 [0182.197] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.212] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", len=0x47 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned 1 [0182.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0182.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.953] CloseHandle (hObject=0x46c) returned 1 [0182.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.067] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.068] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOPIC~2.YOU")) returned 0x5b9770 [0183.068] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.068] GetProcessHeap () returned 0x580000 [0183.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0183.068] GetProcessHeap () returned 0x580000 [0183.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6c29878 [0183.068] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.068] ReadFile (in: hFile=0x46c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x5c4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0183.080] GetProcessHeap () returned 0x580000 [0183.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0183.080] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.080] WriteFile (in: hFile=0x46c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x5c4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0183.080] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.080] WriteFile (in: hFile=0x46c, lpBuffer=0x6c2a577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a577*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.081] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.081] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.081] CloseHandle (hObject=0x46c) returned 1 [0183.081] GetProcessHeap () returned 0x580000 [0183.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0183.081] GetProcessHeap () returned 0x580000 [0183.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0183.081] GetProcessHeap () returned 0x580000 [0183.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4bbd1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd38, dwReserved0=0x5c4fd28, dwReserved1=0x635768, cFileName="STOPICON.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOPIC~2.YOU")) returned 0x5b9770 [0183.806] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.821] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", len=0x62 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned 1 [0183.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0183.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.434] CloseHandle (hObject=0x49c) returned 1 [0185.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.id_1622540890_.your_last_chance")) returned 1 [0185.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU88B1~1.YOU")) returned 0x5b9770 [0185.435] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.436] GetProcessHeap () returned 0x580000 [0185.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0185.436] GetProcessHeap () returned 0x580000 [0185.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0185.436] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.436] ReadFile (in: hFile=0x49c, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0185.440] GetProcessHeap () returned 0x580000 [0185.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.440] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.440] WriteFile (in: hFile=0x49c, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0185.441] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.441] WriteFile (in: hFile=0x49c, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.441] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.441] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.441] CloseHandle (hObject=0x49c) returned 1 [0185.441] GetProcessHeap () returned 0x580000 [0185.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0185.441] GetProcessHeap () returned 0x580000 [0185.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0185.441] GetProcessHeap () returned 0x580000 [0185.441] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.537] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa625a2a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x292, dwReserved0=0x5c4fd28, dwReserved1=0x6df2798, cFileName="button_right.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU88B1~1.YOU")) returned 0x5b9770 [0185.537] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.588] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", len=0x44 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned 1 [0185.589] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b0) returned 0x6f14048 [0185.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.606] CloseHandle (hObject=0x49c) returned 1 [0185.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.606] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.id_1622540890_.your_last_chance")) returned 1 [0185.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5fdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR7~1.YOU")) returned 0x5b9770 [0185.607] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.607] GetProcessHeap () returned 0x580000 [0185.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5fe1) returned 0x7082b28 [0185.607] GetProcessHeap () returned 0x580000 [0185.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5fe1) returned 0x7088b18 [0185.607] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.607] ReadFile (in: hFile=0x49c, lpBuffer=0x7082b28, nNumberOfBytesToRead=0x5fc0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7082b28*, lpNumberOfBytesRead=0x5c4ff14*=0x5fc0, lpOverlapped=0x0) returned 1 [0187.716] GetProcessHeap () returned 0x580000 [0187.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0e050 [0187.717] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x49c, lpBuffer=0x7088b18*, nNumberOfBytesToWrite=0x5fc0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7088b18*, lpNumberOfBytesWritten=0x5c4ff14*=0x5fc0, lpOverlapped=0x0) returned 1 [0187.717] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x49c, lpBuffer=0x708ead7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x708ead7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.717] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.717] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.717] CloseHandle (hObject=0x49c) returned 1 [0187.718] GetProcessHeap () returned 0x580000 [0187.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7088b18 | out: hHeap=0x580000) returned 1 [0187.718] GetProcessHeap () returned 0x580000 [0187.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7082b28 | out: hHeap=0x580000) returned 1 [0187.718] GetProcessHeap () returned 0x580000 [0187.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0e050 | out: hHeap=0x580000) returned 1 [0188.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7812b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6003, dwReserved0=0x5c4fd28, dwReserved1=0x7082b28, cFileName="ZPDIR7F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR7~1.YOU")) returned 0x5b9770 [0188.057] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.061] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", len=0x84 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 1 [0188.061] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a4) returned 0x6f14048 [0188.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0188.062] CloseHandle (hObject=0x4a4) returned 1 [0188.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24051, dwReserved0=0x750071, dwReserved1=0x730069, cFileName="Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIRING~1.YOU")) returned 0x5b9770 [0188.063] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0188.064] GetProcessHeap () returned 0x580000 [0188.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0188.064] GetProcessHeap () returned 0x580000 [0188.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0188.064] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.064] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.918] GetProcessHeap () returned 0x580000 [0190.918] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0190.918] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.918] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0190.919] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.919] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0190.919] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.919] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0190.919] CloseHandle (hObject=0x4a4) returned 1 [0190.919] GetProcessHeap () returned 0x580000 [0190.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0190.919] GetProcessHeap () returned 0x580000 [0190.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0190.919] GetProcessHeap () returned 0x580000 [0190.919] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9692540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24075, dwReserved0=0x5c4fd28, dwReserved1=0x6d630a8, cFileName="Hiring Requisition - Customized.fdt.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIRING~1.YOU")) returned 0x5b9770 [0193.193] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.234] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", len=0x69 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned 1 [0193.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2078) returned 0x6f14048 [0193.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0193.235] CloseHandle (hObject=0x48c) returned 1 [0193.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.id_1622540890_.your_last_chance")) returned 1 [0193.242] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b9770 [0193.269] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0193.269] GetProcessHeap () returned 0x580000 [0193.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dd8c30 [0193.269] GetProcessHeap () returned 0x580000 [0193.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0193.269] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.269] ReadFile (in: hFile=0x39c, lpBuffer=0x6dd8c30, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8c30*, lpNumberOfBytesRead=0x5c4ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0193.337] GetProcessHeap () returned 0x580000 [0193.337] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0193.337] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.337] WriteFile (in: hFile=0x39c, lpBuffer=0x67c940*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesWritten=0x5c4ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0193.338] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.338] WriteFile (in: hFile=0x39c, lpBuffer=0x67cc1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x67cc1f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.338] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.338] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.338] CloseHandle (hObject=0x39c) returned 1 [0193.338] GetProcessHeap () returned 0x580000 [0193.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0193.338] GetProcessHeap () returned 0x580000 [0193.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8c30 | out: hHeap=0x580000) returned 1 [0193.338] GetProcessHeap () returned 0x580000 [0193.338] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0193.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaada1a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x310, dwReserved0=0x5c4fd28, dwReserved1=0x6dd8c30, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b97b0 [0193.338] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.422] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", len=0x68 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned 1 [0193.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0193.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.433] CloseHandle (hObject=0x438) returned 1 [0193.433] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.id_1622540890_.your_last_chance")) returned 1 [0193.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b97b0 [0193.435] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0193.435] GetProcessHeap () returned 0x580000 [0193.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062b20 [0193.435] GetProcessHeap () returned 0x580000 [0193.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x7062da8 [0193.435] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.435] ReadFile (in: hFile=0x438, lpBuffer=0x7062b20, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062b20*, lpNumberOfBytesRead=0x5c4ff14*=0x240, lpOverlapped=0x0) returned 1 [0193.462] GetProcessHeap () returned 0x580000 [0193.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcef58 [0193.462] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.462] WriteFile (in: hFile=0x438, lpBuffer=0x7062da8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062da8*, lpNumberOfBytesWritten=0x5c4ff14*=0x240, lpOverlapped=0x0) returned 1 [0193.462] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.463] WriteFile (in: hFile=0x438, lpBuffer=0x7062fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7062fe7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0193.463] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.463] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0193.463] CloseHandle (hObject=0x438) returned 1 [0193.473] GetProcessHeap () returned 0x580000 [0193.473] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062da8 | out: hHeap=0x580000) returned 1 [0193.474] GetProcessHeap () returned 0x580000 [0193.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7062b20 | out: hHeap=0x580000) returned 1 [0193.474] GetProcessHeap () returned 0x580000 [0193.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcef58 | out: hHeap=0x580000) returned 1 [0193.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaaed2560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x5c4fd28, dwReserved1=0x7062b20, cFileName="button_right_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b97f0 [0193.923] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.956] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x72 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0193.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0193.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0194.008] CloseHandle (hObject=0x468) returned 1 [0194.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0194.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.009] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x440041, dwReserved1=0x520045, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0194.009] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0194.010] GetProcessHeap () returned 0x580000 [0194.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dcf700 [0194.010] GetProcessHeap () returned 0x580000 [0194.010] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6dce580 [0194.010] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.010] ReadFile (in: hFile=0x468, lpBuffer=0x6dcf700, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf700*, lpNumberOfBytesRead=0x5c4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0194.011] GetProcessHeap () returned 0x580000 [0194.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0194.011] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.011] WriteFile (in: hFile=0x468, lpBuffer=0x6dce580*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce580*, lpNumberOfBytesWritten=0x5c4ff14*=0xe0, lpOverlapped=0x0) returned 1 [0194.012] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.012] WriteFile (in: hFile=0x468, lpBuffer=0x6dce65f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce65f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.012] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.012] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.012] CloseHandle (hObject=0x468) returned 1 [0194.012] GetProcessHeap () returned 0x580000 [0194.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0194.012] GetProcessHeap () returned 0x580000 [0194.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0194.012] GetProcessHeap () returned 0x580000 [0194.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0194.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab407580, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x5c4fd28, dwReserved1=0x6dcf700, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0194.012] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.020] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", len=0x69 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned 1 [0194.021] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0194.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0194.021] CloseHandle (hObject=0x4b0) returned 1 [0194.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.id_1622540890_.your_last_chance")) returned 1 [0194.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b97f0 [0194.022] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0194.023] GetProcessHeap () returned 0x580000 [0194.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc79b8 [0194.023] GetProcessHeap () returned 0x580000 [0194.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc7da0 [0194.023] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.023] ReadFile (in: hFile=0x4b0, lpBuffer=0x6dc79b8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc79b8*, lpNumberOfBytesRead=0x5c4ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0194.027] GetProcessHeap () returned 0x580000 [0194.027] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0194.027] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.027] WriteFile (in: hFile=0x4b0, lpBuffer=0x6dc7da0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7da0*, lpNumberOfBytesWritten=0x5c4ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0194.027] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.027] WriteFile (in: hFile=0x4b0, lpBuffer=0x6dc813f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc813f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.028] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.028] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.028] CloseHandle (hObject=0x4b0) returned 1 [0194.028] GetProcessHeap () returned 0x580000 [0194.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7da0 | out: hHeap=0x580000) returned 1 [0194.028] GetProcessHeap () returned 0x580000 [0194.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc79b8 | out: hHeap=0x580000) returned 1 [0194.028] GetProcessHeap () returned 0x580000 [0194.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0194.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab42d6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x580000, cFileName="Casual.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASUAL~1.YOU")) returned 0x5b97f0 [0194.028] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.033] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", len=0x69 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned 1 [0194.033] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0194.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0194.034] CloseHandle (hObject=0x4b0) returned 1 [0194.034] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.034] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.id_1622540890_.your_last_chance")) returned 1 [0194.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b97f0 [0194.035] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0194.035] GetProcessHeap () returned 0x580000 [0194.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef770 [0194.035] GetProcessHeap () returned 0x580000 [0194.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eefb18 [0194.035] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.035] ReadFile (in: hFile=0x4b0, lpBuffer=0x6eef770, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef770*, lpNumberOfBytesRead=0x5c4ff14*=0x360, lpOverlapped=0x0) returned 1 [0194.040] GetProcessHeap () returned 0x580000 [0194.040] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0194.040] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.040] WriteFile (in: hFile=0x4b0, lpBuffer=0x6eefb18*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefb18*, lpNumberOfBytesWritten=0x5c4ff14*=0x360, lpOverlapped=0x0) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.040] WriteFile (in: hFile=0x4b0, lpBuffer=0x6eefe77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefe77*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.040] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.040] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.041] CloseHandle (hObject=0x4b0) returned 1 [0194.041] GetProcessHeap () returned 0x580000 [0194.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eefb18 | out: hHeap=0x580000) returned 1 [0194.041] GetProcessHeap () returned 0x580000 [0194.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef770 | out: hHeap=0x580000) returned 1 [0194.041] GetProcessHeap () returned 0x580000 [0194.041] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0194.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab453840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x394, dwReserved0=0x5c4fd28, dwReserved1=0x6eef770, cFileName="Earthy.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="EARTHY~1.YOU")) returned 0x5b97f0 [0194.041] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.049] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", len=0x6b | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned 1 [0194.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0194.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0195.609] CloseHandle (hObject=0x490) returned 1 [0195.609] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0195.609] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.id_1622540890_.your_last_chance")) returned 1 [0195.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0195.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x2e0073, dwReserved1=0x640069, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b97b0 [0195.622] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0195.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0195.623] GetProcessHeap () returned 0x580000 [0195.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6df2798 [0195.623] GetProcessHeap () returned 0x580000 [0195.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6df2b80 [0195.623] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.623] ReadFile (in: hFile=0x490, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x5c4ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0195.627] GetProcessHeap () returned 0x580000 [0195.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.627] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.628] WriteFile (in: hFile=0x490, lpBuffer=0x6df2b80*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2b80*, lpNumberOfBytesWritten=0x5c4ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0195.628] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.628] WriteFile (in: hFile=0x490, lpBuffer=0x6df2f1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2f1f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.628] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.628] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.628] CloseHandle (hObject=0x490) returned 1 [0195.628] GetProcessHeap () returned 0x580000 [0195.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2b80 | out: hHeap=0x580000) returned 1 [0195.628] GetProcessHeap () returned 0x580000 [0195.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0195.628] GetProcessHeap () returned 0x580000 [0195.628] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.013] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac380480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x5c4fd28, dwReserved1=0x6df2798, cFileName="GreenTea.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GREENT~1.YOU")) returned 0x5b97b0 [0197.014] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.122] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", len=0x43 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned 1 [0197.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0197.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.123] CloseHandle (hObject=0x450) returned 1 [0197.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.id_1622540890_.your_last_chance")) returned 1 [0197.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x445d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR9B~1.YOU")) returned 0x5b97b0 [0197.124] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0197.124] GetProcessHeap () returned 0x580000 [0197.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4461) returned 0x6d6e6c8 [0197.124] GetProcessHeap () returned 0x580000 [0197.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4461) returned 0x6d72b38 [0197.124] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.124] ReadFile (in: hFile=0x450, lpBuffer=0x6d6e6c8, nNumberOfBytesToRead=0x4440, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6e6c8*, lpNumberOfBytesRead=0x5c4ff14*=0x4440, lpOverlapped=0x0) returned 1 [0197.622] GetProcessHeap () returned 0x580000 [0197.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0197.623] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.623] WriteFile (in: hFile=0x450, lpBuffer=0x6d72b38*, nNumberOfBytesToWrite=0x4440, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d72b38*, lpNumberOfBytesWritten=0x5c4ff14*=0x4440, lpOverlapped=0x0) returned 1 [0197.623] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.623] WriteFile (in: hFile=0x450, lpBuffer=0x6d76f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d76f77*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.623] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.623] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.623] CloseHandle (hObject=0x450) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d72b38 | out: hHeap=0x580000) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6e6c8 | out: hHeap=0x580000) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0199.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad68b480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4481, dwReserved0=0x5c4fd28, dwReserved1=0x6d6e6c8, cFileName="PDIR9B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR9B~1.YOU")) returned 0x5b96b0 [0199.657] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.041] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", len=0x6e | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned 1 [0201.041] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0201.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.962] CloseHandle (hObject=0x4ac) returned 1 [0201.962] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0201.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x67002e, dwReserved1=0x660069, cFileName="header.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0201.964] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.964] GetProcessHeap () returned 0x580000 [0201.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0201.964] GetProcessHeap () returned 0x580000 [0201.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6f668d8 [0201.964] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.964] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x5c4ff14*=0xca0, lpOverlapped=0x0) returned 1 [0201.976] GetProcessHeap () returned 0x580000 [0201.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0201.976] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.976] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x5c4ff14*=0xca0, lpOverlapped=0x0) returned 1 [0201.976] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.976] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f67577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67577*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.976] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.976] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.976] CloseHandle (hObject=0x4ac) returned 1 [0201.977] GetProcessHeap () returned 0x580000 [0201.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0201.977] GetProcessHeap () returned 0x580000 [0201.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.977] GetProcessHeap () returned 0x580000 [0201.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0203.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb000d420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xce1, dwReserved0=0x5c4fd28, dwReserved1=0x635768, cFileName="header.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97b0 [0203.125] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.162] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned 1 [0203.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0203.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0209.149] CloseHandle (hObject=0x3a8) returned 1 [0209.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.149] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0209.150] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x115a, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b9830 [0209.150] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0209.150] GetProcessHeap () returned 0x580000 [0209.150] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1161) returned 0x6f19958 [0209.533] GetProcessHeap () returned 0x580000 [0209.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1161) returned 0x6d430c0 [0209.533] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.533] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f19958, nNumberOfBytesToRead=0x1140, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesRead=0x5c4ff14*=0x1140, lpOverlapped=0x0) returned 1 [0209.550] GetProcessHeap () returned 0x580000 [0209.551] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.551] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.551] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d430c0*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430c0*, lpNumberOfBytesWritten=0x5c4ff14*=0x1140, lpOverlapped=0x0) returned 1 [0209.551] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.551] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d441ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d441ff*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.551] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.551] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.551] CloseHandle (hObject=0x3a8) returned 1 [0209.551] GetProcessHeap () returned 0x580000 [0209.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430c0 | out: hHeap=0x580000) returned 1 [0209.551] GetProcessHeap () returned 0x580000 [0209.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0209.551] GetProcessHeap () returned 0x580000 [0209.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4834f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x117e, dwReserved0=0x5c4fd28, dwReserved1=0x6f19958, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~1.YOU")) returned 0x5b97b0 [0210.091] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.136] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS", len=0x45 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS") returned 1 [0210.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0210.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0210.137] CloseHandle (hObject=0x428) returned 1 [0210.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css.id_1622540890_.your_last_chance")) returned 1 [0210.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1752aa00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1752aa00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC25A2~1.YOU")) returned 0x5b97b0 [0210.138] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0210.138] GetProcessHeap () returned 0x580000 [0210.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0210.138] GetProcessHeap () returned 0x580000 [0210.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0210.139] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.139] ReadFile (in: hFile=0x428, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.896] GetProcessHeap () returned 0x580000 [0213.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0213.896] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.897] WriteFile (in: hFile=0x428, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.897] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.897] WriteFile (in: hFile=0x428, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0213.897] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.897] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0213.897] CloseHandle (hObject=0x428) returned 1 [0213.897] GetProcessHeap () returned 0x580000 [0213.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0214.249] GetProcessHeap () returned 0x580000 [0214.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0214.249] GetProcessHeap () returned 0x580000 [0214.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0214.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1752aa00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb71b6ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eb0a, dwReserved0=0x5c4fd28, dwReserved1=0x6f976f8, cFileName="SCHEME21.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC25A2~1.YOU")) returned 0x5b97b0 [0214.875] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.940] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", len=0x3c | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned 1 [0214.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0214.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0214.941] CloseHandle (hObject=0x42c) returned 1 [0214.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.id_1622540890_.your_last_chance")) returned 1 [0214.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.942] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d18b800, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR634D~1.YOU")) returned 0x5b97b0 [0214.942] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0214.943] GetProcessHeap () returned 0x580000 [0214.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x711c020 [0214.943] GetProcessHeap () returned 0x580000 [0214.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x711e428 [0214.943] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.943] ReadFile (in: hFile=0x42c, lpBuffer=0x711c020, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c020*, lpNumberOfBytesRead=0x5c4ff14*=0x2200, lpOverlapped=0x0) returned 1 [0215.003] GetProcessHeap () returned 0x580000 [0215.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0215.003] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.003] WriteFile (in: hFile=0x42c, lpBuffer=0x711e428*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x711e428*, lpNumberOfBytesWritten=0x5c4ff14*=0x2200, lpOverlapped=0x0) returned 1 [0215.003] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.003] WriteFile (in: hFile=0x42c, lpBuffer=0x7120627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7120627*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.003] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.003] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.003] CloseHandle (hObject=0x42c) returned 1 [0215.003] GetProcessHeap () returned 0x580000 [0215.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711e428 | out: hHeap=0x580000) returned 1 [0215.003] GetProcessHeap () returned 0x580000 [0215.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c020 | out: hHeap=0x580000) returned 1 [0215.003] GetProcessHeap () returned 0x580000 [0215.003] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0215.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7c47040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2224, dwReserved0=0x5c4fd28, dwReserved1=0x711c020, cFileName="PROTTPLV.XLS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR634D~1.YOU")) returned 0x5b97b0 [0215.004] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.636] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", len=0x5b | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned 1 [0217.636] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0217.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0217.637] CloseHandle (hObject=0x3e4) returned 1 [0217.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.637] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.id_1622540890_.your_last_chance")) returned 1 [0221.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b97f0 [0221.011] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0221.011] GetProcessHeap () returned 0x580000 [0221.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0221.011] GetProcessHeap () returned 0x580000 [0221.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0221.011] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.011] ReadFile (in: hFile=0x3e4, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0221.015] GetProcessHeap () returned 0x580000 [0221.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.015] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.015] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0221.015] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.015] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.015] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.015] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.016] CloseHandle (hObject=0x3e4) returned 1 [0221.016] GetProcessHeap () returned 0x580000 [0221.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0221.016] GetProcessHeap () returned 0x580000 [0221.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0221.016] GetProcessHeap () returned 0x580000 [0221.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0221.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb58e1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c4fd28, dwReserved1=0x6c61120, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b9730 [0221.965] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.564] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", len=0x5d | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned 1 [0223.564] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0223.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0223.565] CloseHandle (hObject=0x46c) returned 1 [0223.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.id_1622540890_.your_last_chance")) returned 1 [0225.406] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.407] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b9630 [0225.407] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0225.407] GetProcessHeap () returned 0x580000 [0225.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0225.407] GetProcessHeap () returned 0x580000 [0225.407] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0225.407] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.407] ReadFile (in: hFile=0x46c, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0225.410] GetProcessHeap () returned 0x580000 [0225.410] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.410] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.411] WriteFile (in: hFile=0x46c, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x5c4ff14*=0x260, lpOverlapped=0x0) returned 1 [0225.411] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.411] WriteFile (in: hFile=0x46c, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.411] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.411] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.411] CloseHandle (hObject=0x46c) returned 1 [0225.411] GetProcessHeap () returned 0x580000 [0225.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0225.411] GetProcessHeap () returned 0x580000 [0225.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0225.411] GetProcessHeap () returned 0x580000 [0225.411] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde057a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x5c4fd28, dwReserved1=0x6c61120, cFileName="LAUNCH.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAUNCH~1.YOU")) returned 0x5b9630 [0226.316] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.425] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", len=0x52 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css") returned 1 [0226.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d90) returned 0x6dee6e0 [0226.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0226.426] CloseHandle (hObject=0x170) returned 1 [0226.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.426] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.id_1622540890_.your_last_chance")) returned 1 [0230.133] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b9730 [0230.133] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0230.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0230.134] GetProcessHeap () returned 0x580000 [0230.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x635768 [0230.134] GetProcessHeap () returned 0x580000 [0230.134] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd21) returned 0x6f668d8 [0230.134] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.134] ReadFile (in: hFile=0x170, lpBuffer=0x635768, nNumberOfBytesToRead=0xd00, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x5c4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0230.146] GetProcessHeap () returned 0x580000 [0230.146] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0230.147] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.147] WriteFile (in: hFile=0x170, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x5c4ff14*=0xd00, lpOverlapped=0x0) returned 1 [0230.147] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.147] WriteFile (in: hFile=0x170, lpBuffer=0x6f675d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675d7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0230.147] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.147] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0230.147] CloseHandle (hObject=0x170) returned 1 [0230.147] GetProcessHeap () returned 0x580000 [0230.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0230.147] GetProcessHeap () returned 0x580000 [0230.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0230.147] GetProcessHeap () returned 0x580000 [0230.147] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc0b19840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x5c4fd28, dwReserved1=0x635768, cFileName="Swirl.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SWIRLC~1.YOU")) returned 0x5b9630 [0230.859] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.952] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", len=0x3b | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 1 [0230.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0230.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0230.953] CloseHandle (hObject=0x3b4) returned 1 [0230.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.953] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.id_1622540890_.your_last_chance")) returned 1 [0230.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~2.YOU")) returned 0x5b9630 [0230.954] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0230.954] GetProcessHeap () returned 0x580000 [0230.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x6f668d8 [0230.954] GetProcessHeap () returned 0x580000 [0230.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x6c29878 [0230.954] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.954] ReadFile (in: hFile=0x3b4, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x5c4ff14*=0xc00, lpOverlapped=0x0) returned 1 [0231.028] GetProcessHeap () returned 0x580000 [0231.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x5c4ff14*=0xc00, lpOverlapped=0x0) returned 1 [0231.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c2a477*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a477*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0231.028] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.028] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0231.028] CloseHandle (hObject=0x3b4) returned 1 [0231.028] GetProcessHeap () returned 0x580000 [0231.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0231.028] GetProcessHeap () returned 0x580000 [0231.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0231.028] GetProcessHeap () returned 0x580000 [0231.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc13946a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x5c4fd28, dwReserved1=0x6f668d8, cFileName="mscss7wre_es.dub.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCSS7~2.YOU")) returned 0x5b9630 [0231.029] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.131] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", len=0x36 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 1 [0231.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0231.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.131] CloseHandle (hObject=0x268) returned 1 [0231.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0231.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.id_1622540890_.your_last_chance")) returned 1 [0231.132] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0231.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCOL1~1.YOU")) returned 0x5b9630 [0231.132] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0231.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mscol11.ppd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0231.133] GetProcessHeap () returned 0x580000 [0231.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ac1) returned 0x6d0e508 [0231.133] GetProcessHeap () returned 0x580000 [0231.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ac1) returned 0x6dd40d0 [0231.133] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.133] ReadFile (in: hFile=0x268, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1aa0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x5c4ff14*=0x1aa0, lpOverlapped=0x0) returned 1 [0231.157] GetProcessHeap () returned 0x580000 [0231.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.158] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.158] WriteFile (in: hFile=0x268, lpBuffer=0x6dd40d0*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesWritten=0x5c4ff14*=0x1aa0, lpOverlapped=0x0) returned 1 [0231.158] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.158] WriteFile (in: hFile=0x268, lpBuffer=0x6dd5b6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd5b6f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0231.158] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.158] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0231.158] CloseHandle (hObject=0x268) returned 1 [0231.158] GetProcessHeap () returned 0x580000 [0231.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0231.158] GetProcessHeap () returned 0x580000 [0231.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0231.158] GetProcessHeap () returned 0x580000 [0231.158] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14c51a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ad1, dwReserved0=0x5c4fd28, dwReserved1=0x6d0e508, cFileName="MSCOL11.PPD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSCOL1~1.YOU")) returned 0x5b9630 [0231.158] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0233.198] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", len=0x36 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned 1 [0233.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0233.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0233.221] CloseHandle (hObject=0x4ac) returned 1 [0233.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0233.221] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.id_1622540890_.your_last_chance")) returned 1 [0236.639] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0236.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLKIRM~1.YOU")) returned 0x5b9730 [0236.639] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0236.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\olkirmv.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0236.639] GetProcessHeap () returned 0x580000 [0236.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72aabe8 [0236.639] GetProcessHeap () returned 0x580000 [0236.639] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead6a0 [0236.639] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.639] ReadFile (in: hFile=0x4ac, lpBuffer=0x72aabe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72aabe8*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.758] GetProcessHeap () returned 0x580000 [0238.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf2a0 [0238.758] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.758] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ead6a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead6a0*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.280] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.280] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ebee9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebee9f*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.280] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.280] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.280] CloseHandle (hObject=0x4ac) returned 1 [0239.391] GetProcessHeap () returned 0x580000 [0239.391] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead6a0 | out: hHeap=0x580000) returned 1 [0239.392] GetProcessHeap () returned 0x580000 [0239.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72aabe8 | out: hHeap=0x580000) returned 1 [0239.392] GetProcessHeap () returned 0x580000 [0239.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf2a0 | out: hHeap=0x580000) returned 1 [0240.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6247e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x135b8, dwReserved0=0x5c4fd28, dwReserved1=0x72aabe8, cFileName="OLKIRMV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLKIRM~1.YOU")) returned 0x5b9730 [0240.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.655] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML", len=0x4f | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned 1 [0240.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0240.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0240.708] CloseHandle (hObject=0x3b4) returned 1 [0240.708] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.708] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml.id_1622540890_.your_last_chance")) returned 1 [0240.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA9BC0~1.YOU")) returned 0x5b9730 [0240.709] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0240.709] GetProcessHeap () returned 0x580000 [0240.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0240.709] GetProcessHeap () returned 0x580000 [0240.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0240.709] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.709] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x5c4ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.765] GetProcessHeap () returned 0x580000 [0240.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.765] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.765] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x5c4ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.765] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.765] WriteFile (in: hFile=0x3b4, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.765] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.765] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.765] CloseHandle (hObject=0x3b4) returned 1 [0240.765] GetProcessHeap () returned 0x580000 [0240.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0240.765] GetProcessHeap () returned 0x580000 [0240.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0240.765] GetProcessHeap () returned 0x580000 [0240.765] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc706a0a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x5c4fd28, dwReserved1=0x6d0a340, cFileName="YAHOO.COM.AR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA9BC0~1.YOU")) returned 0x5b9730 [0240.765] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.807] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", len=0x52 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned 1 [0240.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0240.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.870] CloseHandle (hObject=0x470) returned 1 [0241.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.871] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.id_1622540890_.your_last_chance")) returned 1 [0241.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BTOPEN~1.YOU")) returned 0x5b9630 [0241.872] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.872] GetProcessHeap () returned 0x580000 [0241.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.872] GetProcessHeap () returned 0x580000 [0241.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.872] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.872] ReadFile (in: hFile=0x470, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x5c4ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.876] GetProcessHeap () returned 0x580000 [0241.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.876] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.876] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x5c4ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.877] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.877] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.877] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.877] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.877] CloseHandle (hObject=0x470) returned 1 [0241.877] GetProcessHeap () returned 0x580000 [0241.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.877] GetProcessHeap () returned 0x580000 [0241.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.877] GetProcessHeap () returned 0x580000 [0241.877] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7afa240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34b, dwReserved0=0x5c4fd28, dwReserved1=0x6d0a340, cFileName="BTOPENWORLD.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BTOPEN~1.YOU")) returned 0x5b9630 [0241.877] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.879] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML", len=0x40 | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned 1 [0241.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0241.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0244.547] CloseHandle (hObject=0x478) returned 1 [0244.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml.id_1622540890_.your_last_chance")) returned 1 [0244.629] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x2dbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~1.YOU")) returned 0x5b96f0 [0244.629] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0244.630] GetProcessHeap () returned 0x580000 [0244.630] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ead008 [0244.630] GetProcessHeap () returned 0x580000 [0244.631] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f976f8 [0244.631] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.631] ReadFile (in: hFile=0x478, lpBuffer=0x6ead008, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ead008*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0247.982] GetProcessHeap () returned 0x580000 [0247.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0247.982] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.982] WriteFile (in: hFile=0x478, lpBuffer=0x6f976f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesWritten=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 [0247.983] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.983] WriteFile (in: hFile=0x478, lpBuffer=0x6fa8ef7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8ef7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0247.983] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0247.983] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0247.983] CloseHandle (hObject=0x478) returned 1 [0248.223] GetProcessHeap () returned 0x580000 [0248.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0248.223] GetProcessHeap () returned 0x580000 [0248.223] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ead008 | out: hHeap=0x580000) returned 1 [0248.224] GetProcessHeap () returned 0x580000 [0248.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0253.071] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb54bd40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2dc10, dwReserved0=0x5c4fd28, dwReserved1=0x6ead008, cFileName="PGLBL108.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~1.YOU")) returned 0x5b9730 [0253.071] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.110] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV", len=0x3e | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 1 [0253.111] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0253.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0253.111] CloseHandle (hObject=0x480) returned 1 [0253.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.id_1622540890_.your_last_chance")) returned 1 [0253.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e02aa00, ftCreationTime.dwHighDateTime=0x1c9c882, ftLastAccessTime.dwLowDateTime=0x51a3b970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e02aa00, ftLastWriteTime.dwHighDateTime=0x1c9c882, nFileSizeHigh=0x0, nFileSizeLow=0xf0ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BORDER~2.YOU")) returned 0x5b9730 [0253.113] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0253.113] GetProcessHeap () returned 0x580000 [0253.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf101) returned 0x72d6838 [0253.113] GetProcessHeap () returned 0x580000 [0253.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf101) returned 0x7287008 [0253.114] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.114] ReadFile (in: hFile=0x480, lpBuffer=0x72d6838, nNumberOfBytesToRead=0xf0e0, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x5c4ff14*=0xf0e0, lpOverlapped=0x0) returned 1 [0257.421] GetProcessHeap () returned 0x580000 [0257.421] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0257.422] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.422] WriteFile (in: hFile=0x480, lpBuffer=0x7287008*, nNumberOfBytesToWrite=0xf0e0, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7287008*, lpNumberOfBytesWritten=0x5c4ff14*=0xf0e0, lpOverlapped=0x0) returned 1 [0257.422] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.422] WriteFile (in: hFile=0x480, lpBuffer=0x72960e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x72960e7*, lpNumberOfBytesWritten=0x5c4ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.423] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.423] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5c4ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.423] CloseHandle (hObject=0x480) returned 1 [0258.082] GetProcessHeap () returned 0x580000 [0258.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7287008 | out: hHeap=0x580000) returned 1 [0258.082] GetProcessHeap () returned 0x580000 [0258.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0258.082] GetProcessHeap () returned 0x580000 [0258.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0259.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fccc | out: lpFindFileData=0x5c4fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e02aa00, ftCreationTime.dwHighDateTime=0x1c9c882, ftLastAccessTime.dwLowDateTime=0x51a3b970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0f4dd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf110, dwReserved0=0x5c4fd28, dwReserved1=0x72d6838, cFileName="BORDERBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BORDER~2.YOU")) returned 0x5b9630 [0259.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.231] SysReAllocStringLen (in: pbstr=0x5c4ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV", len=0x3d | out: pbstr=0x5c4ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV") returned 1 [0259.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20dc) returned 0x72e5948 [0259.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0259.278] CloseHandle (hObject=0x4ac) returned 1 [0259.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.279] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5c4ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.280] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5c4fc74 | out: lpFindFileData=0x5c4fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4ddf00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b4ddf00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x79e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDREP.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDRE~1.YOU")) returned 0x5b9630 [0259.280] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0259.280] GetProcessHeap () returned 0x580000 [0259.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7189e48 [0259.280] GetProcessHeap () returned 0x580000 [0259.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7287008 [0259.281] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.281] ReadFile (in: hFile=0x4ac, lpBuffer=0x7189e48, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5c4ff14, lpOverlapped=0x0 | out: lpBuffer=0x7189e48*, lpNumberOfBytesRead=0x5c4ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 51 os_tid = 0xac4 [0039.069] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.673] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.812] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.291] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.505] Sleep (dwMilliseconds=0x1) [0040.534] Sleep (dwMilliseconds=0x1) [0040.549] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.325] Sleep (dwMilliseconds=0x1) [0042.351] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.791] Sleep (dwMilliseconds=0x1) [0042.816] Sleep (dwMilliseconds=0x1) [0042.831] Sleep (dwMilliseconds=0x1) [0042.848] Sleep (dwMilliseconds=0x1) [0042.862] Sleep (dwMilliseconds=0x1) [0042.917] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.431] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.556] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.701] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.742] Sleep (dwMilliseconds=0x1) [0043.749] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.781] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.827] Sleep (dwMilliseconds=0x1) [0043.842] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.873] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.907] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.936] Sleep (dwMilliseconds=0x1) [0043.952] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.021] Sleep (dwMilliseconds=0x1) [0044.031] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.367] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.435] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.466] Sleep (dwMilliseconds=0x1) [0044.482] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.513] Sleep (dwMilliseconds=0x1) [0044.529] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.591] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.622] Sleep (dwMilliseconds=0x1) [0044.638] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.668] Sleep (dwMilliseconds=0x1) [0044.685] Sleep (dwMilliseconds=0x1) [0044.700] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.778] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.809] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.933] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.965] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.012] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.043] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.089] Sleep (dwMilliseconds=0x1) [0045.106] Sleep (dwMilliseconds=0x1) [0045.121] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.168] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.206] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.246] Sleep (dwMilliseconds=0x1) [0045.262] Sleep (dwMilliseconds=0x1) [0045.277] Sleep (dwMilliseconds=0x1) [0045.292] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.324] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.355] Sleep (dwMilliseconds=0x1) [0045.370] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.401] Sleep (dwMilliseconds=0x1) [0045.418] Sleep (dwMilliseconds=0x1) [0045.433] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.480] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.526] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.558] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.802] Sleep (dwMilliseconds=0x1) [0045.819] Sleep (dwMilliseconds=0x1) [0045.833] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.864] Sleep (dwMilliseconds=0x1) [0045.882] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.911] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.958] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.989] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.020] Sleep (dwMilliseconds=0x1) [0046.036] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.067] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.114] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.145] Sleep (dwMilliseconds=0x1) [0046.161] Sleep (dwMilliseconds=0x1) [0046.176] Sleep (dwMilliseconds=0x1) [0046.198] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.223] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.272] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.301] Sleep (dwMilliseconds=0x1) [0046.317] Sleep (dwMilliseconds=0x1) [0046.332] Sleep (dwMilliseconds=0x1) [0046.348] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.379] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.411] Sleep (dwMilliseconds=0x1) [0046.426] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.457] Sleep (dwMilliseconds=0x1) [0046.475] Sleep (dwMilliseconds=0x1) [0046.488] Sleep (dwMilliseconds=0x1) [0046.504] Sleep (dwMilliseconds=0x1) [0046.520] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.551] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.583] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.613] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.644] Sleep (dwMilliseconds=0x1) [0046.660] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.691] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.738] Sleep (dwMilliseconds=0x1) [0046.754] Sleep (dwMilliseconds=0x1) [0046.769] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.800] Sleep (dwMilliseconds=0x1) [0046.816] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.847] Sleep (dwMilliseconds=0x1) [0046.863] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.894] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.941] Sleep (dwMilliseconds=0x1) [0046.956] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.003] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.081] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.112] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.159] Sleep (dwMilliseconds=0x1) [0047.175] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.237] Sleep (dwMilliseconds=0x1) [0047.253] Sleep (dwMilliseconds=0x1) [0047.268] Sleep (dwMilliseconds=0x1) [0047.284] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.315] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.424] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.471] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.502] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.535] Sleep (dwMilliseconds=0x1) [0047.549] Sleep (dwMilliseconds=0x1) [0047.565] Sleep (dwMilliseconds=0x1) [0047.581] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.663] Sleep (dwMilliseconds=0x1) [0047.679] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.705] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.736] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.802] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.894] Sleep (dwMilliseconds=0x1) [0047.908] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.017] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.048] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.126] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.173] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.204] Sleep (dwMilliseconds=0x1) [0048.220] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.251] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.298] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.360] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.407] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.485] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.532] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.563] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.610] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.641] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.688] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.721] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.797] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.844] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.875] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.953] Sleep (dwMilliseconds=0x1) [0048.969] Sleep (dwMilliseconds=0x1) [0048.984] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.031] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.062] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.111] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.156] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.312] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.421] Sleep (dwMilliseconds=0x1) [0049.439] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.468] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.577] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.624] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.655] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.733] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.780] Sleep (dwMilliseconds=0x1) [0049.796] Sleep (dwMilliseconds=0x1) [0049.811] Sleep (dwMilliseconds=0x1) [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.936] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.967] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.014] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.045] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.092] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.201] Sleep (dwMilliseconds=0x1) [0050.219] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.248] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.326] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.357] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.404] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.452] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.513] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.560] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] Sleep (dwMilliseconds=0x1) [0050.669] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.716] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.825] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.856] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.903] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.966] Sleep (dwMilliseconds=0x1) [0050.981] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.012] Sleep (dwMilliseconds=0x1) [0051.028] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.059] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.137] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.190] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.215] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.293] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.326] Sleep (dwMilliseconds=0x1) [0051.340] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.371] Sleep (dwMilliseconds=0x1) [0051.387] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.418] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.449] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.496] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.527] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.590] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.641] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.696] Sleep (dwMilliseconds=0x1) [0051.701] Sleep (dwMilliseconds=0x1) [0051.716] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.449] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.761] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.011] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.042] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.229] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.666] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.869] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.446] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.571] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.602] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.680] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.758] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.883] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.914] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.961] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.304] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.351] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.487] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", len=0x51 | out: pbstr=0x5d8ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 1 [0058.487] GetProcessHeap () returned 0x580000 [0058.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e94b0 [0058.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0063.321] CloseHandle (hObject=0x474) returned 1 [0063.321] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0063.321] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id_1622540890_.your_last_chance")) returned 1 [0064.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0064.710] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b9630 [0064.710] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0064.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0064.710] GetProcessHeap () returned 0x580000 [0064.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cc0448 [0064.710] GetProcessHeap () returned 0x580000 [0064.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cd1c78 [0064.710] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.711] ReadFile (in: hFile=0x474, lpBuffer=0x6cc0448, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc0448*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0069.141] GetProcessHeap () returned 0x580000 [0069.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0069.141] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.141] WriteFile (in: hFile=0x474, lpBuffer=0x6cd1c78*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cd1c78*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0069.986] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.986] WriteFile (in: hFile=0x474, lpBuffer=0x6ce3477*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3477*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0070.045] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.046] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0070.046] CloseHandle (hObject=0x474) returned 1 [0070.131] GetProcessHeap () returned 0x580000 [0070.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cd1c78 | out: hHeap=0x580000) returned 1 [0070.131] GetProcessHeap () returned 0x580000 [0070.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cc0448 | out: hHeap=0x580000) returned 1 [0070.131] GetProcessHeap () returned 0x580000 [0070.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0072.141] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x61867f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd7224, dwReserved0=0x5d8fd28, dwReserved1=0x6cc0448, cFileName="Proof.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFM~1.YOU")) returned 0x5b9770 [0072.141] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.151] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", len=0x52 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 1 [0072.151] GetProcessHeap () returned 0x580000 [0072.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x60) returned 0x5b5d08 [0072.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.002] Sleep (dwMilliseconds=0x1) [0073.075] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", len=0x3d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 1 [0073.075] GetProcessHeap () returned 0x580000 [0073.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x34) returned 0x5b5d08 [0073.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.649] CloseHandle (hObject=0x464) returned 1 [0074.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id_1622540890_.your_last_chance")) returned 1 [0074.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWPGI~1.YOU")) returned 0x5b9730 [0074.650] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.650] GetProcessHeap () returned 0x580000 [0074.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x5f3908 [0074.650] GetProcessHeap () returned 0x580000 [0074.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6f094f0 [0074.650] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.650] ReadFile (in: hFile=0x464, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x5d8ff14*=0x560, lpOverlapped=0x0) returned 1 [0074.656] GetProcessHeap () returned 0x580000 [0074.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0074.657] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.657] WriteFile (in: hFile=0x464, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x5d8ff14*=0x560, lpOverlapped=0x0) returned 1 [0074.657] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.657] WriteFile (in: hFile=0x464, lpBuffer=0x6f09a4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09a4f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.657] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.657] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.657] CloseHandle (hObject=0x464) returned 1 [0074.657] GetProcessHeap () returned 0x580000 [0074.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0074.657] GetProcessHeap () returned 0x580000 [0074.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0074.657] GetProcessHeap () returned 0x580000 [0074.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0074.967] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x64210020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x58a, dwReserved0=0x5d8fd28, dwReserved1=0x5f3908, cFileName="MS.WPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWPGI~1.YOU")) returned 0x5b96f0 [0077.059] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.454] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", len=0x51 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 1 [0079.454] GetProcessHeap () returned 0x580000 [0079.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0079.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0079.874] CloseHandle (hObject=0x48c) returned 1 [0079.874] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.874] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id_1622540890_.your_last_chance")) returned 1 [0079.875] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.875] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOINT~1.YOU")) returned 0x5b96f0 [0079.875] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0079.875] GetProcessHeap () returned 0x580000 [0079.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f8d9a0 [0079.875] GetProcessHeap () returned 0x580000 [0079.875] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f9f1d0 [0079.876] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.876] ReadFile (in: hFile=0x48c, lpBuffer=0x6f8d9a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d9a0*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.473] GetProcessHeap () returned 0x580000 [0081.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0081.474] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.474] WriteFile (in: hFile=0x48c, lpBuffer=0x6f9f1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f1d0*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.474] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.474] WriteFile (in: hFile=0x48c, lpBuffer=0x6fb09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb09cf*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.552] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.552] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.552] CloseHandle (hObject=0x48c) returned 1 [0081.552] GetProcessHeap () returned 0x580000 [0081.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9f1d0 | out: hHeap=0x580000) returned 1 [0081.552] GetProcessHeap () returned 0x580000 [0081.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f8d9a0 | out: hHeap=0x580000) returned 1 [0081.554] GetProcessHeap () returned 0x580000 [0081.554] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0081.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x68385d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x152fa4, dwReserved0=0x580000, dwReserved1=0x67ef68, cFileName="MSOINTL.REST.IDX_DLL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOINT~1.YOU")) returned 0x5b9730 [0081.611] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.519] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", len=0x65 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 1 [0083.519] GetProcessHeap () returned 0x580000 [0083.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0083.522] CloseHandle (hObject=0x478) returned 1 [0083.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0083.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0083.523] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0083.524] GetProcessHeap () returned 0x580000 [0083.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1881) returned 0x625d20 [0083.524] GetProcessHeap () returned 0x580000 [0083.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1881) returned 0x6275b0 [0083.524] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.524] ReadFile (in: hFile=0x478, lpBuffer=0x625d20, nNumberOfBytesToRead=0x1860, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x625d20*, lpNumberOfBytesRead=0x5d8ff14*=0x1860, lpOverlapped=0x0) returned 1 [0083.547] GetProcessHeap () returned 0x580000 [0083.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.547] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.547] WriteFile (in: hFile=0x478, lpBuffer=0x6275b0*, nNumberOfBytesToWrite=0x1860, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6275b0*, lpNumberOfBytesWritten=0x5d8ff14*=0x1860, lpOverlapped=0x0) returned 1 [0083.547] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.547] WriteFile (in: hFile=0x478, lpBuffer=0x628e0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x628e0f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.547] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.547] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.547] CloseHandle (hObject=0x478) returned 1 [0083.547] GetProcessHeap () returned 0x580000 [0083.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6275b0 | out: hHeap=0x580000) returned 1 [0083.547] GetProcessHeap () returned 0x580000 [0083.547] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x625d20 | out: hHeap=0x580000) returned 1 [0083.547] GetProcessHeap () returned 0x580000 [0083.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x69690d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1885, dwReserved0=0x5d8fd28, dwReserved1=0x625d20, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0083.548] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.679] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", len=0x60 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 1 [0083.679] GetProcessHeap () returned 0x580000 [0083.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0083.680] CloseHandle (hObject=0x458) returned 1 [0083.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0083.682] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0083.682] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0083.682] GetProcessHeap () returned 0x580000 [0083.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x62a780 [0083.683] GetProcessHeap () returned 0x580000 [0083.683] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5081) returned 0x62f810 [0083.683] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.683] ReadFile (in: hFile=0x458, lpBuffer=0x62a780, nNumberOfBytesToRead=0x5060, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62a780*, lpNumberOfBytesRead=0x5d8ff14*=0x5060, lpOverlapped=0x0) returned 1 [0083.949] GetProcessHeap () returned 0x580000 [0083.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.949] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.949] WriteFile (in: hFile=0x458, lpBuffer=0x62f810*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f810*, lpNumberOfBytesWritten=0x5d8ff14*=0x5060, lpOverlapped=0x0) returned 1 [0083.949] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.949] WriteFile (in: hFile=0x458, lpBuffer=0x63486f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x63486f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.950] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.950] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.950] CloseHandle (hObject=0x458) returned 1 [0083.950] GetProcessHeap () returned 0x580000 [0083.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62f810 | out: hHeap=0x580000) returned 1 [0083.950] GetProcessHeap () returned 0x580000 [0083.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62a780 | out: hHeap=0x580000) returned 1 [0083.951] GetProcessHeap () returned 0x580000 [0083.951] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.951] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x69a6f0e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5085, dwReserved0=0x5d8fd28, dwReserved1=0x62a780, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0083.951] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.051] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", len=0x41 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 1 [0084.051] GetProcessHeap () returned 0x580000 [0084.051] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0084.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0084.605] CloseHandle (hObject=0x48c) returned 1 [0084.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id_1622540890_.your_last_chance")) returned 1 [0084.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~3.YOU")) returned 0x5b9630 [0084.648] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0084.648] GetProcessHeap () returned 0x580000 [0084.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0084.648] GetProcessHeap () returned 0x580000 [0084.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f10048 [0084.649] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.649] ReadFile (in: hFile=0x48c, lpBuffer=0x6481a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.127] GetProcessHeap () returned 0x580000 [0086.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0086.127] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.127] WriteFile (in: hFile=0x48c, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0086.127] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.127] WriteFile (in: hFile=0x48c, lpBuffer=0x6f21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21847*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0086.198] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.198] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0086.198] CloseHandle (hObject=0x48c) returned 1 [0086.198] GetProcessHeap () returned 0x580000 [0086.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0086.226] GetProcessHeap () returned 0x580000 [0086.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0086.228] GetProcessHeap () returned 0x580000 [0086.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0086.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6afdb6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x48313, dwReserved0=0x580000, dwReserved1=0x6f0efd8, cFileName="MSWDS_FR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSWDS_~3.YOU")) returned 0x5b9630 [0086.228] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.360] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 1 [0088.360] GetProcessHeap () returned 0x580000 [0088.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615398 [0088.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0088.360] CloseHandle (hObject=0x438) returned 1 [0088.360] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0099.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0100.903] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0101.844] GetProcessHeap () returned 0x580000 [0101.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6fc1) returned 0x6c730d8 [0101.844] GetProcessHeap () returned 0x580000 [0101.844] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6fc1) returned 0x6599d0 [0101.844] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.844] ReadFile (in: hFile=0x4b0, lpBuffer=0x6c730d8, nNumberOfBytesToRead=0x6fa0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c730d8*, lpNumberOfBytesRead=0x5d8ff14*=0x6fa0, lpOverlapped=0x0) returned 1 [0103.312] GetProcessHeap () returned 0x580000 [0103.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.312] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.312] WriteFile (in: hFile=0x4b0, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x5d8ff14*=0x6fa0, lpOverlapped=0x0) returned 1 [0103.313] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.313] WriteFile (in: hFile=0x4b0, lpBuffer=0x66096f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x66096f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.313] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.313] WriteFile (in: hFile=0x4b0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.313] CloseHandle (hObject=0x4b0) returned 1 [0103.314] GetProcessHeap () returned 0x580000 [0103.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0103.314] GetProcessHeap () returned 0x580000 [0103.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c730d8 | out: hHeap=0x580000) returned 1 [0103.314] GetProcessHeap () returned 0x580000 [0103.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7530fb40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6fd7, dwReserved0=0x5d8fd28, dwReserved1=0x6c730d8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9630 [0103.314] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.843] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", len=0x2a | out: pbstr=0x5d8ff84*="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 1 [0111.843] GetProcessHeap () returned 0x580000 [0111.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0111.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.868] Sleep (dwMilliseconds=0x1) [0112.127] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", len=0x51 | out: pbstr=0x5d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned 1 [0112.127] GetProcessHeap () returned 0x580000 [0112.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b9630 [0112.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.138] Sleep (dwMilliseconds=0x1) [0112.203] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.203] Sleep (dwMilliseconds=0x1) [0112.218] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", len=0x47 | out: pbstr=0x5d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned 1 [0112.219] GetProcessHeap () returned 0x580000 [0112.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x2c) returned 0x61f848 [0112.219] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.219] Sleep (dwMilliseconds=0x1) [0112.235] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", len=0x4e | out: pbstr=0x5d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned 1 [0112.235] GetProcessHeap () returned 0x580000 [0112.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1828, Size=0x48) returned 0x596cd8 [0112.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.250] Sleep (dwMilliseconds=0x1) [0112.391] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x5d8ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.391] GetProcessHeap () returned 0x580000 [0112.391] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.391] Sleep (dwMilliseconds=0x1) [0113.317] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", len=0x3f | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 1 [0113.317] GetProcessHeap () returned 0x580000 [0113.318] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xdc) returned 0x6f0ceb8 [0113.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0113.490] CloseHandle (hObject=0x468) returned 1 [0113.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.894] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.894] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0255~1.YOU")) returned 0x5b9630 [0114.894] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0114.894] GetProcessHeap () returned 0x580000 [0114.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x667250 [0114.894] GetProcessHeap () returned 0x580000 [0114.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x6d0e508 [0114.894] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.894] ReadFile (in: hFile=0x468, lpBuffer=0x667250, nNumberOfBytesToRead=0x19e0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x5d8ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0114.919] GetProcessHeap () returned 0x580000 [0114.919] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.920] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.920] WriteFile (in: hFile=0x468, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x5d8ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0114.920] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.920] WriteFile (in: hFile=0x468, lpBuffer=0x6d0fee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0fee7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.920] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.920] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.920] CloseHandle (hObject=0x468) returned 1 [0114.920] GetProcessHeap () returned 0x580000 [0114.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0114.920] GetProcessHeap () returned 0x580000 [0114.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0114.920] GetProcessHeap () returned 0x580000 [0114.920] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c1bfa40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a0c, dwReserved0=0x5d8fd28, dwReserved1=0x667250, cFileName="AN02559_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0255~1.YOU")) returned 0x5b9630 [0115.940] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0115.997] CloseHandle (hObject=0x4ac) returned 1 [0115.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~1.YOU")) returned 0x5b9630 [0115.998] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0115.998] GetProcessHeap () returned 0x580000 [0115.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2041) returned 0x6c78088 [0115.999] GetProcessHeap () returned 0x580000 [0115.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2041) returned 0x6ef7f38 [0115.999] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.999] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c78088, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78088*, lpNumberOfBytesRead=0x5d8ff14*=0x2020, lpOverlapped=0x0) returned 1 [0116.062] GetProcessHeap () returned 0x580000 [0116.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.062] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ef7f38*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7f38*, lpNumberOfBytesWritten=0x5d8ff14*=0x2020, lpOverlapped=0x0) returned 1 [0116.062] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ef9f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef9f57*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.062] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.062] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.062] CloseHandle (hObject=0x4ac) returned 1 [0116.062] GetProcessHeap () returned 0x580000 [0116.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef7f38 | out: hHeap=0x580000) returned 1 [0116.062] GetProcessHeap () returned 0x580000 [0116.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c78088 | out: hHeap=0x580000) returned 1 [0116.062] GetProcessHeap () returned 0x580000 [0116.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cc9bea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x204a, dwReserved0=0x5d8fd28, dwReserved1=0x6c78088, cFileName="SO00159_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0015~1.YOU")) returned 0x5b9630 [0116.063] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.876] CloseHandle (hObject=0x3fc) returned 1 [0118.876] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.876] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~2.YOU")) returned 0x5b9630 [0118.877] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.877] GetProcessHeap () returned 0x580000 [0118.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c676b8 [0118.877] GetProcessHeap () returned 0x580000 [0118.877] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c21890 [0118.877] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.877] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x5d8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0118.890] GetProcessHeap () returned 0x580000 [0118.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.890] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.890] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c21890*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21890*, lpNumberOfBytesWritten=0x5d8ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0118.890] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.890] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c21e2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c21e2f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.890] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.890] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.890] CloseHandle (hObject=0x3fc) returned 1 [0118.890] GetProcessHeap () returned 0x580000 [0118.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c21890 | out: hHeap=0x580000) returned 1 [0118.890] GetProcessHeap () returned 0x580000 [0118.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.890] GetProcessHeap () returned 0x580000 [0118.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0118.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e7af8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d8, dwReserved0=0x5d8fd28, dwReserved1=0x6c676b8, cFileName="SO02437_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0243~2.YOU")) returned 0x5b9630 [0118.891] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.982] CloseHandle (hObject=0x3fc) returned 1 [0118.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.982] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0227~2.YOU")) returned 0x5b9630 [0118.983] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0118.983] GetProcessHeap () returned 0x580000 [0118.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x6c6ec88 [0118.983] GetProcessHeap () returned 0x580000 [0118.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x6d9f1e8 [0118.985] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.985] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c6ec88, nNumberOfBytesToRead=0xa60, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6ec88*, lpNumberOfBytesRead=0x5d8ff14*=0xa60, lpOverlapped=0x0) returned 1 [0119.003] GetProcessHeap () returned 0x580000 [0119.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.003] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.003] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d9f1e8*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1e8*, lpNumberOfBytesWritten=0x5d8ff14*=0xa60, lpOverlapped=0x0) returned 1 [0119.003] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.003] WriteFile (in: hFile=0x3fc, lpBuffer=0x6d9fc47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9fc47*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.004] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.004] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.004] CloseHandle (hObject=0x3fc) returned 1 [0119.004] GetProcessHeap () returned 0x580000 [0119.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1e8 | out: hHeap=0x580000) returned 1 [0119.004] GetProcessHeap () returned 0x580000 [0119.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6ec88 | out: hHeap=0x580000) returned 1 [0119.004] GetProcessHeap () returned 0x580000 [0119.004] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0119.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e8ba280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x5d8fd28, dwReserved1=0x6c6ec88, cFileName="SO02270_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0227~2.YOU")) returned 0x5b9630 [0119.004] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0119.108] CloseHandle (hObject=0x43c) returned 1 [0119.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.108] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0223~1.YOU")) returned 0x5b9630 [0119.109] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0119.109] GetProcessHeap () returned 0x580000 [0119.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6c676b8 [0119.109] GetProcessHeap () returned 0x580000 [0119.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x62ed18 [0119.109] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.109] ReadFile (in: hFile=0x43c, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x5d8ff14*=0x900, lpOverlapped=0x0) returned 1 [0119.130] GetProcessHeap () returned 0x580000 [0119.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.130] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.130] WriteFile (in: hFile=0x43c, lpBuffer=0x62ed18*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62ed18*, lpNumberOfBytesWritten=0x5d8ff14*=0x900, lpOverlapped=0x0) returned 1 [0119.130] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.130] WriteFile (in: hFile=0x43c, lpBuffer=0x62f617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x62f617*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.130] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.130] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.130] CloseHandle (hObject=0x43c) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62ed18 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e9ead80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x5d8fd28, dwReserved1=0x6c676b8, cFileName="SO02233_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0223~1.YOU")) returned 0x5b96f0 [0120.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.155] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", len=0x4c | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 1 [0120.155] GetProcessHeap () returned 0x580000 [0120.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a4) returned 0x6d06ca8 [0120.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.180] CloseHandle (hObject=0x438) returned 1 [0122.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.id_1622540890_.your_last_chance")) returned 1 [0122.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0070~1.YOU")) returned 0x5b9730 [0122.181] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.181] GetProcessHeap () returned 0x580000 [0122.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2041) returned 0x6c52808 [0122.181] GetProcessHeap () returned 0x580000 [0122.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2041) returned 0x6f14048 [0122.182] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.182] ReadFile (in: hFile=0x438, lpBuffer=0x6c52808, nNumberOfBytesToRead=0x2020, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c52808*, lpNumberOfBytesRead=0x5d8ff14*=0x2020, lpOverlapped=0x0) returned 1 [0122.211] GetProcessHeap () returned 0x580000 [0122.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.211] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.211] WriteFile (in: hFile=0x438, lpBuffer=0x6f14048*, nNumberOfBytesToWrite=0x2020, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesWritten=0x5d8ff14*=0x2020, lpOverlapped=0x0) returned 1 [0122.211] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.212] WriteFile (in: hFile=0x438, lpBuffer=0x6f16067*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f16067*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.212] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.212] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.212] CloseHandle (hObject=0x438) returned 1 [0122.212] GetProcessHeap () returned 0x580000 [0122.212] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0122.212] GetProcessHeap () returned 0x580000 [0122.212] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c52808 | out: hHeap=0x580000) returned 1 [0122.212] GetProcessHeap () returned 0x580000 [0122.212] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8075fdc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x204a, dwReserved0=0x5d8fd28, dwReserved1=0x6c52808, cFileName="WB00703L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0070~1.YOU")) returned 0x5b9730 [0124.420] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.084] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", len=0x4f | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 1 [0125.084] GetProcessHeap () returned 0x580000 [0125.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1890) returned 0x6f42f08 [0125.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0125.151] CloseHandle (hObject=0x41c) returned 1 [0125.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id_1622540890_.your_last_chance")) returned 1 [0127.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0127.003] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0127.003] GetProcessHeap () returned 0x580000 [0127.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8061) returned 0x6d1fd88 [0127.003] GetProcessHeap () returned 0x580000 [0127.003] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8061) returned 0x64ee50 [0127.003] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.003] ReadFile (in: hFile=0x41c, lpBuffer=0x6d1fd88, nNumberOfBytesToRead=0x8040, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1fd88*, lpNumberOfBytesRead=0x5d8ff14*=0x8040, lpOverlapped=0x0) returned 1 [0127.872] GetProcessHeap () returned 0x580000 [0127.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0127.872] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.872] WriteFile (in: hFile=0x41c, lpBuffer=0x64ee50*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x64ee50*, lpNumberOfBytesWritten=0x5d8ff14*=0x8040, lpOverlapped=0x0) returned 1 [0127.872] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.872] WriteFile (in: hFile=0x41c, lpBuffer=0x656e8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x656e8f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0127.872] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.872] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0127.872] CloseHandle (hObject=0x41c) returned 1 [0127.872] GetProcessHeap () returned 0x580000 [0127.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x64ee50 | out: hHeap=0x580000) returned 1 [0127.873] GetProcessHeap () returned 0x580000 [0127.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1fd88 | out: hHeap=0x580000) returned 1 [0128.049] GetProcessHeap () returned 0x580000 [0128.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0128.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83d3af80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x807d, dwReserved0=0x5d8fd28, dwReserved1=0x6d1fd88, cFileName="Opulent.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OPULEN~1.YOU")) returned 0x5b9730 [0128.050] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.273] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", len=0x45 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned 1 [0128.273] GetProcessHeap () returned 0x580000 [0128.273] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b50) returned 0x6e063d0 [0128.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.050] CloseHandle (hObject=0x41c) returned 1 [0129.050] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.050] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.id_1622540890_.your_last_chance")) returned 1 [0129.051] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1458~2.YOU")) returned 0x5b96f0 [0129.051] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0129.051] GetProcessHeap () returned 0x580000 [0129.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0129.051] GetProcessHeap () returned 0x580000 [0129.051] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60ea48 [0129.051] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.051] ReadFile (in: hFile=0x41c, lpBuffer=0x60e978, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesRead=0x5d8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0129.053] GetProcessHeap () returned 0x580000 [0129.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0129.053] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.053] WriteFile (in: hFile=0x41c, lpBuffer=0x60ea48*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea48*, lpNumberOfBytesWritten=0x5d8ff14*=0xa0, lpOverlapped=0x0) returned 1 [0129.053] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.053] WriteFile (in: hFile=0x41c, lpBuffer=0x60eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x60eae7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.053] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.053] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.053] CloseHandle (hObject=0x41c) returned 1 [0129.053] GetProcessHeap () returned 0x580000 [0129.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60ea48 | out: hHeap=0x580000) returned 1 [0129.053] GetProcessHeap () returned 0x580000 [0129.053] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0129.053] GetProcessHeap () returned 0x580000 [0129.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0129.471] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84889800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x5d8fd28, dwReserved1=0x60e978, cFileName="BD14582_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1458~2.YOU")) returned 0x5b9730 [0129.471] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.495] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", len=0x3d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 1 [0129.495] GetProcessHeap () returned 0x580000 [0129.495] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0129.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.521] CloseHandle (hObject=0x4a4) returned 1 [0129.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id_1622540890_.your_last_chance")) returned 1 [0129.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.525] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9630 [0129.525] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.525] GetProcessHeap () returned 0x580000 [0129.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de0f50 [0129.525] GetProcessHeap () returned 0x580000 [0129.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0129.526] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.526] ReadFile (in: hFile=0x4a4, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0134.909] GetProcessHeap () returned 0x580000 [0134.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0134.909] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.910] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d7cfe8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0134.910] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.910] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d8e7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e7e7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0136.266] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.267] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0136.267] CloseHandle (hObject=0x4a4) returned 1 [0136.267] GetProcessHeap () returned 0x580000 [0136.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0136.267] GetProcessHeap () returned 0x580000 [0136.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0136.267] GetProcessHeap () returned 0x580000 [0136.267] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0136.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88d6b4a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x78474, dwReserved0=0x5d8fd28, dwReserved1=0x6de0f50, cFileName="OFFICE10.MMW.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0136.393] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.413] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", len=0x43 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned 1 [0136.413] GetProcessHeap () returned 0x580000 [0136.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0136.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0136.414] CloseHandle (hObject=0x4a4) returned 1 [0136.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.414] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.id_1622540890_.your_last_chance")) returned 1 [0136.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246baa00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x246baa00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1f91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~3.YOU")) returned 0x5b96b0 [0136.415] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0136.415] GetProcessHeap () returned 0x580000 [0136.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fa1) returned 0x6dcdb90 [0136.415] GetProcessHeap () returned 0x580000 [0136.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fa1) returned 0x6e587f0 [0136.415] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.415] ReadFile (in: hFile=0x4a4, lpBuffer=0x6dcdb90, nNumberOfBytesToRead=0x1f80, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcdb90*, lpNumberOfBytesRead=0x5d8ff14*=0x1f80, lpOverlapped=0x0) returned 1 [0136.498] GetProcessHeap () returned 0x580000 [0136.498] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.498] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.498] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e587f0*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e587f0*, lpNumberOfBytesWritten=0x5d8ff14*=0x1f80, lpOverlapped=0x0) returned 1 [0136.498] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.498] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e5a76f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5a76f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0136.498] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.498] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0136.498] CloseHandle (hObject=0x4a4) returned 1 [0136.498] GetProcessHeap () returned 0x580000 [0136.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e587f0 | out: hHeap=0x580000) returned 1 [0136.498] GetProcessHeap () returned 0x580000 [0136.498] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdb90 | out: hHeap=0x580000) returned 1 [0136.498] GetProcessHeap () returned 0x580000 [0136.499] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0136.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246baa00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88f807e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fb5, dwReserved0=0x5d8fd28, dwReserved1=0x6dcdb90, cFileName="BD21332_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2133~3.YOU")) returned 0x5b96b0 [0136.499] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.526] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", len=0x43 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned 1 [0136.528] GetProcessHeap () returned 0x580000 [0136.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0136.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.548] CloseHandle (hObject=0x484) returned 1 [0136.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.id_1622540890_.your_last_chance")) returned 1 [0136.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a618b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2a618b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~1.YOU")) returned 0x5b9770 [0136.549] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0136.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.549] GetProcessHeap () returned 0x580000 [0136.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x614a48 [0136.549] GetProcessHeap () returned 0x580000 [0136.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x5bad00 [0136.549] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.549] ReadFile (in: hFile=0x484, lpBuffer=0x614a48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x614a48*, lpNumberOfBytesRead=0x5d8ff14*=0x180, lpOverlapped=0x0) returned 1 [0138.339] GetProcessHeap () returned 0x580000 [0138.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0138.339] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.339] WriteFile (in: hFile=0x484, lpBuffer=0x5bad00*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesWritten=0x5d8ff14*=0x180, lpOverlapped=0x0) returned 1 [0138.517] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.517] WriteFile (in: hFile=0x484, lpBuffer=0x5bae7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bae7f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.517] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.517] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.517] CloseHandle (hObject=0x484) returned 1 [0138.758] GetProcessHeap () returned 0x580000 [0138.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0138.758] GetProcessHeap () returned 0x580000 [0138.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x614a48 | out: hHeap=0x580000) returned 1 [0138.758] GetProcessHeap () returned 0x580000 [0138.758] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a618b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a2d7aa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x5d8fd28, dwReserved1=0x614a48, cFileName="BD21328_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~1.YOU")) returned 0x5b9770 [0140.123] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.168] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x5f | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0140.168] GetProcessHeap () returned 0x580000 [0140.168] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0140.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.258] CloseHandle (hObject=0x454) returned 1 [0140.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0140.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0140.259] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0140.259] GetProcessHeap () returned 0x580000 [0140.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5bad00 [0140.259] GetProcessHeap () returned 0x580000 [0140.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x5b0428 [0140.259] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.259] ReadFile (in: hFile=0x454, lpBuffer=0x5bad00, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesRead=0x5d8ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.262] GetProcessHeap () returned 0x580000 [0140.262] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0140.262] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x454, lpBuffer=0x5b0428*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b0428*, lpNumberOfBytesWritten=0x5d8ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x454, lpBuffer=0x5b05c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b05c7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.262] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.262] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.262] CloseHandle (hObject=0x454) returned 1 [0140.262] GetProcessHeap () returned 0x580000 [0140.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b0428 | out: hHeap=0x580000) returned 1 [0140.262] GetProcessHeap () returned 0x580000 [0140.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0140.262] GetProcessHeap () returned 0x580000 [0140.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0140.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3814a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x5d8fd28, dwReserved1=0x5bad00, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9770 [0140.662] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.668] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", len=0x43 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned 1 [0140.669] GetProcessHeap () returned 0x580000 [0140.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da4) returned 0x6f14048 [0140.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.782] CloseHandle (hObject=0x490) returned 1 [0140.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1484~1.YOU")) returned 0x5b9730 [0140.783] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.783] GetProcessHeap () returned 0x580000 [0140.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5aa990 [0140.783] GetProcessHeap () returned 0x580000 [0140.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0140.783] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.783] ReadFile (in: hFile=0x490, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x5d8ff14*=0x120, lpOverlapped=0x0) returned 1 [0140.785] GetProcessHeap () returned 0x580000 [0140.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.785] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.785] WriteFile (in: hFile=0x490, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x5d8ff14*=0x120, lpOverlapped=0x0) returned 1 [0140.785] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.785] WriteFile (in: hFile=0x490, lpBuffer=0x65f1cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f1cf*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.785] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.786] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.786] CloseHandle (hObject=0x490) returned 1 [0140.786] GetProcessHeap () returned 0x580000 [0140.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.786] GetProcessHeap () returned 0x580000 [0140.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.786] GetProcessHeap () returned 0x580000 [0140.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0141.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b86a200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x5d8fd28, dwReserved1=0x5aa990, cFileName="BD14844_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1484~1.YOU")) returned 0x5b9730 [0141.929] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.005] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS", len=0x40 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 1 [0142.005] GetProcessHeap () returned 0x580000 [0142.005] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0142.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0142.005] CloseHandle (hObject=0x4a4) returned 1 [0142.006] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0142.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0142.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0142.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4cf264, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO8371~1.YOU")) returned 0x5b9730 [0142.007] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0142.007] GetProcessHeap () returned 0x580000 [0142.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d56108 [0142.007] GetProcessHeap () returned 0x580000 [0142.007] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d67938 [0142.024] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.024] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d56108, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d56108*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.849] GetProcessHeap () returned 0x580000 [0143.849] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0143.849] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.849] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d67938*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d67938*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.850] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.850] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d79137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d79137*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0143.964] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.964] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0143.964] CloseHandle (hObject=0x4a4) returned 1 [0144.012] GetProcessHeap () returned 0x580000 [0144.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d67938 | out: hHeap=0x580000) returned 1 [0144.012] GetProcessHeap () returned 0x580000 [0144.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d56108 | out: hHeap=0x580000) returned 1 [0144.012] GetProcessHeap () returned 0x580000 [0144.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0146.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8d6c3a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4cf288, dwReserved0=0x5d8fd28, dwReserved1=0x6d56108, cFileName="POWERPNT.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO8371~1.YOU")) returned 0x5b96f0 [0146.862] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.876] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", len=0x44 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned 1 [0146.876] GetProcessHeap () returned 0x580000 [0146.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.057] CloseHandle (hObject=0x480) returned 1 [0153.057] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.057] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.id_1622540890_.your_last_chance")) returned 1 [0153.058] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.058] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1786, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR28~1.YOU")) returned 0x5b9730 [0153.058] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.059] GetProcessHeap () returned 0x580000 [0153.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17a1) returned 0x6f16198 [0153.059] GetProcessHeap () returned 0x580000 [0153.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17a1) returned 0x6cf54a8 [0153.059] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.059] ReadFile (in: hFile=0x480, lpBuffer=0x6f16198, nNumberOfBytesToRead=0x1780, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f16198*, lpNumberOfBytesRead=0x5d8ff14*=0x1780, lpOverlapped=0x0) returned 1 [0153.080] GetProcessHeap () returned 0x580000 [0153.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.080] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.080] WriteFile (in: hFile=0x480, lpBuffer=0x6cf54a8*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf54a8*, lpNumberOfBytesWritten=0x5d8ff14*=0x1780, lpOverlapped=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.081] WriteFile (in: hFile=0x480, lpBuffer=0x6cf6c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6c27*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.081] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.081] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.081] CloseHandle (hObject=0x480) returned 1 [0153.082] GetProcessHeap () returned 0x580000 [0153.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf54a8 | out: hHeap=0x580000) returned 1 [0153.082] GetProcessHeap () returned 0x580000 [0153.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f16198 | out: hHeap=0x580000) returned 1 [0153.082] GetProcessHeap () returned 0x580000 [0153.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92da5d80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17aa, dwReserved0=0x5d8fd28, dwReserved1=0x6f16198, cFileName="PDIR28F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR28~1.YOU")) returned 0x5b9630 [0153.753] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.328] CloseHandle (hObject=0x4a0) returned 1 [0155.328] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.328] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0155.329] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIC061~1.YOU")) returned 0x5b9730 [0155.329] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0155.329] GetProcessHeap () returned 0x580000 [0155.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0155.329] GetProcessHeap () returned 0x580000 [0155.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0155.329] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.330] ReadFile (in: hFile=0x4a0, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0155.455] GetProcessHeap () returned 0x580000 [0155.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.455] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.455] WriteFile (in: hFile=0x4a0, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0155.455] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.455] WriteFile (in: hFile=0x4a0, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.455] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.455] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.456] CloseHandle (hObject=0x4a0) returned 1 [0155.456] GetProcessHeap () returned 0x580000 [0155.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0155.456] GetProcessHeap () returned 0x580000 [0155.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0155.456] GetProcessHeap () returned 0x580000 [0155.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94468fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x5d8fd28, dwReserved1=0x5ad8a0, cFileName="WINWORD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WIC061~1.YOU")) returned 0x5b9630 [0155.972] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.986] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", len=0x3d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 1 [0155.986] GetProcessHeap () returned 0x580000 [0155.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0155.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0165.159] CloseHandle (hObject=0x3fc) returned 1 [0165.159] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.159] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id_1622540890_.your_last_chance")) returned 1 [0166.750] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART3~1.YOU")) returned 0x5b9730 [0166.750] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0166.750] GetProcessHeap () returned 0x580000 [0166.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe141) returned 0x6d6c398 [0166.750] GetProcessHeap () returned 0x580000 [0166.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe141) returned 0x7196f98 [0166.752] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.752] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d6c398, nNumberOfBytesToRead=0xe120, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6c398*, lpNumberOfBytesRead=0x5d8ff14*=0xe120, lpOverlapped=0x0) returned 1 [0168.922] GetProcessHeap () returned 0x580000 [0168.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0168.922] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.923] WriteFile (in: hFile=0x3fc, lpBuffer=0x7196f98*, nNumberOfBytesToWrite=0xe120, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7196f98*, lpNumberOfBytesWritten=0x5d8ff14*=0xe120, lpOverlapped=0x0) returned 1 [0168.923] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.923] WriteFile (in: hFile=0x3fc, lpBuffer=0x71a50b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71a50b7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0168.923] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.923] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0168.923] CloseHandle (hObject=0x3fc) returned 1 [0168.923] GetProcessHeap () returned 0x580000 [0168.923] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7196f98 | out: hHeap=0x580000) returned 1 [0168.928] GetProcessHeap () returned 0x580000 [0168.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6c398 | out: hHeap=0x580000) returned 1 [0168.929] GetProcessHeap () returned 0x580000 [0168.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c4cd280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe152, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="MSART3.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART3~1.YOU")) returned 0x5b96b0 [0170.242] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.246] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", len=0x42 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 1 [0170.246] GetProcessHeap () returned 0x580000 [0170.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2298) returned 0x6f14048 [0170.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.259] CloseHandle (hObject=0x39c) returned 1 [0170.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id_1622540890_.your_last_chance")) returned 1 [0170.260] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~3.YOU")) returned 0x5b96b0 [0170.260] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0170.261] GetProcessHeap () returned 0x580000 [0170.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0170.261] GetProcessHeap () returned 0x580000 [0170.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0170.261] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.261] ReadFile (in: hFile=0x39c, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x5d8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.285] GetProcessHeap () returned 0x580000 [0170.285] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.285] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.285] WriteFile (in: hFile=0x39c, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x5d8ff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.285] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.285] WriteFile (in: hFile=0x39c, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.285] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.286] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.286] CloseHandle (hObject=0x39c) returned 1 [0170.286] GetProcessHeap () returned 0x580000 [0170.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0170.286] GetProcessHeap () returned 0x580000 [0170.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0170.286] GetProcessHeap () returned 0x580000 [0170.286] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d1bea20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x5d8fd28, dwReserved1=0x65f268, cFileName="TASKACCS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKAC~3.YOU")) returned 0x5b9770 [0172.900] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.417] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", len=0x5b | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned 1 [0174.417] GetProcessHeap () returned 0x580000 [0174.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0174.418] CloseHandle (hObject=0x488) returned 1 [0174.418] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.418] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.id_1622540890_.your_last_chance")) returned 1 [0174.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RELAYC~1.YOU")) returned 0x5b96f0 [0174.429] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0174.429] GetProcessHeap () returned 0x580000 [0174.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de0f68 [0174.429] GetProcessHeap () returned 0x580000 [0174.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x6de1370 [0174.429] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.429] ReadFile (in: hFile=0x488, lpBuffer=0x6de0f68, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f68*, lpNumberOfBytesRead=0x5d8ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0174.453] GetProcessHeap () returned 0x580000 [0174.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.453] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.453] WriteFile (in: hFile=0x488, lpBuffer=0x6de1370*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de1370*, lpNumberOfBytesWritten=0x5d8ff14*=0x3c0, lpOverlapped=0x0) returned 1 [0174.454] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.454] WriteFile (in: hFile=0x488, lpBuffer=0x6de172f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de172f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.454] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.454] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.454] CloseHandle (hObject=0x488) returned 1 [0174.454] GetProcessHeap () returned 0x580000 [0174.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de1370 | out: hHeap=0x580000) returned 1 [0174.454] GetProcessHeap () returned 0x580000 [0174.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f68 | out: hHeap=0x580000) returned 1 [0174.454] GetProcessHeap () returned 0x580000 [0174.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f977940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x5d8fd28, dwReserved1=0x6de0f68, cFileName="RELAY.CER.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RELAYC~1.YOU")) returned 0x5b9730 [0174.454] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.481] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT", len=0x41 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 1 [0174.481] GetProcessHeap () returned 0x580000 [0174.481] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0174.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.482] CloseHandle (hObject=0x484) returned 1 [0174.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0174.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI27AD~1.YOU")) returned 0x5b9730 [0174.483] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.483] GetProcessHeap () returned 0x580000 [0174.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0174.483] GetProcessHeap () returned 0x580000 [0174.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0174.483] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.483] ReadFile (in: hFile=0x484, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0174.485] GetProcessHeap () returned 0x580000 [0174.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.485] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.485] WriteFile (in: hFile=0x484, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0174.485] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.485] WriteFile (in: hFile=0x484, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.485] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.485] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.485] CloseHandle (hObject=0x484) returned 1 [0174.485] GetProcessHeap () returned 0x580000 [0174.485] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0174.485] GetProcessHeap () returned 0x580000 [0174.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0174.486] GetProcessHeap () returned 0x580000 [0174.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f9c3c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x5d8fd28, dwReserved1=0x5ad8a0, cFileName="VISIO_STD_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI27AD~1.YOU")) returned 0x5b9730 [0174.486] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.550] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", len=0x4a | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned 1 [0174.550] GetProcessHeap () returned 0x580000 [0174.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0174.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0175.688] CloseHandle (hObject=0x43c) returned 1 [0175.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.id_1622540890_.your_last_chance")) returned 1 [0175.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GIGGLE~1.YOU")) returned 0x5b96f0 [0175.689] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0175.689] GetProcessHeap () returned 0x580000 [0175.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7881) returned 0x713d148 [0175.689] GetProcessHeap () returned 0x580000 [0175.689] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7881) returned 0x71449d8 [0175.689] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.689] ReadFile (in: hFile=0x43c, lpBuffer=0x713d148, nNumberOfBytesToRead=0x7860, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x713d148*, lpNumberOfBytesRead=0x5d8ff14*=0x7860, lpOverlapped=0x0) returned 1 [0177.128] GetProcessHeap () returned 0x580000 [0177.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.128] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.128] WriteFile (in: hFile=0x43c, lpBuffer=0x71449d8*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71449d8*, lpNumberOfBytesWritten=0x5d8ff14*=0x7860, lpOverlapped=0x0) returned 1 [0177.128] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.128] WriteFile (in: hFile=0x43c, lpBuffer=0x714c237*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x714c237*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.128] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.128] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.128] CloseHandle (hObject=0x43c) returned 1 [0177.128] GetProcessHeap () returned 0x580000 [0177.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71449d8 | out: hHeap=0x580000) returned 1 [0177.128] GetProcessHeap () returned 0x580000 [0177.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x713d148 | out: hHeap=0x580000) returned 1 [0177.128] GetProcessHeap () returned 0x580000 [0177.128] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0179.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa130e5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7884, dwReserved0=0x5d8fd28, dwReserved1=0x713d148, cFileName="GIGGLE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GIGGLE~1.YOU")) returned 0x5b96f0 [0179.167] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.274] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", len=0x5d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned 1 [0180.274] GetProcessHeap () returned 0x580000 [0180.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0180.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.275] CloseHandle (hObject=0x3fc) returned 1 [0180.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd49300, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKBA~1.YOU")) returned 0x5b9770 [0180.276] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.276] GetProcessHeap () returned 0x580000 [0180.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6cda390 [0180.276] GetProcessHeap () returned 0x580000 [0180.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6cda918 [0180.276] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.276] ReadFile (in: hFile=0x3fc, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x5d8ff14*=0x540, lpOverlapped=0x0) returned 1 [0180.345] GetProcessHeap () returned 0x580000 [0180.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x6cda918*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda918*, lpNumberOfBytesWritten=0x5d8ff14*=0x540, lpOverlapped=0x0) returned 1 [0180.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x6cdae57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdae57*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.345] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.345] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.345] CloseHandle (hObject=0x3fc) returned 1 [0180.345] GetProcessHeap () returned 0x580000 [0180.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda918 | out: hHeap=0x580000) returned 1 [0180.345] GetProcessHeap () returned 0x580000 [0180.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0180.345] GetProcessHeap () returned 0x580000 [0180.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa31b4100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x5d8fd28, dwReserved1=0x6cda390, cFileName="TaskbarIconImagesMask256Colors.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKBA~1.YOU")) returned 0x5b96b0 [0180.346] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.353] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", len=0x6d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned 1 [0180.354] GetProcessHeap () returned 0x580000 [0180.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0180.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.417] CloseHandle (hObject=0x4a8) returned 1 [0180.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.418] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x6d0062, dwReserved1=0x2e0070, cFileName="MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b96b0 [0180.418] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.418] GetProcessHeap () returned 0x580000 [0180.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0180.418] GetProcessHeap () returned 0x580000 [0180.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0180.418] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.418] ReadFile (in: hFile=0x4a8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0180.420] GetProcessHeap () returned 0x580000 [0180.420] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.420] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.420] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0180.420] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.420] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.420] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.420] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.420] CloseHandle (hObject=0x4a8) returned 1 [0180.420] GetProcessHeap () returned 0x580000 [0180.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0180.420] GetProcessHeap () returned 0x580000 [0180.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0180.420] GetProcessHeap () returned 0x580000 [0180.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa32727e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x5d8fd28, dwReserved1=0x5ad8a0, cFileName="MessageBoxIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MESSAG~2.YOU")) returned 0x5b96b0 [0180.420] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.461] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", len=0x6b | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned 1 [0180.461] GetProcessHeap () returned 0x580000 [0180.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0180.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.462] CloseHandle (hObject=0x4a8) returned 1 [0180.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bf59600, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x2e0070, dwReserved1=0x640069, cFileName="CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~3.YOU")) returned 0x5b96b0 [0180.463] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.463] GetProcessHeap () returned 0x580000 [0180.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6ce54c0 [0180.463] GetProcessHeap () returned 0x580000 [0180.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9e1) returned 0x6ce5ec8 [0180.463] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.463] ReadFile (in: hFile=0x4a8, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x9c0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x5d8ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0180.487] GetProcessHeap () returned 0x580000 [0180.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.488] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.488] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce5ec8*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5ec8*, lpNumberOfBytesWritten=0x5d8ff14*=0x9c0, lpOverlapped=0x0) returned 1 [0180.488] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.488] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce6887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6887*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.488] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.488] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.488] CloseHandle (hObject=0x4a8) returned 1 [0180.488] GetProcessHeap () returned 0x580000 [0180.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5ec8 | out: hHeap=0x580000) returned 1 [0180.488] GetProcessHeap () returned 0x580000 [0180.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0180.488] GetProcessHeap () returned 0x580000 [0180.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa330ad60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x5d8fd28, dwReserved1=0x6ce54c0, cFileName="CommsOutgoingImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~3.YOU")) returned 0x5b96b0 [0180.488] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.572] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", len=0x67 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned 1 [0180.572] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0180.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.636] CloseHandle (hObject=0x464) returned 1 [0180.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.636] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.637] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x258f8e00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~3.YOU")) returned 0x5b96b0 [0180.637] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.637] GetProcessHeap () returned 0x580000 [0180.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0180.637] GetProcessHeap () returned 0x580000 [0180.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0180.637] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.637] ReadFile (in: hFile=0x464, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x5d8ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0181.460] GetProcessHeap () returned 0x580000 [0181.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0181.460] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.460] WriteFile (in: hFile=0x464, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x5d8ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0181.461] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.461] WriteFile (in: hFile=0x464, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.461] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.461] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.461] CloseHandle (hObject=0x464) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0183.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3c6a400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x5d8fd28, dwReserved1=0x6cbc098, cFileName="AlertImage_OffMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~3.YOU")) returned 0x5b96b0 [0183.460] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.472] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", len=0x73 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned 1 [0183.473] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0183.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.585] CloseHandle (hObject=0x428) returned 1 [0184.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.585] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0184.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x4d0065, dwReserved1=0x730061, cFileName="InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INACTI~2.YOU")) returned 0x5b9770 [0184.586] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.586] GetProcessHeap () returned 0x580000 [0184.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6fc42a8 [0184.586] GetProcessHeap () returned 0x580000 [0184.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0184.586] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.586] ReadFile (in: hFile=0x428, lpBuffer=0x6fc42a8, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc42a8*, lpNumberOfBytesRead=0x5d8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0184.601] GetProcessHeap () returned 0x580000 [0184.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0184.602] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.602] WriteFile (in: hFile=0x428, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x5d8ff14*=0xca0, lpOverlapped=0x0) returned 1 [0184.602] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.602] WriteFile (in: hFile=0x428, lpBuffer=0x636407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636407*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.602] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.602] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.602] CloseHandle (hObject=0x428) returned 1 [0184.602] GetProcessHeap () returned 0x580000 [0184.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0184.602] GetProcessHeap () returned 0x580000 [0184.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc42a8 | out: hHeap=0x580000) returned 1 [0184.602] GetProcessHeap () returned 0x580000 [0184.602] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0184.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5a51860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xccc, dwReserved0=0x5d8fd28, dwReserved1=0x6fc42a8, cFileName="InactiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INACTI~2.YOU")) returned 0x5b9770 [0184.603] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.615] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", len=0x5e | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned 1 [0184.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0184.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.335] CloseHandle (hObject=0x450) returned 1 [0185.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.id_1622540890_.your_last_chance")) returned 1 [0185.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x300039, dwReserved1=0x2e005f, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b9770 [0185.336] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0185.336] GetProcessHeap () returned 0x580000 [0185.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x715c008 [0185.336] GetProcessHeap () returned 0x580000 [0185.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6161) returned 0x6fbad28 [0185.336] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.336] ReadFile (in: hFile=0x450, lpBuffer=0x715c008, nNumberOfBytesToRead=0x6140, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x5d8ff14*=0x6140, lpOverlapped=0x0) returned 1 [0185.949] GetProcessHeap () returned 0x580000 [0185.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0185.949] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x450, lpBuffer=0x6fbad28*, nNumberOfBytesToWrite=0x6140, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbad28*, lpNumberOfBytesWritten=0x5d8ff14*=0x6140, lpOverlapped=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x450, lpBuffer=0x6fc0e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc0e67*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.949] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.949] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.949] CloseHandle (hObject=0x450) returned 1 [0185.949] GetProcessHeap () returned 0x580000 [0185.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbad28 | out: hHeap=0x580000) returned 1 [0185.949] GetProcessHeap () returned 0x580000 [0185.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0185.949] GetProcessHeap () returned 0x580000 [0185.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0185.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa671cea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6172, dwReserved0=0x5d8fd28, dwReserved1=0x715c008, cFileName="BG_ADOBE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_ADO~1.YOU")) returned 0x5b96b0 [0185.950] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0187.422] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", len=0x6d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 1 [0187.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ac) returned 0x6f14048 [0187.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.013] CloseHandle (hObject=0x390) returned 1 [0188.013] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.013] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id_1622540890_.your_last_chance")) returned 1 [0188.014] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a52fdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x17d6d, dwReserved0=0x440046, dwReserved1=0x2e0054, cFileName="POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POLICI~1.YOU")) returned 0x5b9770 [0188.014] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0188.014] GetProcessHeap () returned 0x580000 [0188.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70075b8 [0188.015] GetProcessHeap () returned 0x580000 [0188.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0188.015] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.015] ReadFile (in: hFile=0x390, lpBuffer=0x70075b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x70075b8*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.899] GetProcessHeap () returned 0x580000 [0191.899] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0191.899] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.899] WriteFile (in: hFile=0x390, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0191.899] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.899] WriteFile (in: hFile=0x390, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.900] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.900] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.900] CloseHandle (hObject=0x390) returned 1 [0191.900] GetProcessHeap () returned 0x580000 [0191.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0191.900] GetProcessHeap () returned 0x580000 [0191.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70075b8 | out: hHeap=0x580000) returned 1 [0191.900] GetProcessHeap () returned 0x580000 [0191.900] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0193.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a52fdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9ff1be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17d91, dwReserved0=0x5d8fd28, dwReserved1=0x70075b8, cFileName="POLICIES.FDT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POLICI~1.YOU")) returned 0x5b97b0 [0193.418] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.458] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", len=0x64 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned 1 [0193.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0193.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.562] CloseHandle (hObject=0x4a4) returned 1 [0193.562] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0193.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.id_1622540890_.your_last_chance")) returned 1 [0193.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0193.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b97f0 [0193.563] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0193.563] GetProcessHeap () returned 0x580000 [0193.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6c59108 [0193.563] GetProcessHeap () returned 0x580000 [0193.563] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c81) returned 0x6ff21b8 [0193.563] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.564] ReadFile (in: hFile=0x4a4, lpBuffer=0x6c59108, nNumberOfBytesToRead=0x3c60, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesRead=0x5d8ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0195.195] GetProcessHeap () returned 0x580000 [0195.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.195] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x4a4, lpBuffer=0x6ff21b8*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff21b8*, lpNumberOfBytesWritten=0x5d8ff14*=0x3c60, lpOverlapped=0x0) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x4a4, lpBuffer=0x6ff5e17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff5e17*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.195] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.195] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.195] CloseHandle (hObject=0x4a4) returned 1 [0195.195] GetProcessHeap () returned 0x580000 [0195.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff21b8 | out: hHeap=0x580000) returned 1 [0195.195] GetProcessHeap () returned 0x580000 [0195.195] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0195.195] GetProcessHeap () returned 0x580000 [0195.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0195.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabf55e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3c88, dwReserved0=0x5d8fd28, dwReserved1=0x6c59108, cFileName="bg_VelvetRose.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_VEL~1.YOU")) returned 0x5b97b0 [0195.196] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.980] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", len=0x43 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned 1 [0197.980] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0197.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.016] CloseHandle (hObject=0x488) returned 1 [0198.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xce72, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR5F~1.YOU")) returned 0x5b97f0 [0198.017] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.017] GetProcessHeap () returned 0x580000 [0198.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xce81) returned 0x6f976f8 [0198.017] GetProcessHeap () returned 0x580000 [0198.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xce81) returned 0x6d630a8 [0198.017] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] ReadFile (in: hFile=0x488, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0xce60, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x5d8ff14*=0xce60, lpOverlapped=0x0) returned 1 [0198.853] GetProcessHeap () returned 0x580000 [0198.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0198.853] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.853] WriteFile (in: hFile=0x488, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0xce60, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x5d8ff14*=0xce60, lpOverlapped=0x0) returned 1 [0198.853] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.853] WriteFile (in: hFile=0x488, lpBuffer=0x6d6ff07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6ff07*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0198.866] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.866] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0198.866] CloseHandle (hObject=0x488) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0199.655] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae24c120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xce96, dwReserved0=0x5d8fd28, dwReserved1=0x6f976f8, cFileName="PDIR5F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR5F~1.YOU")) returned 0x5b96b0 [0199.655] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.039] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", len=0x67 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned 1 [0201.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0201.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.846] CloseHandle (hObject=0x450) returned 1 [0201.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.id_1622540890_.your_last_chance")) returned 1 [0201.846] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b97b0 [0201.847] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.847] GetProcessHeap () returned 0x580000 [0201.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x635768 [0201.847] GetProcessHeap () returned 0x580000 [0201.847] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x6f668d8 [0201.847] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.847] ReadFile (in: hFile=0x450, lpBuffer=0x635768, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x5d8ff14*=0xce0, lpOverlapped=0x0) returned 1 [0201.859] GetProcessHeap () returned 0x580000 [0201.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.859] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.859] WriteFile (in: hFile=0x450, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x5d8ff14*=0xce0, lpOverlapped=0x0) returned 1 [0201.859] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.859] WriteFile (in: hFile=0x450, lpBuffer=0x6f675b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675b7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.860] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.860] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.860] CloseHandle (hObject=0x450) returned 1 [0201.860] GetProcessHeap () returned 0x580000 [0201.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0201.860] GetProcessHeap () returned 0x580000 [0201.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.860] GetProcessHeap () returned 0x580000 [0201.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafedc920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd0c, dwReserved0=0x5d8fd28, dwReserved1=0x635768, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b9770 [0202.962] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.024] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", len=0x5a | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned 1 [0203.024] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0203.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0203.117] CloseHandle (hObject=0x458) returned 1 [0203.117] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js.id_1622540890_.your_last_chance")) returned 1 [0203.118] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x135f4, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b9770 [0203.118] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0203.118] GetProcessHeap () returned 0x580000 [0203.118] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f0208 [0203.119] GetProcessHeap () returned 0x580000 [0203.119] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7450048 [0203.120] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.120] ReadFile (in: hFile=0x458, lpBuffer=0x72f0208, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x72f0208*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.344] GetProcessHeap () returned 0x580000 [0209.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0209.345] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.345] WriteFile (in: hFile=0x458, lpBuffer=0x7450048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7450048*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.345] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.345] WriteFile (in: hFile=0x458, lpBuffer=0x7461847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461847*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.345] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.345] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.345] CloseHandle (hObject=0x458) returned 1 [0209.346] GetProcessHeap () returned 0x580000 [0209.346] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7450048 | out: hHeap=0x580000) returned 1 [0209.678] GetProcessHeap () returned 0x580000 [0209.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f0208 | out: hHeap=0x580000) returned 1 [0209.678] GetProcessHeap () returned 0x580000 [0209.678] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0209.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4645d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13618, dwReserved0=0x5d8fd28, dwReserved1=0x72f0208, cFileName="FORM.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMJS~1.YOU")) returned 0x5b97f0 [0209.679] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.706] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x73 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0209.706] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0209.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0209.707] CloseHandle (hObject=0x438) returned 1 [0209.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.707] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0210.046] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0210.046] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0210.046] GetProcessHeap () returned 0x580000 [0210.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0210.046] GetProcessHeap () returned 0x580000 [0210.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0210.046] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.046] ReadFile (in: hFile=0x438, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0210.048] GetProcessHeap () returned 0x580000 [0210.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.048] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.048] WriteFile (in: hFile=0x438, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x5d8ff14*=0xc0, lpOverlapped=0x0) returned 1 [0210.048] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.048] WriteFile (in: hFile=0x438, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.048] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.048] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.048] CloseHandle (hObject=0x438) returned 1 [0210.048] GetProcessHeap () returned 0x580000 [0210.048] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0210.048] GetProcessHeap () returned 0x580000 [0210.048] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0210.048] GetProcessHeap () returned 0x580000 [0210.048] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cf7b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x5d8fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.538] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.557] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0214.557] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0214.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0214.565] CloseHandle (hObject=0x44c) returned 1 [0214.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0214.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x460046, dwReserved1=0x47002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.595] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0214.595] GetProcessHeap () returned 0x580000 [0214.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0214.595] GetProcessHeap () returned 0x580000 [0214.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0214.595] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.595] ReadFile (in: hFile=0x44c, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x5d8ff14*=0x160, lpOverlapped=0x0) returned 1 [0214.597] GetProcessHeap () returned 0x580000 [0214.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.597] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x44c, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x5d8ff14*=0x160, lpOverlapped=0x0) returned 1 [0214.598] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x44c, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.598] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.598] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.598] CloseHandle (hObject=0x44c) returned 1 [0214.598] GetProcessHeap () returned 0x580000 [0214.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0214.598] GetProcessHeap () returned 0x580000 [0214.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0214.598] GetProcessHeap () returned 0x580000 [0214.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0217.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7868c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x190, dwReserved0=0x5d8fd28, dwReserved1=0x5b8df0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0217.165] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.211] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", len=0x6e | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned 1 [0217.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0217.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0217.212] CloseHandle (hObject=0x464) returned 1 [0217.212] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.212] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0218.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0218.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x47002e, dwReserved1=0x460049, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0218.442] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0218.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0218.442] GetProcessHeap () returned 0x580000 [0218.442] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5bc18 [0218.442] GetProcessHeap () returned 0x580000 [0218.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5bd50 [0218.443] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.443] ReadFile (in: hFile=0x464, lpBuffer=0x6c5bc18, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5bc18*, lpNumberOfBytesRead=0x5d8ff14*=0x100, lpOverlapped=0x0) returned 1 [0218.444] GetProcessHeap () returned 0x580000 [0218.444] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.444] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.444] WriteFile (in: hFile=0x464, lpBuffer=0x6c5bd50*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5bd50*, lpNumberOfBytesWritten=0x5d8ff14*=0x100, lpOverlapped=0x0) returned 1 [0218.445] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.445] WriteFile (in: hFile=0x464, lpBuffer=0x6c5be4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5be4f*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0218.445] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.445] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0218.445] CloseHandle (hObject=0x464) returned 1 [0218.445] GetProcessHeap () returned 0x580000 [0218.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5bd50 | out: hHeap=0x580000) returned 1 [0218.445] GetProcessHeap () returned 0x580000 [0218.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5bc18 | out: hHeap=0x580000) returned 1 [0218.445] GetProcessHeap () returned 0x580000 [0218.445] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9d01ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x5d8fd28, dwReserved1=0x6c5bc18, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0221.333] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0221.334] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", len=0x60 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned 1 [0221.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0221.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.335] CloseHandle (hObject=0x49c) returned 1 [0221.335] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.id_1622540890_.your_last_chance")) returned 1 [0221.336] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b9770 [0221.336] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0221.336] GetProcessHeap () returned 0x580000 [0221.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x75c1) returned 0x6e063d0 [0221.336] GetProcessHeap () returned 0x580000 [0221.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x75c1) returned 0x745a598 [0221.336] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.336] ReadFile (in: hFile=0x49c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x75a0, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x5d8ff14*=0x75a0, lpOverlapped=0x0) returned 1 [0222.400] GetProcessHeap () returned 0x580000 [0222.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0222.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.401] WriteFile (in: hFile=0x49c, lpBuffer=0x745a598*, nNumberOfBytesToWrite=0x75a0, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x745a598*, lpNumberOfBytesWritten=0x5d8ff14*=0x75a0, lpOverlapped=0x0) returned 1 [0222.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.401] WriteFile (in: hFile=0x49c, lpBuffer=0x7461b37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461b37*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.401] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.401] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.401] CloseHandle (hObject=0x49c) returned 1 [0222.401] GetProcessHeap () returned 0x580000 [0222.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x745a598 | out: hHeap=0x580000) returned 1 [0222.401] GetProcessHeap () returned 0x580000 [0222.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0222.401] GetProcessHeap () returned 0x580000 [0222.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0223.819] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc2cbc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x75ce, dwReserved0=0x5d8fd28, dwReserved1=0x6e063d0, cFileName="validation.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VALIDA~1.YOU")) returned 0x5b9630 [0225.411] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.535] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", len=0x34 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 1 [0230.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0230.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0230.536] CloseHandle (hObject=0x48c) returned 1 [0230.536] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.536] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.id_1622540890_.your_last_chance")) returned 1 [0230.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPPTO~1.YOU")) returned 0x5b9630 [0230.542] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msppt.olb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0230.543] GetProcessHeap () returned 0x580000 [0230.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7522db8 [0230.584] GetProcessHeap () returned 0x580000 [0230.584] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x75345e8 [0230.585] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.585] ReadFile (in: hFile=0x48c, lpBuffer=0x7522db8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7522db8*, lpNumberOfBytesRead=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.357] GetProcessHeap () returned 0x580000 [0238.357] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0238.357] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.358] WriteFile (in: hFile=0x48c, lpBuffer=0x75345e8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x75345e8*, lpNumberOfBytesWritten=0x5d8ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.332] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.332] WriteFile (in: hFile=0x48c, lpBuffer=0x7545de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x7545de7*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.384] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.384] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.384] CloseHandle (hObject=0x48c) returned 1 [0239.456] GetProcessHeap () returned 0x580000 [0239.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x75345e8 | out: hHeap=0x580000) returned 1 [0239.456] GetProcessHeap () returned 0x580000 [0239.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7522db8 | out: hHeap=0x580000) returned 1 [0239.460] GetProcessHeap () returned 0x580000 [0239.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0240.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc63527a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x625ac, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="MSPPT.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPPTO~1.YOU")) returned 0x5b9730 [0240.740] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.801] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML", len=0x4d | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned 1 [0240.801] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0240.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.802] CloseHandle (hObject=0x3f4) returned 1 [0240.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml.id_1622540890_.your_last_chance")) returned 1 [0240.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ROGERS~1.YOU")) returned 0x5b9730 [0240.803] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.804] GetProcessHeap () returned 0x580000 [0240.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d095a0 [0240.804] GetProcessHeap () returned 0x580000 [0240.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09908 [0240.804] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.804] ReadFile (in: hFile=0x3f4, lpBuffer=0x6d095a0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d095a0*, lpNumberOfBytesRead=0x5d8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.828] GetProcessHeap () returned 0x580000 [0240.828] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0240.828] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.828] WriteFile (in: hFile=0x3f4, lpBuffer=0x6d09908*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09908*, lpNumberOfBytesWritten=0x5d8ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.828] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.828] WriteFile (in: hFile=0x3f4, lpBuffer=0x6d09c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09c27*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.828] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.828] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.828] CloseHandle (hObject=0x3f4) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09908 | out: hHeap=0x580000) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d095a0 | out: hHeap=0x580000) returned 1 [0240.849] GetProcessHeap () returned 0x580000 [0240.849] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0240.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7102620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x356, dwReserved0=0x5d8fd28, dwReserved1=0x6d095a0, cFileName="ROGERS.COM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ROGERS~1.YOU")) returned 0x5b9730 [0241.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0242.565] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML", len=0x40 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned 1 [0242.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0242.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0245.396] CloseHandle (hObject=0x458) returned 1 [0245.396] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.396] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml.id_1622540890_.your_last_chance")) returned 1 [0248.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c357500, ftLastWriteTime.dwHighDateTime=0x1c6d897, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG3EFC~1.YOU")) returned 0x5b96f0 [0248.914] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0248.915] GetProcessHeap () returned 0x580000 [0248.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe741) returned 0x707ec98 [0248.916] GetProcessHeap () returned 0x580000 [0248.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe741) returned 0x708d3e8 [0248.916] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.916] ReadFile (in: hFile=0x458, lpBuffer=0x707ec98, nNumberOfBytesToRead=0xe720, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x5d8ff14*=0xe720, lpOverlapped=0x0) returned 1 [0252.153] GetProcessHeap () returned 0x580000 [0252.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.154] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.154] WriteFile (in: hFile=0x458, lpBuffer=0x708d3e8*, nNumberOfBytesToWrite=0xe720, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x708d3e8*, lpNumberOfBytesWritten=0x5d8ff14*=0xe720, lpOverlapped=0x0) returned 1 [0252.154] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.154] WriteFile (in: hFile=0x458, lpBuffer=0x709bb07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x709bb07*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.154] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.154] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.154] CloseHandle (hObject=0x458) returned 1 [0252.155] GetProcessHeap () returned 0x580000 [0252.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708d3e8 | out: hHeap=0x580000) returned 1 [0252.155] GetProcessHeap () returned 0x580000 [0252.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0252.155] GetProcessHeap () returned 0x580000 [0252.155] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.422] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdd04c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe754, dwReserved0=0x5d8fd28, dwReserved1=0x707ec98, cFileName="PGLBL102.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG3EFC~1.YOU")) returned 0x5b9730 [0254.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.358] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV", len=0x3c | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 1 [0255.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f84) returned 0x72e5948 [0255.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.866] CloseHandle (hObject=0x4a8) returned 1 [0258.866] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.866] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573f000, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573f000, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGTEAR~1.YOU")) returned 0x5b96f0 [0258.867] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0258.868] GetProcessHeap () returned 0x580000 [0258.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x677cd0 [0258.868] GetProcessHeap () returned 0x580000 [0258.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x635768 [0258.868] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.868] ReadFile (in: hFile=0x4a8, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x5d8ff14*=0xc00, lpOverlapped=0x0) returned 1 [0258.879] GetProcessHeap () returned 0x580000 [0258.879] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.879] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.879] WriteFile (in: hFile=0x4a8, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x5d8ff14*=0xc00, lpOverlapped=0x0) returned 1 [0258.879] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.879] WriteFile (in: hFile=0x4a8, lpBuffer=0x636367*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x636367*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.879] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.879] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.879] CloseHandle (hObject=0x4a8) returned 1 [0258.879] GetProcessHeap () returned 0x580000 [0258.879] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0258.879] GetProcessHeap () returned 0x580000 [0258.879] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0258.879] GetProcessHeap () returned 0x580000 [0258.880] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fccc | out: lpFindFileData=0x5d8fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573f000, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1d23d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x5d8fd28, dwReserved1=0x677cd0, cFileName="DGTEAR.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGTEAR~1.YOU")) returned 0x5b9630 [0259.224] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.238] SysReAllocStringLen (in: pbstr=0x5d8ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC", len=0x43 | out: pbstr=0x5d8ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC") returned 1 [0259.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x207c) returned 0x72e5948 [0259.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.411] CloseHandle (hObject=0x3e4) returned 1 [0259.411] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc.id_1622540890_.your_last_chance")) returned 1 [0259.412] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5d8ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.412] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5d8fc74 | out: lpFindFileData=0x5d8fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42f1b00, ftCreationTime.dwHighDateTime=0x1c98d8c, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe42f1b00, ftLastWriteTime.dwHighDateTime=0x1c98d8c, nFileSizeHigh=0x0, nFileSizeLow=0xa71a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIDEBA~2.YOU")) returned 0x5b9630 [0259.412] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0259.413] GetProcessHeap () returned 0x580000 [0259.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa721) returned 0x6e9f060 [0259.413] GetProcessHeap () returned 0x580000 [0259.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa721) returned 0x71f2f68 [0259.414] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.414] ReadFile (in: hFile=0x3e4, lpBuffer=0x6e9f060, nNumberOfBytesToRead=0xa700, lpNumberOfBytesRead=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9f060*, lpNumberOfBytesRead=0x5d8ff14*=0xa700, lpOverlapped=0x0) returned 1 [0264.853] GetProcessHeap () returned 0x580000 [0264.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0264.853] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.853] WriteFile (in: hFile=0x3e4, lpBuffer=0x71f2f68*, nNumberOfBytesToWrite=0xa700, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71f2f68*, lpNumberOfBytesWritten=0x5d8ff14*=0xa700, lpOverlapped=0x0) returned 1 [0264.853] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.853] WriteFile (in: hFile=0x3e4, lpBuffer=0x71fd667*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x71fd667*, lpNumberOfBytesWritten=0x5d8ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.853] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.853] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5d8ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5d8ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.853] CloseHandle (hObject=0x3e4) returned 1 [0264.853] GetProcessHeap () returned 0x580000 [0264.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71f2f68 | out: hHeap=0x580000) returned 1 [0264.853] GetProcessHeap () returned 0x580000 [0264.853] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9f060 | out: hHeap=0x580000) returned 1 [0264.854] GetProcessHeap () returned 0x580000 [0264.854] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 Thread: id = 52 os_tid = 0xac8 [0039.069] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.673] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.373] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.534] Sleep (dwMilliseconds=0x1) [0040.549] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.856] Sleep (dwMilliseconds=0x1) [0042.911] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.322] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.588] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.749] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.781] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.827] Sleep (dwMilliseconds=0x1) [0043.843] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.874] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.908] Sleep (dwMilliseconds=0x1) [0043.920] Sleep (dwMilliseconds=0x1) [0043.936] Sleep (dwMilliseconds=0x1) [0043.952] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.983] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.021] Sleep (dwMilliseconds=0x1) [0044.031] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.368] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.435] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.466] Sleep (dwMilliseconds=0x1) [0044.482] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.513] Sleep (dwMilliseconds=0x1) [0044.529] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.591] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.622] Sleep (dwMilliseconds=0x1) [0044.638] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.669] Sleep (dwMilliseconds=0x1) [0044.685] Sleep (dwMilliseconds=0x1) [0044.700] Sleep (dwMilliseconds=0x1) [0044.715] Sleep (dwMilliseconds=0x1) [0044.731] Sleep (dwMilliseconds=0x1) [0044.746] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.778] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.809] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.840] Sleep (dwMilliseconds=0x1) [0044.855] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.934] Sleep (dwMilliseconds=0x1) [0044.949] Sleep (dwMilliseconds=0x1) [0044.965] Sleep (dwMilliseconds=0x1) [0044.980] Sleep (dwMilliseconds=0x1) [0044.996] Sleep (dwMilliseconds=0x1) [0045.012] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.043] Sleep (dwMilliseconds=0x1) [0045.058] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.090] Sleep (dwMilliseconds=0x1) [0045.106] Sleep (dwMilliseconds=0x1) [0045.121] Sleep (dwMilliseconds=0x1) [0045.136] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.168] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.206] Sleep (dwMilliseconds=0x1) [0045.214] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.246] Sleep (dwMilliseconds=0x1) [0045.262] Sleep (dwMilliseconds=0x1) [0045.277] Sleep (dwMilliseconds=0x1) [0045.293] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.324] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.355] Sleep (dwMilliseconds=0x1) [0045.371] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.402] Sleep (dwMilliseconds=0x1) [0045.418] Sleep (dwMilliseconds=0x1) [0045.433] Sleep (dwMilliseconds=0x1) [0045.448] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.480] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.527] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.558] Sleep (dwMilliseconds=0x1) [0045.573] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.802] Sleep (dwMilliseconds=0x1) [0045.819] Sleep (dwMilliseconds=0x1) [0045.833] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.882] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.958] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.036] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.067] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.114] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.145] Sleep (dwMilliseconds=0x1) [0046.161] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.198] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.272] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.317] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.348] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.379] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.411] Sleep (dwMilliseconds=0x1) [0046.426] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.457] Sleep (dwMilliseconds=0x1) [0046.475] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.504] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.551] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.583] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.660] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.691] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.738] Sleep (dwMilliseconds=0x1) [0046.754] Sleep (dwMilliseconds=0x1) [0046.769] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.816] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.863] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.894] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.941] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.003] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.081] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.159] Sleep (dwMilliseconds=0x1) [0047.175] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.253] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.284] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.315] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.471] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.535] Sleep (dwMilliseconds=0x1) [0047.549] Sleep (dwMilliseconds=0x1) [0047.565] Sleep (dwMilliseconds=0x1) [0047.581] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.663] Sleep (dwMilliseconds=0x1) [0047.680] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.705] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.802] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.894] Sleep (dwMilliseconds=0x1) [0047.908] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.017] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.173] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.204] Sleep (dwMilliseconds=0x1) [0048.220] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.251] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.298] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.407] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.485] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.532] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.563] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.610] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.641] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.688] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.721] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.797] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.844] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.875] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.953] Sleep (dwMilliseconds=0x1) [0048.969] Sleep (dwMilliseconds=0x1) [0048.984] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.031] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.111] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.156] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.312] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.421] Sleep (dwMilliseconds=0x1) [0049.439] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.468] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.577] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.624] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.733] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.780] Sleep (dwMilliseconds=0x1) [0049.796] Sleep (dwMilliseconds=0x1) [0049.811] Sleep (dwMilliseconds=0x1) [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.936] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.014] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.045] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.092] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.201] Sleep (dwMilliseconds=0x1) [0050.219] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.248] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.326] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.357] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.404] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.452] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.513] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.560] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] Sleep (dwMilliseconds=0x1) [0050.669] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.716] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.825] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.903] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.966] Sleep (dwMilliseconds=0x1) [0050.981] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.012] Sleep (dwMilliseconds=0x1) [0051.028] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.059] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.137] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.190] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.215] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.293] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.326] Sleep (dwMilliseconds=0x1) [0051.340] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.371] Sleep (dwMilliseconds=0x1) [0051.387] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.418] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.496] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.527] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.590] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.641] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.872] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.950] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.106] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.340] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.465] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.652] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.808] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.089] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.120] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.276] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.510] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.557] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.088] Sleep (dwMilliseconds=0x1) [0054.103] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.563] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.805] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.226] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.651] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.487] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", len=0x51 | out: pbstr=0x5ecff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 1 [0058.487] GetProcessHeap () returned 0x580000 [0058.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0xc) returned 0x5e94f8 [0058.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0062.229] CloseHandle (hObject=0x41c) returned 1 [0062.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0062.229] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id_1622540890_.your_last_chance")) returned 1 [0063.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0063.184] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b9670 [0063.189] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0063.193] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0063.197] GetProcessHeap () returned 0x580000 [0063.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ce54a8 [0063.198] GetProcessHeap () returned 0x580000 [0063.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6cf6cd8 [0063.198] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.198] ReadFile (in: hFile=0x414, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0068.197] GetProcessHeap () returned 0x580000 [0068.197] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0068.197] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.197] WriteFile (in: hFile=0x414, lpBuffer=0x6cf6cd8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0068.198] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0068.198] WriteFile (in: hFile=0x414, lpBuffer=0x6d084d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d084d7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0069.988] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.988] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0069.988] CloseHandle (hObject=0x414) returned 1 [0074.820] GetProcessHeap () returned 0x580000 [0074.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0074.820] GetProcessHeap () returned 0x580000 [0074.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0074.820] GetProcessHeap () returned 0x580000 [0074.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0079.334] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x643b2f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd02b0e, dwReserved0=0x5ecfd28, dwReserved1=0x6ce54a8, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b96f0 [0079.334] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.349] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", len=0x3e | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 1 [0079.350] GetProcessHeap () returned 0x580000 [0079.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x38) returned 0x5f76f0 [0079.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.360] Sleep (dwMilliseconds=0x1) [0083.929] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", len=0x5b | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 1 [0083.929] GetProcessHeap () returned 0x580000 [0083.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.997] CloseHandle (hObject=0x444) returned 1 [0083.997] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id_1622540890_.your_last_chance")) returned 1 [0083.998] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPWM~1.YOU")) returned 0x5b9630 [0083.998] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0083.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.998] GetProcessHeap () returned 0x580000 [0083.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba61) returned 0x673cd0 [0083.998] GetProcessHeap () returned 0x580000 [0083.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba61) returned 0x626d18 [0083.999] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.999] ReadFile (in: hFile=0x444, lpBuffer=0x673cd0, nNumberOfBytesToRead=0xba40, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x5ecff14*=0xba40, lpOverlapped=0x0) returned 1 [0084.307] GetProcessHeap () returned 0x580000 [0084.307] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.307] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] WriteFile (in: hFile=0x444, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x5ecff14*=0xba40, lpOverlapped=0x0) returned 1 [0084.307] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] WriteFile (in: hFile=0x444, lpBuffer=0x632757*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x632757*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0084.307] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.307] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0084.308] CloseHandle (hObject=0x444) returned 1 [0084.308] GetProcessHeap () returned 0x580000 [0084.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0084.308] GetProcessHeap () returned 0x580000 [0084.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0084.308] GetProcessHeap () returned 0x580000 [0084.308] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69ddb080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba82, dwReserved0=0x5ecfd28, dwReserved1=0x673cd0, cFileName="OSPPWMI.MOF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPWM~1.YOU")) returned 0x5b96b0 [0084.308] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.226] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", len=0x49 | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 1 [0088.226] GetProcessHeap () returned 0x580000 [0088.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0088.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.344] CloseHandle (hObject=0x450) returned 1 [0088.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.344] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id_1622540890_.your_last_chance")) returned 1 [0088.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREEZE~1.YOU")) returned 0x5b96f0 [0088.344] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0088.345] GetProcessHeap () returned 0x580000 [0088.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0088.345] GetProcessHeap () returned 0x580000 [0088.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04eb8 [0088.345] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.345] ReadFile (in: hFile=0x450, lpBuffer=0x6d04cc0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesRead=0x5ecff14*=0x1c0, lpOverlapped=0x0) returned 1 [0088.347] GetProcessHeap () returned 0x580000 [0088.347] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.347] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.347] WriteFile (in: hFile=0x450, lpBuffer=0x6d04eb8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04eb8*, lpNumberOfBytesWritten=0x5ecff14*=0x1c0, lpOverlapped=0x0) returned 1 [0088.348] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x450, lpBuffer=0x6d05077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d05077*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0088.348] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.348] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0088.348] CloseHandle (hObject=0x450) returned 1 [0088.348] GetProcessHeap () returned 0x580000 [0088.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04eb8 | out: hHeap=0x580000) returned 1 [0088.348] GetProcessHeap () returned 0x580000 [0088.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0088.348] GetProcessHeap () returned 0x580000 [0088.348] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c4634a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x5ecfd28, dwReserved1=0x6d04cc0, cFileName="BREEZE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BREEZE~1.YOU")) returned 0x5b96f0 [0088.348] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.671] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", len=0x4b | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 1 [0091.671] GetProcessHeap () returned 0x580000 [0091.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0091.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0092.883] CloseHandle (hObject=0x45c) returned 1 [0092.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id_1622540890_.your_last_chance")) returned 1 [0092.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x45, dwReserved1=0x0, cFileName="ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECLIPS~2.YOU")) returned 0x5b96f0 [0092.884] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0092.884] GetProcessHeap () returned 0x580000 [0092.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0092.884] GetProcessHeap () returned 0x580000 [0092.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dcf390 [0092.884] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.884] ReadFile (in: hFile=0x45c, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.722] GetProcessHeap () returned 0x580000 [0099.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0099.723] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.723] WriteFile (in: hFile=0x45c, lpBuffer=0x6dcf390*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcf390*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0099.723] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.723] WriteFile (in: hFile=0x45c, lpBuffer=0x6de0b8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0b8f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0099.723] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.723] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0099.724] CloseHandle (hObject=0x45c) returned 1 [0099.724] GetProcessHeap () returned 0x580000 [0099.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf390 | out: hHeap=0x580000) returned 1 [0099.730] GetProcessHeap () returned 0x580000 [0099.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0099.730] GetProcessHeap () returned 0x580000 [0099.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x730d7f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cf55, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="ECLIPSE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECLIPS~2.YOU")) returned 0x5b96f0 [0101.348] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.403] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", len=0x4d | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 1 [0101.403] GetProcessHeap () returned 0x580000 [0101.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0101.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0101.430] CloseHandle (hObject=0x4a4) returned 1 [0101.430] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.430] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id_1622540890_.your_last_chance")) returned 1 [0103.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0103.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRTED~1.YOU")) returned 0x5b9730 [0103.821] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0103.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0103.821] GetProcessHeap () returned 0x580000 [0103.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0103.821] GetProcessHeap () returned 0x580000 [0103.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0103.821] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.821] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x5ecff14*=0x260, lpOverlapped=0x0) returned 1 [0103.825] GetProcessHeap () returned 0x580000 [0103.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.825] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.825] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x5ecff14*=0x260, lpOverlapped=0x0) returned 1 [0103.825] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.825] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0103.825] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.825] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0103.825] CloseHandle (hObject=0x4a4) returned 1 [0103.825] GetProcessHeap () returned 0x580000 [0103.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0103.826] GetProcessHeap () returned 0x580000 [0103.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0103.826] GetProcessHeap () returned 0x580000 [0103.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x757f88a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x5ecfd28, dwReserved1=0x6d08520, cFileName="STRTEDGE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STRTED~1.YOU")) returned 0x5b9730 [0103.826] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.668] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", len=0x36 | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 1 [0109.669] GetProcessHeap () returned 0x580000 [0109.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x30) returned 0x61f420 [0109.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.707] Sleep (dwMilliseconds=0x1) [0109.717] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", len=0x40 | out: pbstr=0x5ecff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 1 [0109.717] GetProcessHeap () returned 0x580000 [0109.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0xc) returned 0x5e94c8 [0109.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0109.722] CloseHandle (hObject=0x3f4) returned 1 [0109.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0109.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id_1622540890_.your_last_chance")) returned 1 [0109.722] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0109.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOEE~2.YOU")) returned 0x5b9630 [0109.723] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0109.723] GetProcessHeap () returned 0x580000 [0109.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5561) returned 0x6cfac48 [0109.723] GetProcessHeap () returned 0x580000 [0109.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5561) returned 0x6f10048 [0109.723] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0109.723] ReadFile (in: hFile=0x3f4, lpBuffer=0x6cfac48, nNumberOfBytesToRead=0x5540, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfac48*, lpNumberOfBytesRead=0x5ecff14*=0x5540, lpOverlapped=0x0) returned 1 [0111.223] GetProcessHeap () returned 0x580000 [0111.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0111.223] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.223] WriteFile (in: hFile=0x3f4, lpBuffer=0x6f10048*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesWritten=0x5ecff14*=0x5540, lpOverlapped=0x0) returned 1 [0111.224] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.224] WriteFile (in: hFile=0x3f4, lpBuffer=0x6f15587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15587*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0111.224] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.224] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0111.224] CloseHandle (hObject=0x3f4) returned 1 [0111.224] GetProcessHeap () returned 0x580000 [0111.224] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0111.225] GetProcessHeap () returned 0x580000 [0111.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfac48 | out: hHeap=0x580000) returned 1 [0111.225] GetProcessHeap () returned 0x580000 [0111.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0111.225] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x79e7d460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5574, dwReserved0=0x5ecfd28, dwReserved1=0x6cfac48, cFileName="vstoee90.tlb.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOEE~2.YOU")) returned 0x5b96f0 [0111.225] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.914] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", len=0x51 | out: pbstr=0x5ecff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 1 [0111.914] GetProcessHeap () returned 0x580000 [0111.915] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.915] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.959] Sleep (dwMilliseconds=0x1) [0112.129] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", len=0x47 | out: pbstr=0x5ecff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned 1 [0112.130] GetProcessHeap () returned 0x580000 [0112.130] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x28) returned 0x5dc550 [0112.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.138] Sleep (dwMilliseconds=0x1) [0112.219] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", len=0x4f | out: pbstr=0x5ecff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned 1 [0112.219] GetProcessHeap () returned 0x580000 [0112.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.220] Sleep (dwMilliseconds=0x1) [0112.237] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", len=0x49 | out: pbstr=0x5ecff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 1 [0112.237] GetProcessHeap () returned 0x580000 [0112.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.237] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.249] Sleep (dwMilliseconds=0x1) [0112.366] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", len=0x44 | out: pbstr=0x5ecff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 1 [0112.366] GetProcessHeap () returned 0x580000 [0112.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.366] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.387] Sleep (dwMilliseconds=0x1) [0113.313] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 1 [0113.313] GetProcessHeap () returned 0x580000 [0113.313] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xf4) returned 0x6f0ceb8 [0113.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0113.493] CloseHandle (hObject=0x410) returned 1 [0113.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.024] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0417~1.YOU")) returned 0x5b9630 [0115.024] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x410 [0115.024] GetProcessHeap () returned 0x580000 [0115.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x677cd0 [0115.024] GetProcessHeap () returned 0x580000 [0115.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa61) returned 0x6c3a820 [0115.025] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.025] ReadFile (in: hFile=0x410, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xa40, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x5ecff14*=0xa40, lpOverlapped=0x0) returned 1 [0115.035] GetProcessHeap () returned 0x580000 [0115.035] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.035] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.035] WriteFile (in: hFile=0x410, lpBuffer=0x6c3a820*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesWritten=0x5ecff14*=0xa40, lpOverlapped=0x0) returned 1 [0115.036] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.036] WriteFile (in: hFile=0x410, lpBuffer=0x6c3b25f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b25f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0115.036] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.036] WriteFile (in: hFile=0x410, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0115.036] CloseHandle (hObject=0x410) returned 1 [0115.036] GetProcessHeap () returned 0x580000 [0115.036] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0115.036] GetProcessHeap () returned 0x580000 [0115.036] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0115.036] GetProcessHeap () returned 0x580000 [0115.036] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c2f0540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa70, dwReserved0=0x5ecfd28, dwReserved1=0x677cd0, cFileName="AN04174_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0417~1.YOU")) returned 0x5b9630 [0116.146] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0116.222] CloseHandle (hObject=0x48c) returned 1 [0116.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.223] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0156~1.YOU")) returned 0x5b9630 [0116.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0116.224] GetProcessHeap () returned 0x580000 [0116.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ce1) returned 0x6dcb570 [0116.224] GetProcessHeap () returned 0x580000 [0116.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ce1) returned 0x6dd2260 [0116.224] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.224] ReadFile (in: hFile=0x48c, lpBuffer=0x6dcb570, nNumberOfBytesToRead=0x6cc0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb570*, lpNumberOfBytesRead=0x5ecff14*=0x6cc0, lpOverlapped=0x0) returned 1 [0117.771] GetProcessHeap () returned 0x580000 [0117.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0117.771] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.771] WriteFile (in: hFile=0x48c, lpBuffer=0x6dd2260*, nNumberOfBytesToWrite=0x6cc0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd2260*, lpNumberOfBytesWritten=0x5ecff14*=0x6cc0, lpOverlapped=0x0) returned 1 [0117.771] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.771] WriteFile (in: hFile=0x48c, lpBuffer=0x6dd8f1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f1f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0117.772] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.772] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0117.772] CloseHandle (hObject=0x48c) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd2260 | out: hHeap=0x580000) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb570 | out: hHeap=0x580000) returned 1 [0117.929] GetProcessHeap () returned 0x580000 [0117.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0120.014] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dcf95e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6ce8, dwReserved0=0x5ecfd28, dwReserved1=0x6dcb570, cFileName="SL01565_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0156~1.YOU")) returned 0x5b96f0 [0120.014] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.032] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF") returned 1 [0120.032] GetProcessHeap () returned 0x580000 [0120.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1790) returned 0x6d06ca8 [0120.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.034] CloseHandle (hObject=0x438) returned 1 [0120.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.035] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.035] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0183~1.YOU")) returned 0x5b96f0 [0120.035] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.036] GetProcessHeap () returned 0x580000 [0120.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6c29878 [0120.036] GetProcessHeap () returned 0x580000 [0120.036] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6d10048 [0120.036] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.036] ReadFile (in: hFile=0x438, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe40, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x5ecff14*=0xe40, lpOverlapped=0x0) returned 1 [0120.050] GetProcessHeap () returned 0x580000 [0120.050] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.050] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x438, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x5ecff14*=0xe40, lpOverlapped=0x0) returned 1 [0120.050] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x438, lpBuffer=0x6d10e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10e87*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0120.050] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.050] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0120.050] CloseHandle (hObject=0x438) returned 1 [0120.051] GetProcessHeap () returned 0x580000 [0120.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0120.051] GetProcessHeap () returned 0x580000 [0120.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0120.051] GetProcessHeap () returned 0x580000 [0120.051] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f2b1ea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe68, dwReserved0=0x5ecfd28, dwReserved1=0x6c29878, cFileName="WB01838_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0183~1.YOU")) returned 0x5b96f0 [0120.051] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.058] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF") returned 1 [0120.058] GetProcessHeap () returned 0x580000 [0120.058] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1788) returned 0x6d06ca8 [0120.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.059] CloseHandle (hObject=0x438) returned 1 [0120.059] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.059] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.060] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0175~1.YOU")) returned 0x5b96f0 [0120.060] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.060] GetProcessHeap () returned 0x580000 [0120.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x635768 [0120.060] GetProcessHeap () returned 0x580000 [0120.060] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6107d8 [0120.060] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.060] ReadFile (in: hFile=0x438, lpBuffer=0x635768, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x5ecff14*=0x3a0, lpOverlapped=0x0) returned 1 [0120.072] GetProcessHeap () returned 0x580000 [0120.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.072] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.072] WriteFile (in: hFile=0x438, lpBuffer=0x6107d8*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesWritten=0x5ecff14*=0x3a0, lpOverlapped=0x0) returned 1 [0120.072] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.072] WriteFile (in: hFile=0x438, lpBuffer=0x610b77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x610b77*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0120.073] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.073] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0120.073] CloseHandle (hObject=0x438) returned 1 [0120.073] GetProcessHeap () returned 0x580000 [0120.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0120.073] GetProcessHeap () returned 0x580000 [0120.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0120.073] GetProcessHeap () returned 0x580000 [0120.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f2d8000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3dd, dwReserved0=0x5ecfd28, dwReserved1=0x635768, cFileName="WB01751_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0175~1.YOU")) returned 0x5b96f0 [0120.073] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.466] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", len=0x4e | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned 1 [0120.466] GetProcessHeap () returned 0x580000 [0120.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1868) returned 0x6e00ac0 [0120.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.075] CloseHandle (hObject=0x440) returned 1 [0122.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.075] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.id_1622540890_.your_last_chance")) returned 1 [0122.075] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0122.076] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.076] GetProcessHeap () returned 0x580000 [0122.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678958 [0122.076] GetProcessHeap () returned 0x580000 [0122.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e1) returned 0x678d60 [0122.077] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.077] ReadFile (in: hFile=0x440, lpBuffer=0x678958, nNumberOfBytesToRead=0x3c0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x678958*, lpNumberOfBytesRead=0x5ecff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.081] GetProcessHeap () returned 0x580000 [0122.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.081] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.081] WriteFile (in: hFile=0x440, lpBuffer=0x678d60*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x678d60*, lpNumberOfBytesWritten=0x5ecff14*=0x3c0, lpOverlapped=0x0) returned 1 [0122.082] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.082] WriteFile (in: hFile=0x440, lpBuffer=0x67911f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x67911f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0122.082] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.082] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0122.082] CloseHandle (hObject=0x440) returned 1 [0122.082] GetProcessHeap () returned 0x580000 [0122.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678d60 | out: hHeap=0x580000) returned 1 [0122.082] GetProcessHeap () returned 0x580000 [0122.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x678958 | out: hHeap=0x580000) returned 1 [0122.082] GetProcessHeap () returned 0x580000 [0122.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80609160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x5ecfd28, dwReserved1=0x678958, cFileName="Waveform.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WAVEFO~1.YOU")) returned 0x5b9730 [0124.354] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.380] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", len=0x4c | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned 1 [0124.380] GetProcessHeap () returned 0x580000 [0124.380] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x190c) returned 0x6f42f08 [0124.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.480] CloseHandle (hObject=0x470) returned 1 [0124.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.id_1622540890_.your_last_chance")) returned 1 [0124.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORIZO~1.YOU")) returned 0x5b9730 [0124.481] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0124.481] GetProcessHeap () returned 0x580000 [0124.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6c29878 [0124.481] GetProcessHeap () returned 0x580000 [0124.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe41) returned 0x6ce2378 [0124.481] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.481] ReadFile (in: hFile=0x470, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x5ecff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.494] GetProcessHeap () returned 0x580000 [0124.494] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0124.494] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.494] WriteFile (in: hFile=0x470, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x5ecff14*=0xe20, lpOverlapped=0x0) returned 1 [0124.495] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.495] WriteFile (in: hFile=0x470, lpBuffer=0x6ce3197*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3197*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0124.495] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.495] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0124.495] CloseHandle (hObject=0x470) returned 1 [0124.495] GetProcessHeap () returned 0x580000 [0124.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.495] GetProcessHeap () returned 0x580000 [0124.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.495] GetProcessHeap () returned 0x580000 [0124.495] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0125.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81d18680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x5ecfd28, dwReserved1=0x6c29878, cFileName="Horizon.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HORIZO~1.YOU")) returned 0x5b9730 [0125.317] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.342] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", len=0x3d | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned 1 [0125.342] GetProcessHeap () returned 0x580000 [0125.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x195c) returned 0x6f42f08 [0125.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0128.877] CloseHandle (hObject=0x418) returned 1 [0128.877] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.033] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02352~1.YOU")) returned 0x5b9730 [0130.034] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0130.034] GetProcessHeap () returned 0x580000 [0130.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1841) returned 0x6d06ca8 [0130.034] GetProcessHeap () returned 0x580000 [0130.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1841) returned 0x65d440 [0130.034] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.034] ReadFile (in: hFile=0x418, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x1820, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x5ecff14*=0x1820, lpOverlapped=0x0) returned 1 [0130.056] GetProcessHeap () returned 0x580000 [0130.056] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0130.057] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.057] WriteFile (in: hFile=0x418, lpBuffer=0x65d440*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65d440*, lpNumberOfBytesWritten=0x5ecff14*=0x1820, lpOverlapped=0x0) returned 1 [0130.057] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.057] WriteFile (in: hFile=0x418, lpBuffer=0x65ec5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65ec5f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0130.057] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.057] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0130.057] CloseHandle (hObject=0x418) returned 1 [0130.057] GetProcessHeap () returned 0x580000 [0130.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65d440 | out: hHeap=0x580000) returned 1 [0130.057] GetProcessHeap () returned 0x580000 [0130.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0130.057] GetProcessHeap () returned 0x580000 [0130.057] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0130.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8520f000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x5ecfd28, dwReserved1=0x6d06ca8, cFileName="J0235241.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02352~1.YOU")) returned 0x5b9730 [0130.057] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0130.269] CloseHandle (hObject=0x3b4) returned 1 [0130.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0130.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id_1622540890_.your_last_chance")) returned 1 [0130.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GR8GAL~1.YOU")) returned 0x5b9730 [0130.273] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0130.273] GetProcessHeap () returned 0x580000 [0130.273] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d461c8 [0130.273] GetProcessHeap () returned 0x580000 [0130.274] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d579f8 [0130.274] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.274] ReadFile (in: hFile=0x44c, lpBuffer=0x6d461c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d461c8*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0136.955] GetProcessHeap () returned 0x580000 [0136.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0136.955] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.955] WriteFile (in: hFile=0x44c, lpBuffer=0x6d579f8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d579f8*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.470] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.470] WriteFile (in: hFile=0x44c, lpBuffer=0x6d691f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d691f7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0138.470] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.470] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0138.470] CloseHandle (hObject=0x44c) returned 1 [0138.580] GetProcessHeap () returned 0x580000 [0138.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d579f8 | out: hHeap=0x580000) returned 1 [0138.580] GetProcessHeap () returned 0x580000 [0138.580] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d461c8 | out: hHeap=0x580000) returned 1 [0138.584] GetProcessHeap () returned 0x580000 [0138.584] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0139.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a265680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2da24, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="GR8GALRY.GRA.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GR8GAL~1.YOU")) returned 0x5b9770 [0139.878] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.905] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", len=0x59 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0139.905] GetProcessHeap () returned 0x580000 [0139.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0139.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.940] CloseHandle (hObject=0x170) returned 1 [0139.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0139.954] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0139.954] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0139.955] GetProcessHeap () returned 0x580000 [0139.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6c79898 [0139.955] GetProcessHeap () returned 0x580000 [0139.955] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6d00cd8 [0139.955] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.955] ReadFile (in: hFile=0x170, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5ecff14*=0x860, lpOverlapped=0x0) returned 1 [0139.969] GetProcessHeap () returned 0x580000 [0139.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0139.969] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.969] WriteFile (in: hFile=0x170, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x5ecff14*=0x860, lpOverlapped=0x0) returned 1 [0139.969] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.969] WriteFile (in: hFile=0x170, lpBuffer=0x6d01537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01537*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0139.970] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.970] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0139.970] CloseHandle (hObject=0x170) returned 1 [0139.970] GetProcessHeap () returned 0x580000 [0139.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0139.970] GetProcessHeap () returned 0x580000 [0139.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0139.970] GetProcessHeap () returned 0x580000 [0139.970] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b0ada80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x890, dwReserved0=0x5ecfd28, dwReserved1=0x6c79898, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0140.165] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.450] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", len=0x43 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned 1 [0140.450] GetProcessHeap () returned 0x580000 [0140.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db4) returned 0x6f14048 [0140.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.544] CloseHandle (hObject=0x3a8) returned 1 [0140.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1499~2.YOU")) returned 0x5b9770 [0140.545] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.546] GetProcessHeap () returned 0x580000 [0140.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e023e8 [0140.546] GetProcessHeap () returned 0x580000 [0140.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x6e026f0 [0140.546] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.546] ReadFile (in: hFile=0x3a8, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x5ecff14*=0x2c0, lpOverlapped=0x0) returned 1 [0140.550] GetProcessHeap () returned 0x580000 [0140.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.550] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.550] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e026f0*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e026f0*, lpNumberOfBytesWritten=0x5ecff14*=0x2c0, lpOverlapped=0x0) returned 1 [0140.550] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.550] WriteFile (in: hFile=0x3a8, lpBuffer=0x6e029af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e029af*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0140.550] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.550] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0140.550] CloseHandle (hObject=0x3a8) returned 1 [0140.550] GetProcessHeap () returned 0x580000 [0140.550] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e026f0 | out: hHeap=0x580000) returned 1 [0140.551] GetProcessHeap () returned 0x580000 [0140.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0140.551] GetProcessHeap () returned 0x580000 [0140.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.859] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b62ed60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x5ecfd28, dwReserved1=0x6e023e8, cFileName="BD14996_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1499~2.YOU")) returned 0x5b9730 [0140.860] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.930] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK", len=0x42 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 1 [0141.930] GetProcessHeap () returned 0x580000 [0141.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1edc) returned 0x6f14048 [0141.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.931] CloseHandle (hObject=0x470) returned 1 [0141.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0141.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b9730 [0141.932] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.932] GetProcessHeap () returned 0x580000 [0141.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0141.932] GetProcessHeap () returned 0x580000 [0141.932] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0141.932] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.932] ReadFile (in: hFile=0x470, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.933] GetProcessHeap () returned 0x580000 [0141.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.934] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.934] WriteFile (in: hFile=0x470, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.934] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.934] WriteFile (in: hFile=0x470, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0141.934] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.934] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0141.934] CloseHandle (hObject=0x470) returned 1 [0141.934] GetProcessHeap () returned 0x580000 [0141.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0141.934] GetProcessHeap () returned 0x580000 [0141.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0141.934] GetProcessHeap () returned 0x580000 [0141.934] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c36c7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x5ecfd28, dwReserved1=0x61b540, cFileName="POWERPNT_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b9730 [0141.934] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.958] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK", len=0x46 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 1 [0141.958] GetProcessHeap () returned 0x580000 [0141.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec8) returned 0x6f14048 [0141.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0141.959] CloseHandle (hObject=0x4a4) returned 1 [0141.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.959] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0141.960] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO7B5C~1.YOU")) returned 0x5b9730 [0141.960] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0141.961] GetProcessHeap () returned 0x580000 [0141.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0141.961] GetProcessHeap () returned 0x580000 [0141.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0141.961] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.961] ReadFile (in: hFile=0x4a4, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.962] GetProcessHeap () returned 0x580000 [0141.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.962] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.962] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0141.962] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.962] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0141.963] CloseHandle (hObject=0x4a4) returned 1 [0141.963] GetProcessHeap () returned 0x580000 [0141.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0141.963] GetProcessHeap () returned 0x580000 [0141.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0141.963] GetProcessHeap () returned 0x580000 [0141.963] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c3b8a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x5ecfd28, dwReserved1=0x61b540, cFileName="POWERPNT.DEV_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO7B5C~1.YOU")) returned 0x5b9730 [0141.963] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.992] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK", len=0x46 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 1 [0141.992] GetProcessHeap () returned 0x580000 [0141.992] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec4) returned 0x6f14048 [0141.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.992] CloseHandle (hObject=0x470) returned 1 [0141.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.993] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0141.993] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO2E83~1.YOU")) returned 0x5b9730 [0141.994] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0141.994] GetProcessHeap () returned 0x580000 [0141.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0141.994] GetProcessHeap () returned 0x580000 [0141.994] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0141.994] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.994] ReadFile (in: hFile=0x470, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.995] GetProcessHeap () returned 0x580000 [0141.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.995] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.995] WriteFile (in: hFile=0x470, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0141.996] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.996] WriteFile (in: hFile=0x470, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0141.996] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.996] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0141.996] CloseHandle (hObject=0x470) returned 1 [0141.996] GetProcessHeap () returned 0x580000 [0141.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0141.996] GetProcessHeap () returned 0x580000 [0141.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0141.996] GetProcessHeap () returned 0x580000 [0141.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c404d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5ecfd28, dwReserved1=0x61b540, cFileName="POWERPNT.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PO2E83~1.YOU")) returned 0x5b9730 [0141.996] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.007] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD", len=0x3c | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 1 [0142.007] GetProcessHeap () returned 0x580000 [0142.007] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0142.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.249] CloseHandle (hObject=0x478) returned 1 [0144.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.250] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id_1622540890_.your_last_chance")) returned 1 [0144.250] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5cd5800, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIPELI~1.YOU")) returned 0x5b96f0 [0144.251] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0144.251] GetProcessHeap () returned 0x580000 [0144.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6c79898 [0144.251] GetProcessHeap () returned 0x580000 [0144.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef3020 [0144.251] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.251] ReadFile (in: hFile=0x478, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5ecff14*=0x780, lpOverlapped=0x0) returned 1 [0144.261] GetProcessHeap () returned 0x580000 [0144.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.261] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x478, lpBuffer=0x6ef3020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesWritten=0x5ecff14*=0x780, lpOverlapped=0x0) returned 1 [0144.261] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x478, lpBuffer=0x6ef379f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef379f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0144.261] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.261] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0144.261] CloseHandle (hObject=0x478) returned 1 [0144.262] GetProcessHeap () returned 0x580000 [0144.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0144.262] GetProcessHeap () returned 0x580000 [0144.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0144.262] GetProcessHeap () returned 0x580000 [0144.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8d9974a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7a4, dwReserved0=0x5ecfd28, dwReserved1=0x6c79898, cFileName="PIPELINE.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PIPELI~1.YOU")) returned 0x5b96f0 [0146.865] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.879] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", len=0x44 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned 1 [0146.879] GetProcessHeap () returned 0x580000 [0146.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0146.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0152.555] CloseHandle (hObject=0x454) returned 1 [0152.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.556] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.556] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR19~1.YOU")) returned 0x5b9730 [0152.556] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0152.556] GetProcessHeap () returned 0x580000 [0152.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x677cd0 [0152.556] GetProcessHeap () returned 0x580000 [0152.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x706e008 [0152.557] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.557] ReadFile (in: hFile=0x454, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x5ecff14*=0xc40, lpOverlapped=0x0) returned 1 [0152.569] GetProcessHeap () returned 0x580000 [0152.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0152.569] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.569] WriteFile (in: hFile=0x454, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x5ecff14*=0xc40, lpOverlapped=0x0) returned 1 [0152.569] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.569] WriteFile (in: hFile=0x454, lpBuffer=0x706ec47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x706ec47*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0152.569] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.569] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0152.569] CloseHandle (hObject=0x454) returned 1 [0152.569] GetProcessHeap () returned 0x580000 [0152.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0152.569] GetProcessHeap () returned 0x580000 [0152.569] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0152.570] GetProcessHeap () returned 0x580000 [0152.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0153.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x928e3180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc73, dwReserved0=0x5ecfd28, dwReserved1=0x677cd0, cFileName="PDIR19F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR19~1.YOU")) returned 0x5b9630 [0153.747] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0153.801] CloseHandle (hObject=0x464) returned 1 [0153.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.802] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.id_1622540890_.your_last_chance")) returned 1 [0153.802] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLNTWR~1.YOU")) returned 0x5b9630 [0153.802] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0153.803] GetProcessHeap () returned 0x580000 [0153.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6107d8 [0153.803] GetProcessHeap () returned 0x580000 [0153.803] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x610ce0 [0153.803] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.803] ReadFile (in: hFile=0x464, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x5ecff14*=0x4c0, lpOverlapped=0x0) returned 1 [0153.808] GetProcessHeap () returned 0x580000 [0153.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.808] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.808] WriteFile (in: hFile=0x464, lpBuffer=0x610ce0*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x610ce0*, lpNumberOfBytesWritten=0x5ecff14*=0x4c0, lpOverlapped=0x0) returned 1 [0153.808] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.808] WriteFile (in: hFile=0x464, lpBuffer=0x61119f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61119f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0153.809] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.809] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0153.809] CloseHandle (hObject=0x464) returned 1 [0153.809] GetProcessHeap () returned 0x580000 [0153.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610ce0 | out: hHeap=0x580000) returned 1 [0153.809] GetProcessHeap () returned 0x580000 [0153.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0153.809] GetProcessHeap () returned 0x580000 [0153.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x934a3e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x5ecfd28, dwReserved1=0x6107d8, cFileName="CLNTWRAP.HTM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CLNTWR~1.YOU")) returned 0x5b9630 [0153.809] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.315] CloseHandle (hObject=0x45c) returned 1 [0155.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0155.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~4.YOU")) returned 0x5b9730 [0155.317] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.317] GetProcessHeap () returned 0x580000 [0155.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0155.317] GetProcessHeap () returned 0x580000 [0155.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0155.317] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.317] ReadFile (in: hFile=0x45c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0155.318] GetProcessHeap () returned 0x580000 [0155.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.318] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.318] WriteFile (in: hFile=0x45c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x5ecff14*=0x60, lpOverlapped=0x0) returned 1 [0155.318] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.319] WriteFile (in: hFile=0x45c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0155.319] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.319] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0155.319] CloseHandle (hObject=0x45c) returned 1 [0155.319] GetProcessHeap () returned 0x580000 [0155.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0155.319] GetProcessHeap () returned 0x580000 [0155.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0155.319] GetProcessHeap () returned 0x580000 [0155.319] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94312380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x5ecfd28, dwReserved1=0x61b540, cFileName="WINWORD.DEV_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~4.YOU")) returned 0x5b9630 [0155.971] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.985] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", len=0x3d | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 1 [0155.985] GetProcessHeap () returned 0x580000 [0155.985] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0155.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0158.732] CloseHandle (hObject=0x430) returned 1 [0158.732] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART6~1.YOU")) returned 0x5b9630 [0158.733] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0158.733] GetProcessHeap () returned 0x580000 [0158.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd7c1) returned 0x6d21878 [0158.733] GetProcessHeap () returned 0x580000 [0158.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd7c1) returned 0x6d2f048 [0158.733] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.733] ReadFile (in: hFile=0x430, lpBuffer=0x6d21878, nNumberOfBytesToRead=0xd7a0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x5ecff14*=0xd7a0, lpOverlapped=0x0) returned 1 [0163.549] GetProcessHeap () returned 0x580000 [0163.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0163.549] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.549] WriteFile (in: hFile=0x430, lpBuffer=0x6d2f048*, nNumberOfBytesToWrite=0xd7a0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2f048*, lpNumberOfBytesWritten=0x5ecff14*=0xd7a0, lpOverlapped=0x0) returned 1 [0163.550] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.550] WriteFile (in: hFile=0x430, lpBuffer=0x6d3c7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d3c7e7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0163.550] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.550] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0163.550] CloseHandle (hObject=0x430) returned 1 [0164.380] GetProcessHeap () returned 0x580000 [0164.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2f048 | out: hHeap=0x580000) returned 1 [0164.380] GetProcessHeap () returned 0x580000 [0164.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0164.380] GetProcessHeap () returned 0x580000 [0164.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0166.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99179820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd7da, dwReserved0=0x5ecfd28, dwReserved1=0x6d21878, cFileName="MSART6.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART6~1.YOU")) returned 0x5b9730 [0166.303] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.468] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", len=0x40 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 1 [0166.468] GetProcessHeap () returned 0x580000 [0166.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2258) returned 0x6f14048 [0166.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.510] CloseHandle (hObject=0x390) returned 1 [0166.510] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.510] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id_1622540890_.your_last_chance")) returned 1 [0166.511] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d0fd900, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOML~1.YOU")) returned 0x5b9730 [0166.511] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0166.511] GetProcessHeap () returned 0x580000 [0166.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6281) returned 0x6d950c8 [0166.511] GetProcessHeap () returned 0x580000 [0166.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6281) returned 0x6d430a8 [0166.511] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.511] ReadFile (in: hFile=0x390, lpBuffer=0x6d950c8, nNumberOfBytesToRead=0x6260, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d950c8*, lpNumberOfBytesRead=0x5ecff14*=0x6260, lpOverlapped=0x0) returned 1 [0167.946] GetProcessHeap () returned 0x580000 [0167.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0167.946] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.946] WriteFile (in: hFile=0x390, lpBuffer=0x6d430a8*, nNumberOfBytesToWrite=0x6260, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430a8*, lpNumberOfBytesWritten=0x5ecff14*=0x6260, lpOverlapped=0x0) returned 1 [0167.947] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.947] WriteFile (in: hFile=0x390, lpBuffer=0x6d49307*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d49307*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0167.947] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.947] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0167.947] CloseHandle (hObject=0x390) returned 1 [0167.947] GetProcessHeap () returned 0x580000 [0167.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430a8 | out: hHeap=0x580000) returned 1 [0167.947] GetProcessHeap () returned 0x580000 [0167.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d950c8 | out: hHeap=0x580000) returned 1 [0167.947] GetProcessHeap () returned 0x580000 [0167.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0170.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb6dbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x62a2, dwReserved0=0x5ecfd28, dwReserved1=0x6d950c8, cFileName="INFOML.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOML~1.YOU")) returned 0x5b96f0 [0170.188] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0170.196] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 1 [0170.196] GetProcessHeap () returned 0x580000 [0170.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b8) returned 0x6f14048 [0170.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.197] CloseHandle (hObject=0x458) returned 1 [0170.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.198] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id_1622540890_.your_last_chance")) returned 1 [0170.198] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKSI~1.YOU")) returned 0x5b9730 [0170.199] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.199] GetProcessHeap () returned 0x580000 [0170.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0170.199] GetProcessHeap () returned 0x580000 [0170.199] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0170.199] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.199] ReadFile (in: hFile=0x458, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x5ecff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.210] GetProcessHeap () returned 0x580000 [0170.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.210] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.211] WriteFile (in: hFile=0x458, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x5ecff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.211] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.211] WriteFile (in: hFile=0x458, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0170.211] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.211] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0170.211] CloseHandle (hObject=0x458) returned 1 [0170.211] GetProcessHeap () returned 0x580000 [0170.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0170.211] GetProcessHeap () returned 0x580000 [0170.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0170.211] GetProcessHeap () returned 0x580000 [0170.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d100340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x5ecfd28, dwReserved1=0x65f268, cFileName="TASKS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKSI~1.YOU")) returned 0x5b96b0 [0170.211] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.212] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", len=0x42 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 1 [0170.212] GetProcessHeap () returned 0x580000 [0170.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b4) returned 0x6f14048 [0170.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.213] CloseHandle (hObject=0x458) returned 1 [0170.213] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.213] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id_1622540890_.your_last_chance")) returned 1 [0170.214] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.214] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~1.YOU")) returned 0x5b96b0 [0170.214] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.214] GetProcessHeap () returned 0x580000 [0170.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0170.214] GetProcessHeap () returned 0x580000 [0170.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0170.214] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.214] ReadFile (in: hFile=0x458, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x5ecff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.226] GetProcessHeap () returned 0x580000 [0170.226] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.226] WriteFile (in: hFile=0x458, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x5ecff14*=0xba0, lpOverlapped=0x0) returned 1 [0170.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.226] WriteFile (in: hFile=0x458, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0170.226] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.226] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0170.226] CloseHandle (hObject=0x458) returned 1 [0170.226] GetProcessHeap () returned 0x580000 [0170.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0170.226] GetProcessHeap () returned 0x580000 [0170.226] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0170.227] GetProcessHeap () returned 0x580000 [0170.227] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d1264a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x5ecfd28, dwReserved1=0x65f268, cFileName="TASKREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~1.YOU")) returned 0x5b9770 [0170.227] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0170.228] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", len=0x42 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 1 [0170.228] GetProcessHeap () returned 0x580000 [0170.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b0) returned 0x6f14048 [0170.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0170.228] CloseHandle (hObject=0x488) returned 1 [0170.228] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.228] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id_1622540890_.your_last_chance")) returned 1 [0170.229] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~2.YOU")) returned 0x5b9770 [0170.229] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0170.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0170.229] GetProcessHeap () returned 0x580000 [0170.229] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0170.229] GetProcessHeap () returned 0x580000 [0170.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0170.230] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.230] ReadFile (in: hFile=0x488, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x5ecff14*=0x420, lpOverlapped=0x0) returned 1 [0171.167] GetProcessHeap () returned 0x580000 [0171.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0171.167] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.167] WriteFile (in: hFile=0x488, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x5ecff14*=0x420, lpOverlapped=0x0) returned 1 [0171.168] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.168] WriteFile (in: hFile=0x488, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0171.168] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.168] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0171.168] CloseHandle (hObject=0x488) returned 1 [0172.236] GetProcessHeap () returned 0x580000 [0172.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0172.236] GetProcessHeap () returned 0x580000 [0172.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0172.236] GetProcessHeap () returned 0x580000 [0172.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9da39880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5ecfd28, dwReserved1=0x5cf780, cFileName="TASKREQL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~2.YOU")) returned 0x5b9770 [0173.182] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.192] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", len=0x41 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 1 [0173.192] GetProcessHeap () returned 0x580000 [0173.192] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0173.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.192] CloseHandle (hObject=0x490) returned 1 [0173.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.195] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~2.YOU")) returned 0x5b9770 [0173.195] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.195] GetProcessHeap () returned 0x580000 [0173.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.195] GetProcessHeap () returned 0x580000 [0173.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.195] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.195] ReadFile (in: hFile=0x490, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x5ecff14*=0x420, lpOverlapped=0x0) returned 1 [0173.200] GetProcessHeap () returned 0x580000 [0173.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.200] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x490, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x5ecff14*=0x420, lpOverlapped=0x0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x490, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0173.200] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.200] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0173.200] CloseHandle (hObject=0x490) returned 1 [0173.201] GetProcessHeap () returned 0x580000 [0173.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.201] GetProcessHeap () returned 0x580000 [0173.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.201] GetProcessHeap () returned 0x580000 [0173.201] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed90b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x5ecfd28, dwReserved1=0x5d0090, cFileName="RESENDL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~2.YOU")) returned 0x5b9770 [0174.337] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.346] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", len=0x3c | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned 1 [0174.346] GetProcessHeap () returned 0x580000 [0174.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0174.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.347] CloseHandle (hObject=0x484) returned 1 [0174.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.id_1622540890_.your_last_chance")) returned 1 [0174.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOSEC~1.YOU")) returned 0x5b9770 [0174.348] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.348] GetProcessHeap () returned 0x580000 [0174.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0174.348] GetProcessHeap () returned 0x580000 [0174.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0174.348] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.348] ReadFile (in: hFile=0x484, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x5ecff14*=0xa0, lpOverlapped=0x0) returned 1 [0174.350] GetProcessHeap () returned 0x580000 [0174.350] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.350] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x484, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x5ecff14*=0xa0, lpOverlapped=0x0) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x484, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0174.350] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.350] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0174.350] CloseHandle (hObject=0x484) returned 1 [0174.350] GetProcessHeap () returned 0x580000 [0174.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0174.350] GetProcessHeap () returned 0x580000 [0174.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0174.350] GetProcessHeap () returned 0x580000 [0174.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f893100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x5ecfd28, dwReserved1=0x60e8a8, cFileName="MSOSEC.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSOSEC~1.YOU")) returned 0x5b9770 [0174.351] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.362] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD", len=0x3c | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 1 [0174.362] GetProcessHeap () returned 0x580000 [0174.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.363] CloseHandle (hObject=0x4ac) returned 1 [0174.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id_1622540890_.your_last_chance")) returned 1 [0174.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.364] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDALLL~1.YOU")) returned 0x5b9770 [0174.364] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0174.364] GetProcessHeap () returned 0x580000 [0174.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef3020 [0174.364] GetProcessHeap () returned 0x580000 [0174.364] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7a1) returned 0x6ef37e8 [0174.364] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.364] ReadFile (in: hFile=0x4ac, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x5ecff14*=0x780, lpOverlapped=0x0) returned 1 [0174.373] GetProcessHeap () returned 0x580000 [0174.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0174.373] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.373] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x5ecff14*=0x780, lpOverlapped=0x0) returned 1 [0174.374] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.374] WriteFile (in: hFile=0x4ac, lpBuffer=0x6ef3f67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f67*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0174.374] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.374] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0174.374] CloseHandle (hObject=0x4ac) returned 1 [0174.374] GetProcessHeap () returned 0x580000 [0174.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0174.374] GetProcessHeap () returned 0x580000 [0174.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0174.374] GetProcessHeap () returned 0x580000 [0174.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0174.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f8b9260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7b8, dwReserved0=0x5ecfd28, dwReserved1=0x6ef3020, cFileName="WDALLLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDALLL~1.YOU")) returned 0x5b9770 [0174.374] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.377] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL", len=0x3a | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 1 [0174.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0174.378] CloseHandle (hObject=0x448) returned 1 [0174.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id_1622540890_.your_last_chance")) returned 1 [0174.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52086660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISWEB~1.YOU")) returned 0x5b9770 [0174.381] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0174.381] GetProcessHeap () returned 0x580000 [0174.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10ba1) returned 0x6e063d0 [0174.381] GetProcessHeap () returned 0x580000 [0174.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10ba1) returned 0x6fb2f38 [0174.382] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.382] ReadFile (in: hFile=0x448, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x10b80, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x5ecff14*=0x10b80, lpOverlapped=0x0) returned 1 [0177.754] GetProcessHeap () returned 0x580000 [0177.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.754] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.754] WriteFile (in: hFile=0x448, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x10b80, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x5ecff14*=0x10b80, lpOverlapped=0x0) returned 1 [0177.755] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.755] WriteFile (in: hFile=0x448, lpBuffer=0x6fc3ab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc3ab7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0177.755] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.755] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0177.755] CloseHandle (hObject=0x448) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0178.527] GetProcessHeap () returned 0x580000 [0178.527] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.052] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52086660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa1901cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10bac, dwReserved0=0x5ecfd28, dwReserved1=0x6e063d0, cFileName="VISWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISWEB~1.YOU")) returned 0x5b96b0 [0180.052] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.111] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", len=0x63 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned 1 [0180.112] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0180.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.165] CloseHandle (hObject=0x448) returned 1 [0180.168] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b49, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GLOBEB~2.YOU")) returned 0x5b96b0 [0180.182] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0180.182] GetProcessHeap () returned 0x580000 [0180.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x6d9b0d8 [0180.182] GetProcessHeap () returned 0x580000 [0180.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b61) returned 0x636988 [0180.182] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.182] ReadFile (in: hFile=0x3fc, lpBuffer=0x6d9b0d8, nNumberOfBytesToRead=0x1b40, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9b0d8*, lpNumberOfBytesRead=0x5ecff14*=0x1b40, lpOverlapped=0x0) returned 1 [0180.236] GetProcessHeap () returned 0x580000 [0180.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.236] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] WriteFile (in: hFile=0x3fc, lpBuffer=0x636988*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x636988*, lpNumberOfBytesWritten=0x5ecff14*=0x1b40, lpOverlapped=0x0) returned 1 [0180.236] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] WriteFile (in: hFile=0x3fc, lpBuffer=0x6384c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6384c7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0180.236] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.236] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0180.236] CloseHandle (hObject=0x3fc) returned 1 [0180.237] GetProcessHeap () returned 0x580000 [0180.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636988 | out: hHeap=0x580000) returned 1 [0180.237] GetProcessHeap () returned 0x580000 [0180.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9b0d8 | out: hHeap=0x580000) returned 1 [0180.237] GetProcessHeap () returned 0x580000 [0180.237] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa30a9760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b6d, dwReserved0=0x5ecfd28, dwReserved1=0x6d9b0d8, cFileName="GlobeButtonImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GLOBEB~2.YOU")) returned 0x5b9770 [0180.237] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.336] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", len=0x65 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned 1 [0180.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0180.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0180.337] CloseHandle (hObject=0x428) returned 1 [0180.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.337] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98fc100, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98fc100, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~2.YOU")) returned 0x5b96b0 [0180.338] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0180.338] GetProcessHeap () returned 0x580000 [0180.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2001) returned 0x6d9b0d8 [0180.338] GetProcessHeap () returned 0x580000 [0180.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2001) returned 0x6fab558 [0180.338] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.338] ReadFile (in: hFile=0x428, lpBuffer=0x6d9b0d8, nNumberOfBytesToRead=0x1fe0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9b0d8*, lpNumberOfBytesRead=0x5ecff14*=0x1fe0, lpOverlapped=0x0) returned 1 [0181.342] GetProcessHeap () returned 0x580000 [0181.342] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.342] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.342] WriteFile (in: hFile=0x428, lpBuffer=0x6fab558*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6fab558*, lpNumberOfBytesWritten=0x5ecff14*=0x1fe0, lpOverlapped=0x0) returned 1 [0181.342] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.342] WriteFile (in: hFile=0x428, lpBuffer=0x6fad537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6fad537*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0181.342] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.342] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0181.342] CloseHandle (hObject=0x428) returned 1 [0181.342] GetProcessHeap () returned 0x580000 [0181.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fab558 | out: hHeap=0x580000) returned 1 [0181.342] GetProcessHeap () returned 0x580000 [0181.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9b0d8 | out: hHeap=0x580000) returned 1 [0181.343] GetProcessHeap () returned 0x580000 [0181.343] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98fc100, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3b39900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2022, dwReserved0=0x5ecfd28, dwReserved1=0x6d9b0d8, cFileName="UnreadIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~2.YOU")) returned 0x5b9770 [0183.133] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.482] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", len=0x68 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned 1 [0184.482] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0184.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.427] CloseHandle (hObject=0x49c) returned 1 [0185.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.id_1622540890_.your_last_chance")) returned 1 [0185.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b9770 [0185.428] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.428] GetProcessHeap () returned 0x580000 [0185.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0185.428] GetProcessHeap () returned 0x580000 [0185.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0185.428] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.428] ReadFile (in: hFile=0x49c, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x5ecff14*=0x400, lpOverlapped=0x0) returned 1 [0185.433] GetProcessHeap () returned 0x580000 [0185.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.433] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.433] WriteFile (in: hFile=0x49c, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x5ecff14*=0x400, lpOverlapped=0x0) returned 1 [0185.433] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.433] WriteFile (in: hFile=0x49c, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0185.433] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.434] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0185.434] CloseHandle (hObject=0x49c) returned 1 [0185.434] GetProcessHeap () returned 0x580000 [0185.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0185.434] GetProcessHeap () returned 0x580000 [0185.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0185.434] GetProcessHeap () returned 0x580000 [0185.434] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6234140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x5ecfd28, dwReserved1=0x6c6a110, cFileName="FormsHomePageStyle.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b9770 [0185.536] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.585] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", len=0x44 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned 1 [0185.585] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b4) returned 0x6f14048 [0185.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.586] CloseHandle (hObject=0x49c) returned 1 [0185.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.id_1622540890_.your_last_chance")) returned 1 [0185.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR8~2.YOU")) returned 0x5b9770 [0185.587] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0185.587] GetProcessHeap () returned 0x580000 [0185.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x6dd7c30 [0185.587] GetProcessHeap () returned 0x580000 [0185.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1041) returned 0x67ec60 [0185.587] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.587] ReadFile (in: hFile=0x49c, lpBuffer=0x6dd7c30, nNumberOfBytesToRead=0x1020, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd7c30*, lpNumberOfBytesRead=0x5ecff14*=0x1020, lpOverlapped=0x0) returned 1 [0185.604] GetProcessHeap () returned 0x580000 [0185.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0185.604] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.604] WriteFile (in: hFile=0x49c, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x5ecff14*=0x1020, lpOverlapped=0x0) returned 1 [0185.604] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.604] WriteFile (in: hFile=0x49c, lpBuffer=0x67fc7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc7f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0185.605] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.605] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0185.605] CloseHandle (hObject=0x49c) returned 1 [0185.605] GetProcessHeap () returned 0x580000 [0185.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0185.605] GetProcessHeap () returned 0x580000 [0185.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd7c30 | out: hHeap=0x580000) returned 1 [0185.605] GetProcessHeap () returned 0x580000 [0185.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0185.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa63d7060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x105c, dwReserved0=0x5ecfd28, dwReserved1=0x6dd7c30, cFileName="ZPDIR8B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR8~2.YOU")) returned 0x5b9770 [0185.647] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.722] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", len=0x44 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned 1 [0185.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a8) returned 0x6f14048 [0185.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0185.723] CloseHandle (hObject=0x428) returned 1 [0185.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.id_1622540890_.your_last_chance")) returned 1 [0185.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR6~1.YOU")) returned 0x5b9770 [0185.724] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0185.724] GetProcessHeap () returned 0x580000 [0185.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4201) returned 0x6d6db88 [0185.724] GetProcessHeap () returned 0x580000 [0185.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4201) returned 0x6d71d98 [0185.724] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.724] ReadFile (in: hFile=0x428, lpBuffer=0x6d6db88, nNumberOfBytesToRead=0x41e0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d6db88*, lpNumberOfBytesRead=0x5ecff14*=0x41e0, lpOverlapped=0x0) returned 1 [0187.825] GetProcessHeap () returned 0x580000 [0187.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0de20 [0187.825] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x428, lpBuffer=0x6d71d98*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d71d98*, lpNumberOfBytesWritten=0x5ecff14*=0x41e0, lpOverlapped=0x0) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x428, lpBuffer=0x6d75f77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75f77*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0187.825] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0187.825] CloseHandle (hObject=0x428) returned 1 [0187.825] GetProcessHeap () returned 0x580000 [0187.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d71d98 | out: hHeap=0x580000) returned 1 [0187.826] GetProcessHeap () returned 0x580000 [0187.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d6db88 | out: hHeap=0x580000) returned 1 [0187.826] GetProcessHeap () returned 0x580000 [0187.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0de20 | out: hHeap=0x580000) returned 1 [0188.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa791d500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4209, dwReserved0=0x5ecfd28, dwReserved1=0x6d6db88, cFileName="ZPDIR6F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR6~1.YOU")) returned 0x5b9770 [0190.278] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.106] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", len=0x45 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned 1 [0191.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0191.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0191.107] CloseHandle (hObject=0x4a0) returned 1 [0191.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x112a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAC11~1.YOU")) returned 0x5b9770 [0191.108] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0191.108] GetProcessHeap () returned 0x580000 [0191.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x112c1) returned 0x70904c8 [0191.108] GetProcessHeap () returned 0x580000 [0191.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x112c1) returned 0x70a1798 [0191.108] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.108] ReadFile (in: hFile=0x4a0, lpBuffer=0x70904c8, nNumberOfBytesToRead=0x112a0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesRead=0x5ecff14*=0x112a0, lpOverlapped=0x0) returned 1 [0196.018] GetProcessHeap () returned 0x580000 [0196.018] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.018] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.018] WriteFile (in: hFile=0x4a0, lpBuffer=0x70a1798*, nNumberOfBytesToWrite=0x112a0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1798*, lpNumberOfBytesWritten=0x5ecff14*=0x112a0, lpOverlapped=0x0) returned 1 [0196.019] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.019] WriteFile (in: hFile=0x4a0, lpBuffer=0x70b2a37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x70b2a37*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0196.019] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.019] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0196.019] CloseHandle (hObject=0x4a0) returned 1 [0196.019] GetProcessHeap () returned 0x580000 [0196.019] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1798 | out: hHeap=0x580000) returned 1 [0196.024] GetProcessHeap () returned 0x580000 [0196.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0196.025] GetProcessHeap () returned 0x580000 [0196.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac7386e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x112c7, dwReserved0=0x580000, dwReserved1=0x658968, cFileName="ZPDIR40F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPAC11~1.YOU")) returned 0x5b97f0 [0198.614] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.947] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", len=0x44 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned 1 [0198.947] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0198.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.948] CloseHandle (hObject=0x488) returned 1 [0198.948] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.948] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.id_1622540890_.your_last_chance")) returned 1 [0198.949] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2019, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR45~2.YOU")) returned 0x5b97f0 [0198.949] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.949] GetProcessHeap () returned 0x580000 [0198.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x6dc71d0 [0198.949] GetProcessHeap () returned 0x580000 [0198.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2021) returned 0x70c0730 [0198.949] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.949] ReadFile (in: hFile=0x488, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x5ecff14*=0x2000, lpOverlapped=0x0) returned 1 [0198.982] GetProcessHeap () returned 0x580000 [0198.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0198.982] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.982] WriteFile (in: hFile=0x488, lpBuffer=0x70c0730*, nNumberOfBytesToWrite=0x2000, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x70c0730*, lpNumberOfBytesWritten=0x5ecff14*=0x2000, lpOverlapped=0x0) returned 1 [0198.982] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.982] WriteFile (in: hFile=0x488, lpBuffer=0x70c272f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x70c272f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0198.982] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.982] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0198.983] CloseHandle (hObject=0x488) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c0730 | out: hHeap=0x580000) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0199.024] GetProcessHeap () returned 0x580000 [0199.024] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0199.024] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae37cc20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x203d, dwReserved0=0x5ecfd28, dwReserved1=0x6dc71d0, cFileName="PDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR45~2.YOU")) returned 0x5b97f0 [0199.123] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0201.394] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", len=0x72 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned 1 [0201.394] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0201.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.958] CloseHandle (hObject=0x4ac) returned 1 [0201.958] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.958] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0201.959] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x75006f, dwReserved1=0x64006e, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0201.959] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.959] GetProcessHeap () returned 0x580000 [0201.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09b98 [0201.959] GetProcessHeap () returned 0x580000 [0201.959] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09a80 [0201.959] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.959] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f09b98, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b98*, lpNumberOfBytesRead=0x5ecff14*=0xe0, lpOverlapped=0x0) returned 1 [0201.961] GetProcessHeap () returned 0x580000 [0201.961] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0201.961] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.961] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f09a80*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09a80*, lpNumberOfBytesWritten=0x5ecff14*=0xe0, lpOverlapped=0x0) returned 1 [0201.961] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.961] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f09b5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b5f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0201.962] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.962] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0201.962] CloseHandle (hObject=0x4ac) returned 1 [0201.962] GetProcessHeap () returned 0x580000 [0201.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0201.962] GetProcessHeap () returned 0x580000 [0201.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.962] GetProcessHeap () returned 0x580000 [0201.962] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0203.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaffe72c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x5ecfd28, dwReserved1=0x6f09b98, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0203.122] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.162] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", len=0x65 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned 1 [0203.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0203.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.151] CloseHandle (hObject=0x428) returned 1 [0209.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.id_1622540890_.your_last_chance")) returned 1 [0209.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b9830 [0209.152] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0209.152] GetProcessHeap () returned 0x580000 [0209.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x704d200 [0209.535] GetProcessHeap () returned 0x580000 [0209.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x704e008 [0209.535] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.535] ReadFile (in: hFile=0x428, lpBuffer=0x704d200, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x704d200*, lpNumberOfBytesRead=0x5ecff14*=0xd80, lpOverlapped=0x0) returned 1 [0209.564] GetProcessHeap () returned 0x580000 [0209.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.564] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.564] WriteFile (in: hFile=0x428, lpBuffer=0x704e008*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x704e008*, lpNumberOfBytesWritten=0x5ecff14*=0xd80, lpOverlapped=0x0) returned 1 [0209.564] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.564] WriteFile (in: hFile=0x428, lpBuffer=0x704ed87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x704ed87*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0209.564] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.564] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0209.564] CloseHandle (hObject=0x428) returned 1 [0209.564] GetProcessHeap () returned 0x580000 [0209.564] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704e008 | out: hHeap=0x580000) returned 1 [0209.565] GetProcessHeap () returned 0x580000 [0209.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704d200 | out: hHeap=0x580000) returned 1 [0209.565] GetProcessHeap () returned 0x580000 [0209.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0210.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb485b060, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdc0, dwReserved0=0x5ecfd28, dwReserved1=0x704d200, cFileName="FormsHomePage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~3.YOU")) returned 0x5b97b0 [0210.091] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.140] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS", len=0x45 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS") returned 1 [0210.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0210.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0210.141] CloseHandle (hObject=0x458) returned 1 [0210.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css.id_1622540890_.your_last_chance")) returned 1 [0210.142] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.142] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1883d700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f6f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC2DEB~1.YOU")) returned 0x5b97b0 [0210.142] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0210.142] GetProcessHeap () returned 0x580000 [0210.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0210.143] GetProcessHeap () returned 0x580000 [0210.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72c5008 [0210.143] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.143] ReadFile (in: hFile=0x458, lpBuffer=0x6d21878, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.922] GetProcessHeap () returned 0x580000 [0213.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0213.922] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.923] WriteFile (in: hFile=0x458, lpBuffer=0x72c5008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x72c5008*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.923] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.923] WriteFile (in: hFile=0x458, lpBuffer=0x72d6807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6807*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0213.923] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.923] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0213.923] CloseHandle (hObject=0x458) returned 1 [0213.924] GetProcessHeap () returned 0x580000 [0213.924] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72c5008 | out: hHeap=0x580000) returned 1 [0214.249] GetProcessHeap () returned 0x580000 [0214.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0214.249] GetProcessHeap () returned 0x580000 [0214.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7203160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f714, dwReserved0=0x5ecfd28, dwReserved1=0x6d21878, cFileName="SCHEME20.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC2DEB~1.YOU")) returned 0x5b97b0 [0214.928] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.969] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 1 [0214.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0214.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0214.970] CloseHandle (hObject=0x458) returned 1 [0214.970] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0214.971] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~4.YOU")) returned 0x5b97b0 [0214.971] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0214.971] GetProcessHeap () returned 0x580000 [0214.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0214.971] GetProcessHeap () returned 0x580000 [0214.971] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0214.971] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.971] ReadFile (in: hFile=0x458, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x5ecff14*=0x260, lpOverlapped=0x0) returned 1 [0215.011] GetProcessHeap () returned 0x580000 [0215.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0215.011] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.011] WriteFile (in: hFile=0x458, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x5ecff14*=0x260, lpOverlapped=0x0) returned 1 [0215.011] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.011] WriteFile (in: hFile=0x458, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0215.011] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.011] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0215.011] CloseHandle (hObject=0x458) returned 1 [0215.011] GetProcessHeap () returned 0x580000 [0215.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0215.012] GetProcessHeap () returned 0x580000 [0215.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0215.012] GetProcessHeap () returned 0x580000 [0215.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0215.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c47040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x5ecfd28, dwReserved1=0x6c61120, cFileName="ONENOTE_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONENOT~4.YOU")) returned 0x5b97b0 [0215.012] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.040] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT", len=0x3b | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 1 [0215.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0215.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.042] CloseHandle (hObject=0x458) returned 1 [0215.042] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0215.043] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_CO~1.YOU")) returned 0x5b97b0 [0215.043] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.043] GetProcessHeap () returned 0x580000 [0215.043] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0215.044] GetProcessHeap () returned 0x580000 [0215.044] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0215.044] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.044] ReadFile (in: hFile=0x458, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x5ecff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.045] GetProcessHeap () returned 0x580000 [0215.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0215.045] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.045] WriteFile (in: hFile=0x458, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x5ecff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.045] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.045] WriteFile (in: hFile=0x458, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0215.045] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.046] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0215.046] CloseHandle (hObject=0x458) returned 1 [0215.046] GetProcessHeap () returned 0x580000 [0215.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0215.046] GetProcessHeap () returned 0x580000 [0215.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0215.046] GetProcessHeap () returned 0x580000 [0215.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0215.046] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7c93300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xef, dwReserved0=0x5ecfd28, dwReserved1=0x5ae2f0, cFileName="OIS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_CO~1.YOU")) returned 0x5b97b0 [0215.046] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.087] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD", len=0x3c | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 1 [0215.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0215.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.088] CloseHandle (hObject=0x3b8) returned 1 [0215.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id_1622540890_.your_last_chance")) returned 1 [0215.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~2.YOU")) returned 0x5b97b0 [0215.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.090] GetProcessHeap () returned 0x580000 [0215.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6c79898 [0215.090] GetProcessHeap () returned 0x580000 [0215.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x881) returned 0x6d00cd8 [0215.090] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.090] ReadFile (in: hFile=0x3b8, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x860, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5ecff14*=0x860, lpOverlapped=0x0) returned 1 [0215.163] GetProcessHeap () returned 0x580000 [0215.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.163] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.163] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x5ecff14*=0x860, lpOverlapped=0x0) returned 1 [0215.163] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.163] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d01537*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01537*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0215.163] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.163] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0215.164] CloseHandle (hObject=0x3b8) returned 1 [0215.164] GetProcessHeap () returned 0x580000 [0215.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0215.164] GetProcessHeap () returned 0x580000 [0215.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0215.164] GetProcessHeap () returned 0x580000 [0215.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb7dc3e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x88a, dwReserved0=0x5ecfd28, dwReserved1=0x6c79898, cFileName="NETWORK2.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~2.YOU")) returned 0x5b97b0 [0215.164] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.211] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", len=0x67 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned 1 [0217.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0217.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.237] CloseHandle (hObject=0x48c) returned 1 [0217.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.id_1622540890_.your_last_chance")) returned 1 [0217.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b9770 [0217.247] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.247] GetProcessHeap () returned 0x580000 [0217.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6c9a390 [0217.247] GetProcessHeap () returned 0x580000 [0217.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6c9b498 [0217.248] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.248] ReadFile (in: hFile=0x48c, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x5ecff14*=0x1060, lpOverlapped=0x0) returned 1 [0217.306] GetProcessHeap () returned 0x580000 [0217.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.306] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.306] WriteFile (in: hFile=0x48c, lpBuffer=0x6c9b498*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b498*, lpNumberOfBytesWritten=0x5ecff14*=0x1060, lpOverlapped=0x0) returned 1 [0217.306] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.306] WriteFile (in: hFile=0x48c, lpBuffer=0x6c9c4f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9c4f7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0217.306] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.306] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0217.307] CloseHandle (hObject=0x48c) returned 1 [0217.307] GetProcessHeap () returned 0x580000 [0217.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b498 | out: hHeap=0x580000) returned 1 [0217.307] GetProcessHeap () returned 0x580000 [0217.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0217.307] GetProcessHeap () returned 0x580000 [0217.307] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.307] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9225a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x5ecfd28, dwReserved1=0x6c9a390, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b9770 [0217.307] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.393] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned 1 [0217.393] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0217.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.394] CloseHandle (hObject=0x440) returned 1 [0217.394] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.394] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.id_1622540890_.your_last_chance")) returned 1 [0217.442] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.443] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x2e006c, dwReserved1=0x640069, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0217.443] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.443] GetProcessHeap () returned 0x580000 [0217.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0217.443] GetProcessHeap () returned 0x580000 [0217.443] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0217.443] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.443] ReadFile (in: hFile=0x440, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x5ecff14*=0x820, lpOverlapped=0x0) returned 1 [0217.460] GetProcessHeap () returned 0x580000 [0217.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.460] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.460] WriteFile (in: hFile=0x440, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x5ecff14*=0x820, lpOverlapped=0x0) returned 1 [0217.460] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.461] WriteFile (in: hFile=0x440, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0217.461] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.461] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0217.461] CloseHandle (hObject=0x440) returned 1 [0217.461] GetProcessHeap () returned 0x580000 [0217.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0217.461] GetProcessHeap () returned 0x580000 [0217.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0217.461] GetProcessHeap () returned 0x580000 [0217.461] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.461] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb93a2820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x84d, dwReserved0=0x5ecfd28, dwReserved1=0x6c79898, cFileName="FormsBrowserUpgrade.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~1.YOU")) returned 0x5b9770 [0217.461] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.516] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", len=0x5f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned 1 [0217.516] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0217.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.516] CloseHandle (hObject=0x454) returned 1 [0217.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.id_1622540890_.your_last_chance")) returned 1 [0217.520] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b9770 [0217.520] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.520] GetProcessHeap () returned 0x580000 [0217.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6599e8 [0217.520] GetProcessHeap () returned 0x580000 [0217.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x659db0 [0217.520] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.520] ReadFile (in: hFile=0x454, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x5ecff14*=0x380, lpOverlapped=0x0) returned 1 [0218.606] GetProcessHeap () returned 0x580000 [0218.607] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.607] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.607] WriteFile (in: hFile=0x454, lpBuffer=0x659db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x659db0*, lpNumberOfBytesWritten=0x5ecff14*=0x380, lpOverlapped=0x0) returned 1 [0218.607] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.607] WriteFile (in: hFile=0x454, lpBuffer=0x65a12f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x65a12f*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0218.607] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.607] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0218.607] CloseHandle (hObject=0x454) returned 1 [0218.607] GetProcessHeap () returned 0x580000 [0218.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659db0 | out: hHeap=0x580000) returned 1 [0218.607] GetProcessHeap () returned 0x580000 [0218.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0218.607] GetProcessHeap () returned 0x580000 [0218.607] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ea4de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a7, dwReserved0=0x5ecfd28, dwReserved1=0x6599e8, cFileName="CALENDAR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b97b0 [0221.391] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0221.443] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", len=0x43 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 1 [0221.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f58) returned 0x6dee6e0 [0221.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.463] CloseHandle (hObject=0x414) returned 1 [0221.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id_1622540890_.your_last_chance")) returned 1 [0221.464] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSICO~1.YOU")) returned 0x5b9730 [0221.474] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0221.474] GetProcessHeap () returned 0x580000 [0221.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2381) returned 0x7160f68 [0221.474] GetProcessHeap () returned 0x580000 [0221.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2381) returned 0x6d630a8 [0221.475] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.475] ReadFile (in: hFile=0x414, lpBuffer=0x7160f68, nNumberOfBytesToRead=0x2360, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x7160f68*, lpNumberOfBytesRead=0x5ecff14*=0x2360, lpOverlapped=0x0) returned 1 [0222.178] GetProcessHeap () returned 0x580000 [0222.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0222.178] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.178] WriteFile (in: hFile=0x414, lpBuffer=0x6d630a8*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesWritten=0x5ecff14*=0x2360, lpOverlapped=0x0) returned 1 [0222.178] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.178] WriteFile (in: hFile=0x414, lpBuffer=0x6d65407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d65407*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0222.178] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.178] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0222.178] CloseHandle (hObject=0x414) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7160f68 | out: hHeap=0x580000) returned 1 [0222.442] GetProcessHeap () returned 0x580000 [0222.442] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0225.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0b68c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x238a, dwReserved0=0x5ecfd28, dwReserved1=0x7160f68, cFileName="WSS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSICO~1.YOU")) returned 0x5b9630 [0225.413] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.435] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", len=0x34 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 1 [0225.435] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0225.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0225.436] CloseHandle (hObject=0x460) returned 1 [0225.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.id_1622540890_.your_last_chance")) returned 1 [0225.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXACSP~1.YOU")) returned 0x5b9630 [0225.438] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0225.438] GetProcessHeap () returned 0x580000 [0225.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71acea8 [0225.438] GetProcessHeap () returned 0x580000 [0225.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e0fcf0 [0225.439] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.439] ReadFile (in: hFile=0x460, lpBuffer=0x71acea8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x71acea8*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.930] GetProcessHeap () returned 0x580000 [0233.930] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0233.930] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.930] WriteFile (in: hFile=0x460, lpBuffer=0x6e0fcf0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fcf0*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0233.931] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0233.931] WriteFile (in: hFile=0x460, lpBuffer=0x6e214ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6e214ef*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0235.510] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.511] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0235.511] CloseHandle (hObject=0x460) returned 1 [0235.511] GetProcessHeap () returned 0x580000 [0235.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0fcf0 | out: hHeap=0x580000) returned 1 [0235.511] GetProcessHeap () returned 0x580000 [0235.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71acea8 | out: hHeap=0x580000) returned 1 [0235.512] GetProcessHeap () returned 0x580000 [0235.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0239.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3e47140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x551c4, dwReserved0=0x5ecfd28, dwReserved1=0x71acea8, cFileName="IXACS.PDL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IXACSP~1.YOU")) returned 0x5b9730 [0240.538] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.936] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML", len=0x40 | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned 1 [0241.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0241.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0245.388] CloseHandle (hObject=0x3a8) returned 1 [0245.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml.id_1622540890_.your_last_chance")) returned 1 [0248.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0x15090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG266B~1.YOU")) returned 0x5b96f0 [0248.602] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0248.603] GetProcessHeap () returned 0x580000 [0248.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72f8478 [0248.603] GetProcessHeap () returned 0x580000 [0248.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0248.604] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.604] ReadFile (in: hFile=0x3a8, lpBuffer=0x72f8478, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x72f8478*, lpNumberOfBytesRead=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.481] GetProcessHeap () returned 0x580000 [0252.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0252.481] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.481] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x5ecff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.482] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.482] WriteFile (in: hFile=0x3a8, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0252.482] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.482] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0252.482] CloseHandle (hObject=0x3a8) returned 1 [0252.482] GetProcessHeap () returned 0x580000 [0252.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0252.482] GetProcessHeap () returned 0x580000 [0252.482] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72f8478 | out: hHeap=0x580000) returned 1 [0252.482] GetProcessHeap () returned 0x580000 [0252.483] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0254.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce024940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x150b4, dwReserved0=0x5ecfd28, dwReserved1=0x72f8478, cFileName="PGLBL105.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG266B~1.YOU")) returned 0x5b9730 [0254.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.360] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML", len=0x3f | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML") returned 1 [0255.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f78) returned 0x72e5948 [0255.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0260.505] CloseHandle (hObject=0x43c) returned 1 [0260.505] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml.id_1622540890_.your_last_chance")) returned 1 [0260.506] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.506] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109f3b00, ftCreationTime.dwHighDateTime=0x1c976ec, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x109f3b00, ftLastWriteTime.dwHighDateTime=0x1c976ec, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSIDE~3.YOU")) returned 0x5b9630 [0260.506] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0260.506] GetProcessHeap () returned 0x580000 [0260.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6f668d8 [0260.506] GetProcessHeap () returned 0x580000 [0260.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe01) returned 0x6c29878 [0260.507] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.507] ReadFile (in: hFile=0x43c, lpBuffer=0x6f668d8, nNumberOfBytesToRead=0xde0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesRead=0x5ecff14*=0xde0, lpOverlapped=0x0) returned 1 [0260.519] GetProcessHeap () returned 0x580000 [0260.519] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.519] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.519] WriteFile (in: hFile=0x43c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x5ecff14*=0xde0, lpOverlapped=0x0) returned 1 [0260.519] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.519] WriteFile (in: hFile=0x43c, lpBuffer=0x6c2a657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a657*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0260.520] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.520] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0260.520] CloseHandle (hObject=0x43c) returned 1 [0260.520] GetProcessHeap () returned 0x580000 [0260.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0260.520] GetProcessHeap () returned 0x580000 [0260.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0260.520] GetProcessHeap () returned 0x580000 [0260.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.520] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc | out: lpFindFileData=0x5ecfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109f3b00, ftCreationTime.dwHighDateTime=0x1c976ec, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2cc2d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x5ecfd28, dwReserved1=0x6f668d8, cFileName="DGSIDEBRV.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGSIDE~3.YOU")) returned 0x5b9630 [0260.520] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.521] SysReAllocStringLen (in: pbstr=0x5ecff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC", len=0x3b | out: pbstr=0x5ecff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC") returned 1 [0260.521] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2058) returned 0x72e5948 [0260.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0260.521] CloseHandle (hObject=0x474) returned 1 [0260.521] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.522] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc.id_1622540890_.your_last_chance")) returned 1 [0260.522] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x5ecef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.522] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfc74 | out: lpFindFileData=0x5ecfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf23e000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf23e000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x5df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RES98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RES98P~1.YOU")) returned 0x5b9630 [0260.523] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0260.523] GetProcessHeap () returned 0x580000 [0260.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e01) returned 0x673cd0 [0260.523] GetProcessHeap () returned 0x580000 [0260.523] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5e01) returned 0x74b9dd8 [0260.523] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.523] ReadFile (in: hFile=0x474, lpBuffer=0x673cd0, nNumberOfBytesToRead=0x5de0, lpNumberOfBytesRead=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x5ecff14*=0x5de0, lpOverlapped=0x0) returned 1 [0263.945] GetProcessHeap () returned 0x580000 [0263.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0263.945] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.945] WriteFile (in: hFile=0x474, lpBuffer=0x74b9dd8*, nNumberOfBytesToWrite=0x5de0, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x74b9dd8*, lpNumberOfBytesWritten=0x5ecff14*=0x5de0, lpOverlapped=0x0) returned 1 [0263.945] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.945] WriteFile (in: hFile=0x474, lpBuffer=0x74bfbb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x74bfbb7*, lpNumberOfBytesWritten=0x5ecff14*=0x20, lpOverlapped=0x0) returned 1 [0263.947] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.947] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x5ecff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x5ecff14*=0x4, lpOverlapped=0x0) returned 1 [0263.947] CloseHandle (hObject=0x474) returned 1 [0263.947] GetProcessHeap () returned 0x580000 [0263.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74b9dd8 | out: hHeap=0x580000) returned 1 [0263.947] GetProcessHeap () returned 0x580000 [0263.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0263.947] GetProcessHeap () returned 0x580000 [0263.947] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0263.948] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x5ecfccc) Thread: id = 53 os_tid = 0xacc [0039.069] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.721] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.751] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.056] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.534] Sleep (dwMilliseconds=0x1) [0040.549] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.659] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.856] Sleep (dwMilliseconds=0x1) [0042.911] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.400] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.478] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.525] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.749] Sleep (dwMilliseconds=0x1) [0043.765] Sleep (dwMilliseconds=0x1) [0043.781] Sleep (dwMilliseconds=0x1) [0043.798] Sleep (dwMilliseconds=0x1) [0043.811] Sleep (dwMilliseconds=0x1) [0043.827] Sleep (dwMilliseconds=0x1) [0043.843] Sleep (dwMilliseconds=0x1) [0043.858] Sleep (dwMilliseconds=0x1) [0043.874] Sleep (dwMilliseconds=0x1) [0043.889] Sleep (dwMilliseconds=0x1) [0043.908] Sleep (dwMilliseconds=0x1) [0043.921] Sleep (dwMilliseconds=0x1) [0043.936] Sleep (dwMilliseconds=0x1) [0043.952] Sleep (dwMilliseconds=0x1) [0043.967] Sleep (dwMilliseconds=0x1) [0043.984] Sleep (dwMilliseconds=0x1) [0044.002] Sleep (dwMilliseconds=0x1) [0044.021] Sleep (dwMilliseconds=0x1) [0044.031] Sleep (dwMilliseconds=0x1) [0044.045] Sleep (dwMilliseconds=0x1) [0044.064] Sleep (dwMilliseconds=0x1) [0044.368] Sleep (dwMilliseconds=0x1) [0044.394] Sleep (dwMilliseconds=0x1) [0044.404] Sleep (dwMilliseconds=0x1) [0044.419] Sleep (dwMilliseconds=0x1) [0044.435] Sleep (dwMilliseconds=0x1) [0044.450] Sleep (dwMilliseconds=0x1) [0044.466] Sleep (dwMilliseconds=0x1) [0044.482] Sleep (dwMilliseconds=0x1) [0044.497] Sleep (dwMilliseconds=0x1) [0044.513] Sleep (dwMilliseconds=0x1) [0044.529] Sleep (dwMilliseconds=0x1) [0044.544] Sleep (dwMilliseconds=0x1) [0044.559] Sleep (dwMilliseconds=0x1) [0044.575] Sleep (dwMilliseconds=0x1) [0044.591] Sleep (dwMilliseconds=0x1) [0044.606] Sleep (dwMilliseconds=0x1) [0044.622] Sleep (dwMilliseconds=0x1) [0044.638] Sleep (dwMilliseconds=0x1) [0044.653] Sleep (dwMilliseconds=0x1) [0044.669] Sleep (dwMilliseconds=0x1) [0044.685] Sleep (dwMilliseconds=0x1) [0044.700] Sleep (dwMilliseconds=0x1) [0044.716] Sleep (dwMilliseconds=0x1) [0044.732] Sleep (dwMilliseconds=0x1) [0044.747] Sleep (dwMilliseconds=0x1) [0044.762] Sleep (dwMilliseconds=0x1) [0044.778] Sleep (dwMilliseconds=0x1) [0044.793] Sleep (dwMilliseconds=0x1) [0044.809] Sleep (dwMilliseconds=0x1) [0044.824] Sleep (dwMilliseconds=0x1) [0044.841] Sleep (dwMilliseconds=0x1) [0044.856] Sleep (dwMilliseconds=0x1) [0044.871] Sleep (dwMilliseconds=0x1) [0044.887] Sleep (dwMilliseconds=0x1) [0044.902] Sleep (dwMilliseconds=0x1) [0044.918] Sleep (dwMilliseconds=0x1) [0044.934] Sleep (dwMilliseconds=0x1) [0044.950] Sleep (dwMilliseconds=0x1) [0044.965] Sleep (dwMilliseconds=0x1) [0044.981] Sleep (dwMilliseconds=0x1) [0044.997] Sleep (dwMilliseconds=0x1) [0045.012] Sleep (dwMilliseconds=0x1) [0045.027] Sleep (dwMilliseconds=0x1) [0045.043] Sleep (dwMilliseconds=0x1) [0045.059] Sleep (dwMilliseconds=0x1) [0045.074] Sleep (dwMilliseconds=0x1) [0045.090] Sleep (dwMilliseconds=0x1) [0045.106] Sleep (dwMilliseconds=0x1) [0045.121] Sleep (dwMilliseconds=0x1) [0045.137] Sleep (dwMilliseconds=0x1) [0045.152] Sleep (dwMilliseconds=0x1) [0045.168] Sleep (dwMilliseconds=0x1) [0045.183] Sleep (dwMilliseconds=0x1) [0045.206] Sleep (dwMilliseconds=0x1) [0045.215] Sleep (dwMilliseconds=0x1) [0045.230] Sleep (dwMilliseconds=0x1) [0045.246] Sleep (dwMilliseconds=0x1) [0045.262] Sleep (dwMilliseconds=0x1) [0045.277] Sleep (dwMilliseconds=0x1) [0045.293] Sleep (dwMilliseconds=0x1) [0045.309] Sleep (dwMilliseconds=0x1) [0045.324] Sleep (dwMilliseconds=0x1) [0045.339] Sleep (dwMilliseconds=0x1) [0045.355] Sleep (dwMilliseconds=0x1) [0045.371] Sleep (dwMilliseconds=0x1) [0045.386] Sleep (dwMilliseconds=0x1) [0045.402] Sleep (dwMilliseconds=0x1) [0045.418] Sleep (dwMilliseconds=0x1) [0045.433] Sleep (dwMilliseconds=0x1) [0045.449] Sleep (dwMilliseconds=0x1) [0045.464] Sleep (dwMilliseconds=0x1) [0045.480] Sleep (dwMilliseconds=0x1) [0045.497] Sleep (dwMilliseconds=0x1) [0045.511] Sleep (dwMilliseconds=0x1) [0045.527] Sleep (dwMilliseconds=0x1) [0045.542] Sleep (dwMilliseconds=0x1) [0045.558] Sleep (dwMilliseconds=0x1) [0045.574] Sleep (dwMilliseconds=0x1) [0045.589] Sleep (dwMilliseconds=0x1) [0045.655] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.802] Sleep (dwMilliseconds=0x1) [0045.819] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.882] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.958] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.036] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.114] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.145] Sleep (dwMilliseconds=0x1) [0046.161] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.317] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.348] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.411] Sleep (dwMilliseconds=0x1) [0046.426] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.457] Sleep (dwMilliseconds=0x1) [0046.475] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.504] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.551] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.583] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.660] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.738] Sleep (dwMilliseconds=0x1) [0046.754] Sleep (dwMilliseconds=0x1) [0046.769] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.816] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.863] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.894] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.941] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.003] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.081] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.159] Sleep (dwMilliseconds=0x1) [0047.175] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.253] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.284] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.315] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.471] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.535] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.565] Sleep (dwMilliseconds=0x1) [0047.581] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.663] Sleep (dwMilliseconds=0x1) [0047.680] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.705] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.802] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.894] Sleep (dwMilliseconds=0x1) [0047.908] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.017] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.173] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.220] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.298] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.407] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.485] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.532] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.563] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.610] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.641] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.688] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.721] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.797] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.844] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.953] Sleep (dwMilliseconds=0x1) [0048.969] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.111] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.312] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.421] Sleep (dwMilliseconds=0x1) [0049.439] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.468] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.577] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.624] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.733] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.780] Sleep (dwMilliseconds=0x1) [0049.796] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.936] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.014] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.092] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.201] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.248] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.357] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.404] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.452] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.513] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.716] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.825] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.966] Sleep (dwMilliseconds=0x1) [0050.981] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.028] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.190] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.215] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.293] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.326] Sleep (dwMilliseconds=0x1) [0051.340] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.371] Sleep (dwMilliseconds=0x1) [0051.387] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.496] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.527] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.590] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.810] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.919] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.247] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.418] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.730] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.323] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.401] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.542] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.947] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.025] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.181] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.259] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.306] Sleep (dwMilliseconds=0x1) [0054.323] Sleep (dwMilliseconds=0x1) [0054.338] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.493] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.086] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.117] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.273] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.398] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0058.487] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", len=0x51 | out: pbstr=0x600ff84*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 1 [0058.487] GetProcessHeap () returned 0x580000 [0058.487] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94f8 | out: hHeap=0x580000) returned 1 [0058.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0058.488] CloseHandle (hObject=0x42c) returned 1 [0058.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0058.488] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id_1622540890_.your_last_chance")) returned 1 [0058.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0058.488] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b9630 [0058.489] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0058.489] GetProcessHeap () returned 0x580000 [0058.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7a170 [0058.489] GetProcessHeap () returned 0x580000 [0058.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d8b9a0 [0058.490] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.490] ReadFile (in: hFile=0x42c, lpBuffer=0x6d7a170, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7a170*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0062.647] GetProcessHeap () returned 0x580000 [0062.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0062.647] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.647] WriteFile (in: hFile=0x42c, lpBuffer=0x6d8b9a0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8b9a0*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0064.116] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.116] WriteFile (in: hFile=0x42c, lpBuffer=0x6d9d19f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9d19f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0064.975] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.975] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0064.975] CloseHandle (hObject=0x42c) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8b9a0 | out: hHeap=0x580000) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7a170 | out: hHeap=0x580000) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0074.648] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0x6351e880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaf3611, dwReserved0=0x600fd28, dwReserved1=0x6d7a170, cFileName="Proof.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFC~1.YOU")) returned 0x5b9730 [0074.648] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.330] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", len=0x3d | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 1 [0079.330] GetProcessHeap () returned 0x580000 [0079.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x8c) returned 0x5f76f0 [0079.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.331] Sleep (dwMilliseconds=0x1) [0079.343] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", len=0x3d | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 1 [0079.343] GetProcessHeap () returned 0x580000 [0079.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x5c) returned 0x5f76f0 [0079.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.359] Sleep (dwMilliseconds=0x1) [0081.682] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", len=0x6a | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 1 [0081.682] GetProcessHeap () returned 0x580000 [0081.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x18) returned 0x5a58e8 [0081.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.689] CloseHandle (hObject=0x444) returned 1 [0081.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.690] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0081.690] GetProcessHeap () returned 0x580000 [0081.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6f094f0 [0081.690] GetProcessHeap () returned 0x580000 [0081.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6f09c60 [0081.690] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.690] ReadFile (in: hFile=0x444, lpBuffer=0x6f094f0, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesRead=0x600ff14*=0x740, lpOverlapped=0x0) returned 1 [0081.698] GetProcessHeap () returned 0x580000 [0081.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.698] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.698] WriteFile (in: hFile=0x444, lpBuffer=0x6f09c60*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09c60*, lpNumberOfBytesWritten=0x600ff14*=0x740, lpOverlapped=0x0) returned 1 [0081.698] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.698] WriteFile (in: hFile=0x444, lpBuffer=0x6f0a39f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a39f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.698] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.699] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.699] CloseHandle (hObject=0x444) returned 1 [0081.699] GetProcessHeap () returned 0x580000 [0081.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09c60 | out: hHeap=0x580000) returned 1 [0081.699] GetProcessHeap () returned 0x580000 [0081.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.699] GetProcessHeap () returned 0x580000 [0081.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x68502ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x782, dwReserved0=0x600fd28, dwReserved1=0x6f094f0, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.699] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.902] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", len=0x62 | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 1 [0081.902] GetProcessHeap () returned 0x580000 [0081.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0081.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0081.902] CloseHandle (hObject=0x498) returned 1 [0081.902] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.903] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0081.903] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96f0 [0081.903] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0081.904] GetProcessHeap () returned 0x580000 [0081.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f0c4f8 [0081.904] GetProcessHeap () returned 0x580000 [0081.904] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f094f0 [0081.904] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.904] ReadFile (in: hFile=0x498, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x600ff14*=0x540, lpOverlapped=0x0) returned 1 [0081.912] GetProcessHeap () returned 0x580000 [0081.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0081.912] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.912] WriteFile (in: hFile=0x498, lpBuffer=0x6f094f0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f094f0*, lpNumberOfBytesWritten=0x600ff14*=0x540, lpOverlapped=0x0) returned 1 [0081.912] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.912] WriteFile (in: hFile=0x498, lpBuffer=0x6f09a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09a2f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.913] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.913] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.913] CloseHandle (hObject=0x498) returned 1 [0081.913] GetProcessHeap () returned 0x580000 [0081.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f094f0 | out: hHeap=0x580000) returned 1 [0081.913] GetProcessHeap () returned 0x580000 [0081.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0081.913] GetProcessHeap () returned 0x580000 [0081.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0081.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x686f1cc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x600fd28, dwReserved1=0x6f0c4f8, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b96f0 [0081.913] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.150] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", len=0x62 | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 1 [0082.150] GetProcessHeap () returned 0x580000 [0082.150] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0082.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0082.150] CloseHandle (hObject=0x498) returned 1 [0082.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0082.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id_1622540890_.your_last_chance")) returned 1 [0082.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0082.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9730 [0082.151] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0082.152] GetProcessHeap () returned 0x580000 [0082.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f0c4f8 [0082.152] GetProcessHeap () returned 0x580000 [0082.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c78e08 [0082.152] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.152] ReadFile (in: hFile=0x498, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x600ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0082.158] GetProcessHeap () returned 0x580000 [0082.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0082.158] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.158] WriteFile (in: hFile=0x498, lpBuffer=0x6c78e08*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78e08*, lpNumberOfBytesWritten=0x600ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0082.158] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.158] WriteFile (in: hFile=0x498, lpBuffer=0x6c793a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c793a7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0082.158] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.159] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0082.159] CloseHandle (hObject=0x498) returned 1 [0082.159] GetProcessHeap () returned 0x580000 [0082.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c78e08 | out: hHeap=0x580000) returned 1 [0082.159] GetProcessHeap () returned 0x580000 [0082.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0082.159] GetProcessHeap () returned 0x580000 [0082.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0082.159] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689532c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d6, dwReserved0=0x600fd28, dwReserved1=0x6f0c4f8, cFileName="Proof.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFX~1.YOU")) returned 0x5b9730 [0082.159] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.357] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", len=0x6b | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 1 [0082.357] GetProcessHeap () returned 0x580000 [0082.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0082.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0082.385] CloseHandle (hObject=0x48c) returned 1 [0082.385] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0082.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id_1622540890_.your_last_chance")) returned 1 [0082.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0082.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x2e004c, dwReserved1=0x640069, cFileName="Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~1.YOU")) returned 0x5b96f0 [0082.386] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0082.386] GetProcessHeap () returned 0x580000 [0082.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6f0c4f8 [0082.386] GetProcessHeap () returned 0x580000 [0082.386] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6f0c848 [0082.386] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.386] ReadFile (in: hFile=0x48c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0082.665] GetProcessHeap () returned 0x580000 [0082.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0082.665] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.665] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0c848*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c848*, lpNumberOfBytesWritten=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0082.665] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.665] WriteFile (in: hFile=0x48c, lpBuffer=0x6f0cb67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cb67*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0082.667] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0082.667] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0082.667] CloseHandle (hObject=0x48c) returned 1 [0082.667] GetProcessHeap () returned 0x580000 [0082.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c848 | out: hHeap=0x580000) returned 1 [0082.667] GetProcessHeap () returned 0x580000 [0082.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0082.667] GetProcessHeap () returned 0x580000 [0082.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0082.667] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68e3c020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x600fd28, dwReserved1=0x6f0c4f8, cFileName="Proofing.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROOFI~1.YOU")) returned 0x5b96f0 [0082.667] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.228] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", len=0x4c | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 1 [0088.228] GetProcessHeap () returned 0x580000 [0088.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0088.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0088.246] CloseHandle (hObject=0x464) returned 1 [0088.246] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.246] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0088.247] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.247] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0088.247] GetProcessHeap () returned 0x580000 [0088.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x6f03bc8 [0088.247] GetProcessHeap () returned 0x580000 [0088.247] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x67ec60 [0088.247] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.247] ReadFile (in: hFile=0x464, lpBuffer=0x6f03bc8, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f03bc8*, lpNumberOfBytesRead=0x600ff14*=0xd80, lpOverlapped=0x0) returned 1 [0088.260] GetProcessHeap () returned 0x580000 [0088.260] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.260] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.260] WriteFile (in: hFile=0x464, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x600ff14*=0xd80, lpOverlapped=0x0) returned 1 [0088.261] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.261] WriteFile (in: hFile=0x464, lpBuffer=0x67f9df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f9df*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.261] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.261] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.261] CloseHandle (hObject=0x464) returned 1 [0088.261] GetProcessHeap () returned 0x580000 [0088.261] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0088.261] GetProcessHeap () returned 0x580000 [0088.261] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f03bc8 | out: hHeap=0x580000) returned 1 [0088.261] GetProcessHeap () returned 0x580000 [0088.261] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c37ec60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdbb, dwReserved0=0x600fd28, dwReserved1=0x6f03bc8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0088.261] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.265] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 1 [0088.265] GetProcessHeap () returned 0x580000 [0088.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0088.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0088.266] CloseHandle (hObject=0x464) returned 1 [0088.266] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0089.344] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0089.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0089.344] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0089.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0089.345] GetProcessHeap () returned 0x580000 [0089.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5061) returned 0x6efb338 [0089.345] GetProcessHeap () returned 0x580000 [0089.345] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5061) returned 0x6de5be0 [0089.345] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0089.345] ReadFile (in: hFile=0x464, lpBuffer=0x6efb338, nNumberOfBytesToRead=0x5040, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb338*, lpNumberOfBytesRead=0x600ff14*=0x5040, lpOverlapped=0x0) returned 1 [0090.235] GetProcessHeap () returned 0x580000 [0090.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0090.235] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.235] WriteFile (in: hFile=0x464, lpBuffer=0x6de5be0*, nNumberOfBytesToWrite=0x5040, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de5be0*, lpNumberOfBytesWritten=0x600ff14*=0x5040, lpOverlapped=0x0) returned 1 [0090.757] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0090.759] WriteFile (in: hFile=0x464, lpBuffer=0x6deac1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6deac1f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.438] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.438] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.438] CloseHandle (hObject=0x464) returned 1 [0091.611] GetProcessHeap () returned 0x580000 [0091.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de5be0 | out: hHeap=0x580000) returned 1 [0091.611] GetProcessHeap () returned 0x580000 [0091.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb338 | out: hHeap=0x580000) returned 1 [0091.612] GetProcessHeap () returned 0x580000 [0091.612] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0091.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e1d84e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5083, dwReserved0=0x600fd28, dwReserved1=0x6efb338, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0091.629] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.332] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", len=0x49 | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 1 [0092.332] GetProcessHeap () returned 0x580000 [0092.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x668d98, Size=0x4c) returned 0x669b00 [0092.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0098.375] CloseHandle (hObject=0x414) returned 1 [0098.375] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0098.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id_1622540890_.your_last_chance")) returned 1 [0098.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0098.376] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAYERS~2.YOU")) returned 0x5b96b0 [0098.376] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0098.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0098.376] GetProcessHeap () returned 0x580000 [0098.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0098.376] GetProcessHeap () returned 0x580000 [0098.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0098.376] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.376] ReadFile (in: hFile=0x414, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x600ff14*=0x200, lpOverlapped=0x0) returned 1 [0098.379] GetProcessHeap () returned 0x580000 [0098.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.379] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.379] WriteFile (in: hFile=0x414, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x600ff14*=0x200, lpOverlapped=0x0) returned 1 [0098.379] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.379] WriteFile (in: hFile=0x414, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.379] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.379] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.379] CloseHandle (hObject=0x414) returned 1 [0098.380] GetProcessHeap () returned 0x580000 [0098.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0098.380] GetProcessHeap () returned 0x580000 [0098.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0098.380] GetProcessHeap () returned 0x580000 [0098.380] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7240c8c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x600fd28, dwReserved1=0x6107d8, cFileName="LAYERS.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LAYERS~2.YOU")) returned 0x5b96b0 [0098.380] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0098.390] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", len=0x49 | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 1 [0098.390] GetProcessHeap () returned 0x580000 [0098.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0098.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0099.420] CloseHandle (hObject=0x43c) returned 1 [0099.420] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0099.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.422] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0099.422] GetProcessHeap () returned 0x580000 [0099.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6f04728 [0099.422] GetProcessHeap () returned 0x580000 [0099.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x401) returned 0x6d04600 [0099.422] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.422] ReadFile (in: hFile=0x43c, lpBuffer=0x6f04728, nNumberOfBytesToRead=0x3e0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04728*, lpNumberOfBytesRead=0x600ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0099.427] GetProcessHeap () returned 0x580000 [0099.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.427] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.427] WriteFile (in: hFile=0x43c, lpBuffer=0x6d04600*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04600*, lpNumberOfBytesWritten=0x600ff14*=0x3e0, lpOverlapped=0x0) returned 1 [0099.427] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.427] WriteFile (in: hFile=0x43c, lpBuffer=0x6d049df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d049df*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.427] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.427] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.427] CloseHandle (hObject=0x43c) returned 1 [0099.427] GetProcessHeap () returned 0x580000 [0099.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04600 | out: hHeap=0x580000) returned 1 [0099.428] GetProcessHeap () returned 0x580000 [0099.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04728 | out: hHeap=0x580000) returned 1 [0099.428] GetProcessHeap () returned 0x580000 [0099.428] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72e044e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x415, dwReserved0=0x600fd28, dwReserved1=0x6f04728, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b9730 [0099.428] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0101.354] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", len=0x49 | out: pbstr=0x600ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 1 [0101.354] GetProcessHeap () returned 0x580000 [0101.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0101.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0101.363] CloseHandle (hObject=0x170) returned 1 [0101.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id_1622540890_.your_last_chance")) returned 1 [0102.136] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b9730 [0102.136] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0102.137] GetProcessHeap () returned 0x580000 [0102.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04cc0 [0102.137] GetProcessHeap () returned 0x580000 [0102.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6d04eb8 [0102.137] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.137] ReadFile (in: hFile=0x170, lpBuffer=0x6d04cc0, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04cc0*, lpNumberOfBytesRead=0x600ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0102.139] GetProcessHeap () returned 0x580000 [0102.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.139] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.139] WriteFile (in: hFile=0x170, lpBuffer=0x6d04eb8*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d04eb8*, lpNumberOfBytesWritten=0x600ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0102.139] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.140] WriteFile (in: hFile=0x170, lpBuffer=0x6d05077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d05077*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.140] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.140] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.140] CloseHandle (hObject=0x170) returned 1 [0102.140] GetProcessHeap () returned 0x580000 [0102.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04eb8 | out: hHeap=0x580000) returned 1 [0102.140] GetProcessHeap () returned 0x580000 [0102.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d04cc0 | out: hHeap=0x580000) returned 1 [0102.140] GetProcessHeap () returned 0x580000 [0102.140] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747e7420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x600fd28, dwReserved1=0x6d04cc0, cFileName="SPRING.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPRING~1.YOU")) returned 0x5b9730 [0102.140] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.077] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x600ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned 1 [0112.077] GetProcessHeap () returned 0x580000 [0112.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x28) returned 0x5dc550 [0112.078] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.078] Sleep (dwMilliseconds=0x1) [0112.093] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", len=0x58 | out: pbstr=0x600ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.093] GetProcessHeap () returned 0x580000 [0112.093] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.093] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.099] Sleep (dwMilliseconds=0x1) [0112.192] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.207] Sleep (dwMilliseconds=0x1) [0112.317] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", len=0x64 | out: pbstr=0x600ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned 1 [0112.317] GetProcessHeap () returned 0x580000 [0112.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9730 [0112.317] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.317] Sleep (dwMilliseconds=0x1) [0113.336] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", len=0x3f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 1 [0113.337] GetProcessHeap () returned 0x580000 [0113.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x80) returned 0x6f0ceb8 [0113.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0113.476] CloseHandle (hObject=0x458) returned 1 [0113.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.242] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~3.YOU")) returned 0x5b9630 [0114.242] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0114.242] GetProcessHeap () returned 0x580000 [0114.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1141) returned 0x6c644f8 [0114.243] GetProcessHeap () returned 0x580000 [0114.243] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1141) returned 0x6f19958 [0114.243] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.243] ReadFile (in: hFile=0x458, lpBuffer=0x6c644f8, nNumberOfBytesToRead=0x1120, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c644f8*, lpNumberOfBytesRead=0x600ff14*=0x1120, lpOverlapped=0x0) returned 1 [0114.259] GetProcessHeap () returned 0x580000 [0114.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.259] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.259] WriteFile (in: hFile=0x458, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x1120, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x600ff14*=0x1120, lpOverlapped=0x0) returned 1 [0114.259] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.259] WriteFile (in: hFile=0x458, lpBuffer=0x6f1aa77*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aa77*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.259] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.259] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.259] CloseHandle (hObject=0x458) returned 1 [0114.259] GetProcessHeap () returned 0x580000 [0114.259] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0114.260] GetProcessHeap () returned 0x580000 [0114.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c644f8 | out: hHeap=0x580000) returned 1 [0114.260] GetProcessHeap () returned 0x580000 [0114.260] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.260] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bb80080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x114a, dwReserved0=0x600fd28, dwReserved1=0x6c644f8, cFileName="AG00172_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~3.YOU")) returned 0x5b9630 [0114.260] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0114.278] CloseHandle (hObject=0x390) returned 1 [0114.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03014~1.YOU")) returned 0x5b9630 [0114.279] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0114.279] GetProcessHeap () returned 0x580000 [0114.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a61) returned 0x6f35668 [0114.279] GetProcessHeap () returned 0x580000 [0114.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a61) returned 0x6f3a0d8 [0114.279] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.279] ReadFile (in: hFile=0x390, lpBuffer=0x6f35668, nNumberOfBytesToRead=0x4a40, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f35668*, lpNumberOfBytesRead=0x600ff14*=0x4a40, lpOverlapped=0x0) returned 1 [0115.564] GetProcessHeap () returned 0x580000 [0115.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.564] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.564] WriteFile (in: hFile=0x390, lpBuffer=0x6f3a0d8*, nNumberOfBytesToWrite=0x4a40, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3a0d8*, lpNumberOfBytesWritten=0x600ff14*=0x4a40, lpOverlapped=0x0) returned 1 [0115.565] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.565] WriteFile (in: hFile=0x390, lpBuffer=0x6f3eb17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3eb17*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.565] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.565] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.565] CloseHandle (hObject=0x390) returned 1 [0115.565] GetProcessHeap () returned 0x580000 [0115.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3a0d8 | out: hHeap=0x580000) returned 1 [0115.565] GetProcessHeap () returned 0x580000 [0115.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f35668 | out: hHeap=0x580000) returned 1 [0115.565] GetProcessHeap () returned 0x580000 [0115.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7d92a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4a7e, dwReserved0=0x600fd28, dwReserved1=0x6f35668, cFileName="J0301418.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03014~1.YOU")) returned 0x5b9630 [0117.996] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.539] CloseHandle (hObject=0x4a0) returned 1 [0118.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.540] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0257~1.YOU")) returned 0x5b9730 [0118.540] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.540] GetProcessHeap () returned 0x580000 [0118.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19e1) returned 0x667250 [0118.540] GetProcessHeap () returned 0x580000 [0118.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x19e1) returned 0x6d0e508 [0118.541] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.541] ReadFile (in: hFile=0x4a0, lpBuffer=0x667250, nNumberOfBytesToRead=0x19c0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x600ff14*=0x19c0, lpOverlapped=0x0) returned 1 [0118.564] GetProcessHeap () returned 0x580000 [0118.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.565] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.565] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x19c0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x600ff14*=0x19c0, lpOverlapped=0x0) returned 1 [0118.565] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.565] WriteFile (in: hFile=0x4a0, lpBuffer=0x6d0fec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0fec7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.565] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.565] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.565] CloseHandle (hObject=0x4a0) returned 1 [0118.565] GetProcessHeap () returned 0x580000 [0118.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0118.565] GetProcessHeap () returned 0x580000 [0118.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0118.565] GetProcessHeap () returned 0x580000 [0118.565] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e48fc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19ee, dwReserved0=0x600fd28, dwReserved1=0x667250, cFileName="SO02578_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0257~1.YOU")) returned 0x5b96f0 [0120.125] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.152] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", len=0x4c | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 1 [0120.152] GetProcessHeap () returned 0x580000 [0120.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c4) returned 0x6d06ca8 [0120.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.085] CloseHandle (hObject=0x438) returned 1 [0122.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.097] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.097] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~1.YOU")) returned 0x5b9730 [0122.097] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.098] GetProcessHeap () returned 0x580000 [0122.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0122.098] GetProcessHeap () returned 0x580000 [0122.098] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6f0c8f8 [0122.098] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.098] ReadFile (in: hFile=0x438, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x600ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0122.109] GetProcessHeap () returned 0x580000 [0122.109] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.109] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.109] WriteFile (in: hFile=0x438, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x600ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0122.109] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.109] WriteFile (in: hFile=0x438, lpBuffer=0x6f0cbd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbd7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.109] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.109] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.109] CloseHandle (hObject=0x438) returned 1 [0122.109] GetProcessHeap () returned 0x580000 [0122.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0122.109] GetProcessHeap () returned 0x580000 [0122.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0122.109] GetProcessHeap () returned 0x580000 [0122.109] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.375] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80655420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x600fd28, dwReserved1=0x67c940, cFileName="WB02077_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0207~1.YOU")) returned 0x5b9730 [0124.375] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.419] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", len=0x49 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned 1 [0124.419] GetProcessHeap () returned 0x580000 [0124.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1904) returned 0x6f42f08 [0124.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0125.554] CloseHandle (hObject=0x48c) returned 1 [0125.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.554] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.id_1622540890_.your_last_chance")) returned 1 [0125.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIDXM~1.YOU")) returned 0x5b9730 [0125.555] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0125.555] GetProcessHeap () returned 0x580000 [0125.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6f66848 [0125.555] GetProcessHeap () returned 0x580000 [0125.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe61) returned 0x6c29878 [0125.555] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.555] ReadFile (in: hFile=0x48c, lpBuffer=0x6f66848, nNumberOfBytesToRead=0xe40, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66848*, lpNumberOfBytesRead=0x600ff14*=0xe40, lpOverlapped=0x0) returned 1 [0125.569] GetProcessHeap () returned 0x580000 [0125.569] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0125.569] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.569] WriteFile (in: hFile=0x48c, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x600ff14*=0xe40, lpOverlapped=0x0) returned 1 [0125.569] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.569] WriteFile (in: hFile=0x48c, lpBuffer=0x6c2a6b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a6b7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0125.570] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.570] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0125.570] CloseHandle (hObject=0x48c) returned 1 [0125.570] GetProcessHeap () returned 0x580000 [0125.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0125.570] GetProcessHeap () returned 0x580000 [0125.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f66848 | out: hHeap=0x580000) returned 1 [0125.570] GetProcessHeap () returned 0x580000 [0125.570] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.570] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8275c560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe7d, dwReserved0=0x600fd28, dwReserved1=0x6f66848, cFileName="Grid.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIDXM~1.YOU")) returned 0x5b9730 [0125.570] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.590] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", len=0x3d | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned 1 [0125.590] GetProcessHeap () returned 0x580000 [0125.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e8) returned 0x667250 [0125.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0128.613] CloseHandle (hObject=0x438) returned 1 [0128.613] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.613] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.id_1622540890_.your_last_chance")) returned 1 [0130.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.542] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03028~1.YOU")) returned 0x5b9730 [0130.542] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0130.542] GetProcessHeap () returned 0x580000 [0130.542] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a41) returned 0x6e13f70 [0130.543] GetProcessHeap () returned 0x580000 [0130.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a41) returned 0x6e199c0 [0130.543] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.543] ReadFile (in: hFile=0x438, lpBuffer=0x6e13f70, nNumberOfBytesToRead=0x5a20, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e13f70*, lpNumberOfBytesRead=0x600ff14*=0x5a20, lpOverlapped=0x0) returned 1 [0131.677] GetProcessHeap () returned 0x580000 [0131.678] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0131.678] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.678] WriteFile (in: hFile=0x438, lpBuffer=0x6e199c0*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e199c0*, lpNumberOfBytesWritten=0x600ff14*=0x5a20, lpOverlapped=0x0) returned 1 [0131.678] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.678] WriteFile (in: hFile=0x438, lpBuffer=0x6e1f3df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e1f3df*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0131.678] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.678] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0131.678] CloseHandle (hObject=0x438) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e199c0 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e13f70 | out: hHeap=0x580000) returned 1 [0132.906] GetProcessHeap () returned 0x580000 [0132.907] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0135.292] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.292] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x86187f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5a4f, dwReserved0=0x600fd28, dwReserved1=0x6e13f70, cFileName="J0302827.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03028~1.YOU")) returned 0x5b96f0 [0135.292] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.292] Sleep (dwMilliseconds=0x1) [0135.301] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", len=0x3b | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 1 [0135.301] GetProcessHeap () returned 0x580000 [0135.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0135.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0138.759] CloseHandle (hObject=0x448) returned 1 [0138.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.759] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id_1622540890_.your_last_chance")) returned 1 [0138.759] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIP1~1.YOU")) returned 0x5b9770 [0138.760] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0138.760] GetProcessHeap () returned 0x580000 [0138.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0138.761] GetProcessHeap () returned 0x580000 [0138.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0138.761] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.761] ReadFile (in: hFile=0x448, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0139.796] GetProcessHeap () returned 0x580000 [0139.796] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.797] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.797] WriteFile (in: hFile=0x448, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0139.798] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.798] WriteFile (in: hFile=0x448, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.800] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.800] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.800] CloseHandle (hObject=0x448) returned 1 [0139.800] GetProcessHeap () returned 0x580000 [0139.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0139.800] GetProcessHeap () returned 0x580000 [0139.800] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0139.801] GetProcessHeap () returned 0x580000 [0139.801] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8af0ab60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x53e04, dwReserved0=0x600fd28, dwReserved1=0x6d7cfe8, cFileName="ACTIP10.HLP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIP1~1.YOU")) returned 0x5b9770 [0140.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.173] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", len=0x5f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png") returned 1 [0140.173] GetProcessHeap () returned 0x580000 [0140.173] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.742] CloseHandle (hObject=0x448) returned 1 [0140.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.id_1622540890_.your_last_chance")) returned 1 [0140.742] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="gradient.png.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRADIE~1.YOU")) returned 0x5b9730 [0140.743] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.743] GetProcessHeap () returned 0x580000 [0140.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09508 [0140.743] GetProcessHeap () returned 0x580000 [0140.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09620 [0140.743] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.743] ReadFile (in: hFile=0x448, lpBuffer=0x6f09508, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09508*, lpNumberOfBytesRead=0x600ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.745] GetProcessHeap () returned 0x580000 [0140.745] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ff8 [0140.745] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.745] WriteFile (in: hFile=0x448, lpBuffer=0x6f09620*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09620*, lpNumberOfBytesWritten=0x600ff14*=0xe0, lpOverlapped=0x0) returned 1 [0140.745] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.745] WriteFile (in: hFile=0x448, lpBuffer=0x6f096ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f096ff*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.745] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.745] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.745] CloseHandle (hObject=0x448) returned 1 [0140.745] GetProcessHeap () returned 0x580000 [0140.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0140.745] GetProcessHeap () returned 0x580000 [0140.745] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0140.745] GetProcessHeap () returned 0x580000 [0140.746] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ff8 | out: hHeap=0x580000) returned 1 [0141.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b81df40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x600fd28, dwReserved1=0x6f09508, cFileName="gradient.png.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRADIE~1.YOU")) returned 0x5b9730 [0141.664] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.711] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", len=0x3c | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned 1 [0141.711] GetProcessHeap () returned 0x580000 [0141.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0141.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0141.712] CloseHandle (hObject=0x448) returned 1 [0141.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.id_1622540890_.your_last_chance")) returned 1 [0141.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~4.YOU")) returned 0x5b9730 [0141.713] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0141.713] GetProcessHeap () returned 0x580000 [0141.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6dc8580 [0141.713] GetProcessHeap () returned 0x580000 [0141.713] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6dec6e0 [0141.714] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.714] ReadFile (in: hFile=0x448, lpBuffer=0x6dc8580, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc8580*, lpNumberOfBytesRead=0x600ff14*=0x3000, lpOverlapped=0x0) returned 1 [0142.301] GetProcessHeap () returned 0x580000 [0142.301] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0142.301] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.301] WriteFile (in: hFile=0x448, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x600ff14*=0x3000, lpOverlapped=0x0) returned 1 [0142.302] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.302] WriteFile (in: hFile=0x448, lpBuffer=0x6def6df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def6df*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0142.302] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0142.302] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0142.302] CloseHandle (hObject=0x448) returned 1 [0142.975] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0142.976] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc8580 | out: hHeap=0x580000) returned 1 [0142.976] GetProcessHeap () returned 0x580000 [0142.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0146.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c6d8760, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3024, dwReserved0=0x600fd28, dwReserved1=0x6dc8580, cFileName="PROTTPLN.PPT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~4.YOU")) returned 0x5b96f0 [0146.824] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.860] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", len=0x44 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned 1 [0146.860] GetProcessHeap () returned 0x580000 [0146.860] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0146.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0151.932] CloseHandle (hObject=0x3e4) returned 1 [0151.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0151.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.id_1622540890_.your_last_chance")) returned 1 [0151.933] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0151.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR32~2.YOU")) returned 0x5b9730 [0151.933] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0151.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0151.933] GetProcessHeap () returned 0x580000 [0151.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf61) returned 0x6c29878 [0151.934] GetProcessHeap () returned 0x580000 [0151.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf61) returned 0x6ce2378 [0151.934] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.934] ReadFile (in: hFile=0x3e4, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf40, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x600ff14*=0xf40, lpOverlapped=0x0) returned 1 [0151.949] GetProcessHeap () returned 0x580000 [0151.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0151.949] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.949] WriteFile (in: hFile=0x3e4, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x600ff14*=0xf40, lpOverlapped=0x0) returned 1 [0151.949] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.949] WriteFile (in: hFile=0x3e4, lpBuffer=0x6ce32b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce32b7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.949] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.949] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.949] CloseHandle (hObject=0x3e4) returned 1 [0151.949] GetProcessHeap () returned 0x580000 [0151.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0151.949] GetProcessHeap () returned 0x580000 [0151.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0151.949] GetProcessHeap () returned 0x580000 [0151.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x922efa80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf6b, dwReserved0=0x600fd28, dwReserved1=0x6c29878, cFileName="PDIR32B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR32~2.YOU")) returned 0x5b9730 [0152.051] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0153.489] CloseHandle (hObject=0x45c) returned 1 [0153.489] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.490] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.id_1622540890_.your_last_chance")) returned 1 [0153.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.490] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TERRCO~1.YOU")) returned 0x5b9730 [0153.491] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\terrcott.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0153.491] GetProcessHeap () returned 0x580000 [0153.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0153.491] GetProcessHeap () returned 0x580000 [0153.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6d9c318 [0153.491] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.491] ReadFile (in: hFile=0x45c, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x600ff14*=0xd60, lpOverlapped=0x0) returned 1 [0154.378] GetProcessHeap () returned 0x580000 [0154.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0154.379] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.379] WriteFile (in: hFile=0x45c, lpBuffer=0x6d9c318*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9c318*, lpNumberOfBytesWritten=0x600ff14*=0xd60, lpOverlapped=0x0) returned 1 [0154.379] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.379] WriteFile (in: hFile=0x45c, lpBuffer=0x6d9d077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9d077*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.379] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.379] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.379] CloseHandle (hObject=0x45c) returned 1 [0154.750] GetProcessHeap () returned 0x580000 [0154.750] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9c318 | out: hHeap=0x580000) returned 1 [0154.750] GetProcessHeap () returned 0x580000 [0154.750] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0154.751] GetProcessHeap () returned 0x580000 [0154.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x93a25100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x600fd28, dwReserved1=0x635768, cFileName="TERRCOTT.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TERRCO~1.YOU")) returned 0x5b9730 [0155.736] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.753] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", len=0x3a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned 1 [0155.753] GetProcessHeap () returned 0x580000 [0155.753] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0155.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0155.754] CloseHandle (hObject=0x470) returned 1 [0155.754] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.754] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.id_1622540890_.your_last_chance")) returned 1 [0155.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCMET~2.YOU")) returned 0x5b9630 [0155.755] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0155.755] GetProcessHeap () returned 0x580000 [0155.755] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x65c1) returned 0x6fa8f28 [0155.756] GetProcessHeap () returned 0x580000 [0155.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x65c1) returned 0x6de0f50 [0155.756] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.756] ReadFile (in: hFile=0x470, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x65a0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x600ff14*=0x65a0, lpOverlapped=0x0) returned 1 [0157.459] GetProcessHeap () returned 0x580000 [0157.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0157.459] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.459] WriteFile (in: hFile=0x470, lpBuffer=0x6de0f50*, nNumberOfBytesToWrite=0x65a0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesWritten=0x600ff14*=0x65a0, lpOverlapped=0x0) returned 1 [0157.460] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.460] WriteFile (in: hFile=0x470, lpBuffer=0x6de74ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de74ef*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0157.460] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.460] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0157.460] CloseHandle (hObject=0x470) returned 1 [0158.180] GetProcessHeap () returned 0x580000 [0158.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0158.180] GetProcessHeap () returned 0x580000 [0158.180] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0158.181] GetProcessHeap () returned 0x580000 [0158.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0159.264] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95773fe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65cf, dwReserved0=0x600fd28, dwReserved1=0x6fa8f28, cFileName="bdcmetadata.xsd.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BDCMET~2.YOU")) returned 0x5b9630 [0159.264] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0164.394] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", len=0x45 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned 1 [0164.394] GetProcessHeap () returned 0x580000 [0164.394] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0164.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0164.395] CloseHandle (hObject=0x43c) returned 1 [0164.395] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0164.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl.id_1622540890_.your_last_chance")) returned 1 [0164.397] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0164.397] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APAXSL~1.YOU")) returned 0x5b9730 [0164.397] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0164.397] GetProcessHeap () returned 0x580000 [0164.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7185768 [0164.398] GetProcessHeap () returned 0x580000 [0164.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0164.398] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.398] ReadFile (in: hFile=0x43c, lpBuffer=0x7185768, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x7185768*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0167.619] GetProcessHeap () returned 0x580000 [0167.619] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0167.619] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.619] WriteFile (in: hFile=0x43c, lpBuffer=0x6d7cfe8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0167.619] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.620] WriteFile (in: hFile=0x43c, lpBuffer=0x6d8e7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e7e7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0168.162] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.163] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0168.163] CloseHandle (hObject=0x43c) returned 1 [0168.163] GetProcessHeap () returned 0x580000 [0168.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0168.163] GetProcessHeap () returned 0x580000 [0168.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7185768 | out: hHeap=0x580000) returned 1 [0168.163] GetProcessHeap () returned 0x580000 [0168.163] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0170.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bd82f20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5cd28, dwReserved0=0x600fd28, dwReserved1=0x7185768, cFileName="APA.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APAXSL~1.YOU")) returned 0x5b96b0 [0170.234] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.244] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", len=0x3f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 1 [0170.244] GetProcessHeap () returned 0x580000 [0170.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a8) returned 0x6f14048 [0170.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.262] CloseHandle (hObject=0x458) returned 1 [0170.262] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.262] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id_1622540890_.your_last_chance")) returned 1 [0170.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKLI~1.YOU")) returned 0x5b96b0 [0170.263] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.263] GetProcessHeap () returned 0x580000 [0170.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0170.263] GetProcessHeap () returned 0x580000 [0170.263] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0170.263] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.263] ReadFile (in: hFile=0x458, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x600ff14*=0x420, lpOverlapped=0x0) returned 1 [0170.290] GetProcessHeap () returned 0x580000 [0170.290] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.290] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x458, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x600ff14*=0x420, lpOverlapped=0x0) returned 1 [0170.290] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x458, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.290] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.290] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.290] CloseHandle (hObject=0x458) returned 1 [0170.290] GetProcessHeap () returned 0x580000 [0170.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0170.290] GetProcessHeap () returned 0x580000 [0170.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0170.290] GetProcessHeap () returned 0x580000 [0170.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.914] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d1e4b80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x600fd28, dwReserved1=0x5d0090, cFileName="TASKL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKLI~1.YOU")) returned 0x5b9770 [0172.938] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.244] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", len=0x42 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 1 [0173.244] GetProcessHeap () returned 0x580000 [0173.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0173.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.244] CloseHandle (hObject=0x46c) returned 1 [0173.244] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.245] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.245] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPLTM~1.YOU")) returned 0x5b9770 [0173.246] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.246] GetProcessHeap () returned 0x580000 [0173.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0173.246] GetProcessHeap () returned 0x580000 [0173.246] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0173.246] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.246] ReadFile (in: hFile=0x46c, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.250] GetProcessHeap () returned 0x580000 [0173.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.250] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x46c, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.250] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.250] WriteFile (in: hFile=0x46c, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.251] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.251] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.251] CloseHandle (hObject=0x46c) returned 1 [0173.251] GetProcessHeap () returned 0x580000 [0173.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0173.251] GetProcessHeap () returned 0x580000 [0173.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0173.251] GetProcessHeap () returned 0x580000 [0173.251] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ee02f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x35e, dwReserved0=0x600fd28, dwReserved1=0x6c59120, cFileName="REPLTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPLTM~1.YOU")) returned 0x5b9770 [0173.251] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.658] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", len=0x4a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned 1 [0174.658] GetProcessHeap () returned 0x580000 [0174.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0174.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0174.709] CloseHandle (hObject=0x41c) returned 1 [0174.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.709] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.id_1622540890_.your_last_chance")) returned 1 [0174.710] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOVEL~1.YOU")) returned 0x5b96f0 [0174.710] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0174.710] GetProcessHeap () returned 0x580000 [0174.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf561) returned 0x6d430a8 [0174.710] GetProcessHeap () returned 0x580000 [0174.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf561) returned 0x6d52618 [0174.710] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.710] ReadFile (in: hFile=0x41c, lpBuffer=0x6d430a8, nNumberOfBytesToRead=0xf540, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430a8*, lpNumberOfBytesRead=0x600ff14*=0xf540, lpOverlapped=0x0) returned 1 [0177.241] GetProcessHeap () returned 0x580000 [0177.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.241] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.241] WriteFile (in: hFile=0x41c, lpBuffer=0x6d52618*, nNumberOfBytesToWrite=0xf540, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d52618*, lpNumberOfBytesWritten=0x600ff14*=0xf540, lpOverlapped=0x0) returned 1 [0177.242] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.242] WriteFile (in: hFile=0x41c, lpBuffer=0x6d61b57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d61b57*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.242] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.242] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.242] CloseHandle (hObject=0x41c) returned 1 [0177.242] GetProcessHeap () returned 0x580000 [0177.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d52618 | out: hHeap=0x580000) returned 1 [0177.242] GetProcessHeap () returned 0x580000 [0177.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430a8 | out: hHeap=0x580000) returned 1 [0177.242] GetProcessHeap () returned 0x580000 [0177.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0179.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1418f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf56c, dwReserved0=0x600fd28, dwReserved1=0x6d430a8, cFileName="SHOVEL.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHOVEL~1.YOU")) returned 0x5b96f0 [0179.168] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.339] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", len=0x5f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned 1 [0180.340] GetProcessHeap () returned 0x580000 [0180.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0180.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.353] CloseHandle (hObject=0x43c) returned 1 [0180.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.421] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c135400, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~3.YOU")) returned 0x5b96b0 [0180.421] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0180.422] GetProcessHeap () returned 0x580000 [0180.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2001) returned 0x6d29f58 [0180.422] GetProcessHeap () returned 0x580000 [0180.422] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2001) returned 0x6d2bf68 [0180.422] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.422] ReadFile (in: hFile=0x43c, lpBuffer=0x6d29f58, nNumberOfBytesToRead=0x1fe0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29f58*, lpNumberOfBytesRead=0x600ff14*=0x1fe0, lpOverlapped=0x0) returned 1 [0180.453] GetProcessHeap () returned 0x580000 [0180.453] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.453] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.453] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2bf68*, nNumberOfBytesToWrite=0x1fe0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2bf68*, lpNumberOfBytesWritten=0x600ff14*=0x1fe0, lpOverlapped=0x0) returned 1 [0180.453] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.453] WriteFile (in: hFile=0x43c, lpBuffer=0x6d2df47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2df47*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.453] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.454] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.454] CloseHandle (hObject=0x43c) returned 1 [0180.454] GetProcessHeap () returned 0x580000 [0180.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2bf68 | out: hHeap=0x580000) returned 1 [0180.454] GetProcessHeap () returned 0x580000 [0180.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d29f58 | out: hHeap=0x580000) returned 1 [0180.454] GetProcessHeap () returned 0x580000 [0180.454] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa32beaa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2010, dwReserved0=0x600fd28, dwReserved1=0x6d29f58, cFileName="UnreadIcon.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UNREAD~3.YOU")) returned 0x5b96b0 [0180.454] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.190] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", len=0x50 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned 1 [0183.190] GetProcessHeap () returned 0x580000 [0183.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0183.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.190] CloseHandle (hObject=0x46c) returned 1 [0183.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64fa, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~4.YOU")) returned 0x5b9770 [0183.192] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0183.192] GetProcessHeap () returned 0x580000 [0183.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6501) returned 0x707ec98 [0183.192] GetProcessHeap () returned 0x580000 [0183.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6501) returned 0x70851a8 [0183.192] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.192] ReadFile (in: hFile=0x46c, lpBuffer=0x707ec98, nNumberOfBytesToRead=0x64e0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesRead=0x600ff14*=0x64e0, lpOverlapped=0x0) returned 1 [0184.724] GetProcessHeap () returned 0x580000 [0184.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0184.724] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.724] WriteFile (in: hFile=0x46c, lpBuffer=0x70851a8*, nNumberOfBytesToWrite=0x64e0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x70851a8*, lpNumberOfBytesWritten=0x600ff14*=0x64e0, lpOverlapped=0x0) returned 1 [0184.725] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.725] WriteFile (in: hFile=0x46c, lpBuffer=0x708b687*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x708b687*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.725] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.725] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.726] CloseHandle (hObject=0x46c) returned 1 [0185.002] GetProcessHeap () returned 0x580000 [0185.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70851a8 | out: hHeap=0x580000) returned 1 [0185.002] GetProcessHeap () returned 0x580000 [0185.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0185.002] GetProcessHeap () returned 0x580000 [0185.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0185.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5b82360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x651e, dwReserved0=0x600fd28, dwReserved1=0x707ec98, cFileName="Shared16x16Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SHARED~4.YOU")) returned 0x5b9770 [0185.532] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.580] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", len=0x53 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned 1 [0185.580] GetProcessHeap () returned 0x580000 [0185.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0185.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0185.689] CloseHandle (hObject=0x428) returned 1 [0185.689] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.690] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.690] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e93, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGINT~1.YOU")) returned 0x5b9770 [0185.690] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0185.690] GetProcessHeap () returned 0x580000 [0185.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6e0dcf0 [0185.690] GetProcessHeap () returned 0x580000 [0185.690] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6d430c0 [0185.690] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.690] ReadFile (in: hFile=0x428, lpBuffer=0x6e0dcf0, nNumberOfBytesToRead=0x1e80, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0dcf0*, lpNumberOfBytesRead=0x600ff14*=0x1e80, lpOverlapped=0x0) returned 1 [0185.718] GetProcessHeap () returned 0x580000 [0185.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0185.718] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.718] WriteFile (in: hFile=0x428, lpBuffer=0x6d430c0*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430c0*, lpNumberOfBytesWritten=0x600ff14*=0x1e80, lpOverlapped=0x0) returned 1 [0185.718] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.718] WriteFile (in: hFile=0x428, lpBuffer=0x6d44f3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d44f3f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.718] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.718] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.718] CloseHandle (hObject=0x428) returned 1 [0185.718] GetProcessHeap () returned 0x580000 [0185.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430c0 | out: hHeap=0x580000) returned 1 [0185.718] GetProcessHeap () returned 0x580000 [0185.718] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0dcf0 | out: hHeap=0x580000) returned 1 [0185.718] GetProcessHeap () returned 0x580000 [0185.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0185.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa64e1a00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eb7, dwReserved0=0x600fd28, dwReserved1=0x6e0dcf0, cFileName="LoginTool24x24Images.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LOGINT~1.YOU")) returned 0x5b9770 [0185.719] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.734] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", len=0x44 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned 1 [0185.734] GetProcessHeap () returned 0x580000 [0185.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a4) returned 0x6f14048 [0185.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0185.735] CloseHandle (hObject=0x480) returned 1 [0185.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.735] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.id_1622540890_.your_last_chance")) returned 1 [0185.736] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.736] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR6~2.YOU")) returned 0x5b9770 [0185.736] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0185.736] GetProcessHeap () returned 0x580000 [0185.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ae1) returned 0x656970 [0185.736] GetProcessHeap () returned 0x580000 [0185.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ae1) returned 0x6d75fa8 [0185.736] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.736] ReadFile (in: hFile=0x480, lpBuffer=0x656970, nNumberOfBytesToRead=0x2ac0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesRead=0x600ff14*=0x2ac0, lpOverlapped=0x0) returned 1 [0187.256] GetProcessHeap () returned 0x580000 [0187.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.256] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.256] WriteFile (in: hFile=0x480, lpBuffer=0x6d75fa8*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d75fa8*, lpNumberOfBytesWritten=0x600ff14*=0x2ac0, lpOverlapped=0x0) returned 1 [0187.257] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.257] WriteFile (in: hFile=0x480, lpBuffer=0x6d78a67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d78a67*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.257] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.257] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.257] CloseHandle (hObject=0x480) returned 1 [0187.257] GetProcessHeap () returned 0x580000 [0187.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d75fa8 | out: hHeap=0x580000) returned 1 [0187.257] GetProcessHeap () returned 0x580000 [0187.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0187.257] GetProcessHeap () returned 0x580000 [0187.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0187.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa739c220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b02, dwReserved0=0x600fd28, dwReserved1=0x656970, cFileName="ZPDIR6B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR6~2.YOU")) returned 0x5b96b0 [0187.257] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0188.186] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", len=0x45 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned 1 [0188.186] GetProcessHeap () returned 0x580000 [0188.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0188.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0191.918] CloseHandle (hObject=0x458) returned 1 [0191.918] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.924] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b06, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP3FF0~1.YOU")) returned 0x5b97b0 [0194.924] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0194.924] GetProcessHeap () returned 0x580000 [0194.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6dd40d0 [0194.924] GetProcessHeap () returned 0x580000 [0194.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b21) returned 0x6cba390 [0194.924] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.924] ReadFile (in: hFile=0x458, lpBuffer=0x6dd40d0, nNumberOfBytesToRead=0x1b00, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesRead=0x600ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0194.949] GetProcessHeap () returned 0x580000 [0194.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0194.949] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.949] WriteFile (in: hFile=0x458, lpBuffer=0x6cba390*, nNumberOfBytesToWrite=0x1b00, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cba390*, lpNumberOfBytesWritten=0x600ff14*=0x1b00, lpOverlapped=0x0) returned 1 [0194.949] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.949] WriteFile (in: hFile=0x458, lpBuffer=0x6cbbe8f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbbe8f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.949] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.949] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.949] CloseHandle (hObject=0x458) returned 1 [0194.949] GetProcessHeap () returned 0x580000 [0194.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cba390 | out: hHeap=0x580000) returned 1 [0194.949] GetProcessHeap () returned 0x580000 [0194.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0194.950] GetProcessHeap () returned 0x580000 [0194.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0194.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabcf4800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b2a, dwReserved0=0x600fd28, dwReserved1=0x6dd40d0, cFileName="ZPDIR44B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP3FF0~1.YOU")) returned 0x5b97b0 [0194.950] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.954] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", len=0x6f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned 1 [0194.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0194.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.586] CloseHandle (hObject=0x4a0) returned 1 [0196.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance")) returned 1 [0196.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb6, dwReserved0=0x2e0077, dwReserved1=0x730063, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b97f0 [0196.587] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.587] GetProcessHeap () returned 0x580000 [0196.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0196.587] GetProcessHeap () returned 0x580000 [0196.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6f668d8 [0196.587] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.587] ReadFile (in: hFile=0x4a0, lpBuffer=0x635768, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x600ff14*=0xca0, lpOverlapped=0x0) returned 1 [0196.600] GetProcessHeap () returned 0x580000 [0196.600] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.600] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.600] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x600ff14*=0xca0, lpOverlapped=0x0) returned 1 [0196.600] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.600] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f67577*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67577*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.600] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.600] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.600] CloseHandle (hObject=0x4a0) returned 1 [0196.600] GetProcessHeap () returned 0x580000 [0196.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0196.600] GetProcessHeap () returned 0x580000 [0196.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0196.600] GetProcessHeap () returned 0x580000 [0196.600] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.130] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb99c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcda, dwReserved0=0x600fd28, dwReserved1=0x635768, cFileName="BrightYellow.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIGHT~2.YOU")) returned 0x5b97f0 [0199.130] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.140] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", len=0x43 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned 1 [0199.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0199.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0199.266] CloseHandle (hObject=0x414) returned 1 [0199.266] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.266] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.id_1622540890_.your_last_chance")) returned 1 [0199.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR3B~1.YOU")) returned 0x5b97b0 [0199.267] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0199.267] GetProcessHeap () returned 0x580000 [0199.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ee1) returned 0x6c59108 [0199.267] GetProcessHeap () returned 0x580000 [0199.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2ee1) returned 0x6e09a00 [0199.267] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.267] ReadFile (in: hFile=0x414, lpBuffer=0x6c59108, nNumberOfBytesToRead=0x2ec0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesRead=0x600ff14*=0x2ec0, lpOverlapped=0x0) returned 1 [0199.982] GetProcessHeap () returned 0x580000 [0199.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0199.983] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.983] WriteFile (in: hFile=0x414, lpBuffer=0x6e09a00*, nNumberOfBytesToWrite=0x2ec0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e09a00*, lpNumberOfBytesWritten=0x600ff14*=0x2ec0, lpOverlapped=0x0) returned 1 [0199.983] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.983] WriteFile (in: hFile=0x414, lpBuffer=0x6e0c8bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c8bf*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.983] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.983] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.983] CloseHandle (hObject=0x414) returned 1 [0199.983] GetProcessHeap () returned 0x580000 [0199.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e09a00 | out: hHeap=0x580000) returned 1 [0199.983] GetProcessHeap () returned 0x580000 [0199.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0199.983] GetProcessHeap () returned 0x580000 [0199.983] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.042] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed02420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2efe, dwReserved0=0x600fd28, dwReserved1=0x6c59108, cFileName="PDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR3B~1.YOU")) returned 0x5b9770 [0201.042] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.865] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", len=0x68 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned 1 [0201.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0201.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.870] CloseHandle (hObject=0x450) returned 1 [0201.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.id_1622540890_.your_last_chance")) returned 1 [0201.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b9770 [0201.872] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0201.872] GetProcessHeap () returned 0x580000 [0201.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x677cd0 [0201.872] GetProcessHeap () returned 0x580000 [0201.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc01) returned 0x635768 [0201.872] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.872] ReadFile (in: hFile=0x450, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xbe0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x600ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0201.905] GetProcessHeap () returned 0x580000 [0201.905] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.905] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.905] WriteFile (in: hFile=0x450, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x600ff14*=0xbe0, lpOverlapped=0x0) returned 1 [0201.905] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.906] WriteFile (in: hFile=0x450, lpBuffer=0x636347*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x636347*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.906] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.906] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.906] CloseHandle (hObject=0x450) returned 1 [0201.906] GetProcessHeap () returned 0x580000 [0201.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0201.906] GetProcessHeap () returned 0x580000 [0201.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0201.906] GetProcessHeap () returned 0x580000 [0201.906] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0201.906] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaff4ed40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc16, dwReserved0=0x600fd28, dwReserved1=0x677cd0, cFileName="Oasis.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OASISC~1.YOU")) returned 0x5b9770 [0201.906] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.102] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned 1 [0203.102] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0203.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0203.106] CloseHandle (hObject=0x48c) returned 1 [0203.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.id_1622540890_.your_last_chance")) returned 1 [0203.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0203.107] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0203.107] GetProcessHeap () returned 0x580000 [0203.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x72e8220 [0203.108] GetProcessHeap () returned 0x580000 [0203.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x621) returned 0x72e8868 [0203.108] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.108] ReadFile (in: hFile=0x48c, lpBuffer=0x72e8220, nNumberOfBytesToRead=0x600, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e8220*, lpNumberOfBytesRead=0x600ff14*=0x600, lpOverlapped=0x0) returned 1 [0203.114] GetProcessHeap () returned 0x580000 [0203.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0203.114] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.114] WriteFile (in: hFile=0x48c, lpBuffer=0x72e8868*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e8868*, lpNumberOfBytesWritten=0x600ff14*=0x600, lpOverlapped=0x0) returned 1 [0203.114] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.115] WriteFile (in: hFile=0x48c, lpBuffer=0x72e8e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e8e67*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0203.115] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.115] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0203.115] CloseHandle (hObject=0x48c) returned 1 [0203.115] GetProcessHeap () returned 0x580000 [0203.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72e8868 | out: hHeap=0x580000) returned 1 [0203.115] GetProcessHeap () returned 0x580000 [0203.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72e8220 | out: hHeap=0x580000) returned 1 [0203.115] GetProcessHeap () returned 0x580000 [0203.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0203.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ae9880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x636, dwReserved0=0x600fd28, dwReserved1=0x72e8220, cFileName="FormsPrintTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSP~1.YOU")) returned 0x5b9770 [0203.115] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.128] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned 1 [0203.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0203.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0203.716] CloseHandle (hObject=0x4a8) returned 1 [0203.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.717] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.id_1622540890_.your_last_chance")) returned 1 [0208.201] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0208.201] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7f0, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b9830 [0208.201] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0208.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0208.201] GetProcessHeap () returned 0x580000 [0208.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x706ecb0 [0208.201] GetProcessHeap () returned 0x580000 [0208.201] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x706f538 [0208.201] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.201] ReadFile (in: hFile=0x4a8, lpBuffer=0x706ecb0, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesRead=0x600ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0208.209] GetProcessHeap () returned 0x580000 [0208.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.209] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.209] WriteFile (in: hFile=0x4a8, lpBuffer=0x706f538*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x706f538*, lpNumberOfBytesWritten=0x600ff14*=0x7e0, lpOverlapped=0x0) returned 1 [0208.209] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.209] WriteFile (in: hFile=0x4a8, lpBuffer=0x706fd17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fd17*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.210] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.210] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.210] CloseHandle (hObject=0x4a8) returned 1 [0208.210] GetProcessHeap () returned 0x580000 [0208.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706f538 | out: hHeap=0x580000) returned 1 [0208.210] GetProcessHeap () returned 0x580000 [0208.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0208.210] GetProcessHeap () returned 0x580000 [0208.210] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0209.931] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3b698c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x600fd28, dwReserved1=0x706ecb0, cFileName="FormsImageTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSI~1.YOU")) returned 0x5b97b0 [0209.931] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.477] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS", len=0x45 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS") returned 1 [0210.478] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0210.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0210.625] CloseHandle (hObject=0x45c) returned 1 [0210.625] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.625] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css.id_1622540890_.your_last_chance")) returned 1 [0210.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233e6c00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x233e6c00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x2072a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC904A~1.YOU")) returned 0x5b9830 [0210.626] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0210.626] GetProcessHeap () returned 0x580000 [0210.626] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e78e10 [0210.627] GetProcessHeap () returned 0x580000 [0210.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8a640 [0210.627] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.627] ReadFile (in: hFile=0x45c, lpBuffer=0x6e78e10, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78e10*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.217] GetProcessHeap () returned 0x580000 [0214.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0214.218] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.218] WriteFile (in: hFile=0x45c, lpBuffer=0x6e8a640*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a640*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.218] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.218] WriteFile (in: hFile=0x45c, lpBuffer=0x6e9be3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be3f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.219] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.219] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.219] CloseHandle (hObject=0x45c) returned 1 [0214.219] GetProcessHeap () returned 0x580000 [0214.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8a640 | out: hHeap=0x580000) returned 1 [0214.264] GetProcessHeap () returned 0x580000 [0214.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e78e10 | out: hHeap=0x580000) returned 1 [0214.264] GetProcessHeap () returned 0x580000 [0214.264] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0215.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233e6c00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb74b0a20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2074e, dwReserved0=0x600fd28, dwReserved1=0x6e78e10, cFileName="SCHEME10.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC904A~1.YOU")) returned 0x5b97b0 [0215.050] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.110] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK", len=0x40 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 1 [0215.110] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0215.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.111] CloseHandle (hObject=0x43c) returned 1 [0215.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~1.YOU")) returned 0x5b97b0 [0215.112] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.113] GetProcessHeap () returned 0x580000 [0215.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.113] GetProcessHeap () returned 0x580000 [0215.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.113] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.113] ReadFile (in: hFile=0x43c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x600ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.114] GetProcessHeap () returned 0x580000 [0215.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.114] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.114] WriteFile (in: hFile=0x43c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x600ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.114] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.114] WriteFile (in: hFile=0x43c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.114] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.114] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.114] CloseHandle (hObject=0x43c) returned 1 [0215.115] GetProcessHeap () returned 0x580000 [0215.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.115] GetProcessHeap () returned 0x580000 [0215.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.115] GetProcessHeap () returned 0x580000 [0215.115] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7d519e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x600fd28, dwReserved1=0x61b540, cFileName="MSTORE_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~1.YOU")) returned 0x5b97b0 [0215.115] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.175] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS", len=0x3a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 1 [0215.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0215.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0215.176] CloseHandle (hObject=0x4ac) returned 1 [0215.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id_1622540890_.your_last_chance")) returned 1 [0215.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x5f254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS2DD3~1.YOU")) returned 0x5b97b0 [0215.178] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0215.178] GetProcessHeap () returned 0x580000 [0215.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e32d50 [0215.178] GetProcessHeap () returned 0x580000 [0215.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e44580 [0215.179] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.179] ReadFile (in: hFile=0x4ac, lpBuffer=0x6e32d50, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.480] GetProcessHeap () returned 0x580000 [0220.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce120 [0220.480] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.480] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e44580*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e44580*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0220.481] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.481] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e55d7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55d7f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0220.788] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.788] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0220.789] CloseHandle (hObject=0x4ac) returned 1 [0220.789] GetProcessHeap () returned 0x580000 [0220.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e44580 | out: hHeap=0x580000) returned 1 [0220.794] GetProcessHeap () returned 0x580000 [0220.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0220.795] GetProcessHeap () returned 0x580000 [0220.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce120 | out: hHeap=0x580000) returned 1 [0221.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbb378e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5f278, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="MSTORE.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MS2DD3~1.YOU")) returned 0x5b9730 [0221.878] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.883] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", len=0x68 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned 1 [0221.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0221.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0221.942] CloseHandle (hObject=0x4ac) returned 1 [0221.942] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.942] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.id_1622540890_.your_last_chance")) returned 1 [0221.943] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZOOMIC~2.YOU")) returned 0x5b9730 [0221.943] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0221.943] GetProcessHeap () returned 0x580000 [0221.943] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x677cd0 [0221.944] GetProcessHeap () returned 0x580000 [0221.944] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc61) returned 0x6fadcb8 [0221.944] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.944] ReadFile (in: hFile=0x4ac, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc40, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x600ff14*=0xc40, lpOverlapped=0x0) returned 1 [0222.030] GetProcessHeap () returned 0x580000 [0222.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0222.030] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x6fadcb8*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fadcb8*, lpNumberOfBytesWritten=0x600ff14*=0xc40, lpOverlapped=0x0) returned 1 [0222.030] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x6fae8f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fae8f7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0222.030] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0222.031] CloseHandle (hObject=0x4ac) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fadcb8 | out: hHeap=0x580000) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0222.351] GetProcessHeap () returned 0x580000 [0222.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0223.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbf39b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc7d, dwReserved0=0x600fd28, dwReserved1=0x677cd0, cFileName="ZoomIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZOOMIC~2.YOU")) returned 0x5b96f0 [0223.730] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.747] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", len=0x5f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned 1 [0223.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0223.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0224.435] CloseHandle (hObject=0x45c) returned 1 [0224.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0224.435] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.id_1622540890_.your_last_chance")) returned 1 [0224.976] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0224.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26b4, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b9630 [0225.015] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0225.016] GetProcessHeap () returned 0x580000 [0225.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26c1) returned 0x6f976f8 [0225.016] GetProcessHeap () returned 0x580000 [0225.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x26c1) returned 0x745f058 [0225.016] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.016] ReadFile (in: hFile=0x45c, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x26a0, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x600ff14*=0x26a0, lpOverlapped=0x0) returned 1 [0226.596] GetProcessHeap () returned 0x580000 [0226.596] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0226.596] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.596] WriteFile (in: hFile=0x45c, lpBuffer=0x745f058*, nNumberOfBytesToWrite=0x26a0, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x745f058*, lpNumberOfBytesWritten=0x600ff14*=0x26a0, lpOverlapped=0x0) returned 1 [0226.596] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.596] WriteFile (in: hFile=0x45c, lpBuffer=0x74616f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x74616f7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.597] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.597] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.597] CloseHandle (hObject=0x45c) returned 1 [0226.597] GetProcessHeap () returned 0x580000 [0226.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x745f058 | out: hHeap=0x580000) returned 1 [0226.597] GetProcessHeap () returned 0x580000 [0226.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0226.597] GetProcessHeap () returned 0x580000 [0226.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0230.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe954020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26d8, dwReserved0=0x600fd28, dwReserved1=0x6f976f8, cFileName="form_edit.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_E~1.YOU")) returned 0x5b9630 [0230.247] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.309] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", len=0x37 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 1 [0230.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0230.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.310] CloseHandle (hObject=0x47c) returned 1 [0230.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.id_1622540890_.your_last_chance")) returned 1 [0230.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OEMPRI~1.YOU")) returned 0x5b9630 [0230.311] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\oemprint.cat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.312] GetProcessHeap () returned 0x580000 [0230.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ca1) returned 0x7162dd8 [0230.312] GetProcessHeap () returned 0x580000 [0230.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ca1) returned 0x72bc418 [0230.312] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.312] ReadFile (in: hFile=0x47c, lpBuffer=0x7162dd8, nNumberOfBytesToRead=0x1c80, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162dd8*, lpNumberOfBytesRead=0x600ff14*=0x1c80, lpOverlapped=0x0) returned 1 [0230.455] GetProcessHeap () returned 0x580000 [0230.455] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0230.455] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.455] WriteFile (in: hFile=0x47c, lpBuffer=0x72bc418*, nNumberOfBytesToWrite=0x1c80, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bc418*, lpNumberOfBytesWritten=0x600ff14*=0x1c80, lpOverlapped=0x0) returned 1 [0230.455] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.455] WriteFile (in: hFile=0x47c, lpBuffer=0x72be097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x72be097*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0230.455] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.455] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0230.455] CloseHandle (hObject=0x47c) returned 1 [0230.455] GetProcessHeap () returned 0x580000 [0230.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72bc418 | out: hHeap=0x580000) returned 1 [0230.456] GetProcessHeap () returned 0x580000 [0230.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162dd8 | out: hHeap=0x580000) returned 1 [0230.456] GetProcessHeap () returned 0x580000 [0230.456] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e133c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1cbd, dwReserved0=0x600fd28, dwReserved1=0x7162dd8, cFileName="OEMPRINT.CAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OEMPRI~1.YOU")) returned 0x5b9630 [0230.456] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.465] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", len=0x34 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 1 [0230.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0230.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.523] CloseHandle (hObject=0x47c) returned 1 [0230.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.id_1622540890_.your_last_chance")) returned 1 [0230.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBT~1.YOU")) returned 0x5b9630 [0230.524] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.tlb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0230.524] GetProcessHeap () returned 0x580000 [0230.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74b9c98 [0230.525] GetProcessHeap () returned 0x580000 [0230.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74cb4c8 [0230.525] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.525] ReadFile (in: hFile=0x47c, lpBuffer=0x74b9c98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x74b9c98*, lpNumberOfBytesRead=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.343] GetProcessHeap () returned 0x580000 [0238.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0238.344] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.344] WriteFile (in: hFile=0x47c, lpBuffer=0x74cb4c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x74cb4c8*, lpNumberOfBytesWritten=0x600ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.331] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.331] WriteFile (in: hFile=0x47c, lpBuffer=0x74dccc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x74dccc7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.331] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.331] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.331] CloseHandle (hObject=0x47c) returned 1 [0239.390] GetProcessHeap () returned 0x580000 [0239.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74cb4c8 | out: hHeap=0x580000) returned 1 [0239.390] GetProcessHeap () returned 0x580000 [0239.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74b9c98 | out: hHeap=0x580000) returned 1 [0239.390] GetProcessHeap () returned 0x580000 [0239.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0240.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc62ba220, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4c, dwReserved0=0x600fd28, dwReserved1=0x74b9c98, cFileName="MSPUB.TLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBT~1.YOU")) returned 0x5b9730 [0240.644] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.655] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", len=0x4f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned 1 [0240.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0240.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.723] CloseHandle (hObject=0x264) returned 1 [0240.723] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.723] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml.id_1622540890_.your_last_chance")) returned 1 [0240.724] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA20A7~1.YOU")) returned 0x5b9730 [0240.724] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.724] GetProcessHeap () returned 0x580000 [0240.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c62c60 [0240.724] GetProcessHeap () returned 0x580000 [0240.724] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c62fc8 [0240.724] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.724] ReadFile (in: hFile=0x264, lpBuffer=0x6c62c60, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62c60*, lpNumberOfBytesRead=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.783] GetProcessHeap () returned 0x580000 [0240.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.783] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.783] WriteFile (in: hFile=0x264, lpBuffer=0x6c62fc8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c62fc8*, lpNumberOfBytesWritten=0x600ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.783] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.783] WriteFile (in: hFile=0x264, lpBuffer=0x6c632e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c632e7*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.783] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.783] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.784] CloseHandle (hObject=0x264) returned 1 [0240.784] GetProcessHeap () returned 0x580000 [0240.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c62fc8 | out: hHeap=0x580000) returned 1 [0240.784] GetProcessHeap () returned 0x580000 [0240.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c62c60 | out: hHeap=0x580000) returned 1 [0240.784] GetProcessHeap () returned 0x580000 [0240.784] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.784] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7090200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x600fd28, dwReserved1=0x6c62c60, cFileName="YAHOO.COM.BR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA20A7~1.YOU")) returned 0x5b9730 [0240.784] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.810] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini", len=0x44 | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned 1 [0240.810] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0240.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.899] CloseHandle (hObject=0x418) returned 1 [0240.899] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini.id_1622540890_.your_last_chance")) returned 1 [0240.900] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.900] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~1.YOU")) returned 0x5b9730 [0240.900] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.900] GetProcessHeap () returned 0x580000 [0240.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0240.901] GetProcessHeap () returned 0x580000 [0240.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0240.901] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.901] ReadFile (in: hFile=0x418, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x600ff14*=0x60, lpOverlapped=0x0) returned 1 [0240.902] GetProcessHeap () returned 0x580000 [0240.902] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.902] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.902] WriteFile (in: hFile=0x418, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x600ff14*=0x60, lpOverlapped=0x0) returned 1 [0240.902] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.902] WriteFile (in: hFile=0x418, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.902] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.902] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.902] CloseHandle (hObject=0x418) returned 1 [0240.902] GetProcessHeap () returned 0x580000 [0240.902] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0240.902] GetProcessHeap () returned 0x580000 [0240.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0240.903] GetProcessHeap () returned 0x580000 [0240.903] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc71c0d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9f, dwReserved0=0x600fd28, dwReserved1=0x61b540, cFileName="SendToOneNote.ini.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SENDTO~1.YOU")) returned 0x5b9630 [0241.849] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.863] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML", len=0x3f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned 1 [0241.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0241.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0245.386] CloseHandle (hObject=0x470) returned 1 [0245.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml.id_1622540890_.your_last_chance")) returned 1 [0248.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60487100, ftCreationTime.dwHighDateTime=0x1c9e332, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60487100, ftLastWriteTime.dwHighDateTime=0x1c9e332, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN04~2.YOU")) returned 0x5b96f0 [0248.534] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0248.535] GetProcessHeap () returned 0x580000 [0248.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6daf1e8 [0248.535] GetProcessHeap () returned 0x580000 [0248.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1421) returned 0x6db06f0 [0248.535] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.535] ReadFile (in: hFile=0x470, lpBuffer=0x6daf1e8, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1e8*, lpNumberOfBytesRead=0x600ff14*=0x1400, lpOverlapped=0x0) returned 1 [0248.554] GetProcessHeap () returned 0x580000 [0248.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0248.554] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.554] WriteFile (in: hFile=0x470, lpBuffer=0x6db06f0*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db06f0*, lpNumberOfBytesWritten=0x600ff14*=0x1400, lpOverlapped=0x0) returned 1 [0248.554] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.554] WriteFile (in: hFile=0x470, lpBuffer=0x6db1aef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db1aef*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.554] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.554] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.555] CloseHandle (hObject=0x470) returned 1 [0248.555] GetProcessHeap () returned 0x580000 [0248.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db06f0 | out: hHeap=0x580000) returned 1 [0248.555] GetProcessHeap () returned 0x580000 [0248.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1e8 | out: hHeap=0x580000) returned 1 [0248.555] GetProcessHeap () returned 0x580000 [0248.555] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60487100, ftCreationTime.dwHighDateTime=0x1c9e332, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbaa6ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1436, dwReserved0=0x600fd28, dwReserved1=0x6daf1e8, cFileName="PGMN044.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN04~2.YOU")) returned 0x5b9730 [0253.552] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.603] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC", len=0x3a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 1 [0253.603] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0253.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0253.604] CloseHandle (hObject=0x268) returned 1 [0253.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.id_1622540890_.your_last_chance")) returned 1 [0253.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.605] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xb95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AD98PO~1.YOU")) returned 0x5b9730 [0253.605] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0253.605] GetProcessHeap () returned 0x580000 [0253.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb961) returned 0x703fe38 [0253.605] GetProcessHeap () returned 0x580000 [0253.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb961) returned 0x6fb2e00 [0253.605] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.605] ReadFile (in: hFile=0x268, lpBuffer=0x703fe38, nNumberOfBytesToRead=0xb940, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x703fe38*, lpNumberOfBytesRead=0x600ff14*=0xb940, lpOverlapped=0x0) returned 1 [0257.229] GetProcessHeap () returned 0x580000 [0257.230] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0257.230] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.230] WriteFile (in: hFile=0x268, lpBuffer=0x6fb2e00*, nNumberOfBytesToWrite=0xb940, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2e00*, lpNumberOfBytesWritten=0x600ff14*=0xb940, lpOverlapped=0x0) returned 1 [0257.230] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.230] WriteFile (in: hFile=0x268, lpBuffer=0x6fbe73f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbe73f*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.230] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.231] WriteFile (in: hFile=0x268, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.231] CloseHandle (hObject=0x268) returned 1 [0257.822] GetProcessHeap () returned 0x580000 [0257.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2e00 | out: hHeap=0x580000) returned 1 [0257.822] GetProcessHeap () returned 0x580000 [0257.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703fe38 | out: hHeap=0x580000) returned 1 [0257.822] GetProcessHeap () returned 0x580000 [0257.822] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0259.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0d84ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb97e, dwReserved0=0x600fd28, dwReserved1=0x703fe38, cFileName="AD98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AD98PO~1.YOU")) returned 0x5b9730 [0259.146] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.148] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML", len=0x3a | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML") returned 1 [0259.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ff0) returned 0x72e5948 [0259.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0259.149] CloseHandle (hObject=0x468) returned 1 [0259.149] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.150] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml.id_1622540890_.your_last_chance")) returned 1 [0259.151] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fc74 | out: lpFindFileData=0x600fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3389e500, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3389e500, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x4260, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSXM~1.YOU")) returned 0x5b9730 [0259.151] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0259.151] GetProcessHeap () returned 0x580000 [0259.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4281) returned 0x6ebe1f8 [0259.151] GetProcessHeap () returned 0x580000 [0259.151] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4281) returned 0x7301a38 [0259.151] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.151] ReadFile (in: hFile=0x468, lpBuffer=0x6ebe1f8, nNumberOfBytesToRead=0x4260, lpNumberOfBytesRead=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ebe1f8*, lpNumberOfBytesRead=0x600ff14*=0x4260, lpOverlapped=0x0) returned 1 [0261.130] GetProcessHeap () returned 0x580000 [0261.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0261.130] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.130] WriteFile (in: hFile=0x468, lpBuffer=0x7301a38*, nNumberOfBytesToWrite=0x4260, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesWritten=0x600ff14*=0x4260, lpOverlapped=0x0) returned 1 [0261.130] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.130] WriteFile (in: hFile=0x468, lpBuffer=0x7305c97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x7305c97*, lpNumberOfBytesWritten=0x600ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.130] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.130] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x600ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x600ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.130] CloseHandle (hObject=0x468) returned 1 [0261.130] GetProcessHeap () returned 0x580000 [0261.130] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0261.131] GetProcessHeap () returned 0x580000 [0261.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ebe1f8 | out: hHeap=0x580000) returned 1 [0261.131] GetProcessHeap () returned 0x580000 [0261.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0261.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x600fccc | out: lpFindFileData=0x600fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3389e500, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd32b6460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4284, dwReserved0=0x600fd28, dwReserved1=0x6ebe1f8, cFileName="NEWS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NEWSXM~1.YOU")) returned 0x5b9630 [0261.131] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.876] SysReAllocStringLen (in: pbstr=0x600ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy", len=0x5f | out: pbstr=0x600ff84*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy") returned 1 [0262.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2058) returned 0x72e5948 [0262.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0264.662] CloseHandle (hObject=0x490) returned 1 [0264.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x600ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0264.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy.id_1622540890_.your_last_chance")) Thread: id = 54 os_tid = 0xad0 [0039.070] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.411] Sleep (dwMilliseconds=0x1) [0039.578] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.918] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.549] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.555] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.699] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.856] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.291] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.354] Sleep (dwMilliseconds=0x1) [0043.369] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.416] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.447] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.541] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.572] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.759] Sleep (dwMilliseconds=0x1) [0043.775] Sleep (dwMilliseconds=0x1) [0043.790] Sleep (dwMilliseconds=0x1) [0043.805] Sleep (dwMilliseconds=0x1) [0043.821] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.852] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.930] Sleep (dwMilliseconds=0x1) [0043.946] Sleep (dwMilliseconds=0x1) [0043.961] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.996] Sleep (dwMilliseconds=0x1) [0044.014] Sleep (dwMilliseconds=0x1) [0044.025] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.058] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.414] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.445] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.523] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.554] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.601] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.663] Sleep (dwMilliseconds=0x1) [0044.679] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.710] Sleep (dwMilliseconds=0x1) [0044.726] Sleep (dwMilliseconds=0x1) [0044.741] Sleep (dwMilliseconds=0x1) [0044.757] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.788] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.819] Sleep (dwMilliseconds=0x1) [0044.835] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.866] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.897] Sleep (dwMilliseconds=0x1) [0044.913] Sleep (dwMilliseconds=0x1) [0044.928] Sleep (dwMilliseconds=0x1) [0044.944] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.975] Sleep (dwMilliseconds=0x1) [0044.991] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.022] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.053] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.084] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.131] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.178] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.209] Sleep (dwMilliseconds=0x1) [0045.225] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.287] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.334] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.365] Sleep (dwMilliseconds=0x1) [0045.381] Sleep (dwMilliseconds=0x1) [0045.396] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.443] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.492] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.521] Sleep (dwMilliseconds=0x1) [0045.537] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.568] Sleep (dwMilliseconds=0x1) [0045.584] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.672] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.724] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.802] Sleep (dwMilliseconds=0x1) [0045.819] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.882] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.958] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.114] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.161] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.317] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.411] Sleep (dwMilliseconds=0x1) [0046.426] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.504] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.551] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.583] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.738] Sleep (dwMilliseconds=0x1) [0046.754] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.816] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.863] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.894] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.941] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.081] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.175] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.253] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.284] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.535] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.565] Sleep (dwMilliseconds=0x1) [0047.581] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.663] Sleep (dwMilliseconds=0x1) [0047.680] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.705] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.908] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.017] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.173] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.220] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.298] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.485] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.532] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.610] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.641] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.688] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.721] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.797] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.844] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.953] Sleep (dwMilliseconds=0x1) [0048.969] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.111] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.312] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.439] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.468] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.624] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.780] Sleep (dwMilliseconds=0x1) [0049.796] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.936] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.092] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.248] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.404] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.452] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.966] Sleep (dwMilliseconds=0x1) [0050.981] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.028] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.293] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.326] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.387] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.496] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.590] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.763] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.841] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.904] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.997] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.092] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.231] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.278] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.309] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.372] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.434] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.699] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.840] Sleep (dwMilliseconds=0x1) [0052.855] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.902] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.933] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.215] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.635] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.713] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.760] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.791] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.201] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.244] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.275] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.384] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.587] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.852] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.040] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0059.624] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", len=0x4c | out: pbstr=0x614ff84*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 1 [0059.624] GetProcessHeap () returned 0x580000 [0059.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6077d8, Size=0x60) returned 0x5e1510 [0059.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.065] CloseHandle (hObject=0x458) returned 1 [0061.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.065] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id_1622540890_.your_last_chance")) returned 1 [0061.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.066] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x450043, dwReserved1=0x0, cFileName="GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~3.YOU")) returned 0x5b9630 [0061.066] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.066] GetProcessHeap () returned 0x580000 [0061.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x5f7360 [0061.066] GetProcessHeap () returned 0x580000 [0061.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x5f3908 [0061.066] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.066] ReadFile (in: hFile=0x458, lpBuffer=0x5f7360, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f7360*, lpNumberOfBytesRead=0x614ff14*=0x380, lpOverlapped=0x0) returned 1 [0061.157] GetProcessHeap () returned 0x580000 [0061.157] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0061.157] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.157] WriteFile (in: hFile=0x458, lpBuffer=0x5f3908*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesWritten=0x614ff14*=0x380, lpOverlapped=0x0) returned 1 [0061.157] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.157] WriteFile (in: hFile=0x458, lpBuffer=0x5f3c87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3c87*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.158] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.158] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.158] CloseHandle (hObject=0x458) returned 1 [0061.159] GetProcessHeap () returned 0x580000 [0061.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0061.159] GetProcessHeap () returned 0x580000 [0061.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f7360 | out: hHeap=0x580000) returned 1 [0061.159] GetProcessHeap () returned 0x580000 [0061.159] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0061.159] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5c40d380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b5, dwReserved0=0x614fd28, dwReserved1=0x5f7360, cFileName="GrooveMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~3.YOU")) returned 0x5b9630 [0061.159] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.215] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", len=0x49 | out: pbstr=0x614ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 1 [0061.216] GetProcessHeap () returned 0x580000 [0061.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x24) returned 0x5dc550 [0061.216] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0061.216] CloseHandle (hObject=0x460) returned 1 [0061.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.216] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id_1622540890_.your_last_chance")) returned 1 [0061.217] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.217] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10R~1.YOU")) returned 0x5b96b0 [0061.217] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0061.217] GetProcessHeap () returned 0x580000 [0061.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x636970 [0061.217] GetProcessHeap () returned 0x580000 [0061.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a41) returned 0x63d3c0 [0061.217] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.217] ReadFile (in: hFile=0x460, lpBuffer=0x636970, nNumberOfBytesToRead=0x6a20, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x614ff14*=0x6a20, lpOverlapped=0x0) returned 1 [0063.486] GetProcessHeap () returned 0x580000 [0063.486] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0063.486] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.486] WriteFile (in: hFile=0x460, lpBuffer=0x63d3c0*, nNumberOfBytesToWrite=0x6a20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x63d3c0*, lpNumberOfBytesWritten=0x614ff14*=0x6a20, lpOverlapped=0x0) returned 1 [0064.766] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.766] WriteFile (in: hFile=0x460, lpBuffer=0x643ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x643ddf*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0064.766] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.766] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0064.766] CloseHandle (hObject=0x460) returned 1 [0064.767] GetProcessHeap () returned 0x580000 [0064.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x63d3c0 | out: hHeap=0x580000) returned 1 [0064.767] GetProcessHeap () returned 0x580000 [0064.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0064.767] GetProcessHeap () returned 0x580000 [0064.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0064.768] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0x5e5d2ba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a5f, dwReserved0=0x614fd28, dwReserved1=0x636970, cFileName="pss10r.chm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSS10R~1.YOU")) returned 0x5b9630 [0064.768] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0066.491] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", len=0x4b | out: pbstr=0x614ff84*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 1 [0066.491] GetProcessHeap () returned 0x580000 [0066.491] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x38) returned 0x5e9710 [0066.491] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0073.758] CloseHandle (hObject=0x440) returned 1 [0073.758] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0073.758] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id_1622540890_.your_last_chance")) returned 1 [0075.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0075.376] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x45, dwReserved1=0x0, cFileName="VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~1.YOU")) returned 0x5b96f0 [0075.376] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.376] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0075.376] GetProcessHeap () returned 0x580000 [0075.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c448d8 [0075.376] GetProcessHeap () returned 0x580000 [0075.376] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0075.376] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0075.376] ReadFile (in: hFile=0x440, lpBuffer=0x6c448d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448d8*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.032] GetProcessHeap () returned 0x580000 [0079.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.032] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.032] WriteFile (in: hFile=0x440, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0079.032] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.032] WriteFile (in: hFile=0x440, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.280] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.280] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.280] CloseHandle (hObject=0x440) returned 1 [0079.280] GetProcessHeap () returned 0x580000 [0079.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0079.282] GetProcessHeap () returned 0x580000 [0079.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c448d8 | out: hHeap=0x580000) returned 1 [0079.283] GetProcessHeap () returned 0x580000 [0079.283] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.477] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x66df35c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa31b, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="VisiorWW.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOR~1.YOU")) returned 0x5b96f0 [0079.477] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.487] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", len=0x65 | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 1 [0079.487] GetProcessHeap () returned 0x580000 [0079.487] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6478, Size=0x18) returned 0x5a58e8 [0079.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.494] CloseHandle (hObject=0x478) returned 1 [0079.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0079.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0079.495] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0079.495] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0079.495] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0079.495] GetProcessHeap () returned 0x580000 [0079.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6f06bb8 [0079.495] GetProcessHeap () returned 0x580000 [0079.495] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6d0f510 [0079.495] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.495] ReadFile (in: hFile=0x478, lpBuffer=0x6f06bb8, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesRead=0x614ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0079.511] GetProcessHeap () returned 0x580000 [0079.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0079.511] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.511] WriteFile (in: hFile=0x478, lpBuffer=0x6d0f510*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f510*, lpNumberOfBytesWritten=0x614ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0079.511] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.511] WriteFile (in: hFile=0x478, lpBuffer=0x6d0fdef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0fdef*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0079.511] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0079.511] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0079.511] CloseHandle (hObject=0x478) returned 1 [0079.511] GetProcessHeap () returned 0x580000 [0079.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0f510 | out: hHeap=0x580000) returned 1 [0079.511] GetProcessHeap () returned 0x580000 [0079.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0079.511] GetProcessHeap () returned 0x580000 [0079.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0079.512] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x67008900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x614fd28, dwReserved1=0x6f06bb8, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9730 [0079.512] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.170] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 1 [0080.170] GetProcessHeap () returned 0x580000 [0080.170] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0080.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0080.171] CloseHandle (hObject=0x488) returned 1 [0080.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.171] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0080.171] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0080.172] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0080.172] GetProcessHeap () returned 0x580000 [0080.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6f06bb8 [0080.172] GetProcessHeap () returned 0x580000 [0080.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6f0c4f8 [0080.172] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.172] ReadFile (in: hFile=0x488, lpBuffer=0x6f06bb8, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesRead=0x614ff14*=0x720, lpOverlapped=0x0) returned 1 [0080.182] GetProcessHeap () returned 0x580000 [0080.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0080.182] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.182] WriteFile (in: hFile=0x488, lpBuffer=0x6f0c4f8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesWritten=0x614ff14*=0x720, lpOverlapped=0x0) returned 1 [0080.182] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.182] WriteFile (in: hFile=0x488, lpBuffer=0x6f0cc17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cc17*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0080.183] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.183] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0080.183] CloseHandle (hObject=0x488) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0080.183] GetProcessHeap () returned 0x580000 [0080.183] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0080.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6766e420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x614fd28, dwReserved1=0x6f06bb8, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0080.183] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.717] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", len=0x6d | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 1 [0080.717] GetProcessHeap () returned 0x580000 [0080.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0080.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.718] CloseHandle (hObject=0x458) returned 1 [0080.718] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.718] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id_1622540890_.your_last_chance")) returned 1 [0080.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x4d0058, dwReserved1=0x2e004c, cFileName="OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0080.726] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0080.727] GetProcessHeap () returned 0x580000 [0080.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f3b78 [0080.727] GetProcessHeap () returned 0x580000 [0080.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6f06bb8 [0080.727] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.727] ReadFile (in: hFile=0x458, lpBuffer=0x5f3b78, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3b78*, lpNumberOfBytesRead=0x614ff14*=0x320, lpOverlapped=0x0) returned 1 [0080.731] GetProcessHeap () returned 0x580000 [0080.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0080.731] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.731] WriteFile (in: hFile=0x458, lpBuffer=0x6f06bb8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06bb8*, lpNumberOfBytesWritten=0x614ff14*=0x320, lpOverlapped=0x0) returned 1 [0080.731] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.732] WriteFile (in: hFile=0x458, lpBuffer=0x6f06ed7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f06ed7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0080.732] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.732] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0080.732] CloseHandle (hObject=0x458) returned 1 [0080.732] GetProcessHeap () returned 0x580000 [0080.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f06bb8 | out: hHeap=0x580000) returned 1 [0080.732] GetProcessHeap () returned 0x580000 [0080.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3b78 | out: hHeap=0x580000) returned 1 [0080.732] GetProcessHeap () returned 0x580000 [0080.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0080.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x67bc95a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x614fd28, dwReserved1=0x5f3b78, cFileName="OfficeMUISet.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0080.732] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.746] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", len=0x6a | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 1 [0080.746] GetProcessHeap () returned 0x580000 [0080.746] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9528 [0080.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0080.746] CloseHandle (hObject=0x170) returned 1 [0080.746] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.747] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id_1622540890_.your_last_chance")) returned 1 [0080.747] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0080.747] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0080.747] GetProcessHeap () returned 0x580000 [0080.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x15c1) returned 0x6d0e508 [0080.748] GetProcessHeap () returned 0x580000 [0080.748] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x15c1) returned 0x6d2fb88 [0080.748] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.748] ReadFile (in: hFile=0x170, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x15a0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x614ff14*=0x15a0, lpOverlapped=0x0) returned 1 [0081.025] GetProcessHeap () returned 0x580000 [0081.025] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0081.025] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.025] WriteFile (in: hFile=0x170, lpBuffer=0x6d2fb88*, nNumberOfBytesToWrite=0x15a0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2fb88*, lpNumberOfBytesWritten=0x614ff14*=0x15a0, lpOverlapped=0x0) returned 1 [0081.025] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.025] WriteFile (in: hFile=0x170, lpBuffer=0x6d31127*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d31127*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.026] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.026] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.026] CloseHandle (hObject=0x170) returned 1 [0081.402] GetProcessHeap () returned 0x580000 [0081.402] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2fb88 | out: hHeap=0x580000) returned 1 [0081.403] GetProcessHeap () returned 0x580000 [0081.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.403] GetProcessHeap () returned 0x580000 [0081.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0081.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x67e76e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x15d9, dwReserved0=0x614fd28, dwReserved1=0x6d0e508, cFileName="OfficeMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b96f0 [0081.588] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.969] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", len=0x49 | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 1 [0085.969] GetProcessHeap () returned 0x580000 [0085.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x74) returned 0x614a48 [0085.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.970] Sleep (dwMilliseconds=0x1) [0086.367] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 1 [0086.367] GetProcessHeap () returned 0x580000 [0086.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0086.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0086.382] CloseHandle (hObject=0x46c) returned 1 [0086.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.382] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0086.382] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0086.383] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0086.383] GetProcessHeap () returned 0x580000 [0086.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d61) returned 0x62fca8 [0086.383] GetProcessHeap () returned 0x580000 [0086.383] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4d61) returned 0x6c680f8 [0086.383] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.383] ReadFile (in: hFile=0x46c, lpBuffer=0x62fca8, nNumberOfBytesToRead=0x4d40, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x62fca8*, lpNumberOfBytesRead=0x614ff14*=0x4d40, lpOverlapped=0x0) returned 1 [0086.985] GetProcessHeap () returned 0x580000 [0086.985] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0086.985] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.985] WriteFile (in: hFile=0x46c, lpBuffer=0x6c680f8*, nNumberOfBytesToWrite=0x4d40, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c680f8*, lpNumberOfBytesWritten=0x614ff14*=0x4d40, lpOverlapped=0x0) returned 1 [0086.985] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.470] WriteFile (in: hFile=0x46c, lpBuffer=0x6c6ce37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6ce37*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0087.470] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.470] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0087.470] CloseHandle (hObject=0x46c) returned 1 [0087.471] GetProcessHeap () returned 0x580000 [0087.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c680f8 | out: hHeap=0x580000) returned 1 [0087.471] GetProcessHeap () returned 0x580000 [0087.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62fca8 | out: hHeap=0x580000) returned 1 [0087.471] GetProcessHeap () returned 0x580000 [0087.471] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bc0e7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d68, dwReserved0=0x614fd28, dwReserved1=0x62fca8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0088.144] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.848] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", len=0x48 | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 1 [0091.848] GetProcessHeap () returned 0x580000 [0091.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b96f0 [0091.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0091.871] CloseHandle (hObject=0x474) returned 1 [0091.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0091.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0091.872] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0091.873] GetProcessHeap () returned 0x580000 [0091.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x49a1) returned 0x6c751e8 [0091.873] GetProcessHeap () returned 0x580000 [0091.873] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x49a1) returned 0x6c50cb8 [0091.873] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.873] ReadFile (in: hFile=0x474, lpBuffer=0x6c751e8, nNumberOfBytesToRead=0x4980, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c751e8*, lpNumberOfBytesRead=0x614ff14*=0x4980, lpOverlapped=0x0) returned 1 [0093.034] GetProcessHeap () returned 0x580000 [0093.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.034] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.034] WriteFile (in: hFile=0x474, lpBuffer=0x6c50cb8*, nNumberOfBytesToWrite=0x4980, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c50cb8*, lpNumberOfBytesWritten=0x614ff14*=0x4980, lpOverlapped=0x0) returned 1 [0093.035] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.035] WriteFile (in: hFile=0x474, lpBuffer=0x6c55637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55637*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0093.035] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.035] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0093.035] CloseHandle (hObject=0x474) returned 1 [0093.035] GetProcessHeap () returned 0x580000 [0093.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c50cb8 | out: hHeap=0x580000) returned 1 [0093.035] GetProcessHeap () returned 0x580000 [0093.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c751e8 | out: hHeap=0x580000) returned 1 [0093.035] GetProcessHeap () returned 0x580000 [0093.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.164] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f105120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x49a5, dwReserved0=0x614fd28, dwReserved1=0x6c751e8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96f0 [0094.164] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.164] Sleep (dwMilliseconds=0x1) [0094.184] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", len=0x4b | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 1 [0094.184] GetProcessHeap () returned 0x580000 [0094.184] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x3c) returned 0x61aa08 [0094.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0094.204] CloseHandle (hObject=0x484) returned 1 [0094.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id_1622540890_.your_last_chance")) returned 1 [0094.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x45, dwReserved1=0x0, cFileName="REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REFINE~1.YOU")) returned 0x5b96b0 [0094.205] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0094.205] GetProcessHeap () returned 0x580000 [0094.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb321) returned 0x6c4a3c8 [0094.205] GetProcessHeap () returned 0x580000 [0094.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb321) returned 0x6cb72f8 [0094.205] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.205] ReadFile (in: hFile=0x484, lpBuffer=0x6c4a3c8, nNumberOfBytesToRead=0xb300, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a3c8*, lpNumberOfBytesRead=0x614ff14*=0xb300, lpOverlapped=0x0) returned 1 [0098.202] GetProcessHeap () returned 0x580000 [0098.202] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.203] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.203] WriteFile (in: hFile=0x484, lpBuffer=0x6cb72f8*, nNumberOfBytesToWrite=0xb300, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cb72f8*, lpNumberOfBytesWritten=0x614ff14*=0xb300, lpOverlapped=0x0) returned 1 [0098.203] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.203] WriteFile (in: hFile=0x484, lpBuffer=0x6cc25f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cc25f7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.203] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.203] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.203] CloseHandle (hObject=0x484) returned 1 [0098.204] GetProcessHeap () returned 0x580000 [0098.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cb72f8 | out: hHeap=0x580000) returned 1 [0098.204] GetProcessHeap () returned 0x580000 [0098.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a3c8 | out: hHeap=0x580000) returned 1 [0098.204] GetProcessHeap () returned 0x580000 [0098.204] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x722699a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb332, dwReserved0=0x614fd28, dwReserved1=0x6c4a3c8, cFileName="REFINED.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REFINE~1.YOU")) returned 0x5b96f0 [0098.204] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0099.153] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 1 [0099.153] GetProcessHeap () returned 0x580000 [0099.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0099.153] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0099.153] CloseHandle (hObject=0x3f8) returned 1 [0099.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0100.628] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b9730 [0100.672] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0100.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0100.672] GetProcessHeap () returned 0x580000 [0100.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5541) returned 0x6f10048 [0100.672] GetProcessHeap () returned 0x580000 [0100.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5541) returned 0x6f15598 [0100.672] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.672] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x5520, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x614ff14*=0x5520, lpOverlapped=0x0) returned 1 [0101.186] GetProcessHeap () returned 0x580000 [0101.186] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0101.187] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.187] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f15598*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15598*, lpNumberOfBytesWritten=0x614ff14*=0x5520, lpOverlapped=0x0) returned 1 [0101.187] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.187] WriteFile (in: hFile=0x3f8, lpBuffer=0x6f1aab7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1aab7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.187] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.187] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.187] CloseHandle (hObject=0x3f8) returned 1 [0101.187] GetProcessHeap () returned 0x580000 [0101.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f15598 | out: hHeap=0x580000) returned 1 [0101.192] GetProcessHeap () returned 0x580000 [0101.192] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0101.192] GetProcessHeap () returned 0x580000 [0101.192] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0101.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73ed4040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5558, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.842] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0108.437] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 1 [0108.437] GetProcessHeap () returned 0x580000 [0108.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92e8 | out: hHeap=0x580000) returned 1 [0108.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0108.438] CloseHandle (hObject=0x448) returned 1 [0108.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0108.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id_1622540890_.your_last_chance")) returned 1 [0110.441] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0110.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOIN~1.YOU")) returned 0x5b9630 [0110.441] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0110.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0110.441] GetProcessHeap () returned 0x580000 [0110.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x67c940 [0110.441] GetProcessHeap () returned 0x580000 [0110.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e1) returned 0x668580 [0110.441] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.441] ReadFile (in: hFile=0x448, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x614ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0110.446] GetProcessHeap () returned 0x580000 [0110.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0110.446] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.446] WriteFile (in: hFile=0x448, lpBuffer=0x668580*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x668580*, lpNumberOfBytesWritten=0x614ff14*=0x2c0, lpOverlapped=0x0) returned 1 [0110.446] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.446] WriteFile (in: hFile=0x448, lpBuffer=0x66883f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x66883f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0110.446] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.446] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0110.446] CloseHandle (hObject=0x448) returned 1 [0110.446] GetProcessHeap () returned 0x580000 [0110.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x668580 | out: hHeap=0x580000) returned 1 [0110.446] GetProcessHeap () returned 0x580000 [0110.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0110.446] GetProcessHeap () returned 0x580000 [0110.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0110.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7970cfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x614fd28, dwReserved1=0x67c940, cFileName="VSTOInstaller.config.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VSTOIN~1.YOU")) returned 0x5b9730 [0110.447] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.109] Sleep (dwMilliseconds=0x1) [0111.120] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.715] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", len=0x42 | out: pbstr=0x614ff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 1 [0111.715] GetProcessHeap () returned 0x580000 [0111.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.717] Sleep (dwMilliseconds=0x1) [0111.888] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", len=0x35 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 1 [0111.888] GetProcessHeap () returned 0x580000 [0111.888] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.888] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.891] Sleep (dwMilliseconds=0x1) [0111.905] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", len=0x55 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 1 [0111.905] GetProcessHeap () returned 0x580000 [0111.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0111.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.908] Sleep (dwMilliseconds=0x1) [0111.947] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", len=0x3f | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned 1 [0111.947] GetProcessHeap () returned 0x580000 [0111.947] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x84) returned 0x61b4b0 [0111.947] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.956] Sleep (dwMilliseconds=0x1) [0111.965] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", len=0x41 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 1 [0111.965] GetProcessHeap () returned 0x580000 [0111.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0111.965] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.965] Sleep (dwMilliseconds=0x1) [0112.002] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 1 [0112.002] GetProcessHeap () returned 0x580000 [0112.002] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ab70, Size=0x38) returned 0x5b9630 [0112.002] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.006] Sleep (dwMilliseconds=0x1) [0112.009] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", len=0x4c | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 1 [0112.010] GetProcessHeap () returned 0x580000 [0112.010] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.010] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.011] Sleep (dwMilliseconds=0x1) [0112.055] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", len=0x57 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.055] GetProcessHeap () returned 0x580000 [0112.055] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.061] Sleep (dwMilliseconds=0x1) [0112.086] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", len=0x5a | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.086] GetProcessHeap () returned 0x580000 [0112.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.087] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.089] Sleep (dwMilliseconds=0x1) [0112.119] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", len=0x5a | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.119] GetProcessHeap () returned 0x580000 [0112.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9f48, Size=0x7c) returned 0x5fa1f0 [0112.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.119] Sleep (dwMilliseconds=0x1) [0112.135] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 1 [0112.135] GetProcessHeap () returned 0x580000 [0112.135] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.135] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.135] Sleep (dwMilliseconds=0x1) [0112.150] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", len=0x51 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 1 [0112.150] GetProcessHeap () returned 0x580000 [0112.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x48) returned 0x596cd8 [0112.150] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.154] Sleep (dwMilliseconds=0x1) [0112.166] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", len=0x4a | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned 1 [0112.166] GetProcessHeap () returned 0x580000 [0112.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.166] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.170] Sleep (dwMilliseconds=0x1) [0112.183] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.185] Sleep (dwMilliseconds=0x1) [0112.199] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.202] Sleep (dwMilliseconds=0x1) [0112.244] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", len=0x57 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.244] GetProcessHeap () returned 0x580000 [0112.244] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.245] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.245] Sleep (dwMilliseconds=0x1) [0112.260] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", len=0x5f | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.261] GetProcessHeap () returned 0x580000 [0112.261] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f458, Size=0x2c) returned 0x61f8f0 [0112.261] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.261] Sleep (dwMilliseconds=0x1) [0112.275] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", len=0x5b | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.275] GetProcessHeap () returned 0x580000 [0112.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.275] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.275] Sleep (dwMilliseconds=0x1) [0112.291] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", len=0x67 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned 1 [0112.291] GetProcessHeap () returned 0x580000 [0112.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0112.291] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.294] Sleep (dwMilliseconds=0x1) [0112.307] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", len=0x52 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 1 [0112.307] GetProcessHeap () returned 0x580000 [0112.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1afb0, Size=0x6c) returned 0x6f1b0a0 [0112.307] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.309] Sleep (dwMilliseconds=0x1) [0112.321] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", len=0x5c | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.322] GetProcessHeap () returned 0x580000 [0112.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.322] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.322] Sleep (dwMilliseconds=0x1) [0112.337] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.338] GetProcessHeap () returned 0x580000 [0112.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x28) returned 0x5dc550 [0112.338] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.338] Sleep (dwMilliseconds=0x1) [0112.353] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv", len=0x50 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv") returned 1 [0112.353] GetProcessHeap () returned 0x580000 [0112.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0112.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.354] Sleep (dwMilliseconds=0x1) [0112.368] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 1 [0112.368] GetProcessHeap () returned 0x580000 [0112.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.370] Sleep (dwMilliseconds=0x1) [0112.383] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", len=0x31 | out: pbstr=0x614ff84*="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned 1 [0112.383] GetProcessHeap () returned 0x580000 [0112.383] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x40) returned 0x61ac00 [0112.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.383] Sleep (dwMilliseconds=0x1) [0112.399] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 1 [0112.399] GetProcessHeap () returned 0x580000 [0112.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0112.437] CloseHandle (hObject=0x488) returned 1 [0112.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0112.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id_1622540890_.your_last_chance")) returned 1 [0112.438] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0112.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL70X~1.YOU")) returned 0x5b9630 [0112.438] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0112.438] GetProcessHeap () returned 0x580000 [0112.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7da1) returned 0x6ce54a8 [0112.439] GetProcessHeap () returned 0x580000 [0112.439] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7da1) returned 0x6ced258 [0112.439] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.439] ReadFile (in: hFile=0x488, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0x7d80, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x614ff14*=0x7d80, lpOverlapped=0x0) returned 1 [0112.962] GetProcessHeap () returned 0x580000 [0112.962] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0112.962] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.962] WriteFile (in: hFile=0x488, lpBuffer=0x6ced258*, nNumberOfBytesToWrite=0x7d80, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ced258*, lpNumberOfBytesWritten=0x614ff14*=0x7d80, lpOverlapped=0x0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.963] WriteFile (in: hFile=0x488, lpBuffer=0x6cf4fd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf4fd7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0112.963] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0112.963] CloseHandle (hObject=0x488) returned 1 [0113.034] GetProcessHeap () returned 0x580000 [0113.034] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ced258 | out: hHeap=0x580000) returned 1 [0113.035] GetProcessHeap () returned 0x580000 [0113.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0113.035] GetProcessHeap () returned 0x580000 [0113.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0113.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7af26e60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7db6, dwReserved0=0x614fd28, dwReserved1=0x6ce54a8, cFileName="sql70.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SQL70X~1.YOU")) returned 0x5b9730 [0113.256] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0113.869] CloseHandle (hObject=0x440) returned 1 [0113.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id_1622540890_.your_last_chance")) returned 1 [0113.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0113.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0039~1.YOU")) returned 0x5b9630 [0113.870] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0113.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0113.870] GetProcessHeap () returned 0x580000 [0113.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x6dfcac0 [0113.870] GetProcessHeap () returned 0x580000 [0113.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a61) returned 0x6dff530 [0113.870] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.870] ReadFile (in: hFile=0x440, lpBuffer=0x6dfcac0, nNumberOfBytesToRead=0x2a40, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfcac0*, lpNumberOfBytesRead=0x614ff14*=0x2a40, lpOverlapped=0x0) returned 1 [0113.909] GetProcessHeap () returned 0x580000 [0113.909] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0113.909] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x440, lpBuffer=0x6dff530*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dff530*, lpNumberOfBytesWritten=0x614ff14*=0x2a40, lpOverlapped=0x0) returned 1 [0113.909] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x440, lpBuffer=0x6e01f6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e01f6f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0113.909] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0113.909] CloseHandle (hObject=0x440) returned 1 [0113.910] GetProcessHeap () returned 0x580000 [0113.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dff530 | out: hHeap=0x580000) returned 1 [0113.910] GetProcessHeap () returned 0x580000 [0113.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfcac0 | out: hHeap=0x580000) returned 1 [0113.910] GetProcessHeap () returned 0x580000 [0113.910] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0113.910] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b8140e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x614fd28, dwReserved1=0x6dfcac0, cFileName="FD00397_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FD0039~1.YOU")) returned 0x5b9630 [0113.910] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.364] CloseHandle (hObject=0x438) returned 1 [0116.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0030~1.YOU")) returned 0x5b9730 [0116.365] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0116.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0116.365] GetProcessHeap () returned 0x580000 [0116.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6de2d20 [0116.365] GetProcessHeap () returned 0x580000 [0116.365] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6de4e30 [0116.365] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.365] ReadFile (in: hFile=0x438, lpBuffer=0x6de2d20, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de2d20*, lpNumberOfBytesRead=0x614ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0116.431] GetProcessHeap () returned 0x580000 [0116.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.431] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.431] WriteFile (in: hFile=0x438, lpBuffer=0x6de4e30*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de4e30*, lpNumberOfBytesWritten=0x614ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0116.432] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.432] WriteFile (in: hFile=0x438, lpBuffer=0x6de6f0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de6f0f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.432] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.432] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.432] CloseHandle (hObject=0x438) returned 1 [0116.432] GetProcessHeap () returned 0x580000 [0116.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de4e30 | out: hHeap=0x580000) returned 1 [0116.432] GetProcessHeap () returned 0x580000 [0116.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de2d20 | out: hHeap=0x580000) returned 1 [0116.432] GetProcessHeap () returned 0x580000 [0116.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d02dfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2104, dwReserved0=0x614fd28, dwReserved1=0x6de2d20, cFileName="SL00308_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0030~1.YOU")) returned 0x5b9630 [0116.432] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0119.110] CloseHandle (hObject=0x454) returned 1 [0119.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0222~1.YOU")) returned 0x5b9630 [0119.111] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0119.111] GetProcessHeap () returned 0x580000 [0119.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6f0c8f8 [0119.111] GetProcessHeap () returned 0x580000 [0119.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c57120 [0119.111] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.111] ReadFile (in: hFile=0x454, lpBuffer=0x6f0c8f8, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesRead=0x614ff14*=0x320, lpOverlapped=0x0) returned 1 [0119.133] GetProcessHeap () returned 0x580000 [0119.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0119.133] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.133] WriteFile (in: hFile=0x454, lpBuffer=0x6c57120*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57120*, lpNumberOfBytesWritten=0x614ff14*=0x320, lpOverlapped=0x0) returned 1 [0119.134] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.134] WriteFile (in: hFile=0x454, lpBuffer=0x6c5743f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5743f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.134] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.134] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.134] CloseHandle (hObject=0x454) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57120 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e9ead80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x614fd28, dwReserved1=0x6f0c8f8, cFileName="SO02228_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0222~1.YOU")) returned 0x5b96f0 [0120.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.154] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", len=0x4c | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 1 [0120.154] GetProcessHeap () returned 0x580000 [0120.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a8) returned 0x6d06ca8 [0120.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.603] CloseHandle (hObject=0x48c) returned 1 [0120.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.id_1622540890_.your_last_chance")) returned 1 [0120.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0076~1.YOU")) returned 0x5b9630 [0120.604] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.604] GetProcessHeap () returned 0x580000 [0120.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2321) returned 0x6f14048 [0120.604] GetProcessHeap () returned 0x580000 [0120.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2321) returned 0x6df2780 [0120.604] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.604] ReadFile (in: hFile=0x48c, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x2300, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x614ff14*=0x2300, lpOverlapped=0x0) returned 1 [0120.634] GetProcessHeap () returned 0x580000 [0120.635] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0120.635] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.635] WriteFile (in: hFile=0x48c, lpBuffer=0x6df2780*, nNumberOfBytesToWrite=0x2300, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2780*, lpNumberOfBytesWritten=0x614ff14*=0x2300, lpOverlapped=0x0) returned 1 [0120.635] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.635] WriteFile (in: hFile=0x48c, lpBuffer=0x6df4a7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df4a7f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.635] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.635] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.635] CloseHandle (hObject=0x48c) returned 1 [0120.635] GetProcessHeap () returned 0x580000 [0120.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2780 | out: hHeap=0x580000) returned 1 [0120.965] GetProcessHeap () returned 0x580000 [0120.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0120.965] GetProcessHeap () returned 0x580000 [0120.965] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0121.702] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f833180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2337, dwReserved0=0x614fd28, dwReserved1=0x6f14048, cFileName="WB00760L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0076~1.YOU")) returned 0x5b9730 [0121.910] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.292] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", len=0x4d | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 1 [0122.292] GetProcessHeap () returned 0x580000 [0122.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18bc) returned 0x6e00ac0 [0122.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0122.352] CloseHandle (hObject=0x170) returned 1 [0122.352] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id_1622540890_.your_last_chance")) returned 1 [0122.358] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANE~1.YOU")) returned 0x5b9730 [0122.358] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0122.358] GetProcessHeap () returned 0x580000 [0122.358] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ca1) returned 0x6fa6b18 [0122.359] GetProcessHeap () returned 0x580000 [0122.359] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4ca1) returned 0x6fab7c8 [0122.359] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.359] ReadFile (in: hFile=0x170, lpBuffer=0x6fa6b18, nNumberOfBytesToRead=0x4c80, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa6b18*, lpNumberOfBytesRead=0x614ff14*=0x4c80, lpOverlapped=0x0) returned 1 [0122.954] GetProcessHeap () returned 0x580000 [0122.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.954] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.955] WriteFile (in: hFile=0x170, lpBuffer=0x6fab7c8*, nNumberOfBytesToWrite=0x4c80, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fab7c8*, lpNumberOfBytesWritten=0x614ff14*=0x4c80, lpOverlapped=0x0) returned 1 [0122.955] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.955] WriteFile (in: hFile=0x170, lpBuffer=0x6fb0447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb0447*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.955] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.955] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.955] CloseHandle (hObject=0x170) returned 1 [0122.955] GetProcessHeap () returned 0x580000 [0122.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fab7c8 | out: hHeap=0x580000) returned 1 [0122.955] GetProcessHeap () returned 0x580000 [0122.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa6b18 | out: hHeap=0x580000) returned 1 [0122.955] GetProcessHeap () returned 0x580000 [0122.955] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80e5de60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4cbf, dwReserved0=0x614fd28, dwReserved1=0x6fa6b18, cFileName="Urban.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANE~1.YOU")) returned 0x5b9730 [0124.803] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.819] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", len=0x49 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned 1 [0124.819] GetProcessHeap () returned 0x580000 [0124.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c4) returned 0x6f42f08 [0124.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.820] CloseHandle (hObject=0x484) returned 1 [0124.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.id_1622540890_.your_last_chance")) returned 1 [0124.820] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.820] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APEXXM~1.YOU")) returned 0x5b9730 [0124.821] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0124.821] GetProcessHeap () returned 0x580000 [0124.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0124.821] GetProcessHeap () returned 0x580000 [0124.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6ce2378 [0124.821] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.821] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x614ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.838] GetProcessHeap () returned 0x580000 [0124.838] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.838] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.838] WriteFile (in: hFile=0x484, lpBuffer=0x6ce2378*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce2378*, lpNumberOfBytesWritten=0x614ff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.838] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.838] WriteFile (in: hFile=0x484, lpBuffer=0x6ce3257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce3257*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.838] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.838] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.839] CloseHandle (hObject=0x484) returned 1 [0124.839] GetProcessHeap () returned 0x580000 [0124.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce2378 | out: hHeap=0x580000) returned 1 [0124.839] GetProcessHeap () returned 0x580000 [0124.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0124.839] GetProcessHeap () returned 0x580000 [0124.839] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0124.839] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8205e4c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf12, dwReserved0=0x614fd28, dwReserved1=0x6c29878, cFileName="Apex.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APEXXM~1.YOU")) returned 0x5b9730 [0124.839] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.866] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", len=0x4f | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 1 [0124.866] GetProcessHeap () returned 0x580000 [0124.866] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b0) returned 0x6f42f08 [0124.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0124.866] CloseHandle (hObject=0x170) returned 1 [0124.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id_1622540890_.your_last_chance")) returned 1 [0124.867] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0124.867] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0124.868] GetProcessHeap () returned 0x580000 [0124.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ca1) returned 0x6f468d8 [0124.868] GetProcessHeap () returned 0x580000 [0124.868] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5ca1) returned 0x6f4c588 [0124.868] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.868] ReadFile (in: hFile=0x170, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x5c80, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x614ff14*=0x5c80, lpOverlapped=0x0) returned 1 [0126.332] GetProcessHeap () returned 0x580000 [0126.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0126.332] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.332] WriteFile (in: hFile=0x170, lpBuffer=0x6f4c588*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f4c588*, lpNumberOfBytesWritten=0x614ff14*=0x5c80, lpOverlapped=0x0) returned 1 [0126.333] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.333] WriteFile (in: hFile=0x170, lpBuffer=0x6f52207*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f52207*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.333] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.333] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.333] CloseHandle (hObject=0x170) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f4c588 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0126.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82ea68c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5cb0, dwReserved0=0x614fd28, dwReserved1=0x6f468d8, cFileName="Technic.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0126.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.719] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", len=0x3d | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned 1 [0126.719] GetProcessHeap () returned 0x580000 [0126.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19dc) returned 0x667250 [0126.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0128.872] CloseHandle (hObject=0x458) returned 1 [0128.872] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.405] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03010~1.YOU")) returned 0x5b96f0 [0129.405] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0129.405] GetProcessHeap () returned 0x580000 [0129.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x6f14048 [0129.405] GetProcessHeap () returned 0x580000 [0129.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2261) returned 0x6dd20d0 [0129.406] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.406] ReadFile (in: hFile=0x458, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x2240, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x614ff14*=0x2240, lpOverlapped=0x0) returned 1 [0129.437] GetProcessHeap () returned 0x580000 [0129.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.437] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.437] WriteFile (in: hFile=0x458, lpBuffer=0x6dd20d0*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20d0*, lpNumberOfBytesWritten=0x614ff14*=0x2240, lpOverlapped=0x0) returned 1 [0129.437] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.437] WriteFile (in: hFile=0x458, lpBuffer=0x6dd430f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd430f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.437] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.437] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.437] CloseHandle (hObject=0x458) returned 1 [0129.437] GetProcessHeap () returned 0x580000 [0129.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20d0 | out: hHeap=0x580000) returned 1 [0129.437] GetProcessHeap () returned 0x580000 [0129.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0129.437] GetProcessHeap () returned 0x580000 [0129.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.588] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c41a60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2272, dwReserved0=0x614fd28, dwReserved1=0x6f14048, cFileName="J0301076.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03010~1.YOU")) returned 0x5b9730 [0129.588] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.640] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL", len=0x3a | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 1 [0129.641] GetProcessHeap () returned 0x580000 [0129.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0132.443] CloseHandle (hObject=0x3b8) returned 1 [0132.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.476] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id_1622540890_.your_last_chance")) returned 1 [0132.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.477] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BSTORM~1.YOU")) returned 0x5b9730 [0132.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0132.477] GetProcessHeap () returned 0x580000 [0132.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb3a1) returned 0x6e063d0 [0132.477] GetProcessHeap () returned 0x580000 [0132.477] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb3a1) returned 0x6d69228 [0132.477] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.477] ReadFile (in: hFile=0x3b8, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0xb380, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x614ff14*=0xb380, lpOverlapped=0x0) returned 1 [0134.617] GetProcessHeap () returned 0x580000 [0134.617] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0134.617] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.617] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d69228*, nNumberOfBytesToWrite=0xb380, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d69228*, lpNumberOfBytesWritten=0x614ff14*=0xb380, lpOverlapped=0x0) returned 1 [0134.617] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.617] WriteFile (in: hFile=0x3b8, lpBuffer=0x6d745a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d745a7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.617] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.618] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.618] CloseHandle (hObject=0x3b8) returned 1 [0134.618] GetProcessHeap () returned 0x580000 [0134.618] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d69228 | out: hHeap=0x580000) returned 1 [0134.916] GetProcessHeap () returned 0x580000 [0134.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0134.916] GetProcessHeap () returned 0x580000 [0134.916] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.693] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87da62e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb3b4, dwReserved0=0x614fd28, dwReserved1=0x6e063d0, cFileName="BSTORM.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BSTORM~1.YOU")) returned 0x5b96b0 [0135.694] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.740] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x5a | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0135.740] GetProcessHeap () returned 0x580000 [0135.740] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.741] CloseHandle (hObject=0x488) returned 1 [0135.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0135.741] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.741] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0135.742] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.742] GetProcessHeap () returned 0x580000 [0135.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0135.742] GetProcessHeap () returned 0x580000 [0135.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0135.742] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.742] ReadFile (in: hFile=0x488, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0135.743] GetProcessHeap () returned 0x580000 [0135.743] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.743] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.743] WriteFile (in: hFile=0x488, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0135.744] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.744] WriteFile (in: hFile=0x488, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.744] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.744] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.744] CloseHandle (hObject=0x488) returned 1 [0135.744] GetProcessHeap () returned 0x580000 [0135.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0135.744] GetProcessHeap () returned 0x580000 [0135.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0135.744] GetProcessHeap () returned 0x580000 [0135.744] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8885c5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x614fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0135.744] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.828] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x5c | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0135.828] GetProcessHeap () returned 0x580000 [0135.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0135.834] CloseHandle (hObject=0x488) returned 1 [0135.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0138.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.584] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0138.585] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0138.585] GetProcessHeap () returned 0x580000 [0138.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0138.585] GetProcessHeap () returned 0x580000 [0138.585] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0138.585] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.585] ReadFile (in: hFile=0x488, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.586] GetProcessHeap () returned 0x580000 [0138.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0138.586] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.586] WriteFile (in: hFile=0x488, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.586] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.587] WriteFile (in: hFile=0x488, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.587] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.587] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.587] CloseHandle (hObject=0x488) returned 1 [0138.587] GetProcessHeap () returned 0x580000 [0138.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0138.587] GetProcessHeap () returned 0x580000 [0138.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0138.587] GetProcessHeap () returned 0x580000 [0138.587] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0139.878] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a370020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x614fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0139.878] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.905] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", len=0x51 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css") returned 1 [0139.905] GetProcessHeap () returned 0x580000 [0139.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0139.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.063] CloseHandle (hObject=0x170) returned 1 [0140.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.id_1622540890_.your_last_chance")) returned 1 [0140.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b9770 [0140.064] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.064] GetProcessHeap () returned 0x580000 [0140.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0140.064] GetProcessHeap () returned 0x580000 [0140.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0140.064] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.064] ReadFile (in: hFile=0x170, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x614ff14*=0xd60, lpOverlapped=0x0) returned 1 [0140.077] GetProcessHeap () returned 0x580000 [0140.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.077] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.077] WriteFile (in: hFile=0x170, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x614ff14*=0xd60, lpOverlapped=0x0) returned 1 [0140.077] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.077] WriteFile (in: hFile=0x170, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.077] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.077] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.077] CloseHandle (hObject=0x170) returned 1 [0140.077] GetProcessHeap () returned 0x580000 [0140.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.077] GetProcessHeap () returned 0x580000 [0140.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0140.077] GetProcessHeap () returned 0x580000 [0140.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b1b8420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9b, dwReserved0=0x614fd28, dwReserved1=0x635768, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b9770 [0140.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.449] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", len=0x43 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned 1 [0140.449] GetProcessHeap () returned 0x580000 [0140.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc8) returned 0x6f14048 [0140.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.542] CloseHandle (hObject=0x428) returned 1 [0140.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.543] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.553] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.553] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1507~1.YOU")) returned 0x5b9770 [0140.553] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.554] GetProcessHeap () returned 0x580000 [0140.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x614a48 [0140.554] GetProcessHeap () returned 0x580000 [0140.554] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a1) returned 0x5bad00 [0140.554] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.554] ReadFile (in: hFile=0x428, lpBuffer=0x614a48, nNumberOfBytesToRead=0x180, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x614a48*, lpNumberOfBytesRead=0x614ff14*=0x180, lpOverlapped=0x0) returned 1 [0140.556] GetProcessHeap () returned 0x580000 [0140.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.556] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.556] WriteFile (in: hFile=0x428, lpBuffer=0x5bad00*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bad00*, lpNumberOfBytesWritten=0x614ff14*=0x180, lpOverlapped=0x0) returned 1 [0140.556] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.556] WriteFile (in: hFile=0x428, lpBuffer=0x5bae7f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5bae7f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.556] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.556] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.557] CloseHandle (hObject=0x428) returned 1 [0140.557] GetProcessHeap () returned 0x580000 [0140.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5bad00 | out: hHeap=0x580000) returned 1 [0140.557] GetProcessHeap () returned 0x580000 [0140.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x614a48 | out: hHeap=0x580000) returned 1 [0140.557] GetProcessHeap () returned 0x580000 [0140.557] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b654ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1aa, dwReserved0=0x614fd28, dwReserved1=0x614a48, cFileName="BD15073_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1507~1.YOU")) returned 0x5b9730 [0140.915] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.962] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC", len=0x44 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 1 [0140.962] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0140.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.963] CloseHandle (hObject=0x448) returned 1 [0140.963] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.963] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0140.964] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.964] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD1B6~1.YOU")) returned 0x5b9730 [0140.964] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.964] GetProcessHeap () returned 0x580000 [0140.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2798 [0140.964] GetProcessHeap () returned 0x580000 [0140.964] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6df2a60 [0140.964] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.964] ReadFile (in: hFile=0x448, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x614ff14*=0x280, lpOverlapped=0x0) returned 1 [0140.975] GetProcessHeap () returned 0x580000 [0140.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.975] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.975] WriteFile (in: hFile=0x448, lpBuffer=0x6df2a60*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a60*, lpNumberOfBytesWritten=0x614ff14*=0x280, lpOverlapped=0x0) returned 1 [0140.975] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.975] WriteFile (in: hFile=0x448, lpBuffer=0x6df2cdf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2cdf*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.975] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.975] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.975] CloseHandle (hObject=0x448) returned 1 [0141.229] GetProcessHeap () returned 0x580000 [0141.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a60 | out: hHeap=0x580000) returned 1 [0141.229] GetProcessHeap () returned 0x580000 [0141.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0141.229] GetProcessHeap () returned 0x580000 [0141.229] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0146.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ba33280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x614fd28, dwReserved1=0x6df2798, cFileName="MSACCESS.DEV_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSD1B6~1.YOU")) returned 0x5b9730 [0146.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.533] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", len=0x3c | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT") returned 1 [0146.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0146.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0146.533] CloseHandle (hObject=0x46c) returned 1 [0146.533] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.533] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id_1622540890_.your_last_chance")) returned 1 [0146.534] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHL~2.YOU")) returned 0x5b96f0 [0146.534] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0146.534] GetProcessHeap () returned 0x580000 [0146.534] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e063d0 [0146.535] GetProcessHeap () returned 0x580000 [0146.535] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e17c00 [0146.535] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.535] ReadFile (in: hFile=0x46c, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.170] GetProcessHeap () returned 0x580000 [0150.170] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0150.171] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.171] WriteFile (in: hFile=0x46c, lpBuffer=0x6e17c00*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e17c00*, lpNumberOfBytesWritten=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.171] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.171] WriteFile (in: hFile=0x46c, lpBuffer=0x6e293ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e293ff*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.125] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.125] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.125] CloseHandle (hObject=0x46c) returned 1 [0151.760] GetProcessHeap () returned 0x580000 [0151.760] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e17c00 | out: hHeap=0x580000) returned 1 [0151.763] GetProcessHeap () returned 0x580000 [0151.763] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0151.763] GetProcessHeap () returned 0x580000 [0151.763] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0151.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91b0d1a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f399c, dwReserved0=0x614fd28, dwReserved1=0x580000, cFileName="PSRCHLEX.DAT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PSRCHL~2.YOU")) returned 0x5b9730 [0152.044] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.310] CloseHandle (hObject=0x45c) returned 1 [0155.310] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.310] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0155.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~3.YOU")) returned 0x5b9730 [0155.311] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0155.312] GetProcessHeap () returned 0x580000 [0155.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0155.312] GetProcessHeap () returned 0x580000 [0155.312] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0155.312] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.312] ReadFile (in: hFile=0x45c, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0155.313] GetProcessHeap () returned 0x580000 [0155.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.313] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.313] WriteFile (in: hFile=0x45c, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0155.314] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.314] WriteFile (in: hFile=0x45c, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.314] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.314] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.314] CloseHandle (hObject=0x45c) returned 1 [0155.314] GetProcessHeap () returned 0x580000 [0155.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0155.314] GetProcessHeap () returned 0x580000 [0155.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0155.314] GetProcessHeap () returned 0x580000 [0155.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.971] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94312380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x614fd28, dwReserved1=0x5ad8a0, cFileName="WINWORD.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINWOR~3.YOU")) returned 0x5b9630 [0155.971] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.985] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", len=0x3d | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 1 [0155.985] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0155.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0158.715] CloseHandle (hObject=0x438) returned 1 [0158.715] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0158.715] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id_1622540890_.your_last_chance")) returned 1 [0158.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0158.716] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART7~1.YOU")) returned 0x5b9630 [0158.716] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0158.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0158.716] GetProcessHeap () returned 0x580000 [0158.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6c29878 [0158.716] GetProcessHeap () returned 0x580000 [0158.716] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf41) returned 0x6fafa58 [0158.716] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.716] ReadFile (in: hFile=0x438, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf20, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x614ff14*=0xf20, lpOverlapped=0x0) returned 1 [0158.731] GetProcessHeap () returned 0x580000 [0158.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0158.731] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.731] WriteFile (in: hFile=0x438, lpBuffer=0x6fafa58*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fafa58*, lpNumberOfBytesWritten=0x614ff14*=0xf20, lpOverlapped=0x0) returned 1 [0158.731] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.731] WriteFile (in: hFile=0x438, lpBuffer=0x6fb0977*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb0977*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0158.731] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.731] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0158.732] CloseHandle (hObject=0x438) returned 1 [0158.732] GetProcessHeap () returned 0x580000 [0158.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fafa58 | out: hHeap=0x580000) returned 1 [0158.732] GetProcessHeap () returned 0x580000 [0158.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0158.732] GetProcessHeap () returned 0x580000 [0158.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0159.266] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x963a70a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf48, dwReserved0=0x614fd28, dwReserved1=0x6c29878, cFileName="MSART7.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSART7~1.YOU")) returned 0x5b9730 [0162.837] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.400] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", len=0x44 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned 1 [0164.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0164.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0165.205] CloseHandle (hObject=0x450) returned 1 [0165.205] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0165.205] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl.id_1622540890_.your_last_chance")) returned 1 [0165.206] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0165.206] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAGXSL~1.YOU")) returned 0x5b9730 [0165.206] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0165.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0165.206] GetProcessHeap () returned 0x580000 [0165.206] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a61) returned 0x6d8e818 [0165.207] GetProcessHeap () returned 0x580000 [0165.207] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8a61) returned 0x6dbf1d0 [0165.207] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.207] ReadFile (in: hFile=0x450, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0x8a40, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x614ff14*=0x8a40, lpOverlapped=0x0) returned 1 [0166.028] GetProcessHeap () returned 0x580000 [0166.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0166.028] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.028] WriteFile (in: hFile=0x450, lpBuffer=0x6dbf1d0*, nNumberOfBytesToWrite=0x8a40, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbf1d0*, lpNumberOfBytesWritten=0x614ff14*=0x8a40, lpOverlapped=0x0) returned 1 [0166.029] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.029] WriteFile (in: hFile=0x450, lpBuffer=0x6dc7c0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7c0f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.029] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.029] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.029] CloseHandle (hObject=0x450) returned 1 [0166.029] GetProcessHeap () returned 0x580000 [0166.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbf1d0 | out: hHeap=0x580000) returned 1 [0166.029] GetProcessHeap () returned 0x580000 [0166.029] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0166.035] GetProcessHeap () returned 0x580000 [0166.035] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0169.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a9212c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8a78, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="TAG.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAGXSL~1.YOU")) returned 0x5b9730 [0169.766] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.808] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", len=0x3f | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 1 [0169.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0169.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0169.813] CloseHandle (hObject=0x390) returned 1 [0169.813] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id_1622540890_.your_last_chance")) returned 1 [0169.854] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.855] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMD~1.YOU")) returned 0x5b9730 [0169.855] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0169.855] GetProcessHeap () returned 0x580000 [0169.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79a1) returned 0x7015608 [0169.855] GetProcessHeap () returned 0x580000 [0169.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x79a1) returned 0x701cfb8 [0169.855] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.855] ReadFile (in: hFile=0x390, lpBuffer=0x7015608, nNumberOfBytesToRead=0x7980, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x7015608*, lpNumberOfBytesRead=0x614ff14*=0x7980, lpOverlapped=0x0) returned 1 [0171.723] GetProcessHeap () returned 0x580000 [0171.723] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0171.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.723] WriteFile (in: hFile=0x390, lpBuffer=0x701cfb8*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x701cfb8*, lpNumberOfBytesWritten=0x614ff14*=0x7980, lpOverlapped=0x0) returned 1 [0171.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.723] WriteFile (in: hFile=0x390, lpBuffer=0x7024937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x7024937*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.723] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.723] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.723] CloseHandle (hObject=0x390) returned 1 [0171.724] GetProcessHeap () returned 0x580000 [0171.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x701cfb8 | out: hHeap=0x580000) returned 1 [0171.724] GetProcessHeap () returned 0x580000 [0171.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7015608 | out: hHeap=0x580000) returned 1 [0171.724] GetProcessHeap () returned 0x580000 [0171.724] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0173.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9df6e8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x79b4, dwReserved0=0x614fd28, dwReserved1=0x7015608, cFileName="DELIMDOS.FAE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELIMD~1.YOU")) returned 0x5b9770 [0173.125] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.177] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", len=0x41 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 1 [0173.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0173.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.182] CloseHandle (hObject=0x46c) returned 1 [0173.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id_1622540890_.your_last_chance")) returned 1 [0173.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~1.YOU")) returned 0x5b9770 [0173.184] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.184] GetProcessHeap () returned 0x580000 [0173.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.184] GetProcessHeap () returned 0x580000 [0173.184] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.184] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.184] ReadFile (in: hFile=0x46c, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x614ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.235] GetProcessHeap () returned 0x580000 [0173.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.235] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.235] WriteFile (in: hFile=0x46c, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x614ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.236] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.236] WriteFile (in: hFile=0x46c, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.236] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.236] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.236] CloseHandle (hObject=0x46c) returned 1 [0173.236] GetProcessHeap () returned 0x580000 [0173.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0173.236] GetProcessHeap () returned 0x580000 [0173.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0173.236] GetProcessHeap () returned 0x580000 [0173.236] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0174.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eddce00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x614fd28, dwReserved1=0x662288, cFileName="RESENDS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RESEND~1.YOU")) returned 0x5b9730 [0174.415] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.438] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", len=0x7e | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned 1 [0174.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.439] CloseHandle (hObject=0x440) returned 1 [0174.439] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.id_1622540890_.your_last_chance")) returned 1 [0174.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x670069, dwReserved1=0x69006e, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~2.YOU")) returned 0x5b9730 [0174.440] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0174.440] GetProcessHeap () returned 0x580000 [0174.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc71e8 [0174.441] GetProcessHeap () returned 0x580000 [0174.441] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6dc75d0 [0174.441] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.441] ReadFile (in: hFile=0x440, lpBuffer=0x6dc71e8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71e8*, lpNumberOfBytesRead=0x614ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0174.467] GetProcessHeap () returned 0x580000 [0174.467] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.467] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.467] WriteFile (in: hFile=0x440, lpBuffer=0x6dc75d0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc75d0*, lpNumberOfBytesWritten=0x614ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0174.468] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.468] WriteFile (in: hFile=0x440, lpBuffer=0x6dc796f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc796f*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.468] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.468] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.468] CloseHandle (hObject=0x440) returned 1 [0174.468] GetProcessHeap () returned 0x580000 [0174.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc75d0 | out: hHeap=0x580000) returned 1 [0174.468] GetProcessHeap () returned 0x580000 [0174.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71e8 | out: hHeap=0x580000) returned 1 [0174.468] GetProcessHeap () returned 0x580000 [0174.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f99daa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x614fd28, dwReserved1=0x6dc71e8, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VERISI~2.YOU")) returned 0x5b9730 [0174.468] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.549] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", len=0x4a | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned 1 [0174.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0174.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0175.594] CloseHandle (hObject=0x3fc) returned 1 [0175.594] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.594] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.id_1622540890_.your_last_chance")) returned 1 [0175.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SNEEZE~1.YOU")) returned 0x5b96f0 [0175.595] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0175.595] GetProcessHeap () returned 0x580000 [0175.595] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ca1) returned 0x711c008 [0175.597] GetProcessHeap () returned 0x580000 [0175.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ca1) returned 0x7125cb8 [0175.597] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.597] ReadFile (in: hFile=0x3fc, lpBuffer=0x711c008, nNumberOfBytesToRead=0x9c80, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c008*, lpNumberOfBytesRead=0x614ff14*=0x9c80, lpOverlapped=0x0) returned 1 [0177.525] GetProcessHeap () returned 0x580000 [0177.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0177.525] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.525] WriteFile (in: hFile=0x3fc, lpBuffer=0x7125cb8*, nNumberOfBytesToWrite=0x9c80, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x7125cb8*, lpNumberOfBytesWritten=0x614ff14*=0x9c80, lpOverlapped=0x0) returned 1 [0177.525] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.526] WriteFile (in: hFile=0x3fc, lpBuffer=0x712f937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x712f937*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0177.526] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.526] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0177.526] CloseHandle (hObject=0x3fc) returned 1 [0177.526] GetProcessHeap () returned 0x580000 [0177.526] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7125cb8 | out: hHeap=0x580000) returned 1 [0177.532] GetProcessHeap () returned 0x580000 [0177.532] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c008 | out: hHeap=0x580000) returned 1 [0177.533] GetProcessHeap () returned 0x580000 [0177.533] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa16c6820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ca8, dwReserved0=0x580000, dwReserved1=0x65d9c8, cFileName="SNEEZE.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SNEEZE~1.YOU")) returned 0x5b96f0 [0180.027] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0180.049] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned 1 [0180.049] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0180.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.108] CloseHandle (hObject=0x448) returned 1 [0180.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x55004f, dwReserved1=0x5f0052, cFileName="WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~2.YOU")) returned 0x5b96b0 [0180.109] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0180.110] GetProcessHeap () returned 0x580000 [0180.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0180.110] GetProcessHeap () returned 0x580000 [0180.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0180.110] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.110] ReadFile (in: hFile=0x448, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x614ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.152] GetProcessHeap () returned 0x580000 [0180.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0180.152] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.152] WriteFile (in: hFile=0x448, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x614ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.152] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.152] WriteFile (in: hFile=0x448, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.152] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.152] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.152] CloseHandle (hObject=0x448) returned 1 [0180.152] GetProcessHeap () returned 0x580000 [0180.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0180.152] GetProcessHeap () returned 0x580000 [0180.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0180.153] GetProcessHeap () returned 0x580000 [0180.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.153] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2feb080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x614fd28, dwReserved1=0x626d30, cFileName="WSSFilesToolIconImagesMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSSFIL~2.YOU")) returned 0x5b96b0 [0180.153] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.208] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", len=0x48 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned 1 [0180.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0180.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0180.209] CloseHandle (hObject=0x478) returned 1 [0180.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.209] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.210] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2605, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIPSIM~2.YOU")) returned 0x5b9770 [0180.210] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0180.210] GetProcessHeap () returned 0x580000 [0180.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2621) returned 0x656970 [0180.211] GetProcessHeap () returned 0x580000 [0180.211] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2621) returned 0x6fa8f28 [0180.211] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.211] ReadFile (in: hFile=0x478, lpBuffer=0x656970, nNumberOfBytesToRead=0x2600, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x656970*, lpNumberOfBytesRead=0x614ff14*=0x2600, lpOverlapped=0x0) returned 1 [0181.313] GetProcessHeap () returned 0x580000 [0181.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.313] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.313] WriteFile (in: hFile=0x478, lpBuffer=0x6fa8f28*, nNumberOfBytesToWrite=0x2600, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesWritten=0x614ff14*=0x2600, lpOverlapped=0x0) returned 1 [0181.314] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.314] WriteFile (in: hFile=0x478, lpBuffer=0x6fab527*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fab527*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0181.314] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.314] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0181.314] CloseHandle (hObject=0x478) returned 1 [0181.314] GetProcessHeap () returned 0x580000 [0181.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0181.314] GetProcessHeap () returned 0x580000 [0181.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x656970 | out: hHeap=0x580000) returned 1 [0181.314] GetProcessHeap () returned 0x580000 [0181.314] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0182.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3aed640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2629, dwReserved0=0x614fd28, dwReserved1=0x656970, cFileName="TipsImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TIPSIM~2.YOU")) returned 0x5b9770 [0182.686] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.803] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", len=0x6e | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned 1 [0183.803] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0183.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0186.546] CloseHandle (hObject=0x264) returned 1 [0186.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.546] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.547] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x4a002e, dwReserved1=0x470050, cFileName="NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NUMERI~1.YOU")) returned 0x5b96b0 [0186.547] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0186.548] GetProcessHeap () returned 0x580000 [0186.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4441) returned 0x6fef7d8 [0186.548] GetProcessHeap () returned 0x580000 [0186.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4441) returned 0x6ff3c28 [0186.549] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.549] ReadFile (in: hFile=0x264, lpBuffer=0x6fef7d8, nNumberOfBytesToRead=0x4420, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fef7d8*, lpNumberOfBytesRead=0x614ff14*=0x4420, lpOverlapped=0x0) returned 1 [0187.679] GetProcessHeap () returned 0x580000 [0187.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6e0dd08 [0187.679] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.679] WriteFile (in: hFile=0x264, lpBuffer=0x6ff3c28*, nNumberOfBytesToWrite=0x4420, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff3c28*, lpNumberOfBytesWritten=0x614ff14*=0x4420, lpOverlapped=0x0) returned 1 [0187.679] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.679] WriteFile (in: hFile=0x264, lpBuffer=0x6ff8047*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8047*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.679] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.679] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.679] CloseHandle (hObject=0x264) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff3c28 | out: hHeap=0x580000) returned 1 [0187.789] GetProcessHeap () returned 0x580000 [0187.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fef7d8 | out: hHeap=0x580000) returned 1 [0187.790] GetProcessHeap () returned 0x580000 [0187.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0dd08 | out: hHeap=0x580000) returned 1 [0188.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa77a0740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x445e, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="NUMERIC.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NUMERI~1.YOU")) returned 0x5b9770 [0188.061] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.084] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", len=0x45 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned 1 [0188.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x205c) returned 0x6f14048 [0188.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0191.910] CloseHandle (hObject=0x390) returned 1 [0191.910] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.540] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPA25F~1.YOU")) returned 0x5b97b0 [0194.540] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0194.540] GetProcessHeap () returned 0x580000 [0194.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6c2a820 [0194.540] GetProcessHeap () returned 0x580000 [0194.540] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6c2c028 [0194.540] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.540] ReadFile (in: hFile=0x390, lpBuffer=0x6c2a820, nNumberOfBytesToRead=0x17a0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesRead=0x614ff14*=0x17a0, lpOverlapped=0x0) returned 1 [0194.562] GetProcessHeap () returned 0x580000 [0194.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.562] WriteFile (in: hFile=0x390, lpBuffer=0x6c2c028*, nNumberOfBytesToWrite=0x17a0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2c028*, lpNumberOfBytesWritten=0x614ff14*=0x17a0, lpOverlapped=0x0) returned 1 [0194.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.562] WriteFile (in: hFile=0x390, lpBuffer=0x6c2d7c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2d7c7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.562] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.562] CloseHandle (hObject=0x390) returned 1 [0194.562] GetProcessHeap () returned 0x580000 [0194.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2c028 | out: hHeap=0x580000) returned 1 [0194.562] GetProcessHeap () returned 0x580000 [0194.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0194.562] GetProcessHeap () returned 0x580000 [0194.562] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.562] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab93c5a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17df, dwReserved0=0x614fd28, dwReserved1=0x6c2a820, cFileName="ZPDIR45B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPA25F~1.YOU")) returned 0x5b97b0 [0194.563] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.564] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x73 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0194.564] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0194.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0194.565] CloseHandle (hObject=0x49c) returned 1 [0194.565] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0194.565] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0197.267] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.267] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97f0 [0197.267] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0197.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0197.267] GetProcessHeap () returned 0x580000 [0197.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0197.267] GetProcessHeap () returned 0x580000 [0197.267] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0197.267] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.267] ReadFile (in: hFile=0x49c, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0197.269] GetProcessHeap () returned 0x580000 [0197.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0197.269] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.269] WriteFile (in: hFile=0x49c, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x614ff14*=0xc0, lpOverlapped=0x0) returned 1 [0197.269] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.269] WriteFile (in: hFile=0x49c, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.269] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.269] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.269] CloseHandle (hObject=0x49c) returned 1 [0197.269] GetProcessHeap () returned 0x580000 [0197.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0197.269] GetProcessHeap () returned 0x580000 [0197.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0197.269] GetProcessHeap () returned 0x580000 [0197.269] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0199.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31f4e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x614fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0199.447] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.478] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", len=0x5a | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned 1 [0199.478] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0199.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0199.479] CloseHandle (hObject=0x480) returned 1 [0199.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.479] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js.id_1622540890_.your_last_chance")) returned 1 [0199.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1db1, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b96b0 [0199.560] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0199.561] GetProcessHeap () returned 0x580000 [0199.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x6dee6e0 [0199.561] GetProcessHeap () returned 0x580000 [0199.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x636988 [0199.561] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.561] ReadFile (in: hFile=0x480, lpBuffer=0x6dee6e0, nNumberOfBytesToRead=0x1da0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dee6e0*, lpNumberOfBytesRead=0x614ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0199.592] GetProcessHeap () returned 0x580000 [0199.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0199.592] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.592] WriteFile (in: hFile=0x480, lpBuffer=0x636988*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x636988*, lpNumberOfBytesWritten=0x614ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0199.592] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.592] WriteFile (in: hFile=0x480, lpBuffer=0x638727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x638727*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.592] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.592] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.592] CloseHandle (hObject=0x480) returned 1 [0199.593] GetProcessHeap () returned 0x580000 [0199.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636988 | out: hHeap=0x580000) returned 1 [0199.593] GetProcessHeap () returned 0x580000 [0199.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dee6e0 | out: hHeap=0x580000) returned 1 [0199.593] GetProcessHeap () returned 0x580000 [0199.593] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0199.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae94a1c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dd5, dwReserved0=0x614fd28, dwReserved1=0x6dee6e0, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b96b0 [0199.593] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.622] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", len=0x5b | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned 1 [0199.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0199.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0199.623] CloseHandle (hObject=0x170) returned 1 [0199.623] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.623] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.id_1622540890_.your_last_chance")) returned 1 [0200.941] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.941] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b9770 [0200.941] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0200.941] GetProcessHeap () returned 0x580000 [0200.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0200.941] GetProcessHeap () returned 0x580000 [0200.941] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0200.941] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.942] ReadFile (in: hFile=0x170, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x614ff14*=0x260, lpOverlapped=0x0) returned 1 [0200.945] GetProcessHeap () returned 0x580000 [0200.945] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0200.945] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.945] WriteFile (in: hFile=0x170, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x614ff14*=0x260, lpOverlapped=0x0) returned 1 [0200.945] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.945] WriteFile (in: hFile=0x170, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.945] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.945] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.945] CloseHandle (hObject=0x170) returned 1 [0200.945] GetProcessHeap () returned 0x580000 [0200.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0200.945] GetProcessHeap () returned 0x580000 [0200.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0200.945] GetProcessHeap () returned 0x580000 [0200.945] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0201.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf63b960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x614fd28, dwReserved1=0x6c61120, cFileName="SAVE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVEGI~1.YOU")) returned 0x5b9770 [0201.426] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.030] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", len=0x69 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned 1 [0202.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0202.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0202.031] CloseHandle (hObject=0x3e4) returned 1 [0202.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.032] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.id_1622540890_.your_last_chance")) returned 1 [0202.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b9770 [0202.033] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0202.033] GetProcessHeap () returned 0x580000 [0202.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0202.033] GetProcessHeap () returned 0x580000 [0202.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0202.033] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.033] ReadFile (in: hFile=0x3e4, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x614ff14*=0x360, lpOverlapped=0x0) returned 1 [0202.080] GetProcessHeap () returned 0x580000 [0202.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.080] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.080] WriteFile (in: hFile=0x3e4, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x614ff14*=0x360, lpOverlapped=0x0) returned 1 [0202.080] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.081] WriteFile (in: hFile=0x3e4, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0202.081] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.081] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0202.081] CloseHandle (hObject=0x3e4) returned 1 [0202.081] GetProcessHeap () returned 0x580000 [0202.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0202.081] GetProcessHeap () returned 0x580000 [0202.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0202.081] GetProcessHeap () returned 0x580000 [0202.081] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb00f1c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x386, dwReserved0=0x614fd28, dwReserved1=0x6eef020, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b9770 [0202.081] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.086] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS", len=0x45 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS") returned 1 [0202.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f08) returned 0x6f14048 [0202.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0202.095] CloseHandle (hObject=0x450) returned 1 [0202.176] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css.id_1622540890_.your_last_chance")) returned 1 [0202.177] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.178] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b0900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7b0900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCD847~1.YOU")) returned 0x5b9770 [0202.178] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0202.178] GetProcessHeap () returned 0x580000 [0202.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70904c8 [0202.178] GetProcessHeap () returned 0x580000 [0202.178] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0202.178] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.178] ReadFile (in: hFile=0x450, lpBuffer=0x70904c8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.496] GetProcessHeap () returned 0x580000 [0209.496] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0209.496] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.496] WriteFile (in: hFile=0x450, lpBuffer=0x70a1cf8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesWritten=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.497] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.497] WriteFile (in: hFile=0x450, lpBuffer=0x70b34f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b34f7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.497] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.497] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.497] CloseHandle (hObject=0x450) returned 1 [0209.497] GetProcessHeap () returned 0x580000 [0209.497] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0209.814] GetProcessHeap () returned 0x580000 [0209.814] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0209.814] GetProcessHeap () returned 0x580000 [0209.814] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0209.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b0900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb47c2ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e6ca, dwReserved0=0x614fd28, dwReserved1=0x70904c8, cFileName="SCHEME45.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCD847~1.YOU")) returned 0x5b97f0 [0209.815] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0210.094] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", len=0x6c | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned 1 [0210.095] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0210.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0210.095] CloseHandle (hObject=0x3a8) returned 1 [0210.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance")) returned 1 [0210.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b97b0 [0210.096] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0210.097] GetProcessHeap () returned 0x580000 [0210.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6c29878 [0210.097] GetProcessHeap () returned 0x580000 [0210.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6ece008 [0210.097] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.097] ReadFile (in: hFile=0x3a8, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x614ff14*=0xea0, lpOverlapped=0x0) returned 1 [0210.117] GetProcessHeap () returned 0x580000 [0210.117] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0210.118] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.118] WriteFile (in: hFile=0x3a8, lpBuffer=0x6ece008*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesWritten=0x614ff14*=0xea0, lpOverlapped=0x0) returned 1 [0210.118] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.118] WriteFile (in: hFile=0x3a8, lpBuffer=0x6eceea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eceea7*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.118] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.118] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.118] CloseHandle (hObject=0x3a8) returned 1 [0210.118] GetProcessHeap () returned 0x580000 [0210.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0210.118] GetProcessHeap () returned 0x580000 [0210.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0210.118] GetProcessHeap () returned 0x580000 [0210.118] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0210.118] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4db61e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x614fd28, dwReserved1=0x6c29878, cFileName="GrayCheck.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAYCH~1.YOU")) returned 0x5b97b0 [0210.118] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.242] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS", len=0x45 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS") returned 1 [0210.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0210.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0210.570] CloseHandle (hObject=0x44c) returned 1 [0210.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css.id_1622540890_.your_last_chance")) returned 1 [0210.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCC9E5~1.YOU")) returned 0x5b9830 [0210.621] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0210.621] GetProcessHeap () returned 0x580000 [0210.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e55db0 [0210.622] GetProcessHeap () returned 0x580000 [0210.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e675e0 [0210.623] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.623] ReadFile (in: hFile=0x44c, lpBuffer=0x6e55db0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e55db0*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.413] GetProcessHeap () returned 0x580000 [0214.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.413] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.414] WriteFile (in: hFile=0x44c, lpBuffer=0x6e675e0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesWritten=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.414] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.414] WriteFile (in: hFile=0x44c, lpBuffer=0x6e78ddf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78ddf*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.414] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.414] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.414] CloseHandle (hObject=0x44c) returned 1 [0214.414] GetProcessHeap () returned 0x580000 [0214.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e675e0 | out: hHeap=0x580000) returned 1 [0214.415] GetProcessHeap () returned 0x580000 [0214.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e55db0 | out: hHeap=0x580000) returned 1 [0214.419] GetProcessHeap () returned 0x580000 [0214.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0216.357] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb769fc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f5f0, dwReserved0=0x614fd28, dwReserved1=0x580000, cFileName="SCHEME14.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCC9E5~1.YOU")) returned 0x5b97b0 [0216.357] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.699] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", len=0x62 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned 1 [0217.699] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0217.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.016] CloseHandle (hObject=0x47c) returned 1 [0221.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.id_1622540890_.your_last_chance")) returned 1 [0221.017] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.017] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b97f0 [0221.017] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.017] GetProcessHeap () returned 0x580000 [0221.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0221.017] GetProcessHeap () returned 0x580000 [0221.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0221.017] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.017] ReadFile (in: hFile=0x47c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x614ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.045] GetProcessHeap () returned 0x580000 [0221.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0221.045] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.045] WriteFile (in: hFile=0x47c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x614ff14*=0x340, lpOverlapped=0x0) returned 1 [0221.045] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.045] WriteFile (in: hFile=0x47c, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.045] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.045] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.045] CloseHandle (hObject=0x47c) returned 1 [0221.045] GetProcessHeap () returned 0x580000 [0221.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0221.045] GetProcessHeap () returned 0x580000 [0221.045] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0221.046] GetProcessHeap () returned 0x580000 [0221.046] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0226.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb5da460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x614fd28, dwReserved1=0x6dcfb90, cFileName="rtf_justify.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_JU~1.YOU")) returned 0x5b9630 [0226.022] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.070] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL", len=0x38 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 1 [0226.070] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db0) returned 0x6dee6e0 [0226.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.107] CloseHandle (hObject=0x488) returned 1 [0226.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.107] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id_1622540890_.your_last_chance")) returned 1 [0226.108] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.108] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACVS~1.YOU")) returned 0x5b9630 [0226.108] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0226.108] GetProcessHeap () returned 0x580000 [0226.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d81) returned 0x7301a38 [0226.108] GetProcessHeap () returned 0x580000 [0226.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d81) returned 0x71cff08 [0226.108] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.108] ReadFile (in: hFile=0x488, lpBuffer=0x7301a38, nNumberOfBytesToRead=0x8d60, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesRead=0x614ff14*=0x8d60, lpOverlapped=0x0) returned 1 [0231.176] GetProcessHeap () returned 0x580000 [0231.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0231.176] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.176] WriteFile (in: hFile=0x488, lpBuffer=0x71cff08*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x71cff08*, lpNumberOfBytesWritten=0x614ff14*=0x8d60, lpOverlapped=0x0) returned 1 [0231.177] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.177] WriteFile (in: hFile=0x488, lpBuffer=0x71d8c67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x71d8c67*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0231.182] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0231.182] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0231.182] CloseHandle (hObject=0x488) returned 1 [0231.182] GetProcessHeap () returned 0x580000 [0231.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71cff08 | out: hHeap=0x580000) returned 1 [0231.182] GetProcessHeap () returned 0x580000 [0231.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0231.182] GetProcessHeap () returned 0x580000 [0231.182] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0231.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc1511460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8d8c, dwReserved0=0x614fd28, dwReserved1=0x7301a38, cFileName="HVAC.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HVACVS~1.YOU")) returned 0x5b9630 [0231.183] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0233.268] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", len=0x35 | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned 1 [0233.268] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0233.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.913] CloseHandle (hObject=0x418) returned 1 [0240.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.914] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.id_1622540890_.your_last_chance")) returned 1 [0240.914] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLKIRM~2.YOU")) returned 0x5b9730 [0240.915] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\olkirm.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0240.915] GetProcessHeap () returned 0x580000 [0240.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7298838 [0240.915] GetProcessHeap () returned 0x580000 [0240.915] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72aa068 [0240.915] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.915] ReadFile (in: hFile=0x418, lpBuffer=0x7298838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x7298838*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.224] GetProcessHeap () returned 0x580000 [0244.224] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0244.224] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.224] WriteFile (in: hFile=0x418, lpBuffer=0x72aa068*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x72aa068*, lpNumberOfBytesWritten=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.225] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.225] WriteFile (in: hFile=0x418, lpBuffer=0x72bb867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x72bb867*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.225] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.225] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.225] CloseHandle (hObject=0x418) returned 1 [0244.225] GetProcessHeap () returned 0x580000 [0244.225] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72aa068 | out: hHeap=0x580000) returned 1 [0244.416] GetProcessHeap () returned 0x580000 [0244.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7298838 | out: hHeap=0x580000) returned 1 [0244.416] GetProcessHeap () returned 0x580000 [0244.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0248.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc91711e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13770, dwReserved0=0x614fd28, dwReserved1=0x7298838, cFileName="OLKIRM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLKIRM~2.YOU")) returned 0x5b9730 [0248.386] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.365] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML", len=0x3c | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned 1 [0253.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0253.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0253.366] CloseHandle (hObject=0x420) returned 1 [0253.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml.id_1622540890_.your_last_chance")) returned 1 [0253.367] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.367] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd27b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fd27b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x236c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BANNER~1.YOU")) returned 0x5b9730 [0253.367] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0253.367] GetProcessHeap () returned 0x580000 [0253.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2381) returned 0x72e5948 [0253.367] GetProcessHeap () returned 0x580000 [0253.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2381) returned 0x6fac0f8 [0253.367] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.367] ReadFile (in: hFile=0x420, lpBuffer=0x72e5948, nNumberOfBytesToRead=0x2360, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e5948*, lpNumberOfBytesRead=0x614ff14*=0x2360, lpOverlapped=0x0) returned 1 [0253.436] GetProcessHeap () returned 0x580000 [0253.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0253.436] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.436] WriteFile (in: hFile=0x420, lpBuffer=0x6fac0f8*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fac0f8*, lpNumberOfBytesWritten=0x614ff14*=0x2360, lpOverlapped=0x0) returned 1 [0253.437] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.437] WriteFile (in: hFile=0x420, lpBuffer=0x6fae457*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fae457*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0253.437] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.437] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0253.437] CloseHandle (hObject=0x420) returned 1 [0253.437] GetProcessHeap () returned 0x580000 [0253.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fac0f8 | out: hHeap=0x580000) returned 1 [0253.437] GetProcessHeap () returned 0x580000 [0253.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72e5948 | out: hHeap=0x580000) returned 1 [0253.437] GetProcessHeap () returned 0x580000 [0253.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd27b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce937d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2390, dwReserved0=0x614fd28, dwReserved1=0x72e5948, cFileName="BANNER.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BANNER~1.YOU")) returned 0x5b9730 [0253.437] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.063] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV", len=0x3b | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV") returned 1 [0255.064] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fbc) returned 0x72e5948 [0255.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0255.139] CloseHandle (hObject=0x470) returned 1 [0255.139] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0255.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv.id_1622540890_.your_last_chance")) returned 1 [0255.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0255.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d4dc00, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36d4dc00, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGZIPD~1.YOU")) returned 0x5b9730 [0255.140] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0255.140] GetProcessHeap () returned 0x580000 [0255.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x677cd0 [0255.140] GetProcessHeap () returned 0x580000 [0255.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc21) returned 0x6ec3348 [0255.140] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.140] ReadFile (in: hFile=0x470, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xc00, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x614ff14*=0xc00, lpOverlapped=0x0) returned 1 [0255.172] GetProcessHeap () returned 0x580000 [0255.172] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0255.172] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.172] WriteFile (in: hFile=0x470, lpBuffer=0x6ec3348*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec3348*, lpNumberOfBytesWritten=0x614ff14*=0xc00, lpOverlapped=0x0) returned 1 [0255.172] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.172] WriteFile (in: hFile=0x470, lpBuffer=0x6ec3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec3f47*, lpNumberOfBytesWritten=0x614ff14*=0x20, lpOverlapped=0x0) returned 1 [0255.172] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0255.173] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x614ff14*=0x4, lpOverlapped=0x0) returned 1 [0255.173] CloseHandle (hObject=0x470) returned 1 [0255.173] GetProcessHeap () returned 0x580000 [0255.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec3348 | out: hHeap=0x580000) returned 1 [0255.173] GetProcessHeap () returned 0x580000 [0255.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0255.173] GetProcessHeap () returned 0x580000 [0255.173] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0255.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fccc | out: lpFindFileData=0x614fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d4dc00, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf9e1720, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x614fd28, dwReserved1=0x677cd0, cFileName="DGZIP.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGZIPD~1.YOU")) returned 0x5b9730 [0255.173] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.294] SysReAllocStringLen (in: pbstr=0x614ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV", len=0x3e | out: pbstr=0x614ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 1 [0255.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f98) returned 0x72e5948 [0255.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.914] CloseHandle (hObject=0x3a8) returned 1 [0258.915] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.915] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.916] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x614ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x614fc74 | out: lpFindFileData=0x614fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af16e00, ftCreationTime.dwHighDateTime=0x1c6856e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af16e00, ftLastWriteTime.dwHighDateTime=0x1c6856e, nFileSizeHigh=0x0, nFileSizeLow=0x301be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGWEBC~2.YOU")) returned 0x5b96f0 [0258.916] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0258.916] GetProcessHeap () returned 0x580000 [0258.916] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0258.917] GetProcessHeap () returned 0x580000 [0258.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d21878 [0258.917] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.917] ReadFile (in: hFile=0x3a8, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x614ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x614ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 55 os_tid = 0xad4 [0039.070] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.113] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.285] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.579] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.926] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.162] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.469] Sleep (dwMilliseconds=0x1) [0042.512] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.856] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.997] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.117] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.510] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.759] Sleep (dwMilliseconds=0x1) [0043.775] Sleep (dwMilliseconds=0x1) [0043.790] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.821] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.852] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.930] Sleep (dwMilliseconds=0x1) [0043.946] Sleep (dwMilliseconds=0x1) [0043.961] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.025] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.414] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.445] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.523] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.554] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.601] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.679] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.710] Sleep (dwMilliseconds=0x1) [0044.726] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.757] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.788] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.819] Sleep (dwMilliseconds=0x1) [0044.835] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.866] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.897] Sleep (dwMilliseconds=0x1) [0044.913] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.944] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.975] Sleep (dwMilliseconds=0x1) [0044.991] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.022] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.131] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.178] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.209] Sleep (dwMilliseconds=0x1) [0045.225] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.287] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.334] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.381] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.443] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.492] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.521] Sleep (dwMilliseconds=0x1) [0045.537] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.568] Sleep (dwMilliseconds=0x1) [0045.584] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.802] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.114] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.161] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.317] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.411] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.551] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.738] Sleep (dwMilliseconds=0x1) [0046.754] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.863] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.894] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.941] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.175] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.253] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.284] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.535] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.581] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.663] Sleep (dwMilliseconds=0x1) [0047.681] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.220] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.688] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.721] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.844] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.969] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.390] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.546] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.702] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.796] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.829] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.858] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.905] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.170] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.482] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.638] Sleep (dwMilliseconds=0x1) [0050.654] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.028] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.326] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.387] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.590] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.075] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.590] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.777] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.245] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.838] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.963] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.072] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.150] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.228] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.462] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.618] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.774] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.242] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0059.624] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", len=0x4c | out: pbstr=0x628ff84*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 1 [0059.625] GetProcessHeap () returned 0x580000 [0059.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1510, Size=0x5c) returned 0x5e1578 [0059.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0060.670] CloseHandle (hObject=0x3f4) returned 1 [0060.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.671] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id_1622540890_.your_last_chance")) returned 1 [0060.671] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.671] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x450043, dwReserved1=0x0, cFileName="GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b9630 [0060.671] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0060.672] GetProcessHeap () returned 0x580000 [0060.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c330a8 [0060.672] GetProcessHeap () returned 0x580000 [0060.672] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6c448d8 [0060.672] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.672] ReadFile (in: hFile=0x3f4, lpBuffer=0x6c330a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c330a8*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.555] GetProcessHeap () returned 0x580000 [0066.555] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0066.555] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.555] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c448d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c448d8*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0067.549] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.549] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c560d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c560d7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.877] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.877] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.877] CloseHandle (hObject=0x3f4) returned 1 [0069.021] GetProcessHeap () returned 0x580000 [0069.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c448d8 | out: hHeap=0x580000) returned 1 [0069.021] GetProcessHeap () returned 0x580000 [0069.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c330a8 | out: hHeap=0x580000) returned 1 [0069.021] GetProcessHeap () returned 0x580000 [0069.021] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0069.021] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x60e24040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x264424, dwReserved0=0x628fd28, dwReserved1=0x6c330a8, cFileName="GrooveMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~1.YOU")) returned 0x5b96b0 [0069.021] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0072.142] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", len=0x51 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 1 [0072.142] GetProcessHeap () returned 0x580000 [0072.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x70) returned 0x5b5d08 [0072.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.964] Sleep (dwMilliseconds=0x1) [0073.002] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", len=0x51 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 1 [0073.002] GetProcessHeap () returned 0x580000 [0073.002] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x50) returned 0x5b5d08 [0073.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.071] Sleep (dwMilliseconds=0x1) [0073.087] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 1 [0073.087] GetProcessHeap () returned 0x580000 [0073.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x2c) returned 0x5b5d08 [0073.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.667] CloseHandle (hObject=0x464) returned 1 [0074.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id_1622540890_.your_last_chance")) returned 1 [0074.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSJPGI~1.YOU")) returned 0x5b9730 [0074.668] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.668] GetProcessHeap () returned 0x580000 [0074.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x6e40b80 [0074.668] GetProcessHeap () returned 0x580000 [0074.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5f3908 [0074.668] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.668] ReadFile (in: hFile=0x464, lpBuffer=0x6e40b80, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40b80*, lpNumberOfBytesRead=0x628ff14*=0x420, lpOverlapped=0x0) returned 1 [0074.673] GetProcessHeap () returned 0x580000 [0074.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0074.673] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.673] WriteFile (in: hFile=0x464, lpBuffer=0x5f3908*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesWritten=0x628ff14*=0x420, lpOverlapped=0x0) returned 1 [0074.673] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.674] WriteFile (in: hFile=0x464, lpBuffer=0x5f3d27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3d27*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0074.674] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.674] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0074.674] CloseHandle (hObject=0x464) returned 1 [0074.674] GetProcessHeap () returned 0x580000 [0074.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0074.674] GetProcessHeap () returned 0x580000 [0074.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e40b80 | out: hHeap=0x580000) returned 1 [0074.674] GetProcessHeap () returned 0x580000 [0074.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0079.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x64236180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x449, dwReserved0=0x628fd28, dwReserved1=0x6e40b80, cFileName="MS.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSJPGI~1.YOU")) returned 0x5b96f0 [0079.332] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.346] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 1 [0079.347] GetProcessHeap () returned 0x580000 [0079.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x50) returned 0x5f76f0 [0079.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.359] Sleep (dwMilliseconds=0x1) [0081.684] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 1 [0081.684] GetProcessHeap () returned 0x580000 [0081.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0081.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.719] CloseHandle (hObject=0x488) returned 1 [0081.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.719] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0081.719] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.719] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.719] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0081.720] GetProcessHeap () returned 0x580000 [0081.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x6d0e508 [0081.720] GetProcessHeap () returned 0x580000 [0081.720] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1081) returned 0x673cd0 [0081.720] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.720] ReadFile (in: hFile=0x488, lpBuffer=0x6d0e508, nNumberOfBytesToRead=0x1060, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesRead=0x628ff14*=0x1060, lpOverlapped=0x0) returned 1 [0081.775] GetProcessHeap () returned 0x580000 [0081.775] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.775] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x488, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x1060, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x628ff14*=0x1060, lpOverlapped=0x0) returned 1 [0081.775] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.775] WriteFile (in: hFile=0x488, lpBuffer=0x674d2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x674d2f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.780] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.780] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.780] CloseHandle (hObject=0x488) returned 1 [0081.781] GetProcessHeap () returned 0x580000 [0081.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0081.781] GetProcessHeap () returned 0x580000 [0081.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0081.781] GetProcessHeap () returned 0x580000 [0081.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x685c11c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1093, dwReserved0=0x628fd28, dwReserved1=0x6d0e508, cFileName="SETUP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96f0 [0081.781] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.497] Sleep (dwMilliseconds=0x1) [0086.223] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", len=0x43 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 1 [0086.223] GetProcessHeap () returned 0x580000 [0086.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0086.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0086.288] CloseHandle (hObject=0x478) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0086.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id_1622540890_.your_last_chance")) returned 1 [0086.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0086.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WKS9PX~1.YOU")) returned 0x5b96f0 [0086.316] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0086.317] GetProcessHeap () returned 0x580000 [0086.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdfc1) returned 0x6cf6cd8 [0086.317] GetProcessHeap () returned 0x580000 [0086.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdfc1) returned 0x6481a0 [0086.318] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0086.318] ReadFile (in: hFile=0x478, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0xdfa0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x628ff14*=0xdfa0, lpOverlapped=0x0) returned 1 [0088.725] GetProcessHeap () returned 0x580000 [0088.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0088.725] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.725] WriteFile (in: hFile=0x478, lpBuffer=0x6481a0*, nNumberOfBytesToWrite=0xdfa0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesWritten=0x628ff14*=0xdfa0, lpOverlapped=0x0) returned 1 [0088.726] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.726] WriteFile (in: hFile=0x478, lpBuffer=0x65613f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65613f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.726] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.726] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.726] CloseHandle (hObject=0x478) returned 1 [0088.726] GetProcessHeap () returned 0x580000 [0088.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0088.726] GetProcessHeap () returned 0x580000 [0088.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0088.726] GetProcessHeap () returned 0x580000 [0088.726] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0088.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c7f55a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdfc4, dwReserved0=0x628fd28, dwReserved1=0x6cf6cd8, cFileName="Wks9Pxy.cnv.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WKS9PX~1.YOU")) returned 0x5b96b0 [0088.727] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.181] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 1 [0092.181] GetProcessHeap () returned 0x580000 [0092.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9d28, Size=0x78) returned 0x5d62d8 [0092.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0092.182] CloseHandle (hObject=0x48c) returned 1 [0092.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.182] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0092.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.205] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x450043, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0092.205] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0092.205] GetProcessHeap () returned 0x580000 [0092.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9261) returned 0x6e0c2f0 [0092.205] GetProcessHeap () returned 0x580000 [0092.205] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9261) returned 0x6e32350 [0092.205] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.205] ReadFile (in: hFile=0x48c, lpBuffer=0x6e0c2f0, nNumberOfBytesToRead=0x9240, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0c2f0*, lpNumberOfBytesRead=0x628ff14*=0x9240, lpOverlapped=0x0) returned 1 [0096.210] GetProcessHeap () returned 0x580000 [0096.210] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0096.210] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.210] WriteFile (in: hFile=0x48c, lpBuffer=0x6e32350*, nNumberOfBytesToWrite=0x9240, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32350*, lpNumberOfBytesWritten=0x628ff14*=0x9240, lpOverlapped=0x0) returned 1 [0096.210] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.210] WriteFile (in: hFile=0x48c, lpBuffer=0x6e3b58f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3b58f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0096.210] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.211] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0096.211] CloseHandle (hObject=0x48c) returned 1 [0096.211] GetProcessHeap () returned 0x580000 [0096.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32350 | out: hHeap=0x580000) returned 1 [0096.211] GetProcessHeap () returned 0x580000 [0096.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0c2f0 | out: hHeap=0x580000) returned 1 [0096.211] GetProcessHeap () returned 0x580000 [0096.211] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0096.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f5e9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9264, dwReserved0=0x628fd28, dwReserved1=0x6e0c2f0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0096.211] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0097.563] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", len=0x47 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 1 [0097.563] GetProcessHeap () returned 0x580000 [0097.563] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x14) returned 0x5a58e8 [0097.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0097.563] CloseHandle (hObject=0x450) returned 1 [0097.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0097.564] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0097.564] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0097.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0097.564] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0097.564] GetProcessHeap () returned 0x580000 [0097.564] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6c65268 [0097.564] GetProcessHeap () returned 0x580000 [0097.565] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6f04728 [0097.565] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.565] ReadFile (in: hFile=0x450, lpBuffer=0x6c65268, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65268*, lpNumberOfBytesRead=0x628ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0097.576] GetProcessHeap () returned 0x580000 [0097.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0097.576] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.576] WriteFile (in: hFile=0x450, lpBuffer=0x6f04728*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04728*, lpNumberOfBytesWritten=0x628ff14*=0x3a0, lpOverlapped=0x0) returned 1 [0097.576] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.576] WriteFile (in: hFile=0x450, lpBuffer=0x6f04ac7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04ac7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0097.576] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0097.576] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0097.576] CloseHandle (hObject=0x450) returned 1 [0097.577] GetProcessHeap () returned 0x580000 [0097.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04728 | out: hHeap=0x580000) returned 1 [0097.577] GetProcessHeap () returned 0x580000 [0097.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65268 | out: hHeap=0x580000) returned 1 [0097.577] GetProcessHeap () returned 0x580000 [0097.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0097.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c50140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x628fd28, dwReserved1=0x6c65268, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0097.577] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.578] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", len=0x4b | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 1 [0097.578] GetProcessHeap () returned 0x580000 [0097.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0097.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0101.278] CloseHandle (hObject=0x480) returned 1 [0101.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id_1622540890_.your_last_chance")) returned 1 [0102.088] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0102.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x45, dwReserved1=0x0, cFileName="PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROFIL~2.YOU")) returned 0x5b9730 [0102.088] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0102.088] GetProcessHeap () returned 0x580000 [0102.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67c940 [0102.088] GetProcessHeap () returned 0x580000 [0102.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67fc68 [0102.088] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.088] ReadFile (in: hFile=0x480, lpBuffer=0x67c940, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x628ff14*=0x240, lpOverlapped=0x0) returned 1 [0102.092] GetProcessHeap () returned 0x580000 [0102.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0102.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.092] WriteFile (in: hFile=0x480, lpBuffer=0x67fc68*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesWritten=0x628ff14*=0x240, lpOverlapped=0x0) returned 1 [0102.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.092] WriteFile (in: hFile=0x480, lpBuffer=0x67fea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fea7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0102.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0102.092] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0102.092] CloseHandle (hObject=0x480) returned 1 [0102.092] GetProcessHeap () returned 0x580000 [0102.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0102.092] GetProcessHeap () returned 0x580000 [0102.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0102.093] GetProcessHeap () returned 0x580000 [0102.093] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0102.093] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74775000, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x628fd28, dwReserved1=0x67c940, cFileName="PROFILE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROFIL~2.YOU")) returned 0x5b9730 [0102.093] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.668] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", len=0x35 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 1 [0109.668] GetProcessHeap () returned 0x580000 [0109.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x34) returned 0x5b9630 [0109.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.707] Sleep (dwMilliseconds=0x1) [0109.716] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", len=0x35 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 1 [0109.716] GetProcessHeap () returned 0x580000 [0109.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e9510 [0109.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.719] Sleep (dwMilliseconds=0x1) [0111.108] Sleep (dwMilliseconds=0x1) [0111.120] Sleep (dwMilliseconds=0x1) [0111.135] Sleep (dwMilliseconds=0x1) [0111.151] Sleep (dwMilliseconds=0x1) [0111.715] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", len=0x41 | out: pbstr=0x628ff84*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 1 [0111.715] GetProcessHeap () returned 0x580000 [0111.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0111.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.717] Sleep (dwMilliseconds=0x1) [0111.887] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", len=0x33 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 1 [0111.888] GetProcessHeap () returned 0x580000 [0111.888] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0111.888] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.891] Sleep (dwMilliseconds=0x1) [0111.904] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", len=0x59 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 1 [0111.905] GetProcessHeap () returned 0x580000 [0111.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0111.905] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.907] Sleep (dwMilliseconds=0x1) [0111.933] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", len=0x4e | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned 1 [0111.933] GetProcessHeap () returned 0x580000 [0111.933] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0111.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.933] Sleep (dwMilliseconds=0x1) [0111.947] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", len=0x33 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned 1 [0111.947] GetProcessHeap () returned 0x580000 [0111.947] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61daa8, Size=0x88) returned 0x61b540 [0111.947] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.955] Sleep (dwMilliseconds=0x1) [0111.963] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", len=0x4f | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 1 [0111.965] GetProcessHeap () returned 0x580000 [0111.965] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b2f8, Size=0x68) returned 0x6f09508 [0111.965] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.965] Sleep (dwMilliseconds=0x1) [0111.978] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", len=0x51 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 1 [0111.978] GetProcessHeap () returned 0x580000 [0111.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x3c) returned 0x61ab70 [0111.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.006] Sleep (dwMilliseconds=0x1) [0112.009] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", len=0x50 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 1 [0112.009] GetProcessHeap () returned 0x580000 [0112.009] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.009] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.010] Sleep (dwMilliseconds=0x1) [0112.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.026] Sleep (dwMilliseconds=0x1) [0112.059] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 1 [0112.059] GetProcessHeap () returned 0x580000 [0112.059] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0xc) returned 0x5e9510 [0112.059] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.062] Sleep (dwMilliseconds=0x1) [0112.118] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", len=0x57 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.118] GetProcessHeap () returned 0x580000 [0112.118] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x84) returned 0x61b4b0 [0112.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.118] Sleep (dwMilliseconds=0x1) [0112.134] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", len=0x4b | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned 1 [0112.134] GetProcessHeap () returned 0x580000 [0112.134] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.134] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.134] Sleep (dwMilliseconds=0x1) [0112.149] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", len=0x4a | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 1 [0112.149] GetProcessHeap () returned 0x580000 [0112.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x50) returned 0x5e1ae8 [0112.149] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.154] Sleep (dwMilliseconds=0x1) [0112.165] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", len=0x57 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 1 [0112.165] GetProcessHeap () returned 0x580000 [0112.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.165] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.170] Sleep (dwMilliseconds=0x1) [0112.182] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.185] Sleep (dwMilliseconds=0x1) [0112.198] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.201] Sleep (dwMilliseconds=0x1) [0112.228] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", len=0x48 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned 1 [0112.228] GetProcessHeap () returned 0x580000 [0112.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.228] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.228] Sleep (dwMilliseconds=0x1) [0112.244] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", len=0x58 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.244] GetProcessHeap () returned 0x580000 [0112.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92d0 [0112.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.244] Sleep (dwMilliseconds=0x1) [0112.259] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", len=0x4d | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned 1 [0112.259] GetProcessHeap () returned 0x580000 [0112.259] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x34) returned 0x5b9730 [0112.259] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.261] Sleep (dwMilliseconds=0x1) [0112.276] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", len=0x5a | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.276] GetProcessHeap () returned 0x580000 [0112.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0112.276] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.276] Sleep (dwMilliseconds=0x1) [0112.293] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", len=0x6a | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned 1 [0112.293] GetProcessHeap () returned 0x580000 [0112.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.294] Sleep (dwMilliseconds=0x1) [0112.393] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", len=0x41 | out: pbstr=0x628ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned 1 [0112.393] GetProcessHeap () returned 0x580000 [0112.393] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0xc) returned 0x5e92d0 [0112.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.393] Sleep (dwMilliseconds=0x1) [0113.324] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", len=0x3f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 1 [0113.324] GetProcessHeap () returned 0x580000 [0113.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xc4) returned 0x6f0ceb8 [0113.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0113.486] CloseHandle (hObject=0x480) returned 1 [0113.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.770] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0118~1.YOU")) returned 0x5b9630 [0114.770] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0114.771] GetProcessHeap () returned 0x580000 [0114.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6d10048 [0114.771] GetProcessHeap () returned 0x580000 [0114.771] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6c644f8 [0114.771] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.771] ReadFile (in: hFile=0x480, lpBuffer=0x6d10048, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x628ff14*=0xea0, lpOverlapped=0x0) returned 1 [0114.785] GetProcessHeap () returned 0x580000 [0114.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.785] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.785] WriteFile (in: hFile=0x480, lpBuffer=0x6c644f8*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c644f8*, lpNumberOfBytesWritten=0x628ff14*=0xea0, lpOverlapped=0x0) returned 1 [0114.785] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.785] WriteFile (in: hFile=0x480, lpBuffer=0x6c65397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65397*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.785] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.785] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.785] CloseHandle (hObject=0x480) returned 1 [0114.785] GetProcessHeap () returned 0x580000 [0114.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c644f8 | out: hHeap=0x580000) returned 1 [0114.785] GetProcessHeap () returned 0x580000 [0114.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0114.785] GetProcessHeap () returned 0x580000 [0114.785] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c068de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xec6, dwReserved0=0x628fd28, dwReserved1=0x6d10048, cFileName="AN01184_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0118~1.YOU")) returned 0x5b9630 [0117.328] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.330] CloseHandle (hObject=0x49c) returned 1 [0117.330] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.330] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.331] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0225~1.YOU")) returned 0x5b9630 [0117.331] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0117.331] GetProcessHeap () returned 0x580000 [0117.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6f3e598 [0117.331] GetProcessHeap () returned 0x580000 [0117.331] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c2a820 [0117.331] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.331] ReadFile (in: hFile=0x49c, lpBuffer=0x6f3e598, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3e598*, lpNumberOfBytesRead=0x628ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0117.340] GetProcessHeap () returned 0x580000 [0117.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.340] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.340] WriteFile (in: hFile=0x49c, lpBuffer=0x6c2a820*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesWritten=0x628ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0117.340] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.340] WriteFile (in: hFile=0x49c, lpBuffer=0x6c2b0ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2b0ff*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.340] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.340] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.340] CloseHandle (hObject=0x49c) returned 1 [0117.340] GetProcessHeap () returned 0x580000 [0117.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0117.340] GetProcessHeap () returned 0x580000 [0117.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3e598 | out: hHeap=0x580000) returned 1 [0117.340] GetProcessHeap () returned 0x580000 [0117.340] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d8cef60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x904, dwReserved0=0x628fd28, dwReserved1=0x6f3e598, cFileName="SO02253_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0225~1.YOU")) returned 0x5b9630 [0117.340] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0117.372] CloseHandle (hObject=0x450) returned 1 [0117.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0117.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.id_1622540890_.your_last_chance")) returned 1 [0117.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0117.372] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0013~1.YOU")) returned 0x5b9630 [0117.372] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0117.373] GetProcessHeap () returned 0x580000 [0117.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6f3e598 [0117.373] GetProcessHeap () returned 0x580000 [0117.373] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x821) returned 0x6c676b8 [0117.373] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.373] ReadFile (in: hFile=0x450, lpBuffer=0x6f3e598, nNumberOfBytesToRead=0x800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3e598*, lpNumberOfBytesRead=0x628ff14*=0x800, lpOverlapped=0x0) returned 1 [0117.417] GetProcessHeap () returned 0x580000 [0117.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.417] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.417] WriteFile (in: hFile=0x450, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x628ff14*=0x800, lpOverlapped=0x0) returned 1 [0117.417] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.418] WriteFile (in: hFile=0x450, lpBuffer=0x6c67eb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67eb7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.418] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.418] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.418] CloseHandle (hObject=0x450) returned 1 [0117.826] GetProcessHeap () returned 0x580000 [0117.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0117.826] GetProcessHeap () returned 0x580000 [0117.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3e598 | out: hHeap=0x580000) returned 1 [0117.826] GetProcessHeap () returned 0x580000 [0117.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0120.012] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d98d640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x840, dwReserved0=0x628fd28, dwReserved1=0x6f3e598, cFileName="SY00132_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0013~1.YOU")) returned 0x5b96f0 [0120.012] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.077] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", len=0x3f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF") returned 1 [0120.077] GetProcessHeap () returned 0x580000 [0120.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1784) returned 0x6d06ca8 [0120.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.078] CloseHandle (hObject=0x4a0) returned 1 [0120.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.078] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.079] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0175~2.YOU")) returned 0x5b96f0 [0120.079] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0120.079] GetProcessHeap () returned 0x580000 [0120.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6c676b8 [0120.079] GetProcessHeap () returned 0x580000 [0120.079] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6c67b68 [0120.079] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.079] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x628ff14*=0x480, lpOverlapped=0x0) returned 1 [0120.087] GetProcessHeap () returned 0x580000 [0120.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.087] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.087] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c67b68*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67b68*, lpNumberOfBytesWritten=0x628ff14*=0x480, lpOverlapped=0x0) returned 1 [0120.087] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.087] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c67fe7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67fe7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.087] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.087] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.087] CloseHandle (hObject=0x4a0) returned 1 [0120.088] GetProcessHeap () returned 0x580000 [0120.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c67b68 | out: hHeap=0x580000) returned 1 [0120.088] GetProcessHeap () returned 0x580000 [0120.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0120.088] GetProcessHeap () returned 0x580000 [0120.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.088] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f2fe160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x628fd28, dwReserved1=0x6c676b8, cFileName="WB01750_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0175~2.YOU")) returned 0x5b96f0 [0120.088] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.099] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", len=0x3f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF") returned 1 [0120.099] GetProcessHeap () returned 0x580000 [0120.099] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1774) returned 0x6d06ca8 [0120.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.099] CloseHandle (hObject=0x170) returned 1 [0120.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.099] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~4.YOU")) returned 0x5b96f0 [0120.100] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.100] GetProcessHeap () returned 0x580000 [0120.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6f0c8f8 [0120.100] GetProcessHeap () returned 0x580000 [0120.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67fc68 [0120.100] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.100] ReadFile (in: hFile=0x170, lpBuffer=0x6f0c8f8, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesRead=0x628ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0120.112] GetProcessHeap () returned 0x580000 [0120.112] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.112] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.112] WriteFile (in: hFile=0x170, lpBuffer=0x67fc68*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesWritten=0x628ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0120.113] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.113] WriteFile (in: hFile=0x170, lpBuffer=0x67ff47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ff47*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.113] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.113] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.113] CloseHandle (hObject=0x170) returned 1 [0120.113] GetProcessHeap () returned 0x580000 [0120.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0120.113] GetProcessHeap () returned 0x580000 [0120.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0120.113] GetProcessHeap () returned 0x580000 [0120.113] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f34a420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x306, dwReserved0=0x628fd28, dwReserved1=0x6f0c8f8, cFileName="WB01746_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0174~4.YOU")) returned 0x5b9630 [0120.163] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.176] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", len=0x3f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF") returned 1 [0120.176] GetProcessHeap () returned 0x580000 [0120.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1768) returned 0x6d06ca8 [0120.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.181] CloseHandle (hObject=0x470) returned 1 [0120.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.182] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WBB04C~1.YOU")) returned 0x5b9630 [0120.182] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.182] GetProcessHeap () returned 0x580000 [0120.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6c65108 [0120.182] GetProcessHeap () returned 0x580000 [0120.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6c758b0 [0120.182] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.182] ReadFile (in: hFile=0x470, lpBuffer=0x6c65108, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesRead=0x628ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0120.198] GetProcessHeap () returned 0x580000 [0120.198] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.198] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.198] WriteFile (in: hFile=0x470, lpBuffer=0x6c758b0*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c758b0*, lpNumberOfBytesWritten=0x628ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0120.198] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.198] WriteFile (in: hFile=0x470, lpBuffer=0x6c75d6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75d6f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.198] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.198] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.198] CloseHandle (hObject=0x470) returned 1 [0120.198] GetProcessHeap () returned 0x580000 [0120.198] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c758b0 | out: hHeap=0x580000) returned 1 [0120.198] GetProcessHeap () returned 0x580000 [0120.220] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0120.221] GetProcessHeap () returned 0x580000 [0120.221] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f408b00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f9, dwReserved0=0x628fd28, dwReserved1=0x6c65108, cFileName="WB01743_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WBB04C~1.YOU")) returned 0x5b9630 [0120.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.309] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", len=0x41 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 1 [0120.309] GetProcessHeap () returned 0x580000 [0120.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d4) returned 0x6d06ca8 [0120.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.348] CloseHandle (hObject=0x438) returned 1 [0120.386] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.386] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.id_1622540890_.your_last_chance")) returned 1 [0120.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9630 [0120.387] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0120.387] GetProcessHeap () returned 0x580000 [0120.387] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10da1) returned 0x636970 [0120.388] GetProcessHeap () returned 0x580000 [0120.388] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10da1) returned 0x647720 [0120.388] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.388] ReadFile (in: hFile=0x438, lpBuffer=0x636970, nNumberOfBytesToRead=0x10d80, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesRead=0x628ff14*=0x10d80, lpOverlapped=0x0) returned 1 [0121.820] GetProcessHeap () returned 0x580000 [0121.820] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0121.820] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.820] WriteFile (in: hFile=0x438, lpBuffer=0x647720*, nNumberOfBytesToWrite=0x10d80, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x647720*, lpNumberOfBytesWritten=0x628ff14*=0x10d80, lpOverlapped=0x0) returned 1 [0121.821] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.821] WriteFile (in: hFile=0x438, lpBuffer=0x65849f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65849f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0121.821] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.022] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.022] CloseHandle (hObject=0x438) returned 1 [0122.022] GetProcessHeap () returned 0x580000 [0122.022] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x647720 | out: hHeap=0x580000) returned 1 [0122.028] GetProcessHeap () returned 0x580000 [0122.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0122.028] GetProcessHeap () returned 0x580000 [0122.028] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80570be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10da7, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="Technic.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TECHNI~1.YOU")) returned 0x5b9730 [0124.319] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.352] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", len=0x55 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned 1 [0124.353] GetProcessHeap () returned 0x580000 [0124.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1924) returned 0x6f42f08 [0124.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.373] CloseHandle (hObject=0x440) returned 1 [0124.373] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.373] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.id_1622540890_.your_last_chance")) returned 1 [0124.374] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b9730 [0124.374] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.374] GetProcessHeap () returned 0x580000 [0124.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0124.374] GetProcessHeap () returned 0x580000 [0124.374] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0124.374] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.374] ReadFile (in: hFile=0x440, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x628ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.405] GetProcessHeap () returned 0x580000 [0124.405] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0124.406] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.406] WriteFile (in: hFile=0x440, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x628ff14*=0xe00, lpOverlapped=0x0) returned 1 [0124.406] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.406] WriteFile (in: hFile=0x440, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.406] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.406] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.406] CloseHandle (hObject=0x440) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0124.462] GetProcessHeap () returned 0x580000 [0124.462] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0125.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81c33e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe25, dwReserved0=0x628fd28, dwReserved1=0x6f69420, cFileName="Office Classic 2.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~2.YOU")) returned 0x5b9730 [0125.191] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.316] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", len=0x4c | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 1 [0125.316] GetProcessHeap () returned 0x580000 [0125.316] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1874) returned 0x6f42f08 [0125.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0127.004] CloseHandle (hObject=0x43c) returned 1 [0127.047] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0127.047] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id_1622540890_.your_last_chance")) returned 1 [0127.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0127.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIDEF~1.YOU")) returned 0x5b9730 [0127.048] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0127.048] GetProcessHeap () returned 0x580000 [0127.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x48e1) returned 0x6d10048 [0127.048] GetProcessHeap () returned 0x580000 [0127.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x48e1) returned 0x636970 [0127.048] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.048] ReadFile (in: hFile=0x43c, lpBuffer=0x6d10048, nNumberOfBytesToRead=0x48c0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesRead=0x628ff14*=0x48c0, lpOverlapped=0x0) returned 1 [0127.550] GetProcessHeap () returned 0x580000 [0127.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0127.550] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.550] WriteFile (in: hFile=0x43c, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x628ff14*=0x48c0, lpOverlapped=0x0) returned 1 [0127.550] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.550] WriteFile (in: hFile=0x43c, lpBuffer=0x63b22f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x63b22f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0127.551] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0127.551] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0127.551] CloseHandle (hObject=0x43c) returned 1 [0127.551] GetProcessHeap () returned 0x580000 [0127.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0127.551] GetProcessHeap () returned 0x580000 [0127.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0127.551] GetProcessHeap () returned 0x580000 [0127.551] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0127.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83a41400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x48f3, dwReserved0=0x628fd28, dwReserved1=0x6d10048, cFileName="Grid.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIDEF~1.YOU")) returned 0x5b96f0 [0127.551] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0127.874] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", len=0x42 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 1 [0127.874] GetProcessHeap () returned 0x580000 [0127.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c0) returned 0x667250 [0128.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.048] CloseHandle (hObject=0x41c) returned 1 [0128.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id_1622540890_.your_last_chance")) returned 1 [0128.162] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b9730 [0128.162] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0128.162] GetProcessHeap () returned 0x580000 [0128.162] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0128.163] GetProcessHeap () returned 0x580000 [0128.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6de0f50 [0128.163] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.163] ReadFile (in: hFile=0x41c, lpBuffer=0x6daf1d0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.939] GetProcessHeap () returned 0x580000 [0128.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0128.940] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.940] WriteFile (in: hFile=0x41c, lpBuffer=0x6de0f50*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0128.940] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.940] WriteFile (in: hFile=0x41c, lpBuffer=0x6df274f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df274f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0128.966] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.966] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0128.966] CloseHandle (hObject=0x41c) returned 1 [0128.966] GetProcessHeap () returned 0x580000 [0128.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0128.966] GetProcessHeap () returned 0x580000 [0128.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0128.966] GetProcessHeap () returned 0x580000 [0128.966] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0129.438] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x847cb120, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4c45c, dwReserved0=0x628fd28, dwReserved1=0x6daf1d0, cFileName="OFFICE10.MML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96f0 [0129.438] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.471] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", len=0x43 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned 1 [0129.471] GetProcessHeap () returned 0x580000 [0129.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.484] CloseHandle (hObject=0x4a0) returned 1 [0129.484] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.485] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.id_1622540890_.your_last_chance")) returned 1 [0129.485] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~3.YOU")) returned 0x5b9730 [0129.485] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.485] GetProcessHeap () returned 0x580000 [0129.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0129.485] GetProcessHeap () returned 0x580000 [0129.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0129.485] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.486] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0129.487] GetProcessHeap () returned 0x580000 [0129.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.488] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.488] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0129.488] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.488] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.488] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.488] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.488] CloseHandle (hObject=0x4a0) returned 1 [0129.488] GetProcessHeap () returned 0x580000 [0129.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0129.488] GetProcessHeap () returned 0x580000 [0129.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0129.488] GetProcessHeap () returned 0x580000 [0129.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84cb3e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x628fd28, dwReserved1=0x6f3bec0, cFileName="J0115876.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01158~3.YOU")) returned 0x5b9730 [0129.488] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.641] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML", len=0x48 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML") returned 1 [0129.641] GetProcessHeap () returned 0x580000 [0129.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0129.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.700] CloseHandle (hObject=0x4a0) returned 1 [0129.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.700] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml.id_1622540890_.your_last_chance")) returned 1 [0129.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIBFOR~1.YOU")) returned 0x5b9730 [0129.707] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0129.707] GetProcessHeap () returned 0x580000 [0129.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0129.708] GetProcessHeap () returned 0x580000 [0129.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6daf1d0 [0129.708] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.709] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0134.435] GetProcessHeap () returned 0x580000 [0134.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0134.436] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.436] WriteFile (in: hFile=0x4a0, lpBuffer=0x6daf1d0*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1d0*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0134.437] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.437] WriteFile (in: hFile=0x4a0, lpBuffer=0x6dc09cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc09cf*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0134.437] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0134.437] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0134.437] CloseHandle (hObject=0x4a0) returned 1 [0134.437] GetProcessHeap () returned 0x580000 [0134.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1d0 | out: hHeap=0x580000) returned 1 [0135.857] GetProcessHeap () returned 0x580000 [0135.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0135.857] GetProcessHeap () returned 0x580000 [0135.857] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0136.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87bdd260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16606, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="BIBFORM.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIBFOR~1.YOU")) returned 0x5b96b0 [0136.361] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.392] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", len=0x64 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0136.392] GetProcessHeap () returned 0x580000 [0136.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0136.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0138.542] CloseHandle (hObject=0x170) returned 1 [0138.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0138.545] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.545] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0138.545] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0138.545] GetProcessHeap () returned 0x580000 [0138.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0138.545] GetProcessHeap () returned 0x580000 [0138.545] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0138.545] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.545] ReadFile (in: hFile=0x170, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0138.547] GetProcessHeap () returned 0x580000 [0138.547] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0138.547] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.547] WriteFile (in: hFile=0x170, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0138.548] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.548] WriteFile (in: hFile=0x170, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.548] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.548] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.548] CloseHandle (hObject=0x170) returned 1 [0138.548] GetProcessHeap () returned 0x580000 [0138.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0138.548] GetProcessHeap () returned 0x580000 [0138.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0138.548] GetProcessHeap () returned 0x580000 [0138.548] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0138.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a323d60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x628fd28, dwReserved1=0x6f3bec0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b96b0 [0138.659] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.909] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x5a | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0139.909] GetProcessHeap () returned 0x580000 [0139.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0139.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0139.909] CloseHandle (hObject=0x428) returned 1 [0139.909] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0139.938] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.939] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0139.939] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0139.939] GetProcessHeap () returned 0x580000 [0139.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a110 [0139.939] GetProcessHeap () returned 0x580000 [0139.939] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x421) returned 0x6c6a558 [0139.939] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.939] ReadFile (in: hFile=0x428, lpBuffer=0x6c6a110, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a110*, lpNumberOfBytesRead=0x628ff14*=0x400, lpOverlapped=0x0) returned 1 [0139.949] GetProcessHeap () returned 0x580000 [0139.949] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdef0 [0139.949] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.949] WriteFile (in: hFile=0x428, lpBuffer=0x6c6a558*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a558*, lpNumberOfBytesWritten=0x628ff14*=0x400, lpOverlapped=0x0) returned 1 [0139.949] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.949] WriteFile (in: hFile=0x428, lpBuffer=0x6c6a957*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a957*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.949] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.949] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.949] CloseHandle (hObject=0x428) returned 1 [0139.949] GetProcessHeap () returned 0x580000 [0139.949] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a558 | out: hHeap=0x580000) returned 1 [0139.950] GetProcessHeap () returned 0x580000 [0139.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a110 | out: hHeap=0x580000) returned 1 [0139.950] GetProcessHeap () returned 0x580000 [0139.950] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdef0 | out: hHeap=0x580000) returned 1 [0140.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b087920, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x628fd28, dwReserved1=0x6c6a110, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.416] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", len=0x51 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css") returned 1 [0140.416] GetProcessHeap () returned 0x580000 [0140.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.417] CloseHandle (hObject=0x170) returned 1 [0140.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.417] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.id_1622540890_.your_last_chance")) returned 1 [0140.417] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x43005f, dwReserved1=0x410048, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b96b0 [0140.418] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0140.418] GetProcessHeap () returned 0x580000 [0140.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0140.418] GetProcessHeap () returned 0x580000 [0140.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0140.418] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.418] ReadFile (in: hFile=0x170, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x628ff14*=0xd60, lpOverlapped=0x0) returned 1 [0140.431] GetProcessHeap () returned 0x580000 [0140.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.431] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x170, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x628ff14*=0xd60, lpOverlapped=0x0) returned 1 [0140.431] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x170, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.431] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.431] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.431] CloseHandle (hObject=0x170) returned 1 [0140.431] GetProcessHeap () returned 0x580000 [0140.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.431] GetProcessHeap () returned 0x580000 [0140.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0140.431] GetProcessHeap () returned 0x580000 [0140.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.431] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b4fe260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd8e, dwReserved0=0x628fd28, dwReserved1=0x635768, cFileName="Sts2.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STS2CS~1.YOU")) returned 0x5b96b0 [0140.431] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.447] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", len=0x43 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned 1 [0140.447] GetProcessHeap () returned 0x580000 [0140.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd8) returned 0x6f14048 [0140.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.473] CloseHandle (hObject=0x3a8) returned 1 [0140.473] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.473] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.474] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1518~1.YOU")) returned 0x5b9770 [0140.474] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.474] GetProcessHeap () returned 0x580000 [0140.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6dcfb90 [0140.474] GetProcessHeap () returned 0x580000 [0140.474] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a1) returned 0x6c65108 [0140.474] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.475] ReadFile (in: hFile=0x3a8, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x480, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x628ff14*=0x480, lpOverlapped=0x0) returned 1 [0140.489] GetProcessHeap () returned 0x580000 [0140.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.489] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.489] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x628ff14*=0x480, lpOverlapped=0x0) returned 1 [0140.489] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.489] WriteFile (in: hFile=0x3a8, lpBuffer=0x6c65587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65587*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.489] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.489] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.489] CloseHandle (hObject=0x3a8) returned 1 [0140.541] GetProcessHeap () returned 0x580000 [0140.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0140.541] GetProcessHeap () returned 0x580000 [0140.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0140.541] GetProcessHeap () returned 0x580000 [0140.541] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b5967e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4a6, dwReserved0=0x628fd28, dwReserved1=0x6dcfb90, cFileName="BD15185_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1518~1.YOU")) returned 0x5b9730 [0140.816] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.868] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT", len=0x40 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 1 [0140.868] GetProcessHeap () returned 0x580000 [0140.868] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0140.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.869] CloseHandle (hObject=0x448) returned 1 [0140.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.869] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0140.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~3.YOU")) returned 0x5b9730 [0140.870] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.870] GetProcessHeap () returned 0x580000 [0140.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0140.870] GetProcessHeap () returned 0x580000 [0140.870] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0140.870] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.870] ReadFile (in: hFile=0x448, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.872] GetProcessHeap () returned 0x580000 [0140.872] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.872] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.872] WriteFile (in: hFile=0x448, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.872] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.872] WriteFile (in: hFile=0x448, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.872] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.872] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.872] CloseHandle (hObject=0x448) returned 1 [0140.872] GetProcessHeap () returned 0x580000 [0140.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0140.872] GetProcessHeap () returned 0x580000 [0140.872] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0140.873] GetProcessHeap () returned 0x580000 [0140.873] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.873] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b94ea40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x628fd28, dwReserved1=0x5ad8a0, cFileName="MSACCESS_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSACCE~3.YOU")) returned 0x5b9730 [0140.873] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.931] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT", len=0x44 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 1 [0140.931] GetProcessHeap () returned 0x580000 [0140.931] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0140.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.931] CloseHandle (hObject=0x448) returned 1 [0140.931] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.932] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0140.932] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSA457~1.YOU")) returned 0x5b9730 [0140.933] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0140.933] GetProcessHeap () returned 0x580000 [0140.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0140.933] GetProcessHeap () returned 0x580000 [0140.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0140.933] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.933] ReadFile (in: hFile=0x448, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.934] GetProcessHeap () returned 0x580000 [0140.934] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0140.934] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.934] WriteFile (in: hFile=0x448, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0140.935] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.935] WriteFile (in: hFile=0x448, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.935] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.935] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.935] CloseHandle (hObject=0x448) returned 1 [0140.935] GetProcessHeap () returned 0x580000 [0140.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0140.935] GetProcessHeap () returned 0x580000 [0140.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0140.935] GetProcessHeap () returned 0x580000 [0140.935] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0140.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b9e6fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x628fd28, dwReserved1=0x5ad8a0, cFileName="MSACCESS.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSA457~1.YOU")) returned 0x5b9730 [0140.935] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.972] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL", len=0x38 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 1 [0140.972] GetProcessHeap () returned 0x580000 [0140.972] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0144.152] CloseHandle (hObject=0x170) returned 1 [0144.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id_1622540890_.your_last_chance")) returned 1 [0144.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LGNDVS~1.YOU")) returned 0x5b96f0 [0144.154] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0144.154] GetProcessHeap () returned 0x580000 [0144.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x99a1) returned 0x6d8e818 [0144.154] GetProcessHeap () returned 0x580000 [0144.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x99a1) returned 0x6f58108 [0144.154] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.154] ReadFile (in: hFile=0x170, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0x9980, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x628ff14*=0x9980, lpOverlapped=0x0) returned 1 [0145.697] GetProcessHeap () returned 0x580000 [0145.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0145.697] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.697] WriteFile (in: hFile=0x170, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0x9980, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x628ff14*=0x9980, lpOverlapped=0x0) returned 1 [0145.697] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.697] WriteFile (in: hFile=0x170, lpBuffer=0x6f61a87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f61a87*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0145.698] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0145.698] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0145.698] CloseHandle (hObject=0x170) returned 1 [0145.698] GetProcessHeap () returned 0x580000 [0145.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0145.698] GetProcessHeap () returned 0x580000 [0145.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0145.698] GetProcessHeap () returned 0x580000 [0145.698] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0146.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e747320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x99a4, dwReserved0=0x628fd28, dwReserved1=0x6d8e818, cFileName="LGND.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LGNDVS~1.YOU")) returned 0x5b96f0 [0146.866] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.881] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", len=0x44 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned 1 [0146.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0146.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0152.771] CloseHandle (hObject=0x170) returned 1 [0152.771] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.772] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x430d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR13~1.YOU")) returned 0x5b9730 [0152.772] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0152.773] GetProcessHeap () returned 0x580000 [0152.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4321) returned 0x7051138 [0152.773] GetProcessHeap () returned 0x580000 [0152.773] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4321) returned 0x7055468 [0152.773] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.773] ReadFile (in: hFile=0x170, lpBuffer=0x7051138, nNumberOfBytesToRead=0x4300, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7051138*, lpNumberOfBytesRead=0x628ff14*=0x4300, lpOverlapped=0x0) returned 1 [0154.048] GetProcessHeap () returned 0x580000 [0154.048] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0154.048] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.048] WriteFile (in: hFile=0x170, lpBuffer=0x7055468*, nNumberOfBytesToWrite=0x4300, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7055468*, lpNumberOfBytesWritten=0x628ff14*=0x4300, lpOverlapped=0x0) returned 1 [0154.048] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.048] WriteFile (in: hFile=0x170, lpBuffer=0x7059767*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7059767*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0154.048] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.049] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0154.049] CloseHandle (hObject=0x170) returned 1 [0154.049] GetProcessHeap () returned 0x580000 [0154.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7055468 | out: hHeap=0x580000) returned 1 [0154.049] GetProcessHeap () returned 0x580000 [0154.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7051138 | out: hHeap=0x580000) returned 1 [0154.049] GetProcessHeap () returned 0x580000 [0154.049] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0154.049] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x936df2c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4331, dwReserved0=0x628fd28, dwReserved1=0x7051138, cFileName="PDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR13~1.YOU")) returned 0x5b9630 [0154.049] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.682] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC", len=0x3f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 1 [0154.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0154.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.234] CloseHandle (hObject=0x3e4) returned 1 [0155.234] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0155.234] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0155.235] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0155.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~2.YOU")) returned 0x5b9730 [0155.235] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0155.235] GetProcessHeap () returned 0x580000 [0155.235] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0155.236] GetProcessHeap () returned 0x580000 [0155.236] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0155.236] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.236] ReadFile (in: hFile=0x3e4, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x628ff14*=0x260, lpOverlapped=0x0) returned 1 [0155.239] GetProcessHeap () returned 0x580000 [0155.239] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0155.239] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.239] WriteFile (in: hFile=0x3e4, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x628ff14*=0x260, lpOverlapped=0x0) returned 1 [0155.239] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.239] WriteFile (in: hFile=0x3e4, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0155.239] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.240] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0155.240] CloseHandle (hObject=0x3e4) returned 1 [0155.240] GetProcessHeap () returned 0x580000 [0155.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0155.240] GetProcessHeap () returned 0x580000 [0155.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0155.240] GetProcessHeap () returned 0x580000 [0155.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0155.852] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x94253ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x628fd28, dwReserved1=0x6df2798, cFileName="WINPROJ_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WINPRO~2.YOU")) returned 0x5b9630 [0155.852] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.906] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", len=0x3b | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 1 [0155.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0155.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0159.589] CloseHandle (hObject=0x43c) returned 1 [0159.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.590] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id_1622540890_.your_last_chance")) returned 1 [0159.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.591] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHARSE~1.YOU")) returned 0x5b9630 [0159.591] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0159.591] GetProcessHeap () returned 0x580000 [0159.591] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdce1) returned 0x7185768 [0159.591] GetProcessHeap () returned 0x580000 [0159.592] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdce1) returned 0x7193458 [0159.592] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.592] ReadFile (in: hFile=0x43c, lpBuffer=0x7185768, nNumberOfBytesToRead=0xdcc0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7185768*, lpNumberOfBytesRead=0x628ff14*=0xdcc0, lpOverlapped=0x0) returned 1 [0164.212] GetProcessHeap () returned 0x580000 [0164.212] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0164.212] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.213] WriteFile (in: hFile=0x43c, lpBuffer=0x7193458*, nNumberOfBytesToWrite=0xdcc0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7193458*, lpNumberOfBytesWritten=0x628ff14*=0xdcc0, lpOverlapped=0x0) returned 1 [0164.213] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.213] WriteFile (in: hFile=0x43c, lpBuffer=0x71a1117*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x71a1117*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0164.213] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.213] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0164.214] CloseHandle (hObject=0x43c) returned 1 [0164.214] GetProcessHeap () returned 0x580000 [0164.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7193458 | out: hHeap=0x580000) returned 1 [0164.214] GetProcessHeap () returned 0x580000 [0164.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7185768 | out: hHeap=0x580000) returned 1 [0164.214] GetProcessHeap () returned 0x580000 [0164.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0166.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997df340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdce6, dwReserved0=0x628fd28, dwReserved1=0x7185768, cFileName="CharSetTable.chr.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CHARSE~1.YOU")) returned 0x5b9730 [0166.284] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.421] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 1 [0166.421] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2260) returned 0x6f14048 [0166.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.607] CloseHandle (hObject=0x460) returned 1 [0166.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.608] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id_1622540890_.your_last_chance")) returned 1 [0166.608] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.611] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMCFG~1.YOU")) returned 0x5b9730 [0166.611] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0166.616] GetProcessHeap () returned 0x580000 [0166.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0166.616] GetProcessHeap () returned 0x580000 [0166.616] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x707ec98 [0166.616] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.616] ReadFile (in: hFile=0x460, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x628ff14*=0x300, lpOverlapped=0x0) returned 1 [0166.651] GetProcessHeap () returned 0x580000 [0166.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0166.651] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.651] WriteFile (in: hFile=0x460, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x628ff14*=0x300, lpOverlapped=0x0) returned 1 [0166.651] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.651] WriteFile (in: hFile=0x460, lpBuffer=0x707ef97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ef97*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0166.651] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.651] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0166.651] CloseHandle (hObject=0x460) returned 1 [0166.654] GetProcessHeap () returned 0x580000 [0166.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0166.654] GetProcessHeap () returned 0x580000 [0166.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0166.654] GetProcessHeap () returned 0x580000 [0166.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0166.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9af149c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x33f, dwReserved0=0x628fd28, dwReserved1=0x6df6780, cFileName="IPM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="IPMCFG~1.YOU")) returned 0x5b9730 [0169.125] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0173.047] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", len=0x42 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 1 [0173.047] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2234) returned 0x6f14048 [0173.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.062] CloseHandle (hObject=0x43c) returned 1 [0173.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id_1622540890_.your_last_chance")) returned 1 [0173.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~3.YOU")) returned 0x5b9770 [0173.063] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.063] GetProcessHeap () returned 0x580000 [0173.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cf780 [0173.063] GetProcessHeap () returned 0x580000 [0173.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5cfc08 [0173.064] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.064] ReadFile (in: hFile=0x43c, lpBuffer=0x5cf780, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cf780*, lpNumberOfBytesRead=0x628ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.090] GetProcessHeap () returned 0x580000 [0173.090] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.090] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] WriteFile (in: hFile=0x43c, lpBuffer=0x5cfc08*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5cfc08*, lpNumberOfBytesWritten=0x628ff14*=0x420, lpOverlapped=0x0) returned 1 [0173.090] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] WriteFile (in: hFile=0x43c, lpBuffer=0x5d0027*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0027*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.090] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.090] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.090] CloseHandle (hObject=0x43c) returned 1 [0173.090] GetProcessHeap () returned 0x580000 [0173.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cfc08 | out: hHeap=0x580000) returned 1 [0173.091] GetProcessHeap () returned 0x580000 [0173.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cf780 | out: hHeap=0x580000) returned 1 [0173.091] GetProcessHeap () returned 0x580000 [0173.091] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ec861a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x628fd28, dwReserved1=0x5cf780, cFileName="SCDRESPL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDRES~3.YOU")) returned 0x5b9770 [0173.104] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.130] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", len=0x41 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 1 [0173.130] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0173.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.131] CloseHandle (hObject=0x46c) returned 1 [0173.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.131] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.131] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x216f7400, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~3.YOU")) returned 0x5b9770 [0173.132] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.132] GetProcessHeap () returned 0x580000 [0173.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0173.132] GetProcessHeap () returned 0x580000 [0173.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0173.132] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.132] ReadFile (in: hFile=0x46c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x628ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.180] GetProcessHeap () returned 0x580000 [0173.180] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.180] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.180] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x628ff14*=0x300, lpOverlapped=0x0) returned 1 [0173.181] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.181] WriteFile (in: hFile=0x46c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.181] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.181] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.181] CloseHandle (hObject=0x46c) returned 1 [0173.181] GetProcessHeap () returned 0x580000 [0173.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0173.181] GetProcessHeap () returned 0x580000 [0173.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0173.181] GetProcessHeap () returned 0x580000 [0173.181] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed6a9e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x628fd28, dwReserved1=0x6df6780, cFileName="RSSITEM.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~3.YOU")) returned 0x5b9770 [0173.182] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.203] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", len=0x41 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 1 [0173.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0173.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.208] CloseHandle (hObject=0x490) returned 1 [0173.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id_1622540890_.your_last_chance")) returned 1 [0173.209] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~1.YOU")) returned 0x5b9770 [0173.209] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.209] GetProcessHeap () returned 0x580000 [0173.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65f268 [0173.209] GetProcessHeap () returned 0x580000 [0173.209] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x65fe70 [0173.209] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.209] ReadFile (in: hFile=0x490, lpBuffer=0x65f268, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x628ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.221] GetProcessHeap () returned 0x580000 [0173.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.221] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.221] WriteFile (in: hFile=0x490, lpBuffer=0x65fe70*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65fe70*, lpNumberOfBytesWritten=0x628ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.222] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.222] WriteFile (in: hFile=0x490, lpBuffer=0x660a0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x660a0f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.222] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.222] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.222] CloseHandle (hObject=0x490) returned 1 [0173.222] GetProcessHeap () returned 0x580000 [0173.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65fe70 | out: hHeap=0x580000) returned 1 [0173.222] GetProcessHeap () returned 0x580000 [0173.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0173.222] GetProcessHeap () returned 0x580000 [0173.222] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9edb6ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x628fd28, dwReserved1=0x65f268, cFileName="REPORTS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REPORT~1.YOU")) returned 0x5b9770 [0173.239] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.500] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", len=0x4d | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned 1 [0174.500] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0175.064] CloseHandle (hObject=0x430) returned 1 [0175.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0175.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.id_1622540890_.your_last_chance")) returned 1 [0175.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0175.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHISTL~1.YOU")) returned 0x5b96f0 [0175.065] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0175.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0175.065] GetProcessHeap () returned 0x580000 [0175.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7321) returned 0x70879e8 [0175.065] GetProcessHeap () returned 0x580000 [0175.065] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7321) returned 0x704a5d8 [0175.065] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.065] ReadFile (in: hFile=0x430, lpBuffer=0x70879e8, nNumberOfBytesToRead=0x7300, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x70879e8*, lpNumberOfBytesRead=0x628ff14*=0x7300, lpOverlapped=0x0) returned 1 [0176.468] GetProcessHeap () returned 0x580000 [0176.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.468] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.468] WriteFile (in: hFile=0x430, lpBuffer=0x704a5d8*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x704a5d8*, lpNumberOfBytesWritten=0x628ff14*=0x7300, lpOverlapped=0x0) returned 1 [0176.468] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.468] WriteFile (in: hFile=0x430, lpBuffer=0x70518d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x70518d7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.468] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.468] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.468] CloseHandle (hObject=0x430) returned 1 [0176.468] GetProcessHeap () returned 0x580000 [0176.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x704a5d8 | out: hHeap=0x580000) returned 1 [0176.468] GetProcessHeap () returned 0x580000 [0176.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70879e8 | out: hHeap=0x580000) returned 1 [0176.468] GetProcessHeap () returned 0x580000 [0176.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ccec00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7326, dwReserved0=0x628fd28, dwReserved1=0x70879e8, cFileName="Whistling.wav.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WHISTL~1.YOU")) returned 0x5b96f0 [0179.054] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.069] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", len=0x4b | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx") returned 1 [0179.069] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0179.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0181.181] CloseHandle (hObject=0x490) returned 1 [0181.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0181.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.id_1622540890_.your_last_chance")) returned 1 [0182.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x45, dwReserved1=0x0, cFileName="Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANUSC~1.YOU")) returned 0x5b9770 [0182.115] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0182.115] GetProcessHeap () returned 0x580000 [0182.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2121) returned 0x6dec6e0 [0182.115] GetProcessHeap () returned 0x580000 [0182.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2121) returned 0x6d748d8 [0182.115] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.115] ReadFile (in: hFile=0x46c, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x2100, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x628ff14*=0x2100, lpOverlapped=0x0) returned 1 [0182.192] GetProcessHeap () returned 0x580000 [0182.192] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0182.192] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.192] WriteFile (in: hFile=0x46c, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x2100, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x628ff14*=0x2100, lpOverlapped=0x0) returned 1 [0182.193] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.193] WriteFile (in: hFile=0x46c, lpBuffer=0x6d769d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d769d7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.193] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.193] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.193] CloseHandle (hObject=0x46c) returned 1 [0182.193] GetProcessHeap () returned 0x580000 [0182.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0182.193] GetProcessHeap () returned 0x580000 [0182.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0182.193] GetProcessHeap () returned 0x580000 [0182.193] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0182.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa43684a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2130, dwReserved0=0x628fd28, dwReserved1=0x6dec6e0, cFileName="Manuscript.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANUSC~1.YOU")) returned 0x5b9770 [0182.194] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.212] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", len=0x4b | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned 1 [0182.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0182.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.779] CloseHandle (hObject=0x488) returned 1 [0182.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.779] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.780] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x45, dwReserved1=0x0, cFileName="StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOPIC~1.YOU")) returned 0x5b9770 [0182.780] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.780] GetProcessHeap () returned 0x580000 [0182.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6c79898 [0182.780] GetProcessHeap () returned 0x580000 [0182.780] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x841) returned 0x6d00cd8 [0182.780] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.780] ReadFile (in: hFile=0x488, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x820, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x628ff14*=0x820, lpOverlapped=0x0) returned 1 [0182.788] GetProcessHeap () returned 0x580000 [0182.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.789] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.789] WriteFile (in: hFile=0x488, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x628ff14*=0x820, lpOverlapped=0x0) returned 1 [0182.789] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.789] WriteFile (in: hFile=0x488, lpBuffer=0x6d014f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d014f7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.789] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.789] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.789] CloseHandle (hObject=0x488) returned 1 [0182.789] GetProcessHeap () returned 0x580000 [0182.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0182.789] GetProcessHeap () returned 0x580000 [0182.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0182.789] GetProcessHeap () returned 0x580000 [0182.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa490f8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x628fd28, dwReserved1=0x6c79898, cFileName="StopIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOPIC~1.YOU")) returned 0x5b9770 [0183.803] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.817] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", len=0x6f | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned 1 [0183.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0183.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0186.453] CloseHandle (hObject=0x4a4) returned 1 [0186.453] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.460] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d22, dwReserved0=0x2e0059, dwReserved1=0x50004a, cFileName="CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CURREN~1.YOU")) returned 0x5b96b0 [0186.460] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0186.460] GetProcessHeap () returned 0x580000 [0186.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d41) returned 0x6fdb0f8 [0186.460] GetProcessHeap () returned 0x580000 [0186.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d41) returned 0x6fdee48 [0186.461] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.461] ReadFile (in: hFile=0x420, lpBuffer=0x6fdb0f8, nNumberOfBytesToRead=0x3d20, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdb0f8*, lpNumberOfBytesRead=0x628ff14*=0x3d20, lpOverlapped=0x0) returned 1 [0187.615] GetProcessHeap () returned 0x580000 [0187.615] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0187.616] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.616] WriteFile (in: hFile=0x420, lpBuffer=0x6fdee48*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdee48*, lpNumberOfBytesWritten=0x628ff14*=0x3d20, lpOverlapped=0x0) returned 1 [0187.616] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.616] WriteFile (in: hFile=0x420, lpBuffer=0x6fe2b67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe2b67*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.616] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.616] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.616] CloseHandle (hObject=0x420) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fdee48 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fdb0f8 | out: hHeap=0x580000) returned 1 [0187.781] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0188.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa77081c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d46, dwReserved0=0x628fd28, dwReserved1=0x6fdb0f8, cFileName="CURRENCY.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CURREN~1.YOU")) returned 0x5b9770 [0188.061] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.081] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", len=0x45 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned 1 [0188.081] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2064) returned 0x6f14048 [0188.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0191.911] CloseHandle (hObject=0x4a8) returned 1 [0191.911] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.912] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.579] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.579] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1304, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1919~1.YOU")) returned 0x5b97b0 [0194.579] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0194.579] GetProcessHeap () returned 0x580000 [0194.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6c9a390 [0194.579] GetProcessHeap () returned 0x580000 [0194.580] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1321) returned 0x6c9b798 [0194.580] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.580] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c9a390, nNumberOfBytesToRead=0x1300, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9a390*, lpNumberOfBytesRead=0x628ff14*=0x1300, lpOverlapped=0x0) returned 1 [0194.597] GetProcessHeap () returned 0x580000 [0194.597] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0194.597] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.598] WriteFile (in: hFile=0x4a8, lpBuffer=0x6c9b798*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9b798*, lpNumberOfBytesWritten=0x628ff14*=0x1300, lpOverlapped=0x0) returned 1 [0194.598] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.598] WriteFile (in: hFile=0x4a8, lpBuffer=0x6c9ca97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c9ca97*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0194.598] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.598] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0194.598] CloseHandle (hObject=0x4a8) returned 1 [0194.598] GetProcessHeap () returned 0x580000 [0194.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9b798 | out: hHeap=0x580000) returned 1 [0194.598] GetProcessHeap () returned 0x580000 [0194.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c9a390 | out: hHeap=0x580000) returned 1 [0194.598] GetProcessHeap () returned 0x580000 [0194.598] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab9ae9c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1328, dwReserved0=0x628fd28, dwReserved1=0x6c9a390, cFileName="ZPDIR46B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP1919~1.YOU")) returned 0x5b97b0 [0194.598] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.620] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x73 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0194.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0194.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.204] CloseHandle (hObject=0x488) returned 1 [0196.204] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.204] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0196.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x410045, dwReserved1=0x450044, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0196.601] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0196.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0196.601] GetProcessHeap () returned 0x580000 [0196.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6dd20e8 [0196.601] GetProcessHeap () returned 0x580000 [0196.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6dd22c0 [0196.601] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.601] ReadFile (in: hFile=0x488, lpBuffer=0x6dd20e8, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd20e8*, lpNumberOfBytesRead=0x628ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0196.604] GetProcessHeap () returned 0x580000 [0196.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.604] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.604] WriteFile (in: hFile=0x488, lpBuffer=0x6dd22c0*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd22c0*, lpNumberOfBytesWritten=0x628ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0196.604] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.604] WriteFile (in: hFile=0x488, lpBuffer=0x6dd245f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd245f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.604] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.604] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.604] CloseHandle (hObject=0x488) returned 1 [0196.604] GetProcessHeap () returned 0x580000 [0196.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd22c0 | out: hHeap=0x580000) returned 1 [0196.604] GetProcessHeap () returned 0x580000 [0196.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd20e8 | out: hHeap=0x580000) returned 1 [0196.604] GetProcessHeap () returned 0x580000 [0196.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0199.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb99c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x628fd28, dwReserved1=0x6dd20e8, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0199.131] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.140] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", len=0x44 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned 1 [0199.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0199.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.728] CloseHandle (hObject=0x4ac) returned 1 [0199.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0199.728] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.id_1622540890_.your_last_chance")) returned 1 [0199.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0199.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xaf65, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR39~1.YOU")) returned 0x5b96b0 [0199.729] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0199.729] GetProcessHeap () returned 0x580000 [0199.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaf81) returned 0x70a8b68 [0199.729] GetProcessHeap () returned 0x580000 [0199.729] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaf81) returned 0x70b3af8 [0199.729] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.729] ReadFile (in: hFile=0x4ac, lpBuffer=0x70a8b68, nNumberOfBytesToRead=0xaf60, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a8b68*, lpNumberOfBytesRead=0x628ff14*=0xaf60, lpOverlapped=0x0) returned 1 [0200.888] GetProcessHeap () returned 0x580000 [0200.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.888] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.888] WriteFile (in: hFile=0x4ac, lpBuffer=0x70b3af8*, nNumberOfBytesToWrite=0xaf60, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3af8*, lpNumberOfBytesWritten=0x628ff14*=0xaf60, lpOverlapped=0x0) returned 1 [0200.888] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.889] WriteFile (in: hFile=0x4ac, lpBuffer=0x70bea57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bea57*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.889] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.889] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.889] CloseHandle (hObject=0x4ac) returned 1 [0200.889] GetProcessHeap () returned 0x580000 [0200.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3af8 | out: hHeap=0x580000) returned 1 [0200.889] GetProcessHeap () returned 0x580000 [0200.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a8b68 | out: hHeap=0x580000) returned 1 [0200.889] GetProcessHeap () returned 0x580000 [0200.889] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf5a33e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaf89, dwReserved0=0x628fd28, dwReserved1=0x70a8b68, cFileName="PDIR39F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR39~1.YOU")) returned 0x5b9770 [0201.396] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.401] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", len=0x72 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned 1 [0201.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0201.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.402] CloseHandle (hObject=0x440) returned 1 [0201.402] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.403] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.436] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.436] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0062, dwReserved1=0x6e006f, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.436] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.436] GetProcessHeap () returned 0x580000 [0201.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0201.436] GetProcessHeap () returned 0x580000 [0201.436] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0201.436] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.436] ReadFile (in: hFile=0x440, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.438] GetProcessHeap () returned 0x580000 [0201.438] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.438] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.438] WriteFile (in: hFile=0x440, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0201.438] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.438] WriteFile (in: hFile=0x440, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.438] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.438] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.439] CloseHandle (hObject=0x440) returned 1 [0201.439] GetProcessHeap () returned 0x580000 [0201.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0201.439] GetProcessHeap () returned 0x580000 [0201.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0201.439] GetProcessHeap () returned 0x580000 [0201.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.043] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafad8400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x628fd28, dwReserved1=0x5ae2f0, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0202.043] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.085] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS", len=0x45 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS") returned 1 [0202.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f0c) returned 0x6f14048 [0202.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.090] CloseHandle (hObject=0x4ac) returned 1 [0202.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css.id_1622540890_.your_last_chance")) returned 1 [0202.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.091] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfbc000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cfbc000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1fdb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC96B8~1.YOU")) returned 0x5b9770 [0202.091] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.091] GetProcessHeap () returned 0x580000 [0202.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0202.092] GetProcessHeap () returned 0x580000 [0202.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0202.093] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.093] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.464] GetProcessHeap () returned 0x580000 [0209.464] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0209.464] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.464] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0209.465] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.465] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.465] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.465] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.465] CloseHandle (hObject=0x4ac) returned 1 [0209.465] GetProcessHeap () returned 0x580000 [0209.465] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0209.731] GetProcessHeap () returned 0x580000 [0209.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0209.731] GetProcessHeap () returned 0x580000 [0209.731] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0209.731] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfbc000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4776820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fdda, dwReserved0=0x628fd28, dwReserved1=0x6d630a8, cFileName="SCHEME46.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC96B8~1.YOU")) returned 0x5b97f0 [0209.731] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.781] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", len=0x67 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned 1 [0209.781] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f04) returned 0x6f14048 [0209.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.782] CloseHandle (hObject=0x458) returned 1 [0209.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.782] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.id_1622540890_.your_last_chance")) returned 1 [0209.783] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.783] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU0357~1.YOU")) returned 0x5b97f0 [0209.783] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.783] GetProcessHeap () returned 0x580000 [0209.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0209.783] GetProcessHeap () returned 0x580000 [0209.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0209.783] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.783] ReadFile (in: hFile=0x458, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x628ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.785] GetProcessHeap () returned 0x580000 [0209.785] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0209.785] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.785] WriteFile (in: hFile=0x458, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x628ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.785] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.785] WriteFile (in: hFile=0x458, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.786] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.786] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.786] CloseHandle (hObject=0x458) returned 1 [0209.786] GetProcessHeap () returned 0x580000 [0209.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0209.786] GetProcessHeap () returned 0x580000 [0209.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0209.786] GetProcessHeap () returned 0x580000 [0209.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0209.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a703a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x628fd28, dwReserved1=0x5b8df0, cFileName="button_left_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU0357~1.YOU")) returned 0x5b97f0 [0209.786] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.823] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x6e | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0209.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0209.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0209.824] CloseHandle (hObject=0x448) returned 1 [0209.824] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.824] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0210.029] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x47002e, dwReserved1=0x460049, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0210.029] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.029] GetProcessHeap () returned 0x580000 [0210.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5b4c8 [0210.029] GetProcessHeap () returned 0x580000 [0210.029] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6c5b738 [0210.029] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.029] ReadFile (in: hFile=0x448, lpBuffer=0x6c5b4c8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b4c8*, lpNumberOfBytesRead=0x628ff14*=0x100, lpOverlapped=0x0) returned 1 [0210.031] GetProcessHeap () returned 0x580000 [0210.031] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0210.031] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.031] WriteFile (in: hFile=0x448, lpBuffer=0x6c5b738*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b738*, lpNumberOfBytesWritten=0x628ff14*=0x100, lpOverlapped=0x0) returned 1 [0210.031] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.031] WriteFile (in: hFile=0x448, lpBuffer=0x6c5b837*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c5b837*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.031] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.031] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.031] CloseHandle (hObject=0x448) returned 1 [0210.032] GetProcessHeap () returned 0x580000 [0210.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5b738 | out: hHeap=0x580000) returned 1 [0210.032] GetProcessHeap () returned 0x580000 [0210.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c5b4c8 | out: hHeap=0x580000) returned 1 [0210.032] GetProcessHeap () returned 0x580000 [0210.032] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0214.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cd19a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12f, dwReserved0=0x628fd28, dwReserved1=0x6c5b4c8, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b97b0 [0214.536] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.555] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", len=0x76 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0214.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0214.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0215.692] CloseHandle (hObject=0x3a8) returned 1 [0215.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.695] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance")) returned 1 [0215.707] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.707] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x6b0063, dwReserved1=0x720067, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b97b0 [0215.707] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0215.708] GetProcessHeap () returned 0x580000 [0215.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6dd40d0 [0215.708] GetProcessHeap () returned 0x580000 [0215.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1b01) returned 0x6f14048 [0215.708] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.708] ReadFile (in: hFile=0x3a8, lpBuffer=0x6dd40d0, nNumberOfBytesToRead=0x1ae0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd40d0*, lpNumberOfBytesRead=0x628ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0215.733] GetProcessHeap () returned 0x580000 [0215.733] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0215.733] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.733] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f14048*, nNumberOfBytesToWrite=0x1ae0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesWritten=0x628ff14*=0x1ae0, lpOverlapped=0x0) returned 1 [0216.673] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.673] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f15b27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f15b27*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0216.673] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0216.673] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0216.673] CloseHandle (hObject=0x3a8) returned 1 [0216.673] GetProcessHeap () returned 0x580000 [0216.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0216.673] GetProcessHeap () returned 0x580000 [0216.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd40d0 | out: hHeap=0x580000) returned 1 [0216.673] GetProcessHeap () returned 0x580000 [0216.673] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0220.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8c32360, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1b1e, dwReserved0=0x628fd28, dwReserved1=0x6dd40d0, cFileName="background.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BACKGR~1.YOU")) returned 0x5b9770 [0220.320] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.639] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", len=0x4a | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 1 [0221.639] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f28) returned 0x6dee6e0 [0221.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.672] CloseHandle (hObject=0x458) returned 1 [0221.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id_1622540890_.your_last_chance")) returned 1 [0221.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~2.YOU")) returned 0x5b9730 [0221.673] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.673] GetProcessHeap () returned 0x580000 [0221.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0221.673] GetProcessHeap () returned 0x580000 [0221.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6ece008 [0221.673] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.673] ReadFile (in: hFile=0x458, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x628ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.708] GetProcessHeap () returned 0x580000 [0221.708] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.708] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.708] WriteFile (in: hFile=0x458, lpBuffer=0x6ece008*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesWritten=0x628ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.709] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.709] WriteFile (in: hFile=0x458, lpBuffer=0x6eced67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eced67*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.709] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.709] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.709] CloseHandle (hObject=0x458) returned 1 [0221.709] GetProcessHeap () returned 0x580000 [0221.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0221.709] GetProcessHeap () returned 0x580000 [0221.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0221.709] GetProcessHeap () returned 0x580000 [0221.709] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbc3ff80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x628fd28, dwReserved1=0x6c29878, cFileName="OnLineIdle.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~2.YOU")) returned 0x5b9730 [0221.709] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.777] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", len=0x46 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 1 [0221.777] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0221.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.778] CloseHandle (hObject=0x47c) returned 1 [0221.778] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.778] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id_1622540890_.your_last_chance")) returned 1 [0221.779] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANUAL~1.YOU")) returned 0x5b9730 [0221.779] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.779] GetProcessHeap () returned 0x580000 [0221.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0221.779] GetProcessHeap () returned 0x580000 [0221.779] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5d57a0 [0221.779] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.779] ReadFile (in: hFile=0x47c, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x628ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.781] GetProcessHeap () returned 0x580000 [0221.781] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.781] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.781] WriteFile (in: hFile=0x47c, lpBuffer=0x5d57a0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d57a0*, lpNumberOfBytesWritten=0x628ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.781] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.781] WriteFile (in: hFile=0x47c, lpBuffer=0x5d58bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d58bf*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.781] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.781] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.782] CloseHandle (hObject=0x47c) returned 1 [0221.782] GetProcessHeap () returned 0x580000 [0221.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d57a0 | out: hHeap=0x580000) returned 1 [0221.782] GetProcessHeap () returned 0x580000 [0221.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0221.782] GetProcessHeap () returned 0x580000 [0221.782] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbcd8500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x628fd28, dwReserved1=0x65f0b0, cFileName="MANUAL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MANUAL~1.YOU")) returned 0x5b9730 [0221.782] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.812] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", len=0x52 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 1 [0221.812] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0221.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.009] CloseHandle (hObject=0x480) returned 1 [0223.009] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.009] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id_1622540890_.your_last_chance")) returned 1 [0223.011] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GFSERR~2.YOU")) returned 0x5b96f0 [0223.011] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.011] GetProcessHeap () returned 0x580000 [0223.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0223.011] GetProcessHeap () returned 0x580000 [0223.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0223.011] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.011] ReadFile (in: hFile=0x480, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x628ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0223.019] GetProcessHeap () returned 0x580000 [0223.019] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.019] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.019] WriteFile (in: hFile=0x480, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x628ff14*=0x6a0, lpOverlapped=0x0) returned 1 [0223.019] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.019] WriteFile (in: hFile=0x480, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.019] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.019] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.019] CloseHandle (hObject=0x480) returned 1 [0223.020] GetProcessHeap () returned 0x580000 [0223.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0223.020] GetProcessHeap () returned 0x580000 [0223.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0223.020] GetProcessHeap () returned 0x580000 [0223.020] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc8bf300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6da, dwReserved0=0x628fd28, dwReserved1=0x6c79898, cFileName="gfserrorfromgroove.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GFSERR~2.YOU")) returned 0x5b9630 [0225.465] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.795] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", len=0x69 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned 1 [0225.795] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0225.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.796] CloseHandle (hObject=0x438) returned 1 [0225.796] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0225.797] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9630 [0225.797] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.797] GetProcessHeap () returned 0x580000 [0225.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x6f99dc8 [0225.797] GetProcessHeap () returned 0x580000 [0225.797] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xae1) returned 0x677cd0 [0225.797] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.797] ReadFile (in: hFile=0x438, lpBuffer=0x6f99dc8, nNumberOfBytesToRead=0xac0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f99dc8*, lpNumberOfBytesRead=0x628ff14*=0xac0, lpOverlapped=0x0) returned 1 [0225.817] GetProcessHeap () returned 0x580000 [0225.817] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.817] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.817] WriteFile (in: hFile=0x438, lpBuffer=0x677cd0*, nNumberOfBytesToWrite=0xac0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesWritten=0x628ff14*=0xac0, lpOverlapped=0x0) returned 1 [0225.817] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.817] WriteFile (in: hFile=0x438, lpBuffer=0x67878f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x67878f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.817] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.818] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.818] CloseHandle (hObject=0x438) returned 1 [0225.818] GetProcessHeap () returned 0x580000 [0225.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0225.818] GetProcessHeap () returned 0x580000 [0225.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f99dc8 | out: hHeap=0x580000) returned 1 [0225.818] GetProcessHeap () returned 0x580000 [0225.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe1e3b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb03, dwReserved0=0x628fd28, dwReserved1=0x6f99dc8, cFileName="FormsViewTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~1.YOU")) returned 0x5b9630 [0225.818] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.833] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", len=0x6d | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned 1 [0225.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0225.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.834] CloseHandle (hObject=0x448) returned 1 [0225.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance")) returned 1 [0225.835] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.835] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x730063, dwReserved1=0x2e0073, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b9630 [0225.835] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.836] GetProcessHeap () returned 0x580000 [0225.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4e820 [0225.836] GetProcessHeap () returned 0x580000 [0225.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6c4efa8 [0225.836] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.836] ReadFile (in: hFile=0x448, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x628ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.871] GetProcessHeap () returned 0x580000 [0225.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.871] WriteFile (in: hFile=0x448, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x628ff14*=0x720, lpOverlapped=0x0) returned 1 [0225.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.871] WriteFile (in: hFile=0x448, lpBuffer=0x6c4f6c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6c7*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.871] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.871] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.871] CloseHandle (hObject=0x448) returned 1 [0225.871] GetProcessHeap () returned 0x580000 [0225.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0225.871] GetProcessHeap () returned 0x580000 [0225.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0225.871] GetProcessHeap () returned 0x580000 [0225.871] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe255f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x757, dwReserved0=0x628fd28, dwReserved1=0x6c4e820, cFileName="VelvetRose.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VELVET~1.YOU")) returned 0x5b9630 [0225.872] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.888] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned 1 [0225.888] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0225.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.888] CloseHandle (hObject=0x4a8) returned 1 [0225.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.889] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0225.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x460046, dwReserved1=0x47002e, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9630 [0225.890] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.890] GetProcessHeap () returned 0x580000 [0225.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dece50 [0225.890] GetProcessHeap () returned 0x580000 [0225.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6decfc8 [0225.890] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.890] ReadFile (in: hFile=0x4a8, lpBuffer=0x6dece50, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dece50*, lpNumberOfBytesRead=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0225.892] GetProcessHeap () returned 0x580000 [0225.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.892] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.892] WriteFile (in: hFile=0x4a8, lpBuffer=0x6decfc8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6decfc8*, lpNumberOfBytesWritten=0x628ff14*=0x140, lpOverlapped=0x0) returned 1 [0225.892] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.892] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ded107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ded107*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.892] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.892] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.893] CloseHandle (hObject=0x4a8) returned 1 [0225.893] GetProcessHeap () returned 0x580000 [0225.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6decfc8 | out: hHeap=0x580000) returned 1 [0225.893] GetProcessHeap () returned 0x580000 [0225.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dece50 | out: hHeap=0x580000) returned 1 [0225.893] GetProcessHeap () returned 0x580000 [0225.893] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe2a2240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x628fd28, dwReserved1=0x6dece50, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9630 [0225.893] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.967] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x75 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0225.967] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0225.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.967] CloseHandle (hObject=0x448) returned 1 [0225.967] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance")) returned 1 [0225.968] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x42005c, dwReserved1=0x540055, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9630 [0225.969] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.969] GetProcessHeap () returned 0x580000 [0225.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c59120 [0225.969] GetProcessHeap () returned 0x580000 [0225.969] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c1) returned 0x6c592f8 [0225.969] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.969] ReadFile (in: hFile=0x448, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x1a0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x628ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0225.983] GetProcessHeap () returned 0x580000 [0225.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0225.983] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.983] WriteFile (in: hFile=0x448, lpBuffer=0x6c592f8*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c592f8*, lpNumberOfBytesWritten=0x628ff14*=0x1a0, lpOverlapped=0x0) returned 1 [0225.983] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.983] WriteFile (in: hFile=0x448, lpBuffer=0x6c59497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59497*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.983] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.983] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.983] CloseHandle (hObject=0x448) returned 1 [0225.998] GetProcessHeap () returned 0x580000 [0225.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c592f8 | out: hHeap=0x580000) returned 1 [0225.998] GetProcessHeap () returned 0x580000 [0225.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0225.998] GetProcessHeap () returned 0x580000 [0225.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0225.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe386a80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x628fd28, dwReserved1=0x6c59120, cFileName="BUTTON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~1.YOU")) returned 0x5b9630 [0225.999] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.016] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT", len=0x46 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 1 [0226.016] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc8) returned 0x6dee6e0 [0226.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.064] CloseHandle (hObject=0x454) returned 1 [0226.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.065] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0226.065] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.066] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INCDF9~1.YOU")) returned 0x5b9630 [0226.066] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0226.066] GetProcessHeap () returned 0x580000 [0226.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0226.066] GetProcessHeap () returned 0x580000 [0226.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0226.066] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.066] ReadFile (in: hFile=0x454, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.068] GetProcessHeap () returned 0x580000 [0226.068] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.068] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.068] WriteFile (in: hFile=0x454, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x628ff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.068] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.068] WriteFile (in: hFile=0x454, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0226.068] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.068] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0226.068] CloseHandle (hObject=0x454) returned 1 [0226.068] GetProcessHeap () returned 0x580000 [0226.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0226.068] GetProcessHeap () returned 0x580000 [0226.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0226.068] GetProcessHeap () returned 0x580000 [0226.068] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.544] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe445160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfa, dwReserved0=0x628fd28, dwReserved1=0x5ae2f0, cFileName="INFOPATHEDITOR_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INCDF9~1.YOU")) returned 0x5b9630 [0226.544] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.236] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", len=0x54 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned 1 [0230.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0230.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0230.248] CloseHandle (hObject=0x4a0) returned 1 [0230.248] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.248] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.id_1622540890_.your_last_chance")) returned 1 [0230.249] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x530041, dwReserved1=0x5f0054, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9630 [0230.249] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0230.249] GetProcessHeap () returned 0x580000 [0230.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72d6838 [0230.249] GetProcessHeap () returned 0x580000 [0230.250] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0230.250] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.250] ReadFile (in: hFile=0x4a0, lpBuffer=0x72d6838, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x72d6838*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0238.324] GetProcessHeap () returned 0x580000 [0238.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0238.324] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0238.325] WriteFile (in: hFile=0x4a0, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.327] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.327] WriteFile (in: hFile=0x4a0, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.383] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.383] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.383] CloseHandle (hObject=0x4a0) returned 1 [0239.464] GetProcessHeap () returned 0x580000 [0239.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0239.464] GetProcessHeap () returned 0x580000 [0239.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72d6838 | out: hHeap=0x580000) returned 1 [0239.464] GetProcessHeap () returned 0x580000 [0239.464] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0240.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc63527a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x837fb, dwReserved0=0x628fd28, dwReserved1=0x72d6838, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MICROS~1.YOU")) returned 0x5b9730 [0240.817] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.829] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", len=0x45 | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned 1 [0240.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd0) returned 0x6dee6e0 [0240.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.830] CloseHandle (hObject=0x3f4) returned 1 [0240.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.id_1622540890_.your_last_chance")) returned 1 [0240.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI9053~1.YOU")) returned 0x5b9730 [0240.831] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0240.831] GetProcessHeap () returned 0x580000 [0240.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0240.832] GetProcessHeap () returned 0x580000 [0240.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7287008 [0240.832] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.832] ReadFile (in: hFile=0x3f4, lpBuffer=0x703b9b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.256] GetProcessHeap () returned 0x580000 [0244.256] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0244.257] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.257] WriteFile (in: hFile=0x3f4, lpBuffer=0x7287008*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7287008*, lpNumberOfBytesWritten=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 [0244.257] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.257] WriteFile (in: hFile=0x3f4, lpBuffer=0x7298807*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7298807*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0244.419] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.419] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0244.419] CloseHandle (hObject=0x3f4) returned 1 [0244.420] GetProcessHeap () returned 0x580000 [0244.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7287008 | out: hHeap=0x580000) returned 1 [0244.420] GetProcessHeap () returned 0x580000 [0244.420] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0244.544] GetProcessHeap () returned 0x580000 [0244.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0249.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc933a260, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5a78c, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="Microsoft.BusinessData.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MI9053~1.YOU")) returned 0x5b9730 [0249.274] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.375] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC", len=0x3e | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 1 [0249.375] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0249.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0249.376] CloseHandle (hObject=0x420) returned 1 [0249.376] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0249.377] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.id_1622540890_.your_last_chance")) returned 1 [0249.377] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0249.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xe6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCARD~1.YOU")) returned 0x5b9730 [0249.378] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0249.378] GetProcessHeap () returned 0x580000 [0249.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe701) returned 0x6ff5d60 [0249.378] GetProcessHeap () returned 0x580000 [0249.378] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe701) returned 0x6e49530 [0249.378] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0249.378] ReadFile (in: hFile=0x420, lpBuffer=0x6ff5d60, nNumberOfBytesToRead=0xe6e0, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff5d60*, lpNumberOfBytesRead=0x628ff14*=0xe6e0, lpOverlapped=0x0) returned 1 [0252.415] GetProcessHeap () returned 0x580000 [0252.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0252.416] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.416] WriteFile (in: hFile=0x420, lpBuffer=0x6e49530*, nNumberOfBytesToWrite=0xe6e0, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e49530*, lpNumberOfBytesWritten=0x628ff14*=0xe6e0, lpOverlapped=0x0) returned 1 [0252.416] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.416] WriteFile (in: hFile=0x420, lpBuffer=0x6e57c0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e57c0f*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.416] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.416] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.416] CloseHandle (hObject=0x420) returned 1 [0252.898] GetProcessHeap () returned 0x580000 [0252.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e49530 | out: hHeap=0x580000) returned 1 [0252.898] GetProcessHeap () returned 0x580000 [0252.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff5d60 | out: hHeap=0x580000) returned 1 [0252.898] GetProcessHeap () returned 0x580000 [0252.898] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdf8c3c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe71c, dwReserved0=0x628fd28, dwReserved1=0x6ff5d60, cFileName="BZCARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BZCARD~1.YOU")) returned 0x5b9730 [0254.424] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.362] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 1 [0255.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f60) returned 0x72e5948 [0255.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.662] CloseHandle (hObject=0x170) returned 1 [0258.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.id_1622540890_.your_last_chance")) returned 1 [0258.663] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b69d100, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b69d100, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPUNC~1.YOU")) returned 0x5b96f0 [0258.663] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.664] GetProcessHeap () returned 0x580000 [0258.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6ce54c0 [0258.664] GetProcessHeap () returned 0x580000 [0258.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6ce6348 [0258.664] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.664] ReadFile (in: hFile=0x170, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x628ff14*=0xe00, lpOverlapped=0x0) returned 1 [0258.682] GetProcessHeap () returned 0x580000 [0258.682] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.682] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.682] WriteFile (in: hFile=0x170, lpBuffer=0x6ce6348*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6348*, lpNumberOfBytesWritten=0x628ff14*=0xe00, lpOverlapped=0x0) returned 1 [0258.682] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.682] WriteFile (in: hFile=0x170, lpBuffer=0x6ce7147*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce7147*, lpNumberOfBytesWritten=0x628ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.683] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.683] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x628ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.683] CloseHandle (hObject=0x170) returned 1 [0258.683] GetProcessHeap () returned 0x580000 [0258.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce6348 | out: hHeap=0x580000) returned 1 [0258.683] GetProcessHeap () returned 0x580000 [0258.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0258.683] GetProcessHeap () returned 0x580000 [0258.683] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fccc | out: lpFindFileData=0x628fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b69d100, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b5ac80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe24, dwReserved0=0x628fd28, dwReserved1=0x6ce54c0, cFileName="DGPUNCT.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPUNC~1.YOU")) returned 0x5b9630 [0259.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.236] SysReAllocStringLen (in: pbstr=0x628ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV", len=0x3d | out: pbstr=0x628ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV") returned 1 [0259.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2094) returned 0x72e5948 [0259.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0259.341] CloseHandle (hObject=0x420) returned 1 [0259.341] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.341] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv.id_1622540890_.your_last_chance")) returned 1 [0259.342] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x628ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x628fc74 | out: lpFindFileData=0x628fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89f6100, ftCreationTime.dwHighDateTime=0x1ca1016, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf89f6100, ftLastWriteTime.dwHighDateTime=0x1ca1016, nFileSizeHigh=0x0, nFileSizeLow=0x5f93b, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYBB.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STORYB~1.YOU")) returned 0x5b9630 [0259.342] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0259.343] GetProcessHeap () returned 0x580000 [0259.343] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0259.344] GetProcessHeap () returned 0x580000 [0259.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0259.344] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.344] ReadFile (in: hFile=0x420, lpBuffer=0x7007128, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x628ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesRead=0x628ff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 56 os_tid = 0xad8 [0039.070] Sleep (dwMilliseconds=0x1) [0039.092] Sleep (dwMilliseconds=0x1) [0039.114] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.286] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.581] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.589] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.083] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.118] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.717] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.775] Sleep (dwMilliseconds=0x1) [0043.790] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.821] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.930] Sleep (dwMilliseconds=0x1) [0043.946] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.025] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.414] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.445] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.523] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.601] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.679] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.757] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.788] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.835] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.866] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.897] Sleep (dwMilliseconds=0x1) [0044.913] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.991] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.022] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.178] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.225] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.334] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.381] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.492] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.537] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.678] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.896] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.927] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.005] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.083] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.239] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.395] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.536] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.629] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.707] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.785] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.930] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.050] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.128] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.206] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.362] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.409] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.440] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.518] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.681] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.752] Sleep (dwMilliseconds=0x1) [0047.768] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.986] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.064] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.111] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.142] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.376] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.454] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.501] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.766] Sleep (dwMilliseconds=0x1) [0048.782] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.922] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.000] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.047] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.078] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.234] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.281] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.030] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.529] Sleep (dwMilliseconds=0x1) [0050.546] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.794] Sleep (dwMilliseconds=0x1) [0050.810] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.872] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.153] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.826] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.966] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.356] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.387] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.606] Sleep (dwMilliseconds=0x1) [0052.621] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.684] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.058] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.167] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.479] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.526] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.651] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.682] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.994] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.400] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.540] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.696] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.743] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.930] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0059.625] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", len=0x4b | out: pbstr=0x63cff84*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 1 [0059.625] GetProcessHeap () returned 0x580000 [0059.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1578, Size=0x58) returned 0x5a47d8 [0059.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.716] CloseHandle (hObject=0x40c) returned 1 [0060.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.716] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id_1622540890_.your_last_chance")) returned 1 [0060.716] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.717] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x45, dwReserved1=0x0, cFileName="GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~2.YOU")) returned 0x5b9630 [0060.717] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0060.717] GetProcessHeap () returned 0x580000 [0060.717] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e63be0 [0060.718] GetProcessHeap () returned 0x580000 [0060.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e75410 [0060.718] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.718] ReadFile (in: hFile=0x40c, lpBuffer=0x6e63be0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e63be0*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.042] GetProcessHeap () returned 0x580000 [0066.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615648 [0066.042] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.042] WriteFile (in: hFile=0x40c, lpBuffer=0x6e75410*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e75410*, lpNumberOfBytesWritten=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.817] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.817] WriteFile (in: hFile=0x40c, lpBuffer=0x6e86c0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e86c0f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0067.504] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.504] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0067.504] CloseHandle (hObject=0x40c) returned 1 [0069.518] GetProcessHeap () returned 0x580000 [0069.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e75410 | out: hHeap=0x580000) returned 1 [0069.519] GetProcessHeap () returned 0x580000 [0069.519] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e63be0 | out: hHeap=0x580000) returned 1 [0069.520] GetProcessHeap () returned 0x580000 [0069.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615648 | out: hHeap=0x580000) returned 1 [0069.520] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x6129a980, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e43, dwReserved0=0x63cfd28, dwReserved1=0x6e63be0, cFileName="GrooveLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GROOVE~2.YOU")) returned 0x5b96b0 [0069.520] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0072.142] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", len=0x55 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 1 [0072.142] GetProcessHeap () returned 0x580000 [0072.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x6c) returned 0x5b5d08 [0072.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.964] Sleep (dwMilliseconds=0x1) [0073.002] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", len=0x54 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 1 [0073.003] GetProcessHeap () returned 0x580000 [0073.003] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x4c) returned 0x5b5d08 [0073.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.072] Sleep (dwMilliseconds=0x1) [0073.087] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", len=0x3d | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 1 [0073.087] GetProcessHeap () returned 0x580000 [0073.087] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x28) returned 0x5b5d08 [0073.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.674] CloseHandle (hObject=0x464) returned 1 [0074.674] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id_1622540890_.your_last_chance")) returned 1 [0074.675] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSGIFI~1.YOU")) returned 0x5b9730 [0074.675] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0074.675] GetProcessHeap () returned 0x580000 [0074.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x6e40b80 [0074.675] GetProcessHeap () returned 0x580000 [0074.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5f3908 [0074.676] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.676] ReadFile (in: hFile=0x464, lpBuffer=0x6e40b80, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e40b80*, lpNumberOfBytesRead=0x63cff14*=0x420, lpOverlapped=0x0) returned 1 [0074.681] GetProcessHeap () returned 0x580000 [0074.681] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0074.681] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.681] WriteFile (in: hFile=0x464, lpBuffer=0x5f3908*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesWritten=0x63cff14*=0x420, lpOverlapped=0x0) returned 1 [0074.681] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.681] WriteFile (in: hFile=0x464, lpBuffer=0x5f3d27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3d27*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0074.681] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.681] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0074.681] CloseHandle (hObject=0x464) returned 1 [0074.681] GetProcessHeap () returned 0x580000 [0074.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0074.681] GetProcessHeap () returned 0x580000 [0074.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e40b80 | out: hHeap=0x580000) returned 1 [0074.681] GetProcessHeap () returned 0x580000 [0074.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0079.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6425c2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x63cfd28, dwReserved1=0x6e40b80, cFileName="MS.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSGIFI~1.YOU")) returned 0x5b96f0 [0079.333] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.348] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", len=0x3d | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 1 [0079.348] GetProcessHeap () returned 0x580000 [0079.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x48) returned 0x5f76f0 [0079.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.348] Sleep (dwMilliseconds=0x1) [0084.473] Sleep (dwMilliseconds=0x1) [0084.495] Sleep (dwMilliseconds=0x1) [0085.957] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", len=0x48 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 1 [0085.957] GetProcessHeap () returned 0x580000 [0085.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xbc) returned 0x614a48 [0085.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.958] Sleep (dwMilliseconds=0x1) [0085.974] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", len=0x42 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 1 [0085.974] GetProcessHeap () returned 0x580000 [0085.974] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x50) returned 0x614a48 [0085.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.987] Sleep (dwMilliseconds=0x1) [0086.488] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", len=0x49 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 1 [0086.488] GetProcessHeap () returned 0x580000 [0086.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0086.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0087.112] CloseHandle (hObject=0x42c) returned 1 [0087.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0087.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id_1622540890_.your_last_chance")) returned 1 [0087.115] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0087.115] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLENDS~2.YOU")) returned 0x5b96f0 [0087.115] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0087.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0087.115] GetProcessHeap () returned 0x580000 [0087.115] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10dc1) returned 0x6eea568 [0087.116] GetProcessHeap () returned 0x580000 [0087.116] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10dc1) returned 0x6c10048 [0087.117] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0087.117] ReadFile (in: hFile=0x42c, lpBuffer=0x6eea568, nNumberOfBytesToRead=0x10da0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eea568*, lpNumberOfBytesRead=0x63cff14*=0x10da0, lpOverlapped=0x0) returned 1 [0091.281] GetProcessHeap () returned 0x580000 [0091.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616c28 [0091.281] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.281] WriteFile (in: hFile=0x42c, lpBuffer=0x6c10048*, nNumberOfBytesToWrite=0x10da0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10048*, lpNumberOfBytesWritten=0x63cff14*=0x10da0, lpOverlapped=0x0) returned 1 [0091.600] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.600] WriteFile (in: hFile=0x42c, lpBuffer=0x6c20de7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c20de7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0091.601] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.601] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0091.601] CloseHandle (hObject=0x42c) returned 1 [0091.601] GetProcessHeap () returned 0x580000 [0091.601] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10048 | out: hHeap=0x580000) returned 1 [0091.604] GetProcessHeap () returned 0x580000 [0091.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eea568 | out: hHeap=0x580000) returned 1 [0091.604] GetProcessHeap () returned 0x580000 [0091.604] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616c28 | out: hHeap=0x580000) returned 1 [0091.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3552a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10ddb, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="BLENDS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BLENDS~2.YOU")) returned 0x5b96b0 [0091.628] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.274] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", len=0x47 | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 1 [0092.274] GetProcessHeap () returned 0x580000 [0092.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x5c) returned 0x6c561f0 [0092.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.324] CloseHandle (hObject=0x464) returned 1 [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.324] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id_1622540890_.your_last_chance")) returned 1 [0092.324] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LEVELI~1.YOU")) returned 0x5b96b0 [0092.325] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0092.325] GetProcessHeap () returned 0x580000 [0092.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x6107d8 [0092.325] GetProcessHeap () returned 0x580000 [0092.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x221) returned 0x610a20 [0092.325] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.325] ReadFile (in: hFile=0x464, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x200, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x63cff14*=0x200, lpOverlapped=0x0) returned 1 [0092.328] GetProcessHeap () returned 0x580000 [0092.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.328] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.328] WriteFile (in: hFile=0x464, lpBuffer=0x610a20*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x610a20*, lpNumberOfBytesWritten=0x63cff14*=0x200, lpOverlapped=0x0) returned 1 [0092.328] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.328] WriteFile (in: hFile=0x464, lpBuffer=0x610c1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x610c1f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.328] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.328] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.329] CloseHandle (hObject=0x464) returned 1 [0092.329] GetProcessHeap () returned 0x580000 [0092.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610a20 | out: hHeap=0x580000) returned 1 [0092.329] GetProcessHeap () returned 0x580000 [0092.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0092.329] GetProcessHeap () returned 0x580000 [0092.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea53340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x232, dwReserved0=0x63cfd28, dwReserved1=0x6107d8, cFileName="LEVEL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LEVELI~1.YOU")) returned 0x5b96b0 [0092.329] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.337] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", len=0x4b | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 1 [0092.337] GetProcessHeap () returned 0x580000 [0092.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x44) returned 0x596cd8 [0092.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0092.337] CloseHandle (hObject=0x454) returned 1 [0092.337] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id_1622540890_.your_last_chance")) returned 1 [0092.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x45, dwReserved1=0x0, cFileName="JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JOURNA~1.YOU")) returned 0x5b96b0 [0092.338] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0092.338] GetProcessHeap () returned 0x580000 [0092.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60bb98 [0092.339] GetProcessHeap () returned 0x580000 [0092.339] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60c210 [0092.339] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.339] ReadFile (in: hFile=0x454, lpBuffer=0x60bb98, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x60bb98*, lpNumberOfBytesRead=0x63cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0092.341] GetProcessHeap () returned 0x580000 [0092.341] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.341] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.341] WriteFile (in: hFile=0x454, lpBuffer=0x60c210*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x60c210*, lpNumberOfBytesWritten=0x63cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0092.341] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.341] WriteFile (in: hFile=0x454, lpBuffer=0x60c3ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x60c3ef*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.342] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.342] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.342] CloseHandle (hObject=0x454) returned 1 [0092.342] GetProcessHeap () returned 0x580000 [0092.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c210 | out: hHeap=0x580000) returned 1 [0092.342] GetProcessHeap () returned 0x580000 [0092.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60bb98 | out: hHeap=0x580000) returned 1 [0092.342] GetProcessHeap () returned 0x580000 [0092.342] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.342] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea794a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x217, dwReserved0=0x63cfd28, dwReserved1=0x60bb98, cFileName="JOURNAL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JOURNA~1.YOU")) returned 0x5b96b0 [0092.342] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.353] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", len=0x4b | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 1 [0092.353] GetProcessHeap () returned 0x580000 [0092.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a468 [0092.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0092.354] CloseHandle (hObject=0x454) returned 1 [0092.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.354] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id_1622540890_.your_last_chance")) returned 1 [0092.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x45, dwReserved1=0x0, cFileName="JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JOURNA~2.YOU")) returned 0x5b96b0 [0092.355] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0092.355] GetProcessHeap () returned 0x580000 [0092.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba41) returned 0x6d9f1d0 [0092.356] GetProcessHeap () returned 0x580000 [0092.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xba41) returned 0x6daac20 [0092.356] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.356] ReadFile (in: hFile=0x454, lpBuffer=0x6d9f1d0, nNumberOfBytesToRead=0xba20, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9f1d0*, lpNumberOfBytesRead=0x63cff14*=0xba20, lpOverlapped=0x0) returned 1 [0096.297] GetProcessHeap () returned 0x580000 [0096.297] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0096.297] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.297] WriteFile (in: hFile=0x454, lpBuffer=0x6daac20*, nNumberOfBytesToWrite=0xba20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6daac20*, lpNumberOfBytesWritten=0x63cff14*=0xba20, lpOverlapped=0x0) returned 1 [0096.298] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.298] WriteFile (in: hFile=0x454, lpBuffer=0x6db663f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db663f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0096.298] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0096.298] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0096.298] CloseHandle (hObject=0x454) returned 1 [0096.298] GetProcessHeap () returned 0x580000 [0096.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daac20 | out: hHeap=0x580000) returned 1 [0096.298] GetProcessHeap () returned 0x580000 [0096.298] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9f1d0 | out: hHeap=0x580000) returned 1 [0096.298] GetProcessHeap () returned 0x580000 [0096.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0096.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7101d080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xba56, dwReserved0=0x63cfd28, dwReserved1=0x6d9f1d0, cFileName="JOURNAL.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="JOURNA~2.YOU")) returned 0x5b96b0 [0096.299] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0097.602] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", len=0x4b | out: pbstr=0x63cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 1 [0097.602] GetProcessHeap () returned 0x580000 [0097.602] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0097.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0101.001] CloseHandle (hObject=0x478) returned 1 [0101.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id_1622540890_.your_last_chance")) returned 1 [0101.279] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.279] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x45, dwReserved1=0x0, cFileName="PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROFIL~1.YOU")) returned 0x5b9770 [0101.279] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0101.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0101.280] GetProcessHeap () returned 0x580000 [0101.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb221) returned 0x6ce54a8 [0101.280] GetProcessHeap () returned 0x580000 [0101.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb221) returned 0x626d18 [0101.280] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.280] ReadFile (in: hFile=0x4a0, lpBuffer=0x6ce54a8, nNumberOfBytesToRead=0xb200, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54a8*, lpNumberOfBytesRead=0x63cff14*=0xb200, lpOverlapped=0x0) returned 1 [0103.976] GetProcessHeap () returned 0x580000 [0103.976] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.976] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.976] WriteFile (in: hFile=0x4a0, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0xb200, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x63cff14*=0xb200, lpOverlapped=0x0) returned 1 [0103.977] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.977] WriteFile (in: hFile=0x4a0, lpBuffer=0x631f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x631f17*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0103.977] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.977] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0103.977] CloseHandle (hObject=0x4a0) returned 1 [0103.977] GetProcessHeap () returned 0x580000 [0103.977] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0103.978] GetProcessHeap () returned 0x580000 [0103.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54a8 | out: hHeap=0x580000) returned 1 [0103.978] GetProcessHeap () returned 0x580000 [0103.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75975660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb232, dwReserved0=0x63cfd28, dwReserved1=0x6ce54a8, cFileName="PROFILE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROFIL~1.YOU")) returned 0x5b9730 [0103.978] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.077] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x63cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.077] GetProcessHeap () returned 0x580000 [0112.077] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x2c) returned 0x61f848 [0112.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.077] Sleep (dwMilliseconds=0x1) [0112.093] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", len=0x5e | out: pbstr=0x63cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.093] GetProcessHeap () returned 0x580000 [0112.093] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x18) returned 0x5a58e8 [0112.093] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.098] Sleep (dwMilliseconds=0x1) [0112.191] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.207] Sleep (dwMilliseconds=0x1) [0112.317] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", len=0x47 | out: pbstr=0x63cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned 1 [0112.317] GetProcessHeap () returned 0x580000 [0112.317] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.317] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.317] Sleep (dwMilliseconds=0x1) [0113.336] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", len=0x3f | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 1 [0113.336] GetProcessHeap () returned 0x580000 [0113.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x84) returned 0x6f0ceb8 [0113.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0113.477] CloseHandle (hObject=0x390) returned 1 [0113.477] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.477] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id_1622540890_.your_last_chance")) returned 1 [0114.261] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~4.YOU")) returned 0x5b9630 [0114.261] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0114.261] GetProcessHeap () returned 0x580000 [0114.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c644f8 [0114.261] GetProcessHeap () returned 0x580000 [0114.261] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6f19958 [0114.261] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.262] ReadFile (in: hFile=0x390, lpBuffer=0x6c644f8, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c644f8*, lpNumberOfBytesRead=0x63cff14*=0xf60, lpOverlapped=0x0) returned 1 [0114.276] GetProcessHeap () returned 0x580000 [0114.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0114.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.276] WriteFile (in: hFile=0x390, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x63cff14*=0xf60, lpOverlapped=0x0) returned 1 [0114.276] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.276] WriteFile (in: hFile=0x390, lpBuffer=0x6f1a8b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1a8b7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.277] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.277] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.277] CloseHandle (hObject=0x390) returned 1 [0114.277] GetProcessHeap () returned 0x580000 [0114.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0114.277] GetProcessHeap () returned 0x580000 [0114.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c644f8 | out: hHeap=0x580000) returned 1 [0114.277] GetProcessHeap () returned 0x580000 [0114.277] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0114.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bba61e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfa2, dwReserved0=0x63cfd28, dwReserved1=0x6c644f8, cFileName="AG00174_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AG0017~4.YOU")) returned 0x5b9630 [0114.277] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0114.303] CloseHandle (hObject=0x458) returned 1 [0114.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0114.303] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.id_1622540890_.your_last_chance")) returned 1 [0114.303] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.303] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03155~1.YOU")) returned 0x5b9630 [0114.304] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0114.304] GetProcessHeap () returned 0x580000 [0114.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b21) returned 0x6eef008 [0114.304] GetProcessHeap () returned 0x580000 [0114.304] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4b21) returned 0x6ef3b38 [0114.304] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.304] ReadFile (in: hFile=0x458, lpBuffer=0x6eef008, nNumberOfBytesToRead=0x4b00, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef008*, lpNumberOfBytesRead=0x63cff14*=0x4b00, lpOverlapped=0x0) returned 1 [0115.604] GetProcessHeap () returned 0x580000 [0115.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.604] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.604] WriteFile (in: hFile=0x458, lpBuffer=0x6ef3b38*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3b38*, lpNumberOfBytesWritten=0x63cff14*=0x4b00, lpOverlapped=0x0) returned 1 [0115.604] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.604] WriteFile (in: hFile=0x458, lpBuffer=0x6ef8637*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef8637*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0115.605] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.605] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0115.605] CloseHandle (hObject=0x458) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3b38 | out: hHeap=0x580000) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef008 | out: hHeap=0x580000) returned 1 [0115.605] GetProcessHeap () returned 0x580000 [0115.605] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c84b6c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4b26, dwReserved0=0x63cfd28, dwReserved1=0x6eef008, cFileName="J0315580.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03155~1.YOU")) returned 0x5b9630 [0117.325] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.461] CloseHandle (hObject=0x460) returned 1 [0118.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.461] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.461] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0011~1.YOU")) returned 0x5b9730 [0118.462] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0118.462] GetProcessHeap () returned 0x580000 [0118.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x501) returned 0x6c676b8 [0118.462] GetProcessHeap () returned 0x580000 [0118.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x501) returned 0x6c67bc8 [0118.462] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.462] ReadFile (in: hFile=0x460, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x63cff14*=0x4e0, lpOverlapped=0x0) returned 1 [0118.468] GetProcessHeap () returned 0x580000 [0118.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.468] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.468] WriteFile (in: hFile=0x460, lpBuffer=0x6c67bc8*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67bc8*, lpNumberOfBytesWritten=0x63cff14*=0x4e0, lpOverlapped=0x0) returned 1 [0118.468] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.468] WriteFile (in: hFile=0x460, lpBuffer=0x6c680a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c680a7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0118.468] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.468] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0118.468] CloseHandle (hObject=0x460) returned 1 [0118.468] GetProcessHeap () returned 0x580000 [0118.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c67bc8 | out: hHeap=0x580000) returned 1 [0118.468] GetProcessHeap () returned 0x580000 [0118.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.468] GetProcessHeap () returned 0x580000 [0118.468] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3ab3c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x63cfd28, dwReserved1=0x6c676b8, cFileName="SY00110_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SY0011~1.YOU")) returned 0x5b96f0 [0120.124] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.150] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", len=0x4c | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 1 [0120.150] GetProcessHeap () returned 0x580000 [0120.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d4) returned 0x6d06ca8 [0120.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.658] CloseHandle (hObject=0x48c) returned 1 [0120.658] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.659] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0210~1.YOU")) returned 0x5b9630 [0120.659] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0120.659] GetProcessHeap () returned 0x580000 [0120.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x6d035f8 [0120.659] GetProcessHeap () returned 0x580000 [0120.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1601) returned 0x6f77710 [0120.660] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.660] ReadFile (in: hFile=0x48c, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x15e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x63cff14*=0x15e0, lpOverlapped=0x0) returned 1 [0120.680] GetProcessHeap () returned 0x580000 [0120.680] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.680] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.680] WriteFile (in: hFile=0x48c, lpBuffer=0x6f77710*, nNumberOfBytesToWrite=0x15e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f77710*, lpNumberOfBytesWritten=0x63cff14*=0x15e0, lpOverlapped=0x0) returned 1 [0120.680] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.681] WriteFile (in: hFile=0x48c, lpBuffer=0x6f78cef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f78cef*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0120.681] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.681] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0120.681] CloseHandle (hObject=0x48c) returned 1 [0120.681] GetProcessHeap () returned 0x580000 [0120.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f77710 | out: hHeap=0x580000) returned 1 [0120.681] GetProcessHeap () returned 0x580000 [0120.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0120.681] GetProcessHeap () returned 0x580000 [0120.681] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0120.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f8a55a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x161e, dwReserved0=0x63cfd28, dwReserved1=0x6d035f8, cFileName="WB02106_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0210~1.YOU")) returned 0x5b9630 [0120.681] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.682] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", len=0x4a | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned 1 [0120.682] GetProcessHeap () returned 0x580000 [0120.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x185c) returned 0x6e00ac0 [0120.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.651] CloseHandle (hObject=0x3fc) returned 1 [0122.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.id_1622540890_.your_last_chance")) returned 1 [0122.652] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKXM~1.YOU")) returned 0x5b9730 [0122.652] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0122.652] GetProcessHeap () returned 0x580000 [0122.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x6107d8 [0122.652] GetProcessHeap () returned 0x580000 [0122.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3c1) returned 0x610bc0 [0122.652] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.652] ReadFile (in: hFile=0x3fc, lpBuffer=0x6107d8, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6107d8*, lpNumberOfBytesRead=0x63cff14*=0x3a0, lpOverlapped=0x0) returned 1 [0122.657] GetProcessHeap () returned 0x580000 [0122.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.657] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.657] WriteFile (in: hFile=0x3fc, lpBuffer=0x610bc0*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x610bc0*, lpNumberOfBytesWritten=0x63cff14*=0x3a0, lpOverlapped=0x0) returned 1 [0122.657] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.657] WriteFile (in: hFile=0x3fc, lpBuffer=0x610f5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x610f5f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.657] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.657] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.657] CloseHandle (hObject=0x3fc) returned 1 [0122.657] GetProcessHeap () returned 0x580000 [0122.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x610bc0 | out: hHeap=0x580000) returned 1 [0122.658] GetProcessHeap () returned 0x580000 [0122.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0122.658] GetProcessHeap () returned 0x580000 [0122.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b8a440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x63cfd28, dwReserved1=0x6107d8, cFileName="Trek.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TREKXM~1.YOU")) returned 0x5b9730 [0124.522] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.541] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", len=0x4c | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned 1 [0124.541] GetProcessHeap () returned 0x580000 [0124.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e8) returned 0x6f42f08 [0124.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.586] CloseHandle (hObject=0x440) returned 1 [0124.586] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.586] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.id_1622540890_.your_last_chance")) returned 1 [0124.587] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x450043, dwReserved1=0x0, cFileName="Couture.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUTUR~1.YOU")) returned 0x5b9730 [0124.587] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0124.587] GetProcessHeap () returned 0x580000 [0124.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6d035f8 [0124.587] GetProcessHeap () returned 0x580000 [0124.587] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c6e0f8 [0124.587] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.587] ReadFile (in: hFile=0x440, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x63cff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.692] GetProcessHeap () returned 0x580000 [0124.692] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0124.692] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.692] WriteFile (in: hFile=0x440, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x63cff14*=0xee0, lpOverlapped=0x0) returned 1 [0124.692] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.692] WriteFile (in: hFile=0x440, lpBuffer=0x6c6efd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6efd7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0124.692] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.692] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0124.692] CloseHandle (hObject=0x440) returned 1 [0124.693] GetProcessHeap () returned 0x580000 [0124.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0124.693] GetProcessHeap () returned 0x580000 [0124.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0124.693] GetProcessHeap () returned 0x580000 [0124.693] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0124.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f07860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf20, dwReserved0=0x63cfd28, dwReserved1=0x6d035f8, cFileName="Couture.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COUTUR~1.YOU")) returned 0x5b9730 [0124.701] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.327] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", len=0x3d | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned 1 [0125.327] GetProcessHeap () returned 0x580000 [0125.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ec) returned 0x6f42f08 [0125.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0128.612] CloseHandle (hObject=0x49c) returned 1 [0128.612] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.id_1622540890_.your_last_chance")) returned 1 [0130.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0130.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01997~2.YOU")) returned 0x5b9730 [0130.448] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0130.449] GetProcessHeap () returned 0x580000 [0130.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0130.449] GetProcessHeap () returned 0x580000 [0130.449] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x635768 [0130.449] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.449] ReadFile (in: hFile=0x49c, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x63cff14*=0xae0, lpOverlapped=0x0) returned 1 [0130.459] GetProcessHeap () returned 0x580000 [0130.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0130.459] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.460] WriteFile (in: hFile=0x49c, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x63cff14*=0xae0, lpOverlapped=0x0) returned 1 [0130.460] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.460] WriteFile (in: hFile=0x49c, lpBuffer=0x636247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x636247*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0130.460] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0130.460] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0130.460] CloseHandle (hObject=0x49c) returned 1 [0130.460] GetProcessHeap () returned 0x580000 [0130.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0130.460] GetProcessHeap () returned 0x580000 [0130.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0130.460] GetProcessHeap () returned 0x580000 [0130.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0130.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x855ed3c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb14, dwReserved0=0x63cfd28, dwReserved1=0x677cd0, cFileName="J0199755.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01997~2.YOU")) returned 0x5b9730 [0130.460] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0130.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.772] CloseHandle (hObject=0x430) returned 1 [0132.772] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id_1622540890_.your_last_chance")) returned 1 [0132.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLOCHV~1.YOU")) returned 0x5b9730 [0132.774] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0132.774] GetProcessHeap () returned 0x580000 [0132.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c3a820 [0132.774] GetProcessHeap () returned 0x580000 [0132.774] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x801) returned 0x6c3b0a8 [0132.774] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.774] ReadFile (in: hFile=0x430, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x7e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x63cff14*=0x7e0, lpOverlapped=0x0) returned 1 [0132.782] GetProcessHeap () returned 0x580000 [0132.782] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.782] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.782] WriteFile (in: hFile=0x430, lpBuffer=0x6c3b0a8*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b0a8*, lpNumberOfBytesWritten=0x63cff14*=0x7e0, lpOverlapped=0x0) returned 1 [0132.782] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.782] WriteFile (in: hFile=0x430, lpBuffer=0x6c3b887*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b887*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0132.782] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.782] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0132.782] CloseHandle (hObject=0x430) returned 1 [0132.782] GetProcessHeap () returned 0x580000 [0132.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3b0a8 | out: hHeap=0x580000) returned 1 [0132.783] GetProcessHeap () returned 0x580000 [0132.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0132.783] GetProcessHeap () returned 0x580000 [0132.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0135.283] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.283] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86c180a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x810, dwReserved0=0x63cfd28, dwReserved1=0x6c3a820, cFileName="FLOCH.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FLOCHV~1.YOU")) returned 0x5b96f0 [0135.283] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0135.283] Sleep (dwMilliseconds=0x1) [0135.358] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", len=0x43 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned 1 [0135.358] GetProcessHeap () returned 0x580000 [0135.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0135.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0135.392] CloseHandle (hObject=0x458) returned 1 [0135.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.id_1622540890_.your_last_chance")) returned 1 [0135.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a89600, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7a89600, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2134~1.YOU")) returned 0x5b96b0 [0135.393] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0135.396] GetProcessHeap () returned 0x580000 [0135.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x6d7aa58 [0135.424] GetProcessHeap () returned 0x580000 [0135.424] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x481) returned 0x6c65108 [0135.424] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.424] ReadFile (in: hFile=0x41c, lpBuffer=0x6d7aa58, nNumberOfBytesToRead=0x460, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7aa58*, lpNumberOfBytesRead=0x63cff14*=0x460, lpOverlapped=0x0) returned 1 [0135.457] GetProcessHeap () returned 0x580000 [0135.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.457] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.457] WriteFile (in: hFile=0x41c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x63cff14*=0x460, lpOverlapped=0x0) returned 1 [0135.457] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.457] WriteFile (in: hFile=0x41c, lpBuffer=0x6c65567*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65567*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0135.457] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.457] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0135.458] CloseHandle (hObject=0x41c) returned 1 [0135.458] GetProcessHeap () returned 0x580000 [0135.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0135.458] GetProcessHeap () returned 0x580000 [0135.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7aa58 | out: hHeap=0x580000) returned 1 [0135.458] GetProcessHeap () returned 0x580000 [0135.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.458] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a89600, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x885aed20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x48f, dwReserved0=0x63cfd28, dwReserved1=0x6d7aa58, cFileName="BD21348_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2134~1.YOU")) returned 0x5b96b0 [0135.458] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.559] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", len=0x4a | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned 1 [0135.559] GetProcessHeap () returned 0x580000 [0135.559] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.560] CloseHandle (hObject=0x48c) returned 1 [0135.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.560] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.id_1622540890_.your_last_chance")) returned 1 [0135.560] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b96b0 [0135.561] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0135.561] GetProcessHeap () returned 0x580000 [0135.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0135.561] GetProcessHeap () returned 0x580000 [0135.561] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0135.561] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.561] ReadFile (in: hFile=0x48c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x63cff14*=0x60, lpOverlapped=0x0) returned 1 [0135.562] GetProcessHeap () returned 0x580000 [0135.562] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0135.562] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.562] WriteFile (in: hFile=0x48c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x63cff14*=0x60, lpOverlapped=0x0) returned 1 [0135.562] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.562] WriteFile (in: hFile=0x48c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0135.562] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.562] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0135.563] CloseHandle (hObject=0x48c) returned 1 [0135.563] GetProcessHeap () returned 0x580000 [0135.563] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0135.563] GetProcessHeap () returned 0x580000 [0135.563] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0135.563] GetProcessHeap () returned 0x580000 [0135.563] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0135.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88693560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x63cfd28, dwReserved1=0x61b540, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b96b0 [0135.563] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.689] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", len=0x52 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css") returned 1 [0135.689] GetProcessHeap () returned 0x580000 [0135.689] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0135.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.726] CloseHandle (hObject=0x484) returned 1 [0135.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.727] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.id_1622540890_.your_last_chance")) returned 1 [0135.727] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.727] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b96b0 [0135.727] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.728] GetProcessHeap () returned 0x580000 [0135.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x642e20 [0135.728] GetProcessHeap () returned 0x580000 [0135.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cda390 [0135.728] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.728] ReadFile (in: hFile=0x484, lpBuffer=0x642e20, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x642e20*, lpNumberOfBytesRead=0x63cff14*=0x740, lpOverlapped=0x0) returned 1 [0135.735] GetProcessHeap () returned 0x580000 [0135.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.735] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.735] WriteFile (in: hFile=0x484, lpBuffer=0x6cda390*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesWritten=0x63cff14*=0x740, lpOverlapped=0x0) returned 1 [0135.735] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.735] WriteFile (in: hFile=0x484, lpBuffer=0x6cdaacf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdaacf*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0135.736] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.736] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0135.736] CloseHandle (hObject=0x484) returned 1 [0135.736] GetProcessHeap () returned 0x580000 [0135.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0135.736] GetProcessHeap () returned 0x580000 [0135.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x642e20 | out: hHeap=0x580000) returned 1 [0135.736] GetProcessHeap () returned 0x580000 [0135.736] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.857] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88836480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x63cfd28, dwReserved1=0x642e20, cFileName="Adobe.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADOBEC~1.YOU")) returned 0x5b96b0 [0136.360] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.377] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x60 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0136.377] GetProcessHeap () returned 0x580000 [0136.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0136.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.378] CloseHandle (hObject=0x484) returned 1 [0136.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0136.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x380030, dwReserved1=0x300039, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0136.380] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0136.380] GetProcessHeap () returned 0x580000 [0136.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0136.380] GetProcessHeap () returned 0x580000 [0136.380] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0136.380] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.380] ReadFile (in: hFile=0x484, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x63cff14*=0xc0, lpOverlapped=0x0) returned 1 [0136.382] GetProcessHeap () returned 0x580000 [0136.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0136.382] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.382] WriteFile (in: hFile=0x484, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x63cff14*=0xc0, lpOverlapped=0x0) returned 1 [0136.382] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.382] WriteFile (in: hFile=0x484, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0136.382] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.382] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0136.382] CloseHandle (hObject=0x484) returned 1 [0136.382] GetProcessHeap () returned 0x580000 [0136.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0136.382] GetProcessHeap () returned 0x580000 [0136.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0136.382] GetProcessHeap () returned 0x580000 [0136.382] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0136.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e75e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x63cfd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0136.393] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.407] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x5c | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0136.407] GetProcessHeap () returned 0x580000 [0136.407] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0136.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0137.437] CloseHandle (hObject=0x3a8) returned 1 [0137.437] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0137.437] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0138.526] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b96b0 [0138.526] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0138.526] GetProcessHeap () returned 0x580000 [0138.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09850 [0138.526] GetProcessHeap () returned 0x580000 [0138.526] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x101) returned 0x6f09ee0 [0138.526] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.526] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f09850, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09850*, lpNumberOfBytesRead=0x63cff14*=0xe0, lpOverlapped=0x0) returned 1 [0138.528] GetProcessHeap () returned 0x580000 [0138.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0138.528] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f09ee0*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09ee0*, lpNumberOfBytesWritten=0x63cff14*=0xe0, lpOverlapped=0x0) returned 1 [0138.528] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f09fbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09fbf*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0138.528] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.528] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0138.529] CloseHandle (hObject=0x3a8) returned 1 [0138.529] GetProcessHeap () returned 0x580000 [0138.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0138.529] GetProcessHeap () returned 0x580000 [0138.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0138.529] GetProcessHeap () returned 0x580000 [0138.529] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0138.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2fdc00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x63cfd28, dwReserved1=0x6f09850, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b9770 [0138.612] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.654] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", len=0x43 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned 1 [0138.654] GetProcessHeap () returned 0x580000 [0138.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0138.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.870] CloseHandle (hObject=0x470) returned 1 [0139.870] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.871] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ca00, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ca00, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~2.YOU")) returned 0x5b97b0 [0139.871] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0139.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0139.871] GetProcessHeap () returned 0x580000 [0139.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c57120 [0139.871] GetProcessHeap () returned 0x580000 [0139.871] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c57488 [0139.871] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.871] ReadFile (in: hFile=0x470, lpBuffer=0x6c57120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57120*, lpNumberOfBytesRead=0x63cff14*=0x320, lpOverlapped=0x0) returned 1 [0139.876] GetProcessHeap () returned 0x580000 [0139.876] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.876] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.876] WriteFile (in: hFile=0x470, lpBuffer=0x6c57488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57488*, lpNumberOfBytesWritten=0x63cff14*=0x320, lpOverlapped=0x0) returned 1 [0139.876] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.876] WriteFile (in: hFile=0x470, lpBuffer=0x6c577a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c577a7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0139.876] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.876] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0139.876] CloseHandle (hObject=0x470) returned 1 [0139.876] GetProcessHeap () returned 0x580000 [0139.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57488 | out: hHeap=0x580000) returned 1 [0139.876] GetProcessHeap () returned 0x580000 [0139.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57120 | out: hHeap=0x580000) returned 1 [0139.876] GetProcessHeap () returned 0x580000 [0139.876] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0139.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ca00, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8afc9240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x63cfd28, dwReserved1=0x6c57120, cFileName="BD21307_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2130~2.YOU")) returned 0x5b9770 [0139.877] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.902] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", len=0x57 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned 1 [0139.902] GetProcessHeap () returned 0x580000 [0139.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0139.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.315] CloseHandle (hObject=0x488) returned 1 [0140.315] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.316] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.id_1622540890_.your_last_chance")) returned 1 [0140.316] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.316] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b9770 [0140.316] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.317] GetProcessHeap () returned 0x580000 [0140.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0140.317] GetProcessHeap () returned 0x580000 [0140.317] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0140.317] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.317] ReadFile (in: hFile=0x488, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x63cff14*=0x340, lpOverlapped=0x0) returned 1 [0140.321] GetProcessHeap () returned 0x580000 [0140.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.321] WriteFile (in: hFile=0x488, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x63cff14*=0x340, lpOverlapped=0x0) returned 1 [0140.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.321] WriteFile (in: hFile=0x488, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.321] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.321] CloseHandle (hObject=0x488) returned 1 [0140.321] GetProcessHeap () returned 0x580000 [0140.321] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0140.321] GetProcessHeap () returned 0x580000 [0140.321] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0140.321] GetProcessHeap () returned 0x580000 [0140.321] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b3f38c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x63cfd28, dwReserved1=0x6dcfb90, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b9770 [0140.663] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.673] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", len=0x43 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned 1 [0140.673] GetProcessHeap () returned 0x580000 [0140.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d88) returned 0x6f14048 [0140.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.027] CloseHandle (hObject=0x4a0) returned 1 [0141.027] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.id_1622540890_.your_last_chance")) returned 1 [0141.028] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1467~1.YOU")) returned 0x5b9730 [0141.028] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.028] GetProcessHeap () returned 0x580000 [0141.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0141.028] GetProcessHeap () returned 0x580000 [0141.028] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0141.028] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.028] ReadFile (in: hFile=0x4a0, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x63cff14*=0x100, lpOverlapped=0x0) returned 1 [0141.030] GetProcessHeap () returned 0x580000 [0141.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.030] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.030] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x63cff14*=0x100, lpOverlapped=0x0) returned 1 [0141.030] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.031] WriteFile (in: hFile=0x4a0, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0141.031] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.031] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0141.031] CloseHandle (hObject=0x4a0) returned 1 [0141.031] GetProcessHeap () returned 0x580000 [0141.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0141.031] GetProcessHeap () returned 0x580000 [0141.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0141.031] GetProcessHeap () returned 0x580000 [0141.031] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0144.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8bacb800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x63cfd28, dwReserved1=0x6f0a9f0, cFileName="BD14677_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1467~1.YOU")) returned 0x5b9730 [0144.547] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0144.597] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg", len=0x3e | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg") returned 1 [0144.597] GetProcessHeap () returned 0x580000 [0144.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0144.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0146.098] CloseHandle (hObject=0x3a8) returned 1 [0146.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.id_1622540890_.your_last_chance")) returned 1 [0146.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.099] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb96d3b00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x148d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONGUID~1.YOU")) returned 0x5b9730 [0146.100] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0146.100] GetProcessHeap () returned 0x580000 [0146.100] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7008368 [0146.101] GetProcessHeap () returned 0x580000 [0146.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7019b98 [0146.101] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.101] ReadFile (in: hFile=0x3a8, lpBuffer=0x7008368, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7008368*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0149.814] GetProcessHeap () returned 0x580000 [0149.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0149.815] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.815] WriteFile (in: hFile=0x3a8, lpBuffer=0x7019b98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7019b98*, lpNumberOfBytesWritten=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0149.815] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.815] WriteFile (in: hFile=0x3a8, lpBuffer=0x702b397*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x702b397*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0150.293] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.293] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0150.293] CloseHandle (hObject=0x3a8) returned 1 [0150.293] GetProcessHeap () returned 0x580000 [0150.293] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7019b98 | out: hHeap=0x580000) returned 1 [0150.296] GetProcessHeap () returned 0x580000 [0150.296] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7008368 | out: hHeap=0x580000) returned 1 [0150.297] GetProcessHeap () returned 0x580000 [0150.297] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0150.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9132a8c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x148d8c, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="ONGuide.onepkg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONGUID~1.YOU")) returned 0x5b96f0 [0150.685] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.740] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", len=0x44 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned 1 [0150.740] GetProcessHeap () returned 0x580000 [0150.741] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0150.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0150.784] CloseHandle (hObject=0x484) returned 1 [0150.784] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.785] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.id_1622540890_.your_last_chance")) returned 1 [0150.785] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR9~1.YOU")) returned 0x5b96f0 [0150.785] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0150.786] GetProcessHeap () returned 0x580000 [0150.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x6f5d7e8 [0150.786] GetProcessHeap () returned 0x580000 [0150.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4701) returned 0x6f61ef8 [0150.786] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.786] ReadFile (in: hFile=0x484, lpBuffer=0x6f5d7e8, nNumberOfBytesToRead=0x46e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5d7e8*, lpNumberOfBytesRead=0x63cff14*=0x46e0, lpOverlapped=0x0) returned 1 [0151.397] GetProcessHeap () returned 0x580000 [0151.397] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0151.397] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.397] WriteFile (in: hFile=0x484, lpBuffer=0x6f61ef8*, nNumberOfBytesToWrite=0x46e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f61ef8*, lpNumberOfBytesWritten=0x63cff14*=0x46e0, lpOverlapped=0x0) returned 1 [0151.397] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.398] WriteFile (in: hFile=0x484, lpBuffer=0x6f665d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f665d7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0151.398] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.398] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0151.398] CloseHandle (hObject=0x484) returned 1 [0151.929] GetProcessHeap () returned 0x580000 [0151.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f61ef8 | out: hHeap=0x580000) returned 1 [0151.929] GetProcessHeap () returned 0x580000 [0151.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f5d7e8 | out: hHeap=0x580000) returned 1 [0151.929] GetProcessHeap () returned 0x580000 [0151.929] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0152.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91d94900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4710, dwReserved0=0x63cfd28, dwReserved1=0x6f5d7e8, cFileName="ZPDIR9F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR9~1.YOU")) returned 0x5b9730 [0152.051] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.085] CloseHandle (hObject=0x3a8) returned 1 [0152.085] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0152.086] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~3.YOU")) returned 0x5b9730 [0152.086] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0152.086] GetProcessHeap () returned 0x580000 [0152.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0152.087] GetProcessHeap () returned 0x580000 [0152.087] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0152.087] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.087] ReadFile (in: hFile=0x3a8, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x63cff14*=0xc0, lpOverlapped=0x0) returned 1 [0152.088] GetProcessHeap () returned 0x580000 [0152.088] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0152.088] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.088] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x63cff14*=0xc0, lpOverlapped=0x0) returned 1 [0152.088] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.088] WriteFile (in: hFile=0x3a8, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0152.088] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.088] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0152.089] CloseHandle (hObject=0x3a8) returned 1 [0152.089] GetProcessHeap () returned 0x580000 [0152.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0152.089] GetProcessHeap () returned 0x580000 [0152.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0152.089] GetProcessHeap () returned 0x580000 [0152.089] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0152.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x924466e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x63cfd28, dwReserved1=0x5ad8a0, cFileName="VISIO.DEV_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOD~3.YOU")) returned 0x5b9730 [0152.089] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0153.448] CloseHandle (hObject=0x48c) returned 1 [0153.448] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id_1622540890_.your_last_chance")) returned 1 [0153.449] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50ed22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5fd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UMLVSL~1.YOU")) returned 0x5b9730 [0153.450] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0153.450] GetProcessHeap () returned 0x580000 [0153.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d24ca8 [0153.450] GetProcessHeap () returned 0x580000 [0153.450] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d364d8 [0153.450] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.450] ReadFile (in: hFile=0x48c, lpBuffer=0x6d24ca8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d24ca8*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.715] GetProcessHeap () returned 0x580000 [0157.715] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0157.715] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.715] WriteFile (in: hFile=0x48c, lpBuffer=0x6d364d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d364d8*, lpNumberOfBytesWritten=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0157.716] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.716] WriteFile (in: hFile=0x48c, lpBuffer=0x6d47cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d47cd7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0158.170] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.170] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0158.170] CloseHandle (hObject=0x48c) returned 1 [0158.170] GetProcessHeap () returned 0x580000 [0158.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d364d8 | out: hHeap=0x580000) returned 1 [0158.171] GetProcessHeap () returned 0x580000 [0158.171] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d24ca8 | out: hHeap=0x580000) returned 1 [0158.171] GetProcessHeap () returned 0x580000 [0158.171] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0159.224] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50ed22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95e4bf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5fdac, dwReserved0=0x63cfd28, dwReserved1=0x6d24ca8, cFileName="UML.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="UMLVSL~1.YOU")) returned 0x5b9630 [0159.225] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.263] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", len=0x4a | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL") returned 1 [0159.263] GetProcessHeap () returned 0x580000 [0159.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0159.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.317] CloseHandle (hObject=0x450) returned 1 [0159.317] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.317] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.318] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GOSTNA~1.YOU")) returned 0x5b9630 [0159.318] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0159.318] GetProcessHeap () returned 0x580000 [0159.318] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70f95e8 [0159.319] GetProcessHeap () returned 0x580000 [0159.319] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x710ae18 [0159.319] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.319] ReadFile (in: hFile=0x450, lpBuffer=0x70f95e8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x70f95e8*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.951] GetProcessHeap () returned 0x580000 [0164.951] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0164.952] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.952] WriteFile (in: hFile=0x450, lpBuffer=0x710ae18*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x710ae18*, lpNumberOfBytesWritten=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.952] WriteFile (in: hFile=0x450, lpBuffer=0x711c617*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x711c617*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0164.952] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0164.953] CloseHandle (hObject=0x450) returned 1 [0164.953] GetProcessHeap () returned 0x580000 [0164.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710ae18 | out: hHeap=0x580000) returned 1 [0164.953] GetProcessHeap () returned 0x580000 [0164.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70f95e8 | out: hHeap=0x580000) returned 1 [0164.953] GetProcessHeap () returned 0x580000 [0164.953] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0166.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99edd3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3cd9a, dwReserved0=0x63cfd28, dwReserved1=0x70f95e8, cFileName="GostName.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GOSTNA~1.YOU")) returned 0x5b9730 [0166.630] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.652] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", len=0x3f | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 1 [0166.652] GetProcessHeap () returned 0x580000 [0166.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0166.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.313] CloseHandle (hObject=0x45c) returned 1 [0170.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.314] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id_1622540890_.your_last_chance")) returned 1 [0170.314] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.314] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTLI~1.YOU")) returned 0x5b96b0 [0170.314] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.315] GetProcessHeap () returned 0x580000 [0170.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0170.315] GetProcessHeap () returned 0x580000 [0170.315] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0170.315] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.315] ReadFile (in: hFile=0x45c, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x63cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.320] GetProcessHeap () returned 0x580000 [0170.320] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.320] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.320] WriteFile (in: hFile=0x45c, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x63cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.320] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.320] WriteFile (in: hFile=0x45c, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.320] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.320] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.320] CloseHandle (hObject=0x45c) returned 1 [0170.320] GetProcessHeap () returned 0x580000 [0170.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0170.320] GetProcessHeap () returned 0x580000 [0170.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0170.320] GetProcessHeap () returned 0x580000 [0170.320] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d20ace0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x63cfd28, dwReserved1=0x5d09a0, cFileName="APPTL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="APPTLI~1.YOU")) returned 0x5b9770 [0173.044] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.082] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", len=0x41 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 1 [0173.082] GetProcessHeap () returned 0x580000 [0173.082] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2228) returned 0x6f14048 [0173.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.111] CloseHandle (hObject=0x43c) returned 1 [0173.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.111] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id_1622540890_.your_last_chance")) returned 1 [0173.112] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDREQ~1.YOU")) returned 0x5b9770 [0173.112] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.112] GetProcessHeap () returned 0x580000 [0173.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x660a78 [0173.113] GetProcessHeap () returned 0x580000 [0173.113] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x661680 [0173.113] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.113] ReadFile (in: hFile=0x43c, lpBuffer=0x660a78, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x660a78*, lpNumberOfBytesRead=0x63cff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.143] GetProcessHeap () returned 0x580000 [0173.143] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.143] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x43c, lpBuffer=0x661680*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x661680*, lpNumberOfBytesWritten=0x63cff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x43c, lpBuffer=0x66221f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x66221f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.143] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.143] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.143] CloseHandle (hObject=0x43c) returned 1 [0173.143] GetProcessHeap () returned 0x580000 [0173.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x661680 | out: hHeap=0x580000) returned 1 [0173.143] GetProcessHeap () returned 0x580000 [0173.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x660a78 | out: hHeap=0x580000) returned 1 [0173.143] GetProcessHeap () returned 0x580000 [0173.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ecf85c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x63cfd28, dwReserved1=0x660a78, cFileName="SCDREQS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCDREQ~1.YOU")) returned 0x5b9770 [0173.144] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.240] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", len=0x41 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 1 [0174.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0174.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.241] CloseHandle (hObject=0x49c) returned 1 [0174.241] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.241] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id_1622540890_.your_last_chance")) returned 1 [0174.242] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ODBCRS~1.YOU")) returned 0x5b9770 [0174.242] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.242] GetProcessHeap () returned 0x580000 [0174.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2da1) returned 0x705cfa8 [0174.242] GetProcessHeap () returned 0x580000 [0174.242] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2da1) returned 0x705fd58 [0174.242] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.242] ReadFile (in: hFile=0x49c, lpBuffer=0x705cfa8, nNumberOfBytesToRead=0x2d80, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x705cfa8*, lpNumberOfBytesRead=0x63cff14*=0x2d80, lpOverlapped=0x0) returned 1 [0174.328] GetProcessHeap () returned 0x580000 [0174.328] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0174.328] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.328] WriteFile (in: hFile=0x49c, lpBuffer=0x705fd58*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x705fd58*, lpNumberOfBytesWritten=0x63cff14*=0x2d80, lpOverlapped=0x0) returned 1 [0174.329] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.329] WriteFile (in: hFile=0x49c, lpBuffer=0x7062ad7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7062ad7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0174.329] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.329] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0174.329] CloseHandle (hObject=0x49c) returned 1 [0174.843] GetProcessHeap () returned 0x580000 [0174.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705fd58 | out: hHeap=0x580000) returned 1 [0174.843] GetProcessHeap () returned 0x580000 [0174.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705cfa8 | out: hHeap=0x580000) returned 1 [0174.843] GetProcessHeap () returned 0x580000 [0174.843] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0176.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f846e40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2db4, dwReserved0=0x63cfd28, dwReserved1=0x705cfa8, cFileName="ODBCR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ODBCRS~1.YOU")) returned 0x5b96f0 [0176.809] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.845] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", len=0x3c | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 1 [0176.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0176.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0179.353] CloseHandle (hObject=0x430) returned 1 [0179.353] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.353] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id_1622540890_.your_last_chance")) returned 1 [0179.354] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVASW~1.YOU")) returned 0x5b96f0 [0179.354] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0179.354] GetProcessHeap () returned 0x580000 [0179.354] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbd81) returned 0x6fb2f38 [0179.355] GetProcessHeap () returned 0x580000 [0179.355] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbd81) returned 0x707ec98 [0179.355] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.355] ReadFile (in: hFile=0x430, lpBuffer=0x6fb2f38, nNumberOfBytesToRead=0xbd60, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesRead=0x63cff14*=0xbd60, lpOverlapped=0x0) returned 1 [0181.940] GetProcessHeap () returned 0x580000 [0181.940] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0181.940] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.940] WriteFile (in: hFile=0x430, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0xbd60, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x63cff14*=0xbd60, lpOverlapped=0x0) returned 1 [0181.940] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.940] WriteFile (in: hFile=0x430, lpBuffer=0x708a9f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x708a9f7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0181.940] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.940] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0181.941] CloseHandle (hObject=0x430) returned 1 [0181.941] GetProcessHeap () returned 0x580000 [0181.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0181.941] GetProcessHeap () returned 0x580000 [0181.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0181.941] GetProcessHeap () returned 0x580000 [0181.941] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa40e0d40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbd8c, dwReserved0=0x63cfd28, dwReserved1=0x6fb2f38, cFileName="SAVASWEB.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SAVASW~1.YOU")) returned 0x5b96b0 [0183.459] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.551] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", len=0x71 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned 1 [0183.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0183.989] CloseHandle (hObject=0x4a8) returned 1 [0183.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.id_1622540890_.your_last_chance")) returned 1 [0183.990] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x6e0075, dwReserved1=0x2e0064, cFileName="BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BODYPA~1.YOU")) returned 0x5b9770 [0183.990] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0183.990] GetProcessHeap () returned 0x580000 [0183.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6c676b8 [0183.990] GetProcessHeap () returned 0x580000 [0183.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9c1) returned 0x6ce68d0 [0183.990] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.990] ReadFile (in: hFile=0x4a8, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x9a0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x63cff14*=0x9a0, lpOverlapped=0x0) returned 1 [0183.999] GetProcessHeap () returned 0x580000 [0183.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.000] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce68d0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce68d0*, lpNumberOfBytesWritten=0x63cff14*=0x9a0, lpOverlapped=0x0) returned 1 [0184.000] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x4a8, lpBuffer=0x6ce726f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce726f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.000] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.000] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.000] CloseHandle (hObject=0x4a8) returned 1 [0184.000] GetProcessHeap () returned 0x580000 [0184.000] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce68d0 | out: hHeap=0x580000) returned 1 [0184.000] GetProcessHeap () returned 0x580000 [0184.000] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0184.000] GetProcessHeap () returned 0x580000 [0184.000] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa54842c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9e1, dwReserved0=0x63cfd28, dwReserved1=0x6c676b8, cFileName="BodyPaneBackground.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BODYPA~1.YOU")) returned 0x5b9770 [0184.000] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.002] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", len=0x5f | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned 1 [0184.003] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0184.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0184.003] CloseHandle (hObject=0x4a8) returned 1 [0184.003] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.id_1622540890_.your_last_chance")) returned 1 [0184.004] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.004] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b9770 [0184.004] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0184.004] GetProcessHeap () returned 0x580000 [0184.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0184.004] GetProcessHeap () returned 0x580000 [0184.004] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0184.004] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] ReadFile (in: hFile=0x4a8, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x63cff14*=0x60, lpOverlapped=0x0) returned 1 [0184.006] GetProcessHeap () returned 0x580000 [0184.006] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.006] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x4a8, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x63cff14*=0x60, lpOverlapped=0x0) returned 1 [0184.006] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x4a8, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.006] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.006] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.006] CloseHandle (hObject=0x4a8) returned 1 [0184.006] GetProcessHeap () returned 0x580000 [0184.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0184.006] GetProcessHeap () returned 0x580000 [0184.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0184.006] GetProcessHeap () returned 0x580000 [0184.006] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa54aa420, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x63cfd28, dwReserved1=0x61b540, cFileName="bg_Groove.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRO~1.YOU")) returned 0x5b9770 [0184.007] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.018] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", len=0x61 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned 1 [0184.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0184.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0184.019] CloseHandle (hObject=0x4a8) returned 1 [0184.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.019] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.id_1622540890_.your_last_chance")) returned 1 [0184.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b9770 [0184.020] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0184.020] GetProcessHeap () returned 0x580000 [0184.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x7052698 [0184.020] GetProcessHeap () returned 0x580000 [0184.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x56a1) returned 0x7057d48 [0184.020] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.020] ReadFile (in: hFile=0x4a8, lpBuffer=0x7052698, nNumberOfBytesToRead=0x5680, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7052698*, lpNumberOfBytesRead=0x63cff14*=0x5680, lpOverlapped=0x0) returned 1 [0184.835] GetProcessHeap () returned 0x580000 [0184.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x705fb70 [0184.835] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.835] WriteFile (in: hFile=0x4a8, lpBuffer=0x7057d48*, nNumberOfBytesToWrite=0x5680, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7057d48*, lpNumberOfBytesWritten=0x63cff14*=0x5680, lpOverlapped=0x0) returned 1 [0184.836] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.836] WriteFile (in: hFile=0x4a8, lpBuffer=0x705d3c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x705d3c7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.836] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.836] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.836] CloseHandle (hObject=0x4a8) returned 1 [0185.087] GetProcessHeap () returned 0x580000 [0185.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7057d48 | out: hHeap=0x580000) returned 1 [0185.087] GetProcessHeap () returned 0x580000 [0185.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7052698 | out: hHeap=0x580000) returned 1 [0185.087] GetProcessHeap () returned 0x580000 [0185.087] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705fb70 | out: hHeap=0x580000) returned 1 [0185.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5c8cd00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x56b4, dwReserved0=0x63cfd28, dwReserved1=0x7052698, cFileName="bg_GreenTea.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_GRE~1.YOU")) returned 0x5b9770 [0185.533] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.581] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", len=0x43 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned 1 [0185.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0185.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0185.728] CloseHandle (hObject=0x490) returned 1 [0185.728] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.729] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.729] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIPJP~1.YOU")) returned 0x5b9770 [0185.729] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0185.730] GetProcessHeap () returned 0x580000 [0185.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d41) returned 0x6e0dcf0 [0185.730] GetProcessHeap () returned 0x580000 [0185.730] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d41) returned 0x708eb08 [0185.730] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.730] ReadFile (in: hFile=0x490, lpBuffer=0x6e0dcf0, nNumberOfBytesToRead=0x1d20, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0dcf0*, lpNumberOfBytesRead=0x63cff14*=0x1d20, lpOverlapped=0x0) returned 1 [0185.821] GetProcessHeap () returned 0x580000 [0185.821] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0185.821] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.821] WriteFile (in: hFile=0x490, lpBuffer=0x708eb08*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x708eb08*, lpNumberOfBytesWritten=0x63cff14*=0x1d20, lpOverlapped=0x0) returned 1 [0185.821] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.821] WriteFile (in: hFile=0x490, lpBuffer=0x7090827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7090827*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0185.821] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.821] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0185.821] CloseHandle (hObject=0x490) returned 1 [0185.821] GetProcessHeap () returned 0x580000 [0185.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x708eb08 | out: hHeap=0x580000) returned 1 [0185.821] GetProcessHeap () returned 0x580000 [0185.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0dcf0 | out: hHeap=0x580000) returned 1 [0185.821] GetProcessHeap () returned 0x580000 [0185.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0185.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65ec3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1d4d, dwReserved0=0x63cfd28, dwReserved1=0x6e0dcf0, cFileName="GRIP.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRIPJP~1.YOU")) returned 0x5b9770 [0185.822] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.843] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", len=0x44 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned 1 [0185.843] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x209c) returned 0x6f14048 [0185.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0185.844] CloseHandle (hObject=0x464) returned 1 [0185.844] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.id_1622540890_.your_last_chance")) returned 1 [0185.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x592b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~2.YOU")) returned 0x5b9770 [0185.845] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0185.845] GetProcessHeap () returned 0x580000 [0185.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5941) returned 0x7054b58 [0185.845] GetProcessHeap () returned 0x580000 [0185.845] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5941) returned 0x6fa5248 [0185.845] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.845] ReadFile (in: hFile=0x464, lpBuffer=0x7054b58, nNumberOfBytesToRead=0x5920, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7054b58*, lpNumberOfBytesRead=0x63cff14*=0x5920, lpOverlapped=0x0) returned 1 [0187.917] GetProcessHeap () returned 0x580000 [0187.917] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.917] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x464, lpBuffer=0x6fa5248*, nNumberOfBytesToWrite=0x5920, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5248*, lpNumberOfBytesWritten=0x63cff14*=0x5920, lpOverlapped=0x0) returned 1 [0187.917] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.917] WriteFile (in: hFile=0x464, lpBuffer=0x6faab67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6faab67*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0187.918] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.918] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0187.918] CloseHandle (hObject=0x464) returned 1 [0187.918] GetProcessHeap () returned 0x580000 [0187.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa5248 | out: hHeap=0x580000) returned 1 [0187.918] GetProcessHeap () returned 0x580000 [0187.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7054b58 | out: hHeap=0x580000) returned 1 [0187.918] GetProcessHeap () returned 0x580000 [0187.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.034] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa79dbbe0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x594f, dwReserved0=0x63cfd28, dwReserved1=0x7054b58, cFileName="ZPDIR5B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR5~2.YOU")) returned 0x5b9770 [0191.034] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.109] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", len=0x44 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned 1 [0191.109] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0191.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0191.110] CloseHandle (hObject=0x428) returned 1 [0191.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.111] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x58e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~1.YOU")) returned 0x5b9770 [0191.111] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0191.111] GetProcessHeap () returned 0x580000 [0191.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5901) returned 0x6e063d0 [0191.111] GetProcessHeap () returned 0x580000 [0191.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5901) returned 0x7066b08 [0191.112] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.112] ReadFile (in: hFile=0x428, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x58e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x63cff14*=0x58e0, lpOverlapped=0x0) returned 1 [0192.760] GetProcessHeap () returned 0x580000 [0192.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0192.760] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.760] WriteFile (in: hFile=0x428, lpBuffer=0x7066b08*, nNumberOfBytesToWrite=0x58e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesWritten=0x63cff14*=0x58e0, lpOverlapped=0x0) returned 1 [0192.761] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x428, lpBuffer=0x706c3e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x706c3e7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0192.761] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.761] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0192.761] CloseHandle (hObject=0x428) returned 1 [0194.431] GetProcessHeap () returned 0x580000 [0194.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0194.431] GetProcessHeap () returned 0x580000 [0194.431] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0194.432] GetProcessHeap () returned 0x580000 [0194.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0194.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa820780, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5906, dwReserved0=0x63cfd28, dwReserved1=0x6e063d0, cFileName="ZPDIR3F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~1.YOU")) returned 0x5b97b0 [0194.432] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.679] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", len=0x45 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned 1 [0196.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe4) returned 0x6f14048 [0196.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0196.830] CloseHandle (hObject=0x438) returned 1 [0196.830] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.830] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x42ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5EA4~1.YOU")) returned 0x5b97b0 [0196.831] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0196.831] GetProcessHeap () returned 0x580000 [0196.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4301) returned 0x715f4f8 [0196.831] GetProcessHeap () returned 0x580000 [0196.831] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4301) returned 0x6e32d50 [0196.832] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.832] ReadFile (in: hFile=0x438, lpBuffer=0x715f4f8, nNumberOfBytesToRead=0x42e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x715f4f8*, lpNumberOfBytesRead=0x63cff14*=0x42e0, lpOverlapped=0x0) returned 1 [0197.344] GetProcessHeap () returned 0x580000 [0197.344] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6171a0 [0197.345] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.345] WriteFile (in: hFile=0x438, lpBuffer=0x6e32d50*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e32d50*, lpNumberOfBytesWritten=0x63cff14*=0x42e0, lpOverlapped=0x0) returned 1 [0197.345] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.345] WriteFile (in: hFile=0x438, lpBuffer=0x6e3702f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3702f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0197.345] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.345] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0197.345] CloseHandle (hObject=0x438) returned 1 [0197.767] GetProcessHeap () returned 0x580000 [0197.767] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e32d50 | out: hHeap=0x580000) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715f4f8 | out: hHeap=0x580000) returned 1 [0197.768] GetProcessHeap () returned 0x580000 [0197.768] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6171a0 | out: hHeap=0x580000) returned 1 [0199.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad3ddbc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x430e, dwReserved0=0x63cfd28, dwReserved1=0x715f4f8, cFileName="ZPDIR21F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5EA4~1.YOU")) returned 0x5b96b0 [0199.650] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.953] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", len=0x61 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned 1 [0200.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff0) returned 0x6f14048 [0200.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0200.992] CloseHandle (hObject=0x440) returned 1 [0200.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.992] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.id_1622540890_.your_last_chance")) returned 1 [0201.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b9770 [0201.351] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0201.351] GetProcessHeap () returned 0x580000 [0201.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x705f4e8 [0201.351] GetProcessHeap () returned 0x580000 [0201.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.351] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.351] ReadFile (in: hFile=0x440, lpBuffer=0x705f4e8, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x705f4e8*, lpNumberOfBytesRead=0x63cff14*=0x340, lpOverlapped=0x0) returned 1 [0201.356] GetProcessHeap () returned 0x580000 [0201.356] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0201.356] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.356] WriteFile (in: hFile=0x440, lpBuffer=0x6dcfb90*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesWritten=0x63cff14*=0x340, lpOverlapped=0x0) returned 1 [0201.356] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.356] WriteFile (in: hFile=0x440, lpBuffer=0x6dcfecf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfecf*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.356] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.356] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.356] CloseHandle (hObject=0x440) returned 1 [0201.356] GetProcessHeap () returned 0x580000 [0201.356] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.357] GetProcessHeap () returned 0x580000 [0201.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f4e8 | out: hHeap=0x580000) returned 1 [0201.357] GetProcessHeap () returned 0x580000 [0201.357] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0202.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafa19d20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x63cfd28, dwReserved1=0x705f4e8, cFileName="rtf_center.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_CE~1.YOU")) returned 0x5b9770 [0202.027] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.084] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", len=0x44 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned 1 [0202.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0202.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0203.743] CloseHandle (hObject=0x390) returned 1 [0203.743] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.743] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.id_1622540890_.your_last_chance")) returned 1 [0203.744] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR35~2.YOU")) returned 0x5b97b0 [0203.744] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0203.744] GetProcessHeap () returned 0x580000 [0203.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1201) returned 0x6dc9da0 [0203.744] GetProcessHeap () returned 0x580000 [0203.744] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1201) returned 0x6efb008 [0203.744] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.744] ReadFile (in: hFile=0x390, lpBuffer=0x6dc9da0, nNumberOfBytesToRead=0x11e0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc9da0*, lpNumberOfBytesRead=0x63cff14*=0x11e0, lpOverlapped=0x0) returned 1 [0203.760] GetProcessHeap () returned 0x580000 [0203.760] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0203.760] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.760] WriteFile (in: hFile=0x390, lpBuffer=0x6efb008*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesWritten=0x63cff14*=0x11e0, lpOverlapped=0x0) returned 1 [0203.760] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.761] WriteFile (in: hFile=0x390, lpBuffer=0x6efc1e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efc1e7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0203.761] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.761] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0203.761] CloseHandle (hObject=0x390) returned 1 [0203.761] GetProcessHeap () returned 0x580000 [0203.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0203.761] GetProcessHeap () returned 0x580000 [0203.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc9da0 | out: hHeap=0x580000) returned 1 [0203.761] GetProcessHeap () returned 0x580000 [0203.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0203.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb11030e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x63cfd28, dwReserved1=0x6dc9da0, cFileName="PDIR35B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR35~2.YOU")) returned 0x5b97b0 [0203.761] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.768] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", len=0x69 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned 1 [0203.768] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0203.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.456] CloseHandle (hObject=0x458) returned 1 [0209.456] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.456] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.id_1622540890_.your_last_chance")) returned 1 [0209.457] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b97f0 [0209.457] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.457] GetProcessHeap () returned 0x580000 [0209.457] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x635768 [0209.701] GetProcessHeap () returned 0x580000 [0209.701] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd41) returned 0x6f67710 [0209.701] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.701] ReadFile (in: hFile=0x458, lpBuffer=0x635768, nNumberOfBytesToRead=0xd20, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x63cff14*=0xd20, lpOverlapped=0x0) returned 1 [0209.742] GetProcessHeap () returned 0x580000 [0209.742] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0209.742] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.743] WriteFile (in: hFile=0x458, lpBuffer=0x6f67710*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67710*, lpNumberOfBytesWritten=0x63cff14*=0xd20, lpOverlapped=0x0) returned 1 [0209.743] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.743] WriteFile (in: hFile=0x458, lpBuffer=0x6f6842f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6842f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0209.743] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.743] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0209.743] CloseHandle (hObject=0x458) returned 1 [0209.743] GetProcessHeap () returned 0x580000 [0209.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f67710 | out: hHeap=0x580000) returned 1 [0209.743] GetProcessHeap () returned 0x580000 [0209.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0209.743] GetProcessHeap () returned 0x580000 [0209.743] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0209.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a240e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd59, dwReserved0=0x63cfd28, dwReserved1=0x635768, cFileName="Desert.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DESERT~1.YOU")) returned 0x5b97f0 [0209.743] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.787] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", len=0x62 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned 1 [0209.787] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0209.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.787] CloseHandle (hObject=0x458) returned 1 [0209.787] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.787] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.id_1622540890_.your_last_chance")) returned 1 [0209.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.788] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b97f0 [0209.788] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.788] GetProcessHeap () returned 0x580000 [0209.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0209.788] GetProcessHeap () returned 0x580000 [0209.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0209.788] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.789] ReadFile (in: hFile=0x458, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x63cff14*=0x160, lpOverlapped=0x0) returned 1 [0209.791] GetProcessHeap () returned 0x580000 [0209.791] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0209.791] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.791] WriteFile (in: hFile=0x458, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x63cff14*=0x160, lpOverlapped=0x0) returned 1 [0209.791] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.791] WriteFile (in: hFile=0x458, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0209.791] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.791] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0209.791] CloseHandle (hObject=0x458) returned 1 [0209.791] GetProcessHeap () returned 0x580000 [0209.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0209.791] GetProcessHeap () returned 0x580000 [0209.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0209.791] GetProcessHeap () returned 0x580000 [0209.791] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0209.791] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a96500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x195, dwReserved0=0x63cfd28, dwReserved1=0x5b8df0, cFileName="button_left.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BU2FDF~1.YOU")) returned 0x5b97f0 [0209.792] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.883] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", len=0x6e | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned 1 [0209.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0209.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.063] CloseHandle (hObject=0x448) returned 1 [0210.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.063] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance")) returned 1 [0210.064] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.064] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x63002e, dwReserved1=0x730073, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b97f0 [0210.064] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0210.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0210.064] GetProcessHeap () returned 0x580000 [0210.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6daf1e8 [0210.064] GetProcessHeap () returned 0x580000 [0210.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6daf9f0 [0210.064] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.064] ReadFile (in: hFile=0x448, lpBuffer=0x6daf1e8, nNumberOfBytesToRead=0x7c0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1e8*, lpNumberOfBytesRead=0x63cff14*=0x7c0, lpOverlapped=0x0) returned 1 [0210.072] GetProcessHeap () returned 0x580000 [0210.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0210.072] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.072] WriteFile (in: hFile=0x448, lpBuffer=0x6daf9f0*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf9f0*, lpNumberOfBytesWritten=0x63cff14*=0x7c0, lpOverlapped=0x0) returned 1 [0210.072] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.072] WriteFile (in: hFile=0x448, lpBuffer=0x6db01af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db01af*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0210.072] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.072] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0210.072] CloseHandle (hObject=0x448) returned 1 [0210.072] GetProcessHeap () returned 0x580000 [0210.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf9f0 | out: hHeap=0x580000) returned 1 [0210.073] GetProcessHeap () returned 0x580000 [0210.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1e8 | out: hHeap=0x580000) returned 1 [0210.073] GetProcessHeap () returned 0x580000 [0210.073] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0214.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4d43dc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7f3, dwReserved0=0x63cfd28, dwReserved1=0x6daf1e8, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b97b0 [0214.538] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.558] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", len=0x6d | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned 1 [0214.558] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0214.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0215.733] CloseHandle (hObject=0x39c) returned 1 [0215.733] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance")) returned 1 [0218.152] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0218.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x730063, dwReserved1=0x2e0073, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0218.153] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0218.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0218.153] GetProcessHeap () returned 0x580000 [0218.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4e820 [0218.153] GetProcessHeap () returned 0x580000 [0218.153] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6c4efa8 [0218.153] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.153] ReadFile (in: hFile=0x39c, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x63cff14*=0x740, lpOverlapped=0x0) returned 1 [0218.161] GetProcessHeap () returned 0x580000 [0218.161] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0218.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.161] WriteFile (in: hFile=0x39c, lpBuffer=0x6c4efa8*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4efa8*, lpNumberOfBytesWritten=0x63cff14*=0x740, lpOverlapped=0x0) returned 1 [0218.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.161] WriteFile (in: hFile=0x39c, lpBuffer=0x6c4f6e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4f6e7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0218.161] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.161] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0218.162] CloseHandle (hObject=0x39c) returned 1 [0218.162] GetProcessHeap () returned 0x580000 [0218.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4efa8 | out: hHeap=0x580000) returned 1 [0218.162] GetProcessHeap () returned 0x580000 [0218.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0218.162] GetProcessHeap () returned 0x580000 [0218.162] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9a54600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x76f, dwReserved0=0x63cfd28, dwReserved1=0x6c4e820, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0221.097] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0222.660] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", len=0x8e | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned 1 [0222.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0222.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.661] CloseHandle (hObject=0x480) returned 1 [0222.661] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl.id_1622540890_.your_last_chance")) returned 1 [0222.662] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x157e, dwReserved0=0x65006a, dwReserved1=0x740063, cFileName="Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIERAR~1.YOU")) returned 0x5b96f0 [0222.663] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.663] GetProcessHeap () returned 0x580000 [0222.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1581) returned 0x6de8f50 [0222.663] GetProcessHeap () returned 0x580000 [0222.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1581) returned 0x6c6e0f8 [0222.663] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.663] ReadFile (in: hFile=0x480, lpBuffer=0x6de8f50, nNumberOfBytesToRead=0x1560, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesRead=0x63cff14*=0x1560, lpOverlapped=0x0) returned 1 [0222.698] GetProcessHeap () returned 0x580000 [0222.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0222.698] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.698] WriteFile (in: hFile=0x480, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1560, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x63cff14*=0x1560, lpOverlapped=0x0) returned 1 [0222.698] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.698] WriteFile (in: hFile=0x480, lpBuffer=0x6c6f657*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f657*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.698] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.698] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.699] CloseHandle (hObject=0x480) returned 1 [0222.699] GetProcessHeap () returned 0x580000 [0222.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0222.699] GetProcessHeap () returned 0x580000 [0222.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0222.699] GetProcessHeap () returned 0x580000 [0222.699] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0222.699] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc59f620, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x15a2, dwReserved0=0x63cfd28, dwReserved1=0x6de8f50, cFileName="Hierarchy.xsl.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HIERAR~1.YOU")) returned 0x5b96f0 [0222.699] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.759] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", len=0x6e | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned 1 [0222.759] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0222.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.760] CloseHandle (hObject=0x480) returned 1 [0222.760] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0222.760] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0222.761] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0222.761] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x62002e, dwReserved1=0x70006d, cFileName="MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEETIN~1.YOU")) returned 0x5b96f0 [0222.761] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0222.761] GetProcessHeap () returned 0x580000 [0222.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6c79898 [0222.761] GetProcessHeap () returned 0x580000 [0222.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6c1) returned 0x6d00cd8 [0222.761] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.761] ReadFile (in: hFile=0x480, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x6a0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x63cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0222.808] GetProcessHeap () returned 0x580000 [0222.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0222.808] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.808] WriteFile (in: hFile=0x480, lpBuffer=0x6d00cd8*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d00cd8*, lpNumberOfBytesWritten=0x63cff14*=0x6a0, lpOverlapped=0x0) returned 1 [0222.808] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.808] WriteFile (in: hFile=0x480, lpBuffer=0x6d01377*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d01377*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0222.808] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0222.808] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0222.808] CloseHandle (hObject=0x480) returned 1 [0222.968] GetProcessHeap () returned 0x580000 [0222.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d00cd8 | out: hHeap=0x580000) returned 1 [0222.968] GetProcessHeap () returned 0x580000 [0222.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0222.968] GetProcessHeap () returned 0x580000 [0222.968] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.417] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc6a9fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6dc, dwReserved0=0x63cfd28, dwReserved1=0x6c79898, cFileName="MeetingIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MEETIN~1.YOU")) returned 0x5b9630 [0225.417] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.461] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", len=0x65 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned 1 [0225.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0225.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.462] CloseHandle (hObject=0x438) returned 1 [0225.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.462] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0225.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9630 [0225.463] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0225.463] GetProcessHeap () returned 0x580000 [0225.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x6e675e0 [0225.463] GetProcessHeap () returned 0x580000 [0225.463] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c01) returned 0x6d748d8 [0225.463] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.463] ReadFile (in: hFile=0x438, lpBuffer=0x6e675e0, nNumberOfBytesToRead=0x1be0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesRead=0x63cff14*=0x1be0, lpOverlapped=0x0) returned 1 [0225.793] GetProcessHeap () returned 0x580000 [0225.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.794] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.794] WriteFile (in: hFile=0x438, lpBuffer=0x6d748d8*, nNumberOfBytesToWrite=0x1be0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d748d8*, lpNumberOfBytesWritten=0x63cff14*=0x1be0, lpOverlapped=0x0) returned 1 [0225.794] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.794] WriteFile (in: hFile=0x438, lpBuffer=0x6d764b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d764b7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0225.794] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.794] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0225.794] CloseHandle (hObject=0x438) returned 1 [0225.794] GetProcessHeap () returned 0x580000 [0225.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d748d8 | out: hHeap=0x580000) returned 1 [0225.794] GetProcessHeap () returned 0x580000 [0225.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e675e0 | out: hHeap=0x580000) returned 1 [0225.794] GetProcessHeap () returned 0x580000 [0225.794] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe1978a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c1f, dwReserved0=0x63cfd28, dwReserved1=0x6e675e0, cFileName="FormToolImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMTO~1.YOU")) returned 0x5b9630 [0225.795] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.802] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned 1 [0225.802] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0225.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0225.803] CloseHandle (hObject=0x418) returned 1 [0225.803] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.803] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0225.804] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x4d0073, dwReserved1=0x730061, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b9630 [0225.804] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0225.804] GetProcessHeap () returned 0x580000 [0225.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0225.804] GetProcessHeap () returned 0x580000 [0225.804] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0225.804] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.804] ReadFile (in: hFile=0x418, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x63cff14*=0x620, lpOverlapped=0x0) returned 1 [0227.329] GetProcessHeap () returned 0x580000 [0227.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0227.329] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.329] WriteFile (in: hFile=0x418, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x63cff14*=0x620, lpOverlapped=0x0) returned 1 [0227.329] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.329] WriteFile (in: hFile=0x418, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0227.329] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0227.329] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0227.329] CloseHandle (hObject=0x418) returned 1 [0227.330] GetProcessHeap () returned 0x580000 [0227.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0227.330] GetProcessHeap () returned 0x580000 [0227.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0227.330] GetProcessHeap () returned 0x580000 [0227.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf0520c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x65c, dwReserved0=0x63cfd28, dwReserved1=0x626d30, cFileName="FormsViewAttachmentIconsMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSV~3.YOU")) returned 0x5b9630 [0230.460] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.527] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", len=0x34 | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 1 [0230.527] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0230.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0230.531] CloseHandle (hObject=0x470) returned 1 [0230.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.id_1622540890_.your_last_chance")) returned 1 [0230.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.532] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPRJO~1.YOU")) returned 0x5b9630 [0230.532] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\msprj.olb.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0230.532] GetProcessHeap () returned 0x580000 [0230.532] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74dccf8 [0230.533] GetProcessHeap () returned 0x580000 [0230.533] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x74ee528 [0230.533] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.533] ReadFile (in: hFile=0x470, lpBuffer=0x74dccf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x74dccf8*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.893] GetProcessHeap () returned 0x580000 [0237.893] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0237.894] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.894] WriteFile (in: hFile=0x470, lpBuffer=0x74ee528*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x74ee528*, lpNumberOfBytesWritten=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.269] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.269] WriteFile (in: hFile=0x470, lpBuffer=0x74ffd27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x74ffd27*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0239.343] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.343] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0239.343] CloseHandle (hObject=0x470) returned 1 [0239.474] GetProcessHeap () returned 0x580000 [0239.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74ee528 | out: hHeap=0x580000) returned 1 [0239.474] GetProcessHeap () returned 0x580000 [0239.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x74dccf8 | out: hHeap=0x580000) returned 1 [0239.474] GetProcessHeap () returned 0x580000 [0239.474] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0241.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc62e0380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd65c4, dwReserved0=0x63cfd28, dwReserved1=0x74dccf8, cFileName="MSPRJ.OLB.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPRJO~1.YOU")) returned 0x5b9730 [0241.325] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0241.426] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML", len=0x3f | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned 1 [0241.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0241.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0241.427] CloseHandle (hObject=0x414) returned 1 [0241.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.427] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml.id_1622540890_.your_last_chance")) returned 1 [0241.428] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf7900, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf7900, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN11~2.YOU")) returned 0x5b9630 [0241.428] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0241.429] GetProcessHeap () returned 0x580000 [0241.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcb01) returned 0x7061928 [0241.429] GetProcessHeap () returned 0x580000 [0241.429] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcb01) returned 0x70904c8 [0241.429] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.429] ReadFile (in: hFile=0x414, lpBuffer=0x7061928, nNumberOfBytesToRead=0xcae0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x63cff14*=0xcae0, lpOverlapped=0x0) returned 1 [0244.034] GetProcessHeap () returned 0x580000 [0244.034] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0244.034] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.034] WriteFile (in: hFile=0x414, lpBuffer=0x70904c8*, nNumberOfBytesToWrite=0xcae0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x70904c8*, lpNumberOfBytesWritten=0x63cff14*=0xcae0, lpOverlapped=0x0) returned 1 [0244.035] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.035] WriteFile (in: hFile=0x414, lpBuffer=0x709cfa7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x709cfa7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0244.035] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.035] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0244.035] CloseHandle (hObject=0x414) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70904c8 | out: hHeap=0x580000) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0244.417] GetProcessHeap () returned 0x580000 [0244.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0253.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf7900, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8fa8160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xcb04, dwReserved0=0x63cfd28, dwReserved1=0x7061928, cFileName="PGMN110.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN11~2.YOU")) returned 0x5b9730 [0253.373] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.473] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC", len=0x3d | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 1 [0253.473] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0253.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0253.474] CloseHandle (hObject=0x478) returned 1 [0253.474] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.474] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.id_1622540890_.your_last_chance")) returned 1 [0253.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.475] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa402, dwReserved0=0x0, dwReserved1=0x0, cFileName="AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AWARDH~1.YOU")) returned 0x5b9730 [0253.475] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0253.476] GetProcessHeap () returned 0x580000 [0253.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa421) returned 0x7025c68 [0253.476] GetProcessHeap () returned 0x580000 [0253.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa421) returned 0x7030098 [0253.476] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.476] ReadFile (in: hFile=0x478, lpBuffer=0x7025c68, nNumberOfBytesToRead=0xa400, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7025c68*, lpNumberOfBytesRead=0x63cff14*=0xa400, lpOverlapped=0x0) returned 1 [0256.382] GetProcessHeap () returned 0x580000 [0256.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0256.382] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.383] WriteFile (in: hFile=0x478, lpBuffer=0x7030098*, nNumberOfBytesToWrite=0xa400, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7030098*, lpNumberOfBytesWritten=0x63cff14*=0xa400, lpOverlapped=0x0) returned 1 [0256.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.383] WriteFile (in: hFile=0x478, lpBuffer=0x703a497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x703a497*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0256.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0256.383] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0256.383] CloseHandle (hObject=0x478) returned 1 [0256.384] GetProcessHeap () returned 0x580000 [0256.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7030098 | out: hHeap=0x580000) returned 1 [0256.384] GetProcessHeap () returned 0x580000 [0256.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7025c68 | out: hHeap=0x580000) returned 1 [0256.384] GetProcessHeap () returned 0x580000 [0256.384] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0258.984] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0556100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa426, dwReserved0=0x63cfd28, dwReserved1=0x7025c68, cFileName="AWARDHM.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AWARDH~1.YOU")) returned 0x5b9730 [0258.985] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0259.225] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC", len=0x3e | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC") returned 1 [0259.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e8) returned 0x72e5948 [0259.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0259.226] CloseHandle (hObject=0x47c) returned 1 [0259.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc.id_1622540890_.your_last_chance")) returned 1 [0259.227] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.227] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f71a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43f71a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSIDBR~1.YOU")) returned 0x5b9630 [0259.227] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0259.227] GetProcessHeap () returned 0x580000 [0259.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x7305cc8 [0259.227] GetProcessHeap () returned 0x580000 [0259.228] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x72dace8 [0259.228] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.228] ReadFile (in: hFile=0x47c, lpBuffer=0x7305cc8, nNumberOfBytesToRead=0x31c0, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x7305cc8*, lpNumberOfBytesRead=0x63cff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.156] GetProcessHeap () returned 0x580000 [0261.156] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0261.156] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.156] WriteFile (in: hFile=0x47c, lpBuffer=0x72dace8*, nNumberOfBytesToWrite=0x31c0, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x72dace8*, lpNumberOfBytesWritten=0x63cff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.156] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.156] WriteFile (in: hFile=0x47c, lpBuffer=0x72ddea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x72ddea7*, lpNumberOfBytesWritten=0x63cff14*=0x20, lpOverlapped=0x0) returned 1 [0261.156] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.156] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x63cff14*=0x4, lpOverlapped=0x0) returned 1 [0261.156] CloseHandle (hObject=0x47c) returned 1 [0261.156] GetProcessHeap () returned 0x580000 [0261.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72dace8 | out: hHeap=0x580000) returned 1 [0261.156] GetProcessHeap () returned 0x580000 [0261.156] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7305cc8 | out: hHeap=0x580000) returned 1 [0261.157] GetProcessHeap () returned 0x580000 [0261.157] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0261.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfccc | out: lpFindFileData=0x63cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f71a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd32dc5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x31fa, dwReserved0=0x63cfd28, dwReserved1=0x7305cc8, cFileName="WSIDBR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WSIDBR~1.YOU")) returned 0x5b9630 [0261.157] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.884] SysReAllocStringLen (in: pbstr=0x63cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", len=0x3b | out: pbstr=0x63cff84*="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp") returned 1 [0262.884] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0262.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0262.923] CloseHandle (hObject=0x47c) returned 1 [0262.923] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0262.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.id_1622540890_.your_last_chance")) returned 1 [0265.138] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x63cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0265.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x63cfc74 | out: lpFindFileData=0x63cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd718e200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd718e200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPLASH~1.YOU")) returned 0x5b96f0 [0265.139] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0265.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\splashscreen.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0265.140] GetProcessHeap () returned 0x580000 [0265.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72206f8 [0265.140] GetProcessHeap () returned 0x580000 [0265.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7522708 [0265.141] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0265.141] ReadFile (in: hFile=0x47c, lpBuffer=0x72206f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x63cff14, lpOverlapped=0x0 | out: lpBuffer=0x72206f8*, lpNumberOfBytesRead=0x63cff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 57 os_tid = 0xadc [0039.071] Sleep (dwMilliseconds=0x1) [0039.093] Sleep (dwMilliseconds=0x1) [0039.114] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.286] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.581] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.741] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.834] Sleep (dwMilliseconds=0x1) [0039.864] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.793] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.842] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.118] Sleep (dwMilliseconds=0x1) [0043.141] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.278] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.307] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.338] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.385] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.494] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.718] Sleep (dwMilliseconds=0x1) [0043.743] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.775] Sleep (dwMilliseconds=0x1) [0043.790] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.946] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.025] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.414] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.445] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.523] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.601] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.679] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.757] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.788] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.835] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.866] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.913] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.991] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.178] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.225] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.334] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.381] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.492] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.537] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.788] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.974] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.130] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.286] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.527] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.598] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.832] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.910] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.097] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.378] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.681] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.830] Sleep (dwMilliseconds=0x1) [0047.846] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.331] Sleep (dwMilliseconds=0x1) [0048.345] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.671] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.749] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.061] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.295] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.373] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.607] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.685] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.936] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.092] Sleep (dwMilliseconds=0x1) [0051.106] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.262] Sleep (dwMilliseconds=0x1) [0051.278] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.309] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.574] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.044] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.122] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.190] Sleep (dwMilliseconds=0x1) [0052.200] Sleep (dwMilliseconds=0x1) [0052.216] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.980] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.370] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.448] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.573] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.776] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.916] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.041] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.119] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.353] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.899] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.008] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.164] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.320] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.476] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.542] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0059.626] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x650ff84*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.626] GetProcessHeap () returned 0x580000 [0059.626] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x54) returned 0x5a4778 [0059.626] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0061.106] CloseHandle (hObject=0x460) returned 1 [0061.106] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.106] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0061.107] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.107] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0061.107] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0061.107] GetProcessHeap () returned 0x580000 [0061.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6d330a8 [0061.107] GetProcessHeap () returned 0x580000 [0061.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6d33818 [0061.107] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.107] ReadFile (in: hFile=0x460, lpBuffer=0x6d330a8, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d330a8*, lpNumberOfBytesRead=0x650ff14*=0x740, lpOverlapped=0x0) returned 1 [0061.166] GetProcessHeap () returned 0x580000 [0061.166] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0061.166] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.166] WriteFile (in: hFile=0x460, lpBuffer=0x6d33818*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33818*, lpNumberOfBytesWritten=0x650ff14*=0x740, lpOverlapped=0x0) returned 1 [0061.166] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.166] WriteFile (in: hFile=0x460, lpBuffer=0x6d33f57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d33f57*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.166] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.166] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.166] CloseHandle (hObject=0x460) returned 1 [0061.167] GetProcessHeap () returned 0x580000 [0061.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d33818 | out: hHeap=0x580000) returned 1 [0061.167] GetProcessHeap () returned 0x580000 [0061.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d330a8 | out: hHeap=0x580000) returned 1 [0061.167] GetProcessHeap () returned 0x580000 [0061.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0061.167] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0x5c40d380, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x650fd28, dwReserved1=0x6d330a8, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0061.167] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.218] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", len=0x4f | out: pbstr=0x650ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 1 [0061.218] GetProcessHeap () returned 0x580000 [0061.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x20) returned 0x615348 [0061.219] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.219] CloseHandle (hObject=0x458) returned 1 [0061.219] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.219] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id_1622540890_.your_last_chance")) returned 1 [0061.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.220] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0061.220] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0061.221] GetProcessHeap () returned 0x580000 [0061.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f7360 [0061.221] GetProcessHeap () returned 0x580000 [0061.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x5f3908 [0061.221] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.221] ReadFile (in: hFile=0x458, lpBuffer=0x5f7360, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f7360*, lpNumberOfBytesRead=0x650ff14*=0x320, lpOverlapped=0x0) returned 1 [0061.249] GetProcessHeap () returned 0x580000 [0061.249] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0061.249] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.249] WriteFile (in: hFile=0x458, lpBuffer=0x5f3908*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesWritten=0x650ff14*=0x320, lpOverlapped=0x0) returned 1 [0061.249] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.249] WriteFile (in: hFile=0x458, lpBuffer=0x5f3c27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3c27*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0061.249] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.249] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0061.249] CloseHandle (hObject=0x458) returned 1 [0061.250] GetProcessHeap () returned 0x580000 [0061.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0061.250] GetProcessHeap () returned 0x580000 [0061.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f7360 | out: hHeap=0x580000) returned 1 [0061.250] GetProcessHeap () returned 0x580000 [0061.250] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0061.250] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5c4f1bc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x357, dwReserved0=0x650fd28, dwReserved1=0x5f7360, cFileName="OfficeMUISet.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OFFICE~1.YOU")) returned 0x5b96b0 [0061.250] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.267] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x650ff84*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.267] GetProcessHeap () returned 0x580000 [0061.268] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x5c) returned 0x6c56188 [0061.268] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0061.268] CloseHandle (hObject=0x46c) returned 1 [0061.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.269] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0061.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.269] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0061.269] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.269] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0061.269] GetProcessHeap () returned 0x580000 [0061.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7981) returned 0x66fcd0 [0061.270] GetProcessHeap () returned 0x580000 [0061.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7981) returned 0x677660 [0061.271] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.271] ReadFile (in: hFile=0x46c, lpBuffer=0x66fcd0, nNumberOfBytesToRead=0x7960, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x66fcd0*, lpNumberOfBytesRead=0x650ff14*=0x7960, lpOverlapped=0x0) returned 1 [0064.466] GetProcessHeap () returned 0x580000 [0064.466] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0064.466] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.466] WriteFile (in: hFile=0x46c, lpBuffer=0x677660*, nNumberOfBytesToWrite=0x7960, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x677660*, lpNumberOfBytesWritten=0x650ff14*=0x7960, lpOverlapped=0x0) returned 1 [0064.467] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x46c, lpBuffer=0x67efbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x67efbf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0064.467] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.467] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0064.467] CloseHandle (hObject=0x46c) returned 1 [0065.644] GetProcessHeap () returned 0x580000 [0065.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677660 | out: hHeap=0x580000) returned 1 [0065.644] GetProcessHeap () returned 0x580000 [0065.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x66fcd0 | out: hHeap=0x580000) returned 1 [0065.644] GetProcessHeap () returned 0x580000 [0065.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0065.644] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5e2ff180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x650fd28, dwReserved1=0x66fcd0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b96b0 [0066.490] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.912] SysReAllocStringLen (pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", len=0x43) [0066.912] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", len=0x43 | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 1 [0066.912] GetProcessHeap () returned 0x580000 [0066.912] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9710, Size=0x30) returned 0x5e9710 [0066.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0069.022] CloseHandle (hObject=0x3f4) returned 1 [0069.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0069.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id_1622540890_.your_last_chance")) returned 1 [0072.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0072.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MTEXTR~1.YOU")) returned 0x5b9770 [0072.324] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0072.324] GetProcessHeap () returned 0x580000 [0072.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6f07d60 [0072.324] GetProcessHeap () returned 0x580000 [0072.324] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6f09b70 [0072.324] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0072.324] ReadFile (in: hFile=0x418, lpBuffer=0x6f07d60, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f07d60*, lpNumberOfBytesRead=0x650ff14*=0x1de0, lpOverlapped=0x0) returned 1 [0073.030] GetProcessHeap () returned 0x580000 [0073.030] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0073.030] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x418, lpBuffer=0x6f09b70*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f09b70*, lpNumberOfBytesWritten=0x650ff14*=0x1de0, lpOverlapped=0x0) returned 1 [0073.917] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.917] WriteFile (in: hFile=0x418, lpBuffer=0x6f0b94f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0b94f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0073.917] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0073.917] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0073.917] CloseHandle (hObject=0x418) returned 1 [0073.917] GetProcessHeap () returned 0x580000 [0073.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b70 | out: hHeap=0x580000) returned 1 [0073.917] GetProcessHeap () returned 0x580000 [0073.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f07d60 | out: hHeap=0x580000) returned 1 [0073.917] GetProcessHeap () returned 0x580000 [0073.917] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0073.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63baa500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e0c, dwReserved0=0x650fd28, dwReserved1=0x6f07d60, cFileName="MTEXTRA.TTF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MTEXTR~1.YOU")) returned 0x5b96b0 [0073.917] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.940] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", len=0x56 | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 1 [0074.940] GetProcessHeap () returned 0x580000 [0074.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x34) returned 0x5b5d08 [0074.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.940] Sleep (dwMilliseconds=0x1) [0074.950] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", len=0x4c | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 1 [0074.950] GetProcessHeap () returned 0x580000 [0074.950] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x2c) returned 0x5b5d08 [0074.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.965] Sleep (dwMilliseconds=0x1) [0079.336] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", len=0x3d | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 1 [0079.336] GetProcessHeap () returned 0x580000 [0079.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x78) returned 0x5f76f0 [0079.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.337] Sleep (dwMilliseconds=0x1) [0079.353] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", len=0x5c | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 1 [0079.353] GetProcessHeap () returned 0x580000 [0079.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x20) returned 0x5f76f0 [0079.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.361] Sleep (dwMilliseconds=0x1) [0084.368] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", len=0x4e | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 1 [0084.368] GetProcessHeap () returned 0x580000 [0084.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0084.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0084.418] CloseHandle (hObject=0x48c) returned 1 [0084.459] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0084.459] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id_1622540890_.your_last_chance")) returned 1 [0084.462] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOCKS~2.YOU")) returned 0x5b96b0 [0084.462] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0084.462] GetProcessHeap () returned 0x580000 [0084.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x673cd0 [0084.462] GetProcessHeap () returned 0x580000 [0084.462] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa81) returned 0x6d0e508 [0084.462] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.463] ReadFile (in: hFile=0x48c, lpBuffer=0x673cd0, nNumberOfBytesToRead=0xa60, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesRead=0x650ff14*=0xa60, lpOverlapped=0x0) returned 1 [0084.485] GetProcessHeap () returned 0x580000 [0084.485] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0084.485] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.485] WriteFile (in: hFile=0x48c, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x650ff14*=0xa60, lpOverlapped=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.485] WriteFile (in: hFile=0x48c, lpBuffer=0x6d0ef67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0ef67*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0084.485] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0084.485] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0084.486] CloseHandle (hObject=0x48c) returned 1 [0084.486] GetProcessHeap () returned 0x580000 [0084.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0084.486] GetProcessHeap () returned 0x580000 [0084.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0084.486] GetProcessHeap () returned 0x580000 [0084.486] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0084.486] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0084.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x69f7dfa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaa3, dwReserved0=0x650fd28, dwReserved1=0x673cd0, cFileName="STOCKS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="STOCKS~2.YOU")) returned 0x5b96b0 [0084.486] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.486] Sleep (dwMilliseconds=0x1) [0084.497] Sleep (dwMilliseconds=0x1) [0088.224] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", len=0x4d | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 1 [0088.224] GetProcessHeap () returned 0x580000 [0088.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x28) returned 0x5dc550 [0088.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0088.284] CloseHandle (hObject=0x408) returned 1 [0088.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id_1622540890_.your_last_chance")) returned 1 [0088.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAPSUL~1.YOU")) returned 0x5b96f0 [0088.285] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.285] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0088.285] GetProcessHeap () returned 0x580000 [0088.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1c1) returned 0x6dfaac0 [0088.287] GetProcessHeap () returned 0x580000 [0088.287] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1c1) returned 0x6e08c90 [0088.288] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.288] ReadFile (in: hFile=0x408, lpBuffer=0x6dfaac0, nNumberOfBytesToRead=0xe1a0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dfaac0*, lpNumberOfBytesRead=0x650ff14*=0xe1a0, lpOverlapped=0x0) returned 1 [0091.338] GetProcessHeap () returned 0x580000 [0091.338] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0091.338] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.338] WriteFile (in: hFile=0x408, lpBuffer=0x6e08c90*, nNumberOfBytesToWrite=0xe1a0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e08c90*, lpNumberOfBytesWritten=0x650ff14*=0xe1a0, lpOverlapped=0x0) returned 1 [0091.608] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.608] WriteFile (in: hFile=0x408, lpBuffer=0x6e16e2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e16e2f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.608] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.608] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.608] CloseHandle (hObject=0x408) returned 1 [0091.608] GetProcessHeap () returned 0x580000 [0091.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e08c90 | out: hHeap=0x580000) returned 1 [0091.608] GetProcessHeap () returned 0x580000 [0091.608] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dfaac0 | out: hHeap=0x580000) returned 1 [0091.611] GetProcessHeap () returned 0x580000 [0091.611] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0091.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e37b400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe1de, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="CAPSULES.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CAPSUL~1.YOU")) returned 0x5b96b0 [0091.629] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.322] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 1 [0092.322] GetProcessHeap () returned 0x580000 [0092.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0092.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0092.323] CloseHandle (hObject=0x488) returned 1 [0092.323] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.323] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id_1622540890_.your_last_chance")) returned 1 [0098.936] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0098.936] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x45, dwReserved1=0x0, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0098.936] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0098.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0098.937] GetProcessHeap () returned 0x580000 [0098.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaf41) returned 0x6c4a3c8 [0098.937] GetProcessHeap () returned 0x580000 [0098.937] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaf41) returned 0x6fa4078 [0098.938] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.938] ReadFile (in: hFile=0x488, lpBuffer=0x6c4a3c8, nNumberOfBytesToRead=0xaf20, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a3c8*, lpNumberOfBytesRead=0x650ff14*=0xaf20, lpOverlapped=0x0) returned 1 [0100.814] GetProcessHeap () returned 0x580000 [0100.814] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0100.814] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.814] WriteFile (in: hFile=0x488, lpBuffer=0x6fa4078*, nNumberOfBytesToWrite=0xaf20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa4078*, lpNumberOfBytesWritten=0x650ff14*=0xaf20, lpOverlapped=0x0) returned 1 [0100.816] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.816] WriteFile (in: hFile=0x488, lpBuffer=0x6faef97*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6faef97*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0100.816] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.816] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0100.816] CloseHandle (hObject=0x488) returned 1 [0100.818] GetProcessHeap () returned 0x580000 [0100.818] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa4078 | out: hHeap=0x580000) returned 1 [0100.820] GetProcessHeap () returned 0x580000 [0100.820] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a3c8 | out: hHeap=0x580000) returned 1 [0100.821] GetProcessHeap () returned 0x580000 [0100.821] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.841] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73b41f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaf56, dwReserved0=0x650fd28, dwReserved1=0x6c4a3c8, cFileName="THMBNAIL.PNG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="THMBNA~1.YOU")) returned 0x5b96b0 [0101.841] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.167] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", len=0x45 | out: pbstr=0x650ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 1 [0106.167] GetProcessHeap () returned 0x580000 [0106.167] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e92e8 | out: hHeap=0x580000) returned 1 [0106.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0107.298] CloseHandle (hObject=0x408) returned 1 [0107.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.298] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id_1622540890_.your_last_chance")) returned 1 [0107.298] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.299] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FM20CH~1.YOU")) returned 0x5b9630 [0107.299] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0107.299] GetProcessHeap () returned 0x580000 [0107.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6db0a00 [0107.299] GetProcessHeap () returned 0x580000 [0107.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6dc2230 [0107.299] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.299] ReadFile (in: hFile=0x408, lpBuffer=0x6db0a00, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db0a00*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.662] GetProcessHeap () returned 0x580000 [0111.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0111.662] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.662] WriteFile (in: hFile=0x408, lpBuffer=0x6dc2230*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc2230*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0111.662] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.662] WriteFile (in: hFile=0x408, lpBuffer=0x6dd3a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd3a2f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0111.761] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0111.761] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0111.761] CloseHandle (hObject=0x408) returned 1 [0111.761] GetProcessHeap () returned 0x580000 [0111.761] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc2230 | out: hHeap=0x580000) returned 1 [0111.762] GetProcessHeap () returned 0x580000 [0111.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db0a00 | out: hHeap=0x580000) returned 1 [0111.762] GetProcessHeap () returned 0x580000 [0111.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0111.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a3b2480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x51a7f, dwReserved0=0x650fd28, dwReserved1=0x6db0a00, cFileName="FM20.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FM20CH~1.YOU")) returned 0x5b95f0 [0111.763] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0111.976] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", len=0x4f | out: pbstr=0x650ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 1 [0111.976] GetProcessHeap () returned 0x580000 [0111.976] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x44) returned 0x596828 [0111.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.036] Sleep (dwMilliseconds=0x1) [0112.130] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", len=0x49 | out: pbstr=0x650ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned 1 [0112.130] GetProcessHeap () returned 0x580000 [0112.130] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.139] Sleep (dwMilliseconds=0x1) [0112.220] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", len=0x58 | out: pbstr=0x650ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.220] GetProcessHeap () returned 0x580000 [0112.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.220] Sleep (dwMilliseconds=0x1) [0112.237] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", len=0x49 | out: pbstr=0x650ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 1 [0112.238] GetProcessHeap () returned 0x580000 [0112.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x38) returned 0x5b9630 [0112.238] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.249] Sleep (dwMilliseconds=0x1) [0112.365] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", len=0x47 | out: pbstr=0x650ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png") returned 1 [0112.366] GetProcessHeap () returned 0x580000 [0112.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x24) returned 0x5dc340 [0112.366] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.387] Sleep (dwMilliseconds=0x1) [0113.312] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", len=0x3f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 1 [0113.312] GetProcessHeap () returned 0x580000 [0113.312] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xf8) returned 0x6f0ceb8 [0113.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0113.494] CloseHandle (hObject=0x450) returned 1 [0113.494] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.037] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.037] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~1.YOU")) returned 0x5b9630 [0115.037] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0115.037] GetProcessHeap () returned 0x580000 [0115.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x667250 [0115.037] GetProcessHeap () returned 0x580000 [0115.037] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a01) returned 0x6d0e508 [0115.037] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.037] ReadFile (in: hFile=0x450, lpBuffer=0x667250, nNumberOfBytesToRead=0x19e0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x667250*, lpNumberOfBytesRead=0x650ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0115.061] GetProcessHeap () returned 0x580000 [0115.061] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.061] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.061] WriteFile (in: hFile=0x450, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x19e0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x650ff14*=0x19e0, lpOverlapped=0x0) returned 1 [0115.062] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.062] WriteFile (in: hFile=0x450, lpBuffer=0x6d0fee7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0fee7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.062] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.062] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.062] CloseHandle (hObject=0x450) returned 1 [0115.062] GetProcessHeap () returned 0x580000 [0115.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0115.062] GetProcessHeap () returned 0x580000 [0115.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x667250 | out: hHeap=0x580000) returned 1 [0115.062] GetProcessHeap () returned 0x580000 [0115.062] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.189] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c3166a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1a10, dwReserved0=0x650fd28, dwReserved1=0x667250, cFileName="AN04191_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0419~1.YOU")) returned 0x5b9630 [0116.189] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.226] CloseHandle (hObject=0x428) returned 1 [0116.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.226] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.226] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.226] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0139~1.YOU")) returned 0x5b9630 [0116.227] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.227] GetProcessHeap () returned 0x580000 [0116.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x62e3b8 [0116.227] GetProcessHeap () returned 0x580000 [0116.227] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13a1) returned 0x6c7a390 [0116.229] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.229] ReadFile (in: hFile=0x428, lpBuffer=0x62e3b8, nNumberOfBytesToRead=0x1380, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x62e3b8*, lpNumberOfBytesRead=0x650ff14*=0x1380, lpOverlapped=0x0) returned 1 [0116.316] GetProcessHeap () returned 0x580000 [0116.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0116.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.316] WriteFile (in: hFile=0x428, lpBuffer=0x6c7a390*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7a390*, lpNumberOfBytesWritten=0x650ff14*=0x1380, lpOverlapped=0x0) returned 1 [0116.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.316] WriteFile (in: hFile=0x428, lpBuffer=0x6c7b70f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c7b70f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.316] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.316] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.316] CloseHandle (hObject=0x428) returned 1 [0116.317] GetProcessHeap () returned 0x580000 [0116.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c7a390 | out: hHeap=0x580000) returned 1 [0116.317] GetProcessHeap () returned 0x580000 [0116.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x62e3b8 | out: hHeap=0x580000) returned 1 [0116.317] GetProcessHeap () returned 0x580000 [0116.317] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0116.317] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cf23600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13b0, dwReserved0=0x650fd28, dwReserved1=0x62e3b8, cFileName="SL01395_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0139~1.YOU")) returned 0x5b9630 [0116.317] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.333] CloseHandle (hObject=0x428) returned 1 [0116.333] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.333] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.334] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0071~1.YOU")) returned 0x5b9630 [0116.334] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0116.334] GetProcessHeap () returned 0x580000 [0116.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x6c78088 [0116.334] GetProcessHeap () returned 0x580000 [0116.334] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1dc1) returned 0x6ef7f38 [0116.334] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.334] ReadFile (in: hFile=0x428, lpBuffer=0x6c78088, nNumberOfBytesToRead=0x1da0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c78088*, lpNumberOfBytesRead=0x650ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0117.251] GetProcessHeap () returned 0x580000 [0117.251] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.251] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.251] WriteFile (in: hFile=0x428, lpBuffer=0x6ef7f38*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef7f38*, lpNumberOfBytesWritten=0x650ff14*=0x1da0, lpOverlapped=0x0) returned 1 [0117.252] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.252] WriteFile (in: hFile=0x428, lpBuffer=0x6ef9cd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef9cd7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.252] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.252] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.252] CloseHandle (hObject=0x428) returned 1 [0117.252] GetProcessHeap () returned 0x580000 [0117.252] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef7f38 | out: hHeap=0x580000) returned 1 [0117.252] GetProcessHeap () returned 0x580000 [0117.252] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c78088 | out: hHeap=0x580000) returned 1 [0117.252] GetProcessHeap () returned 0x580000 [0117.252] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d810880, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ddc, dwReserved0=0x650fd28, dwReserved1=0x6c78088, cFileName="SL00712_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SL0071~1.YOU")) returned 0x5b9630 [0118.994] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.031] CloseHandle (hObject=0x170) returned 1 [0119.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0225~2.YOU")) returned 0x5b9630 [0119.032] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.032] GetProcessHeap () returned 0x580000 [0119.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea1) returned 0x6c29878 [0119.032] GetProcessHeap () returned 0x580000 [0119.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xea1) returned 0x6d10048 [0119.032] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.032] ReadFile (in: hFile=0x170, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xe80, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x650ff14*=0xe80, lpOverlapped=0x0) returned 1 [0119.059] GetProcessHeap () returned 0x580000 [0119.059] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.059] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.059] WriteFile (in: hFile=0x170, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x650ff14*=0xe80, lpOverlapped=0x0) returned 1 [0119.059] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.059] WriteFile (in: hFile=0x170, lpBuffer=0x6d10ec7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10ec7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.059] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.059] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.059] CloseHandle (hObject=0x170) returned 1 [0119.070] GetProcessHeap () returned 0x580000 [0119.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0119.107] GetProcessHeap () returned 0x580000 [0119.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0119.107] GetProcessHeap () returned 0x580000 [0119.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.125] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e92c6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeac, dwReserved0=0x650fd28, dwReserved1=0x6c29878, cFileName="SO02252_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0225~2.YOU")) returned 0x5b96f0 [0120.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.153] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", len=0x4c | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 1 [0120.153] GetProcessHeap () returned 0x580000 [0120.153] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b4) returned 0x6d06ca8 [0120.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.136] CloseHandle (hObject=0x438) returned 1 [0122.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.id_1622540890_.your_last_chance")) returned 1 [0122.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0203~1.YOU")) returned 0x5b9730 [0122.137] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0122.138] GetProcessHeap () returned 0x580000 [0122.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60c7d8 [0122.138] GetProcessHeap () returned 0x580000 [0122.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x60cba0 [0122.138] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.138] ReadFile (in: hFile=0x438, lpBuffer=0x60c7d8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60c7d8*, lpNumberOfBytesRead=0x650ff14*=0x380, lpOverlapped=0x0) returned 1 [0122.142] GetProcessHeap () returned 0x580000 [0122.142] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.142] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.142] WriteFile (in: hFile=0x438, lpBuffer=0x60cba0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60cba0*, lpNumberOfBytesWritten=0x650ff14*=0x380, lpOverlapped=0x0) returned 1 [0122.142] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.143] WriteFile (in: hFile=0x438, lpBuffer=0x60cf1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60cf1f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.143] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.143] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.143] CloseHandle (hObject=0x438) returned 1 [0122.143] GetProcessHeap () returned 0x580000 [0122.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60cba0 | out: hHeap=0x580000) returned 1 [0122.143] GetProcessHeap () returned 0x580000 [0122.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c7d8 | out: hHeap=0x580000) returned 1 [0122.143] GetProcessHeap () returned 0x580000 [0122.143] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.420] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x806a16e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x650fd28, dwReserved1=0x60c7d8, cFileName="WB02039_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0203~1.YOU")) returned 0x5b9730 [0124.420] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.083] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", len=0x4d | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 1 [0125.083] GetProcessHeap () returned 0x580000 [0125.084] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1894) returned 0x6f42f08 [0125.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0125.140] CloseHandle (hObject=0x45c) returned 1 [0125.140] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0125.140] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id_1622540890_.your_last_chance")) returned 1 [0125.141] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0125.141] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELE~1.YOU")) returned 0x5b9730 [0125.141] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0125.141] GetProcessHeap () returned 0x580000 [0125.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa8c1) returned 0x6d15418 [0125.141] GetProcessHeap () returned 0x580000 [0125.141] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa8c1) returned 0x6d1fce8 [0125.141] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0125.141] ReadFile (in: hFile=0x45c, lpBuffer=0x6d15418, nNumberOfBytesToRead=0xa8a0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d15418*, lpNumberOfBytesRead=0x650ff14*=0xa8a0, lpOverlapped=0x0) returned 1 [0126.761] GetProcessHeap () returned 0x580000 [0126.761] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0126.762] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.762] WriteFile (in: hFile=0x45c, lpBuffer=0x6d1fce8*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d1fce8*, lpNumberOfBytesWritten=0x650ff14*=0xa8a0, lpOverlapped=0x0) returned 1 [0126.762] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.762] WriteFile (in: hFile=0x45c, lpBuffer=0x6d2a587*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2a587*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.762] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.762] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.762] CloseHandle (hObject=0x45c) returned 1 [0126.762] GetProcessHeap () returned 0x580000 [0126.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d1fce8 | out: hHeap=0x580000) returned 1 [0126.762] GetProcessHeap () returned 0x580000 [0126.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d15418 | out: hHeap=0x580000) returned 1 [0126.762] GetProcessHeap () returned 0x580000 [0126.762] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0126.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x832aade0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa8dd, dwReserved0=0x650fd28, dwReserved1=0x6d15418, cFileName="Oriel.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ORIELE~1.YOU")) returned 0x5b9730 [0126.763] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.235] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", len=0x3d | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned 1 [0127.235] GetProcessHeap () returned 0x580000 [0127.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c8) returned 0x667250 [0127.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0128.869] CloseHandle (hObject=0x440) returned 1 [0128.869] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02997~1.YOU")) returned 0x5b96f0 [0129.110] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0129.110] GetProcessHeap () returned 0x580000 [0129.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4341) returned 0x6de0f50 [0129.111] GetProcessHeap () returned 0x580000 [0129.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4341) returned 0x6de52a0 [0129.111] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.111] ReadFile (in: hFile=0x440, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x4320, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x650ff14*=0x4320, lpOverlapped=0x0) returned 1 [0129.308] GetProcessHeap () returned 0x580000 [0129.308] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.308] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.308] WriteFile (in: hFile=0x440, lpBuffer=0x6de52a0*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de52a0*, lpNumberOfBytesWritten=0x650ff14*=0x4320, lpOverlapped=0x0) returned 1 [0129.308] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.308] WriteFile (in: hFile=0x440, lpBuffer=0x6de95bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de95bf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.308] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.308] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.309] CloseHandle (hObject=0x440) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de52a0 | out: hHeap=0x580000) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0129.403] GetProcessHeap () returned 0x580000 [0129.403] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84aeae00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4346, dwReserved0=0x650fd28, dwReserved1=0x6de0f50, cFileName="J0299763.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02997~1.YOU")) returned 0x5b9730 [0129.583] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.640] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS", len=0x36 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS") returned 1 [0129.640] GetProcessHeap () returned 0x580000 [0129.640] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0129.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.554] CloseHandle (hObject=0x470) returned 1 [0132.554] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.555] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.id_1622540890_.your_last_chance")) returned 1 [0132.555] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.555] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BWCSSI~1.YOU")) returned 0x5b9730 [0132.556] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0132.556] GetProcessHeap () returned 0x580000 [0132.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x635768 [0132.556] GetProcessHeap () returned 0x580000 [0132.556] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x6c29878 [0132.556] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.556] ReadFile (in: hFile=0x470, lpBuffer=0x635768, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x650ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.573] GetProcessHeap () returned 0x580000 [0132.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0132.573] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.573] WriteFile (in: hFile=0x470, lpBuffer=0x6c29878*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesWritten=0x650ff14*=0xd60, lpOverlapped=0x0) returned 1 [0132.573] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.574] WriteFile (in: hFile=0x470, lpBuffer=0x6c2a5d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a5d7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0132.574] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.574] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0132.574] CloseHandle (hObject=0x470) returned 1 [0132.574] GetProcessHeap () returned 0x580000 [0132.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0132.574] GetProcessHeap () returned 0x580000 [0132.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0132.574] GetProcessHeap () returned 0x580000 [0132.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0134.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0134.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x86a28ec0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd9e, dwReserved0=0x650fd28, dwReserved1=0x635768, cFileName="BW.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BWCSSI~1.YOU")) returned 0x5b96f0 [0134.992] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0134.992] Sleep (dwMilliseconds=0x1) [0135.729] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", len=0x53 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css") returned 1 [0135.736] GetProcessHeap () returned 0x580000 [0135.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.737] CloseHandle (hObject=0x484) returned 1 [0135.737] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.id_1622540890_.your_last_chance")) returned 1 [0135.738] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0135.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b96b0 [0135.738] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.738] GetProcessHeap () returned 0x580000 [0135.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x6c29878 [0135.738] GetProcessHeap () returned 0x580000 [0135.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xda1) returned 0x706ecb0 [0135.739] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.739] ReadFile (in: hFile=0x484, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xd80, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x650ff14*=0xd80, lpOverlapped=0x0) returned 1 [0135.827] GetProcessHeap () returned 0x580000 [0135.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0135.827] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.827] WriteFile (in: hFile=0x484, lpBuffer=0x706ecb0*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesWritten=0x650ff14*=0xd80, lpOverlapped=0x0) returned 1 [0135.827] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.827] WriteFile (in: hFile=0x484, lpBuffer=0x706fa2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x706fa2f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0135.827] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0135.828] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0135.828] CloseHandle (hObject=0x484) returned 1 [0135.828] GetProcessHeap () returned 0x580000 [0135.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0135.828] GetProcessHeap () returned 0x580000 [0135.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0135.828] GetProcessHeap () returned 0x580000 [0135.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0135.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8891acc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xda4, dwReserved0=0x650fd28, dwReserved1=0x6c29878, cFileName="Biscay.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BISCAY~1.YOU")) returned 0x5b9770 [0135.828] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.835] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", len=0x61 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned 1 [0135.835] GetProcessHeap () returned 0x580000 [0135.835] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0135.856] CloseHandle (hObject=0x484) returned 1 [0135.856] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0135.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0138.488] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0138.489] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0138.489] GetProcessHeap () returned 0x580000 [0138.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0138.489] GetProcessHeap () returned 0x580000 [0138.489] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0138.489] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.489] ReadFile (in: hFile=0x438, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0138.491] GetProcessHeap () returned 0x580000 [0138.491] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0138.491] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.491] WriteFile (in: hFile=0x438, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0138.491] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.491] WriteFile (in: hFile=0x438, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.491] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.491] WriteFile (in: hFile=0x438, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.491] CloseHandle (hObject=0x438) returned 1 [0138.491] GetProcessHeap () returned 0x580000 [0138.491] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0138.491] GetProcessHeap () returned 0x580000 [0138.492] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0138.492] GetProcessHeap () returned 0x580000 [0138.492] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0138.492] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x650fd28, dwReserved1=0x6f3bec0, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b96b0 [0138.492] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.664] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", len=0x58 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css") returned 1 [0138.665] GetProcessHeap () returned 0x580000 [0138.665] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0138.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0138.668] CloseHandle (hObject=0x170) returned 1 [0138.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0138.668] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance")) returned 1 [0138.669] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b96b0 [0138.669] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0138.669] GetProcessHeap () returned 0x580000 [0138.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6c79898 [0138.669] GetProcessHeap () returned 0x580000 [0138.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7e1) returned 0x6daf1e8 [0138.670] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.671] ReadFile (in: hFile=0x170, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x7c0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x650ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0138.678] GetProcessHeap () returned 0x580000 [0138.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0138.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.679] WriteFile (in: hFile=0x170, lpBuffer=0x6daf1e8*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf1e8*, lpNumberOfBytesWritten=0x650ff14*=0x7c0, lpOverlapped=0x0) returned 1 [0138.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.679] WriteFile (in: hFile=0x170, lpBuffer=0x6daf9a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6daf9a7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.679] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.679] CloseHandle (hObject=0x170) returned 1 [0138.679] GetProcessHeap () returned 0x580000 [0138.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6daf1e8 | out: hHeap=0x580000) returned 1 [0138.679] GetProcessHeap () returned 0x580000 [0138.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0138.679] GetProcessHeap () returned 0x580000 [0138.679] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0139.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a454860, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x650fd28, dwReserved1=0x6c79898, cFileName="LightSpirit.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIGHTS~1.YOU")) returned 0x5b9770 [0139.880] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.887] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", len=0x53 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css") returned 1 [0139.887] GetProcessHeap () returned 0x580000 [0139.887] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0139.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.887] CloseHandle (hObject=0x4a0) returned 1 [0139.887] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.id_1622540890_.your_last_chance")) returned 1 [0139.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x715, dwReserved0=0x540053, dwReserved1=0x43005f, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b9770 [0139.888] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0139.889] GetProcessHeap () returned 0x580000 [0139.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef020 [0139.889] GetProcessHeap () returned 0x580000 [0139.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6eef768 [0139.889] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.889] ReadFile (in: hFile=0x4a0, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x650ff14*=0x700, lpOverlapped=0x0) returned 1 [0139.896] GetProcessHeap () returned 0x580000 [0139.896] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.896] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.896] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eef768*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef768*, lpNumberOfBytesWritten=0x650ff14*=0x700, lpOverlapped=0x0) returned 1 [0139.896] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.896] WriteFile (in: hFile=0x4a0, lpBuffer=0x6eefe67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eefe67*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.896] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.896] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.896] CloseHandle (hObject=0x4a0) returned 1 [0139.897] GetProcessHeap () returned 0x580000 [0139.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef768 | out: hHeap=0x580000) returned 1 [0139.897] GetProcessHeap () returned 0x580000 [0139.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0139.897] GetProcessHeap () returned 0x580000 [0139.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0139.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8afef3a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x650fd28, dwReserved1=0x6eef020, cFileName="Maroon.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MAROON~1.YOU")) returned 0x5b9770 [0139.897] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.126] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x5b | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0140.126] GetProcessHeap () returned 0x580000 [0140.126] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.126] CloseHandle (hObject=0x3b4) returned 1 [0140.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.127] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0140.127] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.127] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x59002e, dwReserved1=0x55004f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.127] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.128] GetProcessHeap () returned 0x580000 [0140.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60a830 [0140.128] GetProcessHeap () returned 0x580000 [0140.128] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60bdc0 [0140.128] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.128] ReadFile (in: hFile=0x3b4, lpBuffer=0x60a830, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60a830*, lpNumberOfBytesRead=0x650ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0140.130] GetProcessHeap () returned 0x580000 [0140.130] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.130] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.130] WriteFile (in: hFile=0x3b4, lpBuffer=0x60bdc0*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60bdc0*, lpNumberOfBytesWritten=0x650ff14*=0x1e0, lpOverlapped=0x0) returned 1 [0140.130] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.130] WriteFile (in: hFile=0x3b4, lpBuffer=0x60bf9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x60bf9f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.130] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.131] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.131] CloseHandle (hObject=0x3b4) returned 1 [0140.131] GetProcessHeap () returned 0x580000 [0140.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60bdc0 | out: hHeap=0x580000) returned 1 [0140.131] GetProcessHeap () returned 0x580000 [0140.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60a830 | out: hHeap=0x580000) returned 1 [0140.131] GetProcessHeap () returned 0x580000 [0140.131] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.131] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b22a840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x214, dwReserved0=0x650fd28, dwReserved1=0x60a830, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0140.131] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.138] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", len=0x55 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css") returned 1 [0140.138] GetProcessHeap () returned 0x580000 [0140.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.380] CloseHandle (hObject=0x488) returned 1 [0140.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.id_1622540890_.your_last_chance")) returned 1 [0140.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b9770 [0140.381] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0140.381] GetProcessHeap () returned 0x580000 [0140.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xee1) returned 0x6c29878 [0140.381] GetProcessHeap () returned 0x580000 [0140.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xee1) returned 0x67ec60 [0140.381] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.381] ReadFile (in: hFile=0x488, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xec0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x650ff14*=0xec0, lpOverlapped=0x0) returned 1 [0140.395] GetProcessHeap () returned 0x580000 [0140.395] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0140.395] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.395] WriteFile (in: hFile=0x488, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x650ff14*=0xec0, lpOverlapped=0x0) returned 1 [0140.395] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.395] WriteFile (in: hFile=0x488, lpBuffer=0x67fb1f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fb1f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.395] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.395] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.395] CloseHandle (hObject=0x488) returned 1 [0140.395] GetProcessHeap () returned 0x580000 [0140.395] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0140.395] GetProcessHeap () returned 0x580000 [0140.396] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0140.396] GetProcessHeap () returned 0x580000 [0140.396] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0140.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b4b1fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xee8, dwReserved0=0x650fd28, dwReserved1=0x6c29878, cFileName="SoftBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOFTBL~1.YOU")) returned 0x5b9770 [0140.674] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.685] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD", len=0x3c | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 1 [0140.685] GetProcessHeap () returned 0x580000 [0140.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.702] CloseHandle (hObject=0x490) returned 1 [0140.702] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id_1622540890_.your_last_chance")) returned 1 [0140.703] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x108a400, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTLI~1.YOU")) returned 0x5b9730 [0140.703] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.703] GetProcessHeap () returned 0x580000 [0140.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef3020 [0140.703] GetProcessHeap () returned 0x580000 [0140.703] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x781) returned 0x6ef37e8 [0140.703] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.703] ReadFile (in: hFile=0x490, lpBuffer=0x6ef3020, nNumberOfBytesToRead=0x760, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3020*, lpNumberOfBytesRead=0x650ff14*=0x760, lpOverlapped=0x0) returned 1 [0140.718] GetProcessHeap () returned 0x580000 [0140.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0140.718] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.718] WriteFile (in: hFile=0x490, lpBuffer=0x6ef37e8*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef37e8*, lpNumberOfBytesWritten=0x650ff14*=0x760, lpOverlapped=0x0) returned 1 [0140.719] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.719] WriteFile (in: hFile=0x490, lpBuffer=0x6ef3f47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef3f47*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.719] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.719] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.719] CloseHandle (hObject=0x490) returned 1 [0140.719] GetProcessHeap () returned 0x580000 [0140.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef37e8 | out: hHeap=0x580000) returned 1 [0140.719] GetProcessHeap () returned 0x580000 [0140.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ef3020 | out: hHeap=0x580000) returned 1 [0140.719] GetProcessHeap () returned 0x580000 [0140.719] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0141.583] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8b7d1c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x78f, dwReserved0=0x650fd28, dwReserved1=0x6ef3020, cFileName="INSTLIST.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INSTLI~1.YOU")) returned 0x5b9730 [0141.589] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.617] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", len=0x3c | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned 1 [0141.617] GetProcessHeap () returned 0x580000 [0141.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0141.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.618] CloseHandle (hObject=0x4a0) returned 1 [0141.618] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.id_1622540890_.your_last_chance")) returned 1 [0141.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~1.YOU")) returned 0x5b9730 [0141.619] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0141.620] GetProcessHeap () returned 0x580000 [0141.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6ec4068 [0141.620] GetProcessHeap () returned 0x580000 [0141.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3021) returned 0x6599d0 [0141.620] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.620] ReadFile (in: hFile=0x4a0, lpBuffer=0x6ec4068, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec4068*, lpNumberOfBytesRead=0x650ff14*=0x3000, lpOverlapped=0x0) returned 1 [0141.662] GetProcessHeap () returned 0x580000 [0141.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0141.663] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.663] WriteFile (in: hFile=0x4a0, lpBuffer=0x6599d0*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599d0*, lpNumberOfBytesWritten=0x650ff14*=0x3000, lpOverlapped=0x0) returned 1 [0141.663] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.663] WriteFile (in: hFile=0x4a0, lpBuffer=0x65c9cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x65c9cf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0141.663] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.663] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0141.663] CloseHandle (hObject=0x4a0) returned 1 [0141.663] GetProcessHeap () returned 0x580000 [0141.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599d0 | out: hHeap=0x580000) returned 1 [0141.664] GetProcessHeap () returned 0x580000 [0141.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ec4068 | out: hHeap=0x580000) returned 1 [0141.664] GetProcessHeap () returned 0x580000 [0141.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c0bef00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3024, dwReserved0=0x650fd28, dwReserved1=0x6ec4068, cFileName="PROTTPLV.PPT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROTTP~1.YOU")) returned 0x5b9730 [0141.664] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.684] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", len=0x45 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS") returned 1 [0146.684] GetProcessHeap () returned 0x580000 [0146.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0146.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0146.685] CloseHandle (hObject=0x3b8) returned 1 [0146.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0146.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css.id_1622540890_.your_last_chance")) returned 1 [0146.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0146.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2a2e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f2a2e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e114, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~1.YOU")) returned 0x5b9730 [0146.686] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0146.686] GetProcessHeap () returned 0x580000 [0146.686] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e29430 [0146.687] GetProcessHeap () returned 0x580000 [0146.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e3ac60 [0146.687] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0146.687] ReadFile (in: hFile=0x3b8, lpBuffer=0x6e29430, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e29430*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.204] GetProcessHeap () returned 0x580000 [0150.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0150.205] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.205] WriteFile (in: hFile=0x3b8, lpBuffer=0x6e3ac60*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3ac60*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0150.205] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.205] WriteFile (in: hFile=0x3b8, lpBuffer=0x6e4c45f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4c45f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0150.205] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.205] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0150.205] CloseHandle (hObject=0x3b8) returned 1 [0150.205] GetProcessHeap () returned 0x580000 [0150.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3ac60 | out: hHeap=0x580000) returned 1 [0150.205] GetProcessHeap () returned 0x580000 [0150.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e29430 | out: hHeap=0x580000) returned 1 [0150.205] GetProcessHeap () returned 0x580000 [0150.205] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0150.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2a2e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91246080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e138, dwReserved0=0x650fd28, dwReserved1=0x6e29430, cFileName="SCHEME55.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHEME~1.YOU")) returned 0x5b96f0 [0150.595] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.634] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", len=0x44 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned 1 [0150.635] GetProcessHeap () returned 0x580000 [0150.635] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0150.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0150.635] CloseHandle (hObject=0x4ac) returned 1 [0150.635] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.635] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.id_1622540890_.your_last_chance")) returned 1 [0150.636] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0150.636] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4a66, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR49~2.YOU")) returned 0x5b96f0 [0150.636] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0150.636] GetProcessHeap () returned 0x580000 [0150.636] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a81) returned 0x6dec6e0 [0150.637] GetProcessHeap () returned 0x580000 [0150.637] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4a81) returned 0x6dc68c0 [0150.637] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0150.637] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x4a60, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x650ff14*=0x4a60, lpOverlapped=0x0) returned 1 [0151.300] GetProcessHeap () returned 0x580000 [0151.300] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0151.300] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.300] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dc68c0*, nNumberOfBytesToWrite=0x4a60, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc68c0*, lpNumberOfBytesWritten=0x650ff14*=0x4a60, lpOverlapped=0x0) returned 1 [0151.300] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.300] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dcb31f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb31f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0151.301] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.301] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0151.301] CloseHandle (hObject=0x4ac) returned 1 [0151.926] GetProcessHeap () returned 0x580000 [0151.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc68c0 | out: hHeap=0x580000) returned 1 [0151.927] GetProcessHeap () returned 0x580000 [0151.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0151.927] GetProcessHeap () returned 0x580000 [0151.927] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0152.050] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91cb00c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4a8a, dwReserved0=0x650fd28, dwReserved1=0x6dec6e0, cFileName="PDIR49B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR49~2.YOU")) returned 0x5b9730 [0152.050] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.072] CloseHandle (hObject=0x3b4) returned 1 [0152.072] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.072] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id_1622540890_.your_last_chance")) returned 1 [0152.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96053b00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96053b00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x2b532a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOH~1.YOU")) returned 0x5b9730 [0152.073] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0152.074] GetProcessHeap () returned 0x580000 [0152.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d7cfe8 [0152.074] GetProcessHeap () returned 0x580000 [0152.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0152.074] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.074] ReadFile (in: hFile=0x3b4, lpBuffer=0x6d7cfe8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d7cfe8*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0156.933] GetProcessHeap () returned 0x580000 [0156.933] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0156.933] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.933] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f468d8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0156.934] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0156.934] WriteFile (in: hFile=0x3b4, lpBuffer=0x6f580d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f580d7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0157.686] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.686] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0157.686] CloseHandle (hObject=0x3b4) returned 1 [0157.686] GetProcessHeap () returned 0x580000 [0157.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0157.686] GetProcessHeap () returned 0x580000 [0157.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d7cfe8 | out: hHeap=0x580000) returned 1 [0157.686] GetProcessHeap () returned 0x580000 [0157.686] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0157.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96053b00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x959af480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2b534e, dwReserved0=0x650fd28, dwReserved1=0x6d7cfe8, cFileName="VISIO.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIOH~1.YOU")) returned 0x5b9630 [0157.686] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.220] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", len=0x48 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL") returned 1 [0159.220] GetProcessHeap () returned 0x580000 [0159.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0159.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0159.220] CloseHandle (hObject=0x464) returned 1 [0159.220] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.220] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl.id_1622540890_.your_last_chance")) returned 1 [0159.221] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIST02~1.YOU")) returned 0x5b9630 [0159.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0159.221] GetProcessHeap () returned 0x580000 [0159.221] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e68d40 [0159.222] GetProcessHeap () returned 0x580000 [0159.222] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e7a570 [0159.223] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.223] ReadFile (in: hFile=0x464, lpBuffer=0x6e68d40, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e68d40*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.825] GetProcessHeap () returned 0x580000 [0164.825] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0164.825] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.825] WriteFile (in: hFile=0x464, lpBuffer=0x6e7a570*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7a570*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0164.826] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.826] WriteFile (in: hFile=0x464, lpBuffer=0x6e8bd6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8bd6f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0164.826] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.826] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0164.826] CloseHandle (hObject=0x464) returned 1 [0164.826] GetProcessHeap () returned 0x580000 [0164.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e7a570 | out: hHeap=0x580000) returned 1 [0164.826] GetProcessHeap () returned 0x580000 [0164.826] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e68d40 | out: hHeap=0x580000) returned 1 [0164.831] GetProcessHeap () returned 0x580000 [0164.831] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0166.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99dac8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3bd69, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="SIST02.XSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIST02~1.YOU")) returned 0x5b9730 [0166.552] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.618] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", len=0x40 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 1 [0166.618] GetProcessHeap () returned 0x580000 [0166.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0166.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.134] CloseHandle (hObject=0x448) returned 1 [0169.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0169.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id_1622540890_.your_last_chance")) returned 1 [0169.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0169.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFRES~1.YOU")) returned 0x5b96b0 [0169.135] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0169.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0169.135] GetProcessHeap () returned 0x580000 [0169.135] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3bec0 [0169.136] GetProcessHeap () returned 0x580000 [0169.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6f3c038 [0169.136] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.136] ReadFile (in: hFile=0x448, lpBuffer=0x6f3bec0, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bec0*, lpNumberOfBytesRead=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0169.137] GetProcessHeap () returned 0x580000 [0169.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0169.138] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.138] WriteFile (in: hFile=0x448, lpBuffer=0x6f3c038*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c038*, lpNumberOfBytesWritten=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0169.138] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.138] WriteFile (in: hFile=0x448, lpBuffer=0x6f3c177*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3c177*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0169.138] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.138] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0169.138] CloseHandle (hObject=0x448) returned 1 [0169.138] GetProcessHeap () returned 0x580000 [0169.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3c038 | out: hHeap=0x580000) returned 1 [0169.138] GetProcessHeap () returned 0x580000 [0169.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bec0 | out: hHeap=0x580000) returned 1 [0169.138] GetProcessHeap () returned 0x580000 [0169.138] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0172.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c6e25c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x650fd28, dwReserved1=0x6f3bec0, cFileName="CNFRES.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CNFRES~1.YOU")) returned 0x5b9770 [0172.812] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.859] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", len=0x40 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 1 [0172.859] GetProcessHeap () returned 0x580000 [0172.859] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2280) returned 0x6f14048 [0172.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.893] CloseHandle (hObject=0x490) returned 1 [0172.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.893] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.907] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.908] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIMEE~1.YOU")) returned 0x5b9770 [0172.908] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0172.908] GetProcessHeap () returned 0x580000 [0172.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4adb0 [0172.908] GetProcessHeap () returned 0x580000 [0172.908] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a1) returned 0x6c4b078 [0172.908] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.908] ReadFile (in: hFile=0x490, lpBuffer=0x6c4adb0, nNumberOfBytesToRead=0x280, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4adb0*, lpNumberOfBytesRead=0x650ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.920] GetProcessHeap () returned 0x580000 [0172.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0172.920] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.920] WriteFile (in: hFile=0x490, lpBuffer=0x6c4b078*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4b078*, lpNumberOfBytesWritten=0x650ff14*=0x280, lpOverlapped=0x0) returned 1 [0172.920] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.920] WriteFile (in: hFile=0x490, lpBuffer=0x6c4b2f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4b2f7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.920] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.920] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.920] CloseHandle (hObject=0x490) returned 1 [0172.925] GetProcessHeap () returned 0x580000 [0172.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4b078 | out: hHeap=0x580000) returned 1 [0172.925] GetProcessHeap () returned 0x580000 [0172.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4adb0 | out: hHeap=0x580000) returned 1 [0172.925] GetProcessHeap () returned 0x580000 [0172.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0173.243] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eae3280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a4, dwReserved0=0x650fd28, dwReserved1=0x6c4adb0, cFileName="SMIMEE.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SMIMEE~1.YOU")) returned 0x5b9770 [0173.243] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.569] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", len=0x48 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned 1 [0174.569] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.619] CloseHandle (hObject=0x49c) returned 1 [0174.619] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.id_1622540890_.your_last_chance")) returned 1 [0174.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WARNWA~1.YOU")) returned 0x5b96f0 [0174.620] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0174.620] GetProcessHeap () returned 0x580000 [0174.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaea1) returned 0x6d8e818 [0174.620] GetProcessHeap () returned 0x580000 [0174.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xaea1) returned 0x6f58108 [0174.620] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.620] ReadFile (in: hFile=0x49c, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xae80, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x650ff14*=0xae80, lpOverlapped=0x0) returned 1 [0176.543] GetProcessHeap () returned 0x580000 [0176.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.543] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.543] WriteFile (in: hFile=0x49c, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0xae80, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x650ff14*=0xae80, lpOverlapped=0x0) returned 1 [0176.543] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.543] WriteFile (in: hFile=0x49c, lpBuffer=0x6f62f87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62f87*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0176.543] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.543] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0176.543] CloseHandle (hObject=0x49c) returned 1 [0176.543] GetProcessHeap () returned 0x580000 [0176.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0176.544] GetProcessHeap () returned 0x580000 [0176.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0176.544] GetProcessHeap () returned 0x580000 [0176.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0179.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0d67180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xaeae, dwReserved0=0x650fd28, dwReserved1=0x6d8e818, cFileName="WARN.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WARNWA~1.YOU")) returned 0x5b96f0 [0179.054] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.070] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", len=0x47 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx") returned 1 [0179.070] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0179.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0182.380] CloseHandle (hObject=0x48c) returned 1 [0182.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.id_1622540890_.your_last_chance")) returned 1 [0182.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.382] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMAL~1.YOU")) returned 0x5b9770 [0182.382] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0182.382] GetProcessHeap () returned 0x580000 [0182.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x6f1bec0 [0182.382] GetProcessHeap () returned 0x580000 [0182.382] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2181) returned 0x6f1e0c8 [0182.382] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.382] ReadFile (in: hFile=0x48c, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x2160, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x650ff14*=0x2160, lpOverlapped=0x0) returned 1 [0182.412] GetProcessHeap () returned 0x580000 [0182.412] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0182.412] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x48c, lpBuffer=0x6f1e0c8*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1e0c8*, lpNumberOfBytesWritten=0x650ff14*=0x2160, lpOverlapped=0x0) returned 1 [0182.412] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x48c, lpBuffer=0x6f20227*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f20227*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.412] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.412] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.412] CloseHandle (hObject=0x48c) returned 1 [0182.412] GetProcessHeap () returned 0x580000 [0182.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1e0c8 | out: hHeap=0x580000) returned 1 [0182.412] GetProcessHeap () returned 0x580000 [0182.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0182.412] GetProcessHeap () returned 0x580000 [0182.412] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0183.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa457d7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x218c, dwReserved0=0x650fd28, dwReserved1=0x6f1bec0, cFileName="Formal.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMAL~1.YOU")) returned 0x5b9770 [0183.659] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.685] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", len=0x65 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned 1 [0183.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0183.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.697] CloseHandle (hObject=0x488) returned 1 [0183.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0183.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.id_1622540890_.your_last_chance")) returned 1 [0183.698] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0183.698] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x320036, dwReserved1=0x350032, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9770 [0183.698] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0183.698] GetProcessHeap () returned 0x580000 [0183.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x6dcfb90 [0183.698] GetProcessHeap () returned 0x580000 [0183.698] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4c1) returned 0x6c65108 [0183.698] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.698] ReadFile (in: hFile=0x488, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x4a0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x650ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0183.731] GetProcessHeap () returned 0x580000 [0183.731] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0183.731] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] WriteFile (in: hFile=0x488, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x650ff14*=0x4a0, lpOverlapped=0x0) returned 1 [0183.732] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] WriteFile (in: hFile=0x488, lpBuffer=0x6c655a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c655a7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0183.732] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.732] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0183.732] CloseHandle (hObject=0x488) returned 1 [0183.732] GetProcessHeap () returned 0x580000 [0183.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0183.732] GetProcessHeap () returned 0x580000 [0183.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0183.732] GetProcessHeap () returned 0x580000 [0183.732] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0183.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa51fcb60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x650fd28, dwReserved1=0x6dcfb90, cFileName="FormsBlankPage.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSB~2.YOU")) returned 0x5b9770 [0183.732] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.801] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", len=0x75 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned 1 [0183.801] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0183.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0186.022] CloseHandle (hObject=0x430) returned 1 [0186.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.022] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.023] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.023] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ad9, dwReserved0=0x650048, dwReserved1=0x640061, cFileName="SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECTIO~1.YOU")) returned 0x5b96b0 [0186.023] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0186.023] GetProcessHeap () returned 0x580000 [0186.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3ae1) returned 0x715c008 [0186.024] GetProcessHeap () returned 0x580000 [0186.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3ae1) returned 0x6fbad28 [0186.024] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.024] ReadFile (in: hFile=0x430, lpBuffer=0x715c008, nNumberOfBytesToRead=0x3ac0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x650ff14*=0x3ac0, lpOverlapped=0x0) returned 1 [0187.459] GetProcessHeap () returned 0x580000 [0187.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdcc0 [0187.459] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.459] WriteFile (in: hFile=0x430, lpBuffer=0x6fbad28*, nNumberOfBytesToWrite=0x3ac0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbad28*, lpNumberOfBytesWritten=0x650ff14*=0x3ac0, lpOverlapped=0x0) returned 1 [0187.460] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x430, lpBuffer=0x6fbe7e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbe7e7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.460] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.460] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.460] CloseHandle (hObject=0x430) returned 1 [0187.778] GetProcessHeap () returned 0x580000 [0187.778] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbad28 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0187.779] GetProcessHeap () returned 0x580000 [0187.779] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdcc0 | out: hHeap=0x580000) returned 1 [0188.059] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa758b400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3afd, dwReserved0=0x650fd28, dwReserved1=0x715c008, cFileName="SectionHeading.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SECTIO~1.YOU")) returned 0x5b9770 [0188.059] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.076] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", len=0x44 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned 1 [0188.076] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2084) returned 0x6f14048 [0188.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0191.917] CloseHandle (hObject=0x41c) returned 1 [0191.917] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.839] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPE9E5~1.YOU")) returned 0x5b97b0 [0194.840] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0194.840] GetProcessHeap () returned 0x580000 [0194.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x6dc71d0 [0194.840] GetProcessHeap () returned 0x580000 [0194.840] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2fe1) returned 0x7053178 [0194.840] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.840] ReadFile (in: hFile=0x41c, lpBuffer=0x6dc71d0, nNumberOfBytesToRead=0x2fc0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71d0*, lpNumberOfBytesRead=0x650ff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0195.756] GetProcessHeap () returned 0x580000 [0195.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0195.756] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x41c, lpBuffer=0x7053178*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7053178*, lpNumberOfBytesWritten=0x650ff14*=0x2fc0, lpOverlapped=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x41c, lpBuffer=0x7056137*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7056137*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0195.756] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.756] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0195.757] CloseHandle (hObject=0x41c) returned 1 [0195.757] GetProcessHeap () returned 0x580000 [0195.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7053178 | out: hHeap=0x580000) returned 1 [0195.757] GetProcessHeap () returned 0x580000 [0195.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71d0 | out: hHeap=0x580000) returned 1 [0195.757] GetProcessHeap () returned 0x580000 [0195.757] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0197.033] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac4b0f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2fe6, dwReserved0=0x650fd28, dwReserved1=0x6dc71d0, cFileName="ZPDIR4B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPE9E5~1.YOU")) returned 0x5b97b0 [0197.033] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.152] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", len=0x43 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned 1 [0197.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0197.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0197.153] CloseHandle (hObject=0x41c) returned 1 [0197.153] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.154] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2204, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR8F~1.YOU")) returned 0x5b97b0 [0197.154] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0197.154] GetProcessHeap () returned 0x580000 [0197.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x711c020 [0197.154] GetProcessHeap () returned 0x580000 [0197.154] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2221) returned 0x711e428 [0197.154] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.154] ReadFile (in: hFile=0x41c, lpBuffer=0x711c020, nNumberOfBytesToRead=0x2200, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x711c020*, lpNumberOfBytesRead=0x650ff14*=0x2200, lpOverlapped=0x0) returned 1 [0197.214] GetProcessHeap () returned 0x580000 [0197.214] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616b10 [0197.214] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.214] WriteFile (in: hFile=0x41c, lpBuffer=0x711e428*, nNumberOfBytesToWrite=0x2200, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x711e428*, lpNumberOfBytesWritten=0x650ff14*=0x2200, lpOverlapped=0x0) returned 1 [0197.214] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.214] WriteFile (in: hFile=0x41c, lpBuffer=0x7120627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7120627*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.214] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.214] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.214] CloseHandle (hObject=0x41c) returned 1 [0197.214] GetProcessHeap () returned 0x580000 [0197.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711e428 | out: hHeap=0x580000) returned 1 [0197.214] GetProcessHeap () returned 0x580000 [0197.214] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x711c020 | out: hHeap=0x580000) returned 1 [0197.214] GetProcessHeap () returned 0x580000 [0197.215] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616b10 | out: hHeap=0x580000) returned 1 [0197.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad286f60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2228, dwReserved0=0x650fd28, dwReserved1=0x711c020, cFileName="PDIR8F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR8F~1.YOU")) returned 0x5b97f0 [0197.792] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.653] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", len=0x61 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned 1 [0199.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0199.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.919] CloseHandle (hObject=0x43c) returned 1 [0200.919] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.id_1622540890_.your_last_chance")) returned 1 [0200.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.920] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b9770 [0200.920] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0200.920] GetProcessHeap () returned 0x580000 [0200.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x67fc68 [0200.920] GetProcessHeap () returned 0x580000 [0200.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x705f4e8 [0200.920] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.920] ReadFile (in: hFile=0x43c, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x650ff14*=0x340, lpOverlapped=0x0) returned 1 [0200.924] GetProcessHeap () returned 0x580000 [0200.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.924] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.924] WriteFile (in: hFile=0x43c, lpBuffer=0x705f4e8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f4e8*, lpNumberOfBytesWritten=0x650ff14*=0x340, lpOverlapped=0x0) returned 1 [0200.924] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.924] WriteFile (in: hFile=0x43c, lpBuffer=0x705f827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x705f827*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0200.924] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.924] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0200.925] CloseHandle (hObject=0x43c) returned 1 [0200.925] GetProcessHeap () returned 0x580000 [0200.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f4e8 | out: hHeap=0x580000) returned 1 [0200.925] GetProcessHeap () returned 0x580000 [0200.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0200.925] GetProcessHeap () returned 0x580000 [0200.925] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf5ef6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x378, dwReserved0=0x650fd28, dwReserved1=0x67fc68, cFileName="rtf_italic.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_IT~1.YOU")) returned 0x5b9770 [0201.396] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.404] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", len=0x6c | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned 1 [0201.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0201.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.481] CloseHandle (hObject=0x480) returned 1 [0201.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.481] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance")) returned 1 [0201.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b97b0 [0201.482] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0201.482] GetProcessHeap () returned 0x580000 [0201.482] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6599e8 [0201.483] GetProcessHeap () returned 0x580000 [0201.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x659db0 [0201.483] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.483] ReadFile (in: hFile=0x480, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x650ff14*=0x380, lpOverlapped=0x0) returned 1 [0201.487] GetProcessHeap () returned 0x580000 [0201.487] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.487] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.487] WriteFile (in: hFile=0x480, lpBuffer=0x659db0*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x659db0*, lpNumberOfBytesWritten=0x650ff14*=0x380, lpOverlapped=0x0) returned 1 [0201.488] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.488] WriteFile (in: hFile=0x480, lpBuffer=0x65a12f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a12f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.488] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.488] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.488] CloseHandle (hObject=0x480) returned 1 [0201.488] GetProcessHeap () returned 0x580000 [0201.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659db0 | out: hHeap=0x580000) returned 1 [0201.488] GetProcessHeap () returned 0x580000 [0201.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0201.488] GetProcessHeap () returned 0x580000 [0201.488] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.087] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafb4a820, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x650fd28, dwReserved1=0x6599e8, cFileName="SlateBlue.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLATEB~1.YOU")) returned 0x5b9770 [0202.087] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.133] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS", len=0x45 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS") returned 1 [0202.134] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0202.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0202.134] CloseHandle (hObject=0x488) returned 1 [0202.134] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css.id_1622540890_.your_last_chance")) returned 1 [0202.135] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.135] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e61400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47e61400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e714, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCAE4A~1.YOU")) returned 0x5b9770 [0202.135] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0202.136] GetProcessHeap () returned 0x580000 [0202.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e21520 [0202.136] GetProcessHeap () returned 0x580000 [0202.136] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x707ec98 [0202.136] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.136] ReadFile (in: hFile=0x488, lpBuffer=0x6e21520, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e21520*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.643] GetProcessHeap () returned 0x580000 [0208.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0208.643] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.644] WriteFile (in: hFile=0x488, lpBuffer=0x707ec98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x707ec98*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.644] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.644] WriteFile (in: hFile=0x488, lpBuffer=0x7090497*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7090497*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.645] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.645] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.645] CloseHandle (hObject=0x488) returned 1 [0208.647] GetProcessHeap () returned 0x580000 [0208.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x707ec98 | out: hHeap=0x580000) returned 1 [0208.647] GetProcessHeap () returned 0x580000 [0208.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e21520 | out: hHeap=0x580000) returned 1 [0208.647] GetProcessHeap () returned 0x580000 [0208.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0210.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e61400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3f93f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e738, dwReserved0=0x650fd28, dwReserved1=0x6e21520, cFileName="SCHEME43.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCAE4A~1.YOU")) returned 0x5b97b0 [0210.086] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.119] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0210.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0210.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0210.166] CloseHandle (hObject=0x4ac) returned 1 [0210.166] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0210.167] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x420041, dwReserved1=0x4f005f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.167] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0210.167] GetProcessHeap () returned 0x580000 [0210.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0210.167] GetProcessHeap () returned 0x580000 [0210.167] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0210.167] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.167] ReadFile (in: hFile=0x4ac, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0210.169] GetProcessHeap () returned 0x580000 [0210.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0210.169] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.169] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0210.169] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.169] WriteFile (in: hFile=0x4ac, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.169] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.169] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.169] CloseHandle (hObject=0x4ac) returned 1 [0210.169] GetProcessHeap () returned 0x580000 [0210.169] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0210.170] GetProcessHeap () returned 0x580000 [0210.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0210.170] GetProcessHeap () returned 0x580000 [0210.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0210.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4e28600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x650fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0210.170] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.179] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS", len=0x45 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS") returned 1 [0210.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0210.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0210.180] CloseHandle (hObject=0x4ac) returned 1 [0210.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css.id_1622540890_.your_last_chance")) returned 1 [0210.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.183] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e79b800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e79b800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC0C74~1.YOU")) returned 0x5b97b0 [0210.183] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0210.183] GetProcessHeap () returned 0x580000 [0210.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7018958 [0210.183] GetProcessHeap () returned 0x580000 [0210.183] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x702a188 [0210.183] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.183] ReadFile (in: hFile=0x4ac, lpBuffer=0x7018958, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018958*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.812] GetProcessHeap () returned 0x580000 [0213.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0213.813] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.813] WriteFile (in: hFile=0x4ac, lpBuffer=0x702a188*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x702a188*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0213.813] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.813] WriteFile (in: hFile=0x4ac, lpBuffer=0x703b987*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x703b987*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0213.813] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0213.814] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0213.814] CloseHandle (hObject=0x4ac) returned 1 [0213.814] GetProcessHeap () returned 0x580000 [0213.814] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x702a188 | out: hHeap=0x580000) returned 1 [0214.270] GetProcessHeap () returned 0x580000 [0214.270] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7018958 | out: hHeap=0x580000) returned 1 [0214.271] GetProcessHeap () returned 0x580000 [0214.271] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0215.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e79b800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb70d2660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e0b8, dwReserved0=0x650fd28, dwReserved1=0x7018958, cFileName="SCHEME15.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC0C74~1.YOU")) returned 0x5b97b0 [0215.051] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.120] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT", len=0x3e | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 1 [0215.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0215.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.120] CloseHandle (hObject=0x43c) returned 1 [0215.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0215.121] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.122] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~3.YOU")) returned 0x5b97b0 [0215.122] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0215.122] GetProcessHeap () returned 0x580000 [0215.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0215.122] GetProcessHeap () returned 0x580000 [0215.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0215.122] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.122] ReadFile (in: hFile=0x43c, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x650ff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.123] GetProcessHeap () returned 0x580000 [0215.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.124] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.124] WriteFile (in: hFile=0x43c, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x650ff14*=0xc0, lpOverlapped=0x0) returned 1 [0215.124] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.124] WriteFile (in: hFile=0x43c, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.124] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.124] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.124] CloseHandle (hObject=0x43c) returned 1 [0215.124] GetProcessHeap () returned 0x580000 [0215.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0215.124] GetProcessHeap () returned 0x580000 [0215.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0215.124] GetProcessHeap () returned 0x580000 [0215.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7d519e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x650fd28, dwReserved1=0x5ae2f0, cFileName="MSTORE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSTORE~3.YOU")) returned 0x5b97b0 [0215.125] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.186] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK", len=0x3f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 1 [0215.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0215.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.187] CloseHandle (hObject=0x46c) returned 1 [0215.187] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.187] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0215.188] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~1.YOU")) returned 0x5b97b0 [0215.189] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0215.189] GetProcessHeap () returned 0x580000 [0215.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0215.189] GetProcessHeap () returned 0x580000 [0215.189] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0215.189] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.189] ReadFile (in: hFile=0x46c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x650ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.190] GetProcessHeap () returned 0x580000 [0215.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.190] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.190] WriteFile (in: hFile=0x46c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x650ff14*=0x60, lpOverlapped=0x0) returned 1 [0215.190] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.190] WriteFile (in: hFile=0x46c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0215.190] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.190] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0215.191] CloseHandle (hObject=0x46c) returned 1 [0215.191] GetProcessHeap () returned 0x580000 [0215.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0215.191] GetProcessHeap () returned 0x580000 [0215.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0215.191] GetProcessHeap () returned 0x580000 [0215.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e100c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x650fd28, dwReserved1=0x61b540, cFileName="MSPUB_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~1.YOU")) returned 0x5b97b0 [0215.191] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.390] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", len=0x67 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned 1 [0217.390] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0217.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.391] CloseHandle (hObject=0x414) returned 1 [0217.391] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.391] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.id_1622540890_.your_last_chance")) returned 1 [0217.392] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b9770 [0217.392] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0217.392] GetProcessHeap () returned 0x580000 [0217.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dc71e8 [0217.392] GetProcessHeap () returned 0x580000 [0217.392] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6dc7510 [0217.392] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.392] ReadFile (in: hFile=0x414, lpBuffer=0x6dc71e8, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc71e8*, lpNumberOfBytesRead=0x650ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0217.431] GetProcessHeap () returned 0x580000 [0217.431] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dced28 [0217.431] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.431] WriteFile (in: hFile=0x414, lpBuffer=0x6dc7510*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc7510*, lpNumberOfBytesWritten=0x650ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0217.431] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.432] WriteFile (in: hFile=0x414, lpBuffer=0x6dc77ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc77ef*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.432] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.432] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.432] CloseHandle (hObject=0x414) returned 1 [0217.432] GetProcessHeap () returned 0x580000 [0217.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc7510 | out: hHeap=0x580000) returned 1 [0217.432] GetProcessHeap () returned 0x580000 [0217.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc71e8 | out: hHeap=0x580000) returned 1 [0217.432] GetProcessHeap () returned 0x580000 [0217.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dced28 | out: hHeap=0x580000) returned 1 [0217.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9356560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x313, dwReserved0=0x650fd28, dwReserved1=0x6dc71e8, cFileName="FormsColorChart.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSC~1.YOU")) returned 0x5b9770 [0217.444] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.462] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", len=0x5d | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned 1 [0217.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0217.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.462] CloseHandle (hObject=0x440) returned 1 [0217.463] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.id_1622540890_.your_last_chance")) returned 1 [0217.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b9770 [0217.469] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0217.469] GetProcessHeap () returned 0x580000 [0217.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0217.470] GetProcessHeap () returned 0x580000 [0217.470] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0217.470] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.470] ReadFile (in: hFile=0x440, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x650ff14*=0x260, lpOverlapped=0x0) returned 1 [0217.528] GetProcessHeap () returned 0x580000 [0217.528] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.528] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.528] WriteFile (in: hFile=0x440, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x650ff14*=0x260, lpOverlapped=0x0) returned 1 [0217.528] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.528] WriteFile (in: hFile=0x440, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.528] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.528] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.528] CloseHandle (hObject=0x440) returned 1 [0217.528] GetProcessHeap () returned 0x580000 [0217.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0217.528] GetProcessHeap () returned 0x580000 [0217.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0217.528] GetProcessHeap () returned 0x580000 [0217.528] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9460f00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x650fd28, dwReserved1=0x6c61120, cFileName="DELETE.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DELETE~1.YOU")) returned 0x5b9770 [0217.529] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.547] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", len=0x5a | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned 1 [0217.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0217.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0217.548] CloseHandle (hObject=0x488) returned 1 [0217.548] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.548] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js.id_1622540890_.your_last_chance")) returned 1 [0217.549] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2095, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b9770 [0217.549] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0217.549] GetProcessHeap () returned 0x580000 [0217.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x6e063d0 [0217.549] GetProcessHeap () returned 0x580000 [0217.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x20a1) returned 0x70c4b40 [0217.550] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.550] ReadFile (in: hFile=0x488, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x2080, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x650ff14*=0x2080, lpOverlapped=0x0) returned 1 [0218.608] GetProcessHeap () returned 0x580000 [0218.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0218.608] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.608] WriteFile (in: hFile=0x488, lpBuffer=0x70c4b40*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c4b40*, lpNumberOfBytesWritten=0x650ff14*=0x2080, lpOverlapped=0x0) returned 1 [0218.609] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.609] WriteFile (in: hFile=0x488, lpBuffer=0x70c6bbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70c6bbf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0218.609] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0218.609] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0218.609] CloseHandle (hObject=0x488) returned 1 [0220.069] GetProcessHeap () returned 0x580000 [0220.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70c4b40 | out: hHeap=0x580000) returned 1 [0220.069] GetProcessHeap () returned 0x580000 [0220.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0220.069] GetProcessHeap () returned 0x580000 [0220.069] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ea4de0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20b9, dwReserved0=0x650fd28, dwReserved1=0x6e063d0, cFileName="VIEW.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VIEWJS~1.YOU")) returned 0x5b9730 [0221.625] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.650] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", len=0x46 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 1 [0221.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f20) returned 0x6dee6e0 [0221.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.678] CloseHandle (hObject=0x3fc) returned 1 [0221.678] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id_1622540890_.your_last_chance")) returned 1 [0221.679] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~3.YOU")) returned 0x5b9730 [0221.679] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0221.679] GetProcessHeap () returned 0x580000 [0221.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x7061928 [0221.679] GetProcessHeap () returned 0x580000 [0221.679] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd81) returned 0x658970 [0221.679] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.679] ReadFile (in: hFile=0x3fc, lpBuffer=0x7061928, nNumberOfBytesToRead=0xd60, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x650ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.734] GetProcessHeap () returned 0x580000 [0221.734] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.734] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.734] WriteFile (in: hFile=0x3fc, lpBuffer=0x658970*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesWritten=0x650ff14*=0xd60, lpOverlapped=0x0) returned 1 [0221.735] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.735] WriteFile (in: hFile=0x3fc, lpBuffer=0x6596cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6596cf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.735] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.735] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.735] CloseHandle (hObject=0x3fc) returned 1 [0221.735] GetProcessHeap () returned 0x580000 [0221.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0221.735] GetProcessHeap () returned 0x580000 [0221.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0221.735] GetProcessHeap () returned 0x580000 [0221.735] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbc660e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x650fd28, dwReserved1=0x7061928, cFileName="ONLINE.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ONLINE~3.YOU")) returned 0x5b9730 [0221.735] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.787] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", len=0x48 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 1 [0221.788] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0221.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.788] CloseHandle (hObject=0x458) returned 1 [0221.788] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id_1622540890_.your_last_chance")) returned 1 [0221.789] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDOMA~1.YOU")) returned 0x5b9730 [0221.789] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0221.790] GetProcessHeap () returned 0x580000 [0221.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x65f0b0 [0221.790] GetProcessHeap () returned 0x580000 [0221.790] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x141) returned 0x5d57a0 [0221.790] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.790] ReadFile (in: hFile=0x458, lpBuffer=0x65f0b0, nNumberOfBytesToRead=0x120, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesRead=0x650ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.792] GetProcessHeap () returned 0x580000 [0221.792] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0221.792] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.792] WriteFile (in: hFile=0x458, lpBuffer=0x5d57a0*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d57a0*, lpNumberOfBytesWritten=0x650ff14*=0x120, lpOverlapped=0x0) returned 1 [0221.792] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.792] WriteFile (in: hFile=0x458, lpBuffer=0x5d58bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5d58bf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.792] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.792] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.792] CloseHandle (hObject=0x458) returned 1 [0221.792] GetProcessHeap () returned 0x580000 [0221.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d57a0 | out: hHeap=0x580000) returned 1 [0221.792] GetProcessHeap () returned 0x580000 [0221.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0221.792] GetProcessHeap () returned 0x580000 [0221.792] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0221.792] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbcfe660, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x162, dwReserved0=0x650fd28, dwReserved1=0x65f0b0, cFileName="INDOMAIN.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INDOMA~1.YOU")) returned 0x5b9730 [0221.792] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.817] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", len=0x4f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 1 [0221.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0221.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.030] CloseHandle (hObject=0x49c) returned 1 [0223.030] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id_1622540890_.your_last_chance")) returned 1 [0223.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b96f0 [0223.031] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0223.032] GetProcessHeap () returned 0x580000 [0223.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6c29878 [0223.032] GetProcessHeap () returned 0x580000 [0223.032] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xec1) returned 0x6ece008 [0223.032] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.032] ReadFile (in: hFile=0x49c, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xea0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x650ff14*=0xea0, lpOverlapped=0x0) returned 1 [0223.046] GetProcessHeap () returned 0x580000 [0223.046] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0223.046] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.046] WriteFile (in: hFile=0x49c, lpBuffer=0x6ece008*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesWritten=0x650ff14*=0xea0, lpOverlapped=0x0) returned 1 [0223.046] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.047] WriteFile (in: hFile=0x49c, lpBuffer=0x6eceea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eceea7*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.047] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.047] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.047] CloseHandle (hObject=0x49c) returned 1 [0223.047] GetProcessHeap () returned 0x580000 [0223.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0223.047] GetProcessHeap () returned 0x580000 [0223.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0223.047] GetProcessHeap () returned 0x580000 [0223.047] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0225.808] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc8e5460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xeca, dwReserved0=0x650fd28, dwReserved1=0x6c29878, cFileName="ContactSelector.ico.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CONTAC~1.YOU")) returned 0x5b9630 [0225.808] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.830] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", len=0x6b | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned 1 [0225.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0225.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.831] CloseHandle (hObject=0x44c) returned 1 [0225.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.id_1622540890_.your_last_chance")) returned 1 [0225.832] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x2e006d, dwReserved1=0x640069, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOF81A~1.YOU")) returned 0x5b9630 [0225.832] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.832] GetProcessHeap () returned 0x580000 [0225.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c3a820 [0225.832] GetProcessHeap () returned 0x580000 [0225.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x901) returned 0x6c3b1a8 [0225.832] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.832] ReadFile (in: hFile=0x44c, lpBuffer=0x6c3a820, nNumberOfBytesToRead=0x8e0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3a820*, lpNumberOfBytesRead=0x650ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0225.863] GetProcessHeap () returned 0x580000 [0225.863] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.863] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.863] WriteFile (in: hFile=0x44c, lpBuffer=0x6c3b1a8*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3b1a8*, lpNumberOfBytesWritten=0x650ff14*=0x8e0, lpOverlapped=0x0) returned 1 [0225.864] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.864] WriteFile (in: hFile=0x44c, lpBuffer=0x6c3ba87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c3ba87*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.864] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.864] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.864] CloseHandle (hObject=0x44c) returned 1 [0225.864] GetProcessHeap () returned 0x580000 [0225.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3b1a8 | out: hHeap=0x580000) returned 1 [0225.864] GetProcessHeap () returned 0x580000 [0225.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c3a820 | out: hHeap=0x580000) returned 1 [0225.864] GetProcessHeap () returned 0x580000 [0225.864] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe255f80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x650fd28, dwReserved1=0x6c3a820, cFileName="FormsVersion1Warning.htm.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FOF81A~1.YOU")) returned 0x5b9630 [0225.864] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.883] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", len=0x6f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned 1 [0225.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0225.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.884] CloseHandle (hObject=0x4a8) returned 1 [0225.884] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0225.885] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.885] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x2e004e, dwReserved1=0x490047, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9630 [0225.885] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0225.885] GetProcessHeap () returned 0x580000 [0225.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0225.885] GetProcessHeap () returned 0x580000 [0225.885] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0225.885] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.885] ReadFile (in: hFile=0x4a8, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x650ff14*=0xc0, lpOverlapped=0x0) returned 1 [0225.887] GetProcessHeap () returned 0x580000 [0225.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.887] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.887] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x650ff14*=0xc0, lpOverlapped=0x0) returned 1 [0225.887] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.887] WriteFile (in: hFile=0x4a8, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.887] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.887] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.887] CloseHandle (hObject=0x4a8) returned 1 [0225.887] GetProcessHeap () returned 0x580000 [0225.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0225.887] GetProcessHeap () returned 0x580000 [0225.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0225.887] GetProcessHeap () returned 0x580000 [0225.887] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe27c0e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x650fd28, dwReserved1=0x5ae2f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9630 [0225.887] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.923] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x76 | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0225.923] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0225.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.924] CloseHandle (hObject=0x448) returned 1 [0225.924] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.924] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0225.925] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.925] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x54005c, dwReserved1=0x420041, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9630 [0225.925] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0225.925] GetProcessHeap () returned 0x580000 [0225.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dece50 [0225.925] GetProcessHeap () returned 0x580000 [0225.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6decfc8 [0225.925] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.926] ReadFile (in: hFile=0x448, lpBuffer=0x6dece50, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dece50*, lpNumberOfBytesRead=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0225.927] GetProcessHeap () returned 0x580000 [0225.927] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0225.927] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.928] WriteFile (in: hFile=0x448, lpBuffer=0x6decfc8*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6decfc8*, lpNumberOfBytesWritten=0x650ff14*=0x140, lpOverlapped=0x0) returned 1 [0225.928] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.928] WriteFile (in: hFile=0x448, lpBuffer=0x6ded107*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ded107*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0225.928] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.928] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0225.928] CloseHandle (hObject=0x448) returned 1 [0225.928] GetProcessHeap () returned 0x580000 [0225.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6decfc8 | out: hHeap=0x580000) returned 1 [0225.928] GetProcessHeap () returned 0x580000 [0225.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dece50 | out: hHeap=0x580000) returned 1 [0225.928] GetProcessHeap () returned 0x580000 [0225.928] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0225.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe2ee500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x650fd28, dwReserved1=0x6dece50, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9630 [0225.928] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.975] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS", len=0x3d | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 1 [0225.975] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd4) returned 0x6dee6e0 [0225.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.977] CloseHandle (hObject=0x44c) returned 1 [0225.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0225.977] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id_1622540890_.your_last_chance")) returned 1 [0225.978] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0225.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x487dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~2.YOU")) returned 0x5b9630 [0225.978] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0225.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0225.978] GetProcessHeap () returned 0x580000 [0225.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e675e0 [0225.979] GetProcessHeap () returned 0x580000 [0225.979] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e78e10 [0225.980] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0225.980] ReadFile (in: hFile=0x44c, lpBuffer=0x6e675e0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e675e0*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.638] GetProcessHeap () returned 0x580000 [0235.638] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0235.639] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.639] WriteFile (in: hFile=0x44c, lpBuffer=0x6e78e10*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78e10*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.639] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.640] WriteFile (in: hFile=0x44c, lpBuffer=0x6e8a60f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a60f*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.145] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.145] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.145] CloseHandle (hObject=0x44c) returned 1 [0239.145] GetProcessHeap () returned 0x580000 [0239.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e78e10 | out: hHeap=0x580000) returned 1 [0239.145] GetProcessHeap () returned 0x580000 [0239.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e675e0 | out: hHeap=0x580000) returned 1 [0239.152] GetProcessHeap () returned 0x580000 [0239.152] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0240.561] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc60f11a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x487dec, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="MSPUB.DEV.HXS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUBD~2.YOU")) returned 0x5b9730 [0240.561] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.571] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML", len=0x4f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned 1 [0240.571] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0240.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.580] CloseHandle (hObject=0x428) returned 1 [0240.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.580] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml.id_1622540890_.your_last_chance")) returned 1 [0240.580] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.581] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~1.YOU")) returned 0x5b9730 [0240.581] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0240.581] GetProcessHeap () returned 0x580000 [0240.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.581] GetProcessHeap () returned 0x580000 [0240.581] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.581] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.581] ReadFile (in: hFile=0x428, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x650ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.602] GetProcessHeap () returned 0x580000 [0240.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.602] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.602] WriteFile (in: hFile=0x428, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x650ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.603] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.603] WriteFile (in: hFile=0x428, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.603] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.603] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.603] CloseHandle (hObject=0x428) returned 1 [0240.621] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.621] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.621] GetProcessHeap () returned 0x580000 [0240.621] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6eed2e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x650fd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.COM.VN.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOC~1.YOU")) returned 0x5b9630 [0241.769] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.821] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML", len=0x3f | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned 1 [0241.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0241.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0245.399] CloseHandle (hObject=0x46c) returned 1 [0245.399] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml.id_1622540890_.your_last_chance")) returned 1 [0248.946] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66024c00, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66024c00, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x31a78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~4.YOU")) returned 0x5b96f0 [0248.946] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0248.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0248.946] GetProcessHeap () returned 0x580000 [0248.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x709bb38 [0248.946] GetProcessHeap () returned 0x580000 [0248.946] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70ad368 [0248.947] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.947] ReadFile (in: hFile=0x46c, lpBuffer=0x709bb38, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x709bb38*, lpNumberOfBytesRead=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.888] GetProcessHeap () returned 0x580000 [0252.888] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0252.889] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.889] WriteFile (in: hFile=0x46c, lpBuffer=0x70ad368*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70ad368*, lpNumberOfBytesWritten=0x650ff14*=0x11800, lpOverlapped=0x0) returned 1 [0252.889] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.889] WriteFile (in: hFile=0x46c, lpBuffer=0x70beb67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70beb67*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0252.889] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.889] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0252.890] CloseHandle (hObject=0x46c) returned 1 [0252.890] GetProcessHeap () returned 0x580000 [0252.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70ad368 | out: hHeap=0x580000) returned 1 [0252.896] GetProcessHeap () returned 0x580000 [0252.896] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x709bb38 | out: hHeap=0x580000) returned 1 [0252.897] GetProcessHeap () returned 0x580000 [0252.897] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0254.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66024c00, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce402d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x31a9c, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PGMN082.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN08~4.YOU")) returned 0x5b9730 [0254.424] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0255.362] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML", len=0x3d | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML") returned 1 [0255.362] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f64) returned 0x72e5948 [0255.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.683] CloseHandle (hObject=0x170) returned 1 [0258.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0258.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml.id_1622540890_.your_last_chance")) returned 1 [0258.684] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0258.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5039ff00, ftCreationTime.dwHighDateTime=0x1c9c865, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5039ff00, ftLastWriteTime.dwHighDateTime=0x1c9c865, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPUNC~2.YOU")) returned 0x5b96f0 [0258.685] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0258.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0258.685] GetProcessHeap () returned 0x580000 [0258.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6cda390 [0258.685] GetProcessHeap () returned 0x580000 [0258.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6cda918 [0258.685] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.685] ReadFile (in: hFile=0x170, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x650ff14*=0x540, lpOverlapped=0x0) returned 1 [0258.691] GetProcessHeap () returned 0x580000 [0258.691] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0258.691] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.691] WriteFile (in: hFile=0x170, lpBuffer=0x6cda918*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda918*, lpNumberOfBytesWritten=0x650ff14*=0x540, lpOverlapped=0x0) returned 1 [0258.691] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.691] WriteFile (in: hFile=0x170, lpBuffer=0x6cdae57*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdae57*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.691] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.691] WriteFile (in: hFile=0x170, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.691] CloseHandle (hObject=0x170) returned 1 [0258.691] GetProcessHeap () returned 0x580000 [0258.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda918 | out: hHeap=0x580000) returned 1 [0258.691] GetProcessHeap () returned 0x580000 [0258.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0258.691] GetProcessHeap () returned 0x580000 [0258.691] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fccc | out: lpFindFileData=0x650fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5039ff00, ftCreationTime.dwHighDateTime=0x1c9c865, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b5ac80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x57a, dwReserved0=0x650fd28, dwReserved1=0x6cda390, cFileName="DGPUNCT.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DGPUNC~2.YOU")) returned 0x5b9630 [0259.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.236] SysReAllocStringLen (in: pbstr=0x650ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC", len=0x3b | out: pbstr=0x650ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC") returned 1 [0259.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2090) returned 0x72e5948 [0259.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0259.338] CloseHandle (hObject=0x44c) returned 1 [0259.338] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.338] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc.id_1622540890_.your_last_chance")) returned 1 [0259.339] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x650ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x650fc74 | out: lpFindFileData=0x650fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x760e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNIPE.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SNIPEP~1.YOU")) returned 0x5b9630 [0259.339] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0259.340] GetProcessHeap () returned 0x580000 [0259.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7621) returned 0x70a3f18 [0259.340] GetProcessHeap () returned 0x580000 [0259.340] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7621) returned 0x70ab548 [0259.340] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.340] ReadFile (in: hFile=0x44c, lpBuffer=0x70a3f18, nNumberOfBytesToRead=0x7600, lpNumberOfBytesRead=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a3f18*, lpNumberOfBytesRead=0x650ff14*=0x7600, lpOverlapped=0x0) returned 1 [0263.217] GetProcessHeap () returned 0x580000 [0263.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0263.218] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0263.218] WriteFile (in: hFile=0x44c, lpBuffer=0x70ab548*, nNumberOfBytesToWrite=0x7600, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70ab548*, lpNumberOfBytesWritten=0x650ff14*=0x7600, lpOverlapped=0x0) returned 1 [0264.703] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.703] WriteFile (in: hFile=0x44c, lpBuffer=0x70b2b47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b2b47*, lpNumberOfBytesWritten=0x650ff14*=0x20, lpOverlapped=0x0) returned 1 [0264.703] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0264.703] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x650ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x650ff14*=0x4, lpOverlapped=0x0) returned 1 [0264.703] CloseHandle (hObject=0x44c) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70ab548 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a3f18 | out: hHeap=0x580000) returned 1 [0265.874] GetProcessHeap () returned 0x580000 [0265.874] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 Thread: id = 58 os_tid = 0xae0 [0039.071] Sleep (dwMilliseconds=0x1) [0039.093] Sleep (dwMilliseconds=0x1) [0039.114] Sleep (dwMilliseconds=0x1) [0039.150] Sleep (dwMilliseconds=0x1) [0039.286] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.581] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.647] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.920] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.012] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.102] Sleep (dwMilliseconds=0x1) [0043.118] Sleep (dwMilliseconds=0x1) [0043.142] Sleep (dwMilliseconds=0x1) [0043.198] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.463] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.695] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.718] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.790] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.025] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.445] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.601] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.835] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.866] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.913] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.991] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.225] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.334] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.381] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.537] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.099] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.442] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.676] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.723] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.019] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.681] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.721] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.955] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.033] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.399] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.423] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.470] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.626] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.657] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.813] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.938] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.193] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.250] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.359] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.406] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.459] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.484] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.515] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.562] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.614] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.718] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.983] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.139] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.342] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.763] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.465] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.631] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.732] Sleep (dwMilliseconds=0x1) [0051.748] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.888] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.499] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.746] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.793] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.996] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.027] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.113] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.464] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.589] Sleep (dwMilliseconds=0x1) [0053.604] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.854] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.885] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.933] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.431] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.868] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.133] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.180] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.211] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.289] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.698] Sleep (dwMilliseconds=0x1) [0059.671] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", len=0x49 | out: pbstr=0x664ff84*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 1 [0059.671] GetProcessHeap () returned 0x580000 [0059.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x50) returned 0x668fa8 [0059.671] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0061.109] CloseHandle (hObject=0x464) returned 1 [0061.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0061.109] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id_1622540890_.your_last_chance")) returned 1 [0061.109] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0061.109] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJLR~1.YOU")) returned 0x5b9630 [0061.110] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0061.110] GetProcessHeap () returned 0x580000 [0061.110] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ecf320 [0061.111] GetProcessHeap () returned 0x580000 [0061.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6ee0b50 [0061.111] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.111] ReadFile (in: hFile=0x464, lpBuffer=0x6ecf320, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf320*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.093] GetProcessHeap () returned 0x580000 [0066.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0066.093] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.093] WriteFile (in: hFile=0x464, lpBuffer=0x6ee0b50*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ee0b50*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.825] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.825] WriteFile (in: hFile=0x464, lpBuffer=0x6ef234f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ef234f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0067.627] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.627] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0067.627] CloseHandle (hObject=0x464) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ee0b50 | out: hHeap=0x580000) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf320 | out: hHeap=0x580000) returned 1 [0074.257] GetProcessHeap () returned 0x580000 [0074.257] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0074.647] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0x63b380e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7e1df1, dwReserved0=0x664fd28, dwReserved1=0x6ecf320, cFileName="ProjLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJLR~1.YOU")) returned 0x5b9730 [0074.647] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.329] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", len=0x3d | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 1 [0079.330] GetProcessHeap () returned 0x580000 [0079.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x90) returned 0x5f76f0 [0079.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.331] Sleep (dwMilliseconds=0x1) [0079.345] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", len=0x3d | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 1 [0079.345] GetProcessHeap () returned 0x580000 [0079.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0x58) returned 0x5f76f0 [0079.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0079.359] Sleep (dwMilliseconds=0x1) [0081.683] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", len=0x72 | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 1 [0081.683] GetProcessHeap () returned 0x580000 [0081.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0081.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.688] CloseHandle (hObject=0x48c) returned 1 [0081.688] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0081.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id_1622540890_.your_last_chance")) returned 1 [0081.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0081.725] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x4d0074, dwReserved1=0x490055, cFileName="PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b96f0 [0081.725] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0081.725] GetProcessHeap () returned 0x580000 [0081.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f0c4f8 [0081.725] GetProcessHeap () returned 0x580000 [0081.725] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6d0f598 [0081.725] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.725] ReadFile (in: hFile=0x48c, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x664ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.788] GetProcessHeap () returned 0x580000 [0081.788] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.788] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.788] WriteFile (in: hFile=0x48c, lpBuffer=0x6d0f598*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f598*, lpNumberOfBytesWritten=0x664ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0081.788] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.788] WriteFile (in: hFile=0x48c, lpBuffer=0x6d0fb37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0fb37*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.788] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.788] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.788] CloseHandle (hObject=0x48c) returned 1 [0081.789] GetProcessHeap () returned 0x580000 [0081.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0f598 | out: hHeap=0x580000) returned 1 [0081.789] GetProcessHeap () returned 0x580000 [0081.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0081.789] GetProcessHeap () returned 0x580000 [0081.789] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x685c11c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5ce, dwReserved0=0x664fd28, dwReserved1=0x6f0c4f8, cFileName="PowerPointMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="POWERP~1.YOU")) returned 0x5b9730 [0081.789] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.772] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", len=0x66 | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 1 [0083.772] GetProcessHeap () returned 0x580000 [0083.772] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0xc) returned 0x5e94e0 [0083.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0083.773] CloseHandle (hObject=0x480) returned 1 [0083.773] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id_1622540890_.your_last_chance")) returned 1 [0083.776] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.777] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~1.YOU")) returned 0x5b96b0 [0083.777] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0083.777] GetProcessHeap () returned 0x580000 [0083.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6f0c4f8 [0083.777] GetProcessHeap () returned 0x580000 [0083.777] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x721) returned 0x6f0efe0 [0083.777] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.777] ReadFile (in: hFile=0x480, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x700, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x664ff14*=0x700, lpOverlapped=0x0) returned 1 [0083.786] GetProcessHeap () returned 0x580000 [0083.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.786] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.786] WriteFile (in: hFile=0x480, lpBuffer=0x6f0efe0*, nNumberOfBytesToWrite=0x700, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0efe0*, lpNumberOfBytesWritten=0x664ff14*=0x700, lpOverlapped=0x0) returned 1 [0083.786] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.786] WriteFile (in: hFile=0x480, lpBuffer=0x6f0f6df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0f6df*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.786] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.786] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.786] CloseHandle (hObject=0x480) returned 1 [0083.786] GetProcessHeap () returned 0x580000 [0083.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0efe0 | out: hHeap=0x580000) returned 1 [0083.786] GetProcessHeap () returned 0x580000 [0083.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0083.786] GetProcessHeap () returned 0x580000 [0083.786] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x698cc1c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x664fd28, dwReserved1=0x6f0c4f8, cFileName="WordMUI.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WORDMU~1.YOU")) returned 0x5b96b0 [0083.787] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.882] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", len=0x7a | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 1 [0083.882] GetProcessHeap () returned 0x580000 [0083.882] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0083.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.882] CloseHandle (hObject=0x444) returned 1 [0083.882] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0083.882] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.your_last_chance")) returned 1 [0083.883] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0083.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x740073, dwReserved1=0x73002d, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPOB~1.YOU")) returned 0x5b96b0 [0083.883] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0083.884] GetProcessHeap () returned 0x580000 [0083.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x626d18 [0083.884] GetProcessHeap () returned 0x580000 [0083.884] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2d81) returned 0x673cd0 [0083.885] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.885] ReadFile (in: hFile=0x444, lpBuffer=0x626d18, nNumberOfBytesToRead=0x2d60, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x664ff14*=0x2d60, lpOverlapped=0x0) returned 1 [0083.995] GetProcessHeap () returned 0x580000 [0083.995] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0083.995] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.995] WriteFile (in: hFile=0x444, lpBuffer=0x673cd0*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x673cd0*, lpNumberOfBytesWritten=0x664ff14*=0x2d60, lpOverlapped=0x0) returned 1 [0083.996] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x444, lpBuffer=0x676a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x676a2f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0083.996] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0083.996] WriteFile (in: hFile=0x444, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0083.996] CloseHandle (hObject=0x444) returned 1 [0083.996] GetProcessHeap () returned 0x580000 [0083.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x673cd0 | out: hHeap=0x580000) returned 1 [0083.996] GetProcessHeap () returned 0x580000 [0083.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0083.996] GetProcessHeap () returned 0x580000 [0083.996] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0083.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69ae1500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2da2, dwReserved0=0x664fd28, dwReserved1=0x626d18, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OSPPOB~1.YOU")) returned 0x5b9630 [0083.997] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0088.240] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", len=0x4b | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 1 [0088.240] GetProcessHeap () returned 0x580000 [0088.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0088.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0088.372] CloseHandle (hObject=0x414) returned 1 [0088.372] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.372] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id_1622540890_.your_last_chance")) returned 1 [0088.467] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x45, dwReserved1=0x0, cFileName="CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASCAD~1.YOU")) returned 0x5b96b0 [0088.467] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0088.468] GetProcessHeap () returned 0x580000 [0088.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6f04908 [0088.468] GetProcessHeap () returned 0x580000 [0088.468] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0088.468] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.468] ReadFile (in: hFile=0x414, lpBuffer=0x6f04908, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f04908*, lpNumberOfBytesRead=0x664ff14*=0x260, lpOverlapped=0x0) returned 1 [0088.548] GetProcessHeap () returned 0x580000 [0088.548] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0088.548] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.548] WriteFile (in: hFile=0x414, lpBuffer=0x6d08520*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesWritten=0x664ff14*=0x260, lpOverlapped=0x0) returned 1 [0088.549] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.549] WriteFile (in: hFile=0x414, lpBuffer=0x6d0877f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0877f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0088.549] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.549] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0088.549] CloseHandle (hObject=0x414) returned 1 [0088.549] GetProcessHeap () returned 0x580000 [0088.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0088.549] GetProcessHeap () returned 0x580000 [0088.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f04908 | out: hHeap=0x580000) returned 1 [0088.549] GetProcessHeap () returned 0x580000 [0088.549] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0088.549] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c652680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x286, dwReserved0=0x664fd28, dwReserved1=0x6f04908, cFileName="CASCADE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CASCAD~1.YOU")) returned 0x5b96b0 [0088.549] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.671] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", len=0x48 | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 1 [0091.671] GetProcessHeap () returned 0x580000 [0091.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x10) returned 0x5e94e0 [0091.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.672] CloseHandle (hObject=0x3f4) returned 1 [0091.672] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0091.673] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.673] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0091.673] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.673] GetProcessHeap () returned 0x580000 [0091.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6f0c4f8 [0091.673] GetProcessHeap () returned 0x580000 [0091.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x67ec60 [0091.673] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.673] ReadFile (in: hFile=0x3f4, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x664ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0091.687] GetProcessHeap () returned 0x580000 [0091.687] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.687] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.687] WriteFile (in: hFile=0x3f4, lpBuffer=0x67ec60*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesWritten=0x664ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0091.687] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.687] WriteFile (in: hFile=0x3f4, lpBuffer=0x67f1ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x67f1ff*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.687] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.687] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.687] CloseHandle (hObject=0x3f4) returned 1 [0091.688] GetProcessHeap () returned 0x580000 [0091.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0091.688] GetProcessHeap () returned 0x580000 [0091.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0091.688] GetProcessHeap () returned 0x580000 [0091.688] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.688] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e439ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d1, dwReserved0=0x664fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0091.702] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.792] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", len=0x4c | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 1 [0091.822] GetProcessHeap () returned 0x580000 [0091.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x1c) returned 0x615370 [0091.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0091.822] CloseHandle (hObject=0x470) returned 1 [0091.822] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0091.823] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0091.823] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0091.824] GetProcessHeap () returned 0x580000 [0091.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6f0c4f8 [0091.824] GetProcessHeap () returned 0x580000 [0091.824] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6d07cb0 [0091.824] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.824] ReadFile (in: hFile=0x470, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x664ff14*=0x540, lpOverlapped=0x0) returned 1 [0091.836] GetProcessHeap () returned 0x580000 [0091.836] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0091.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.836] WriteFile (in: hFile=0x470, lpBuffer=0x6d07cb0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07cb0*, lpNumberOfBytesWritten=0x664ff14*=0x540, lpOverlapped=0x0) returned 1 [0091.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.836] WriteFile (in: hFile=0x470, lpBuffer=0x6d081ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d081ef*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0091.836] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.836] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0091.836] CloseHandle (hObject=0x470) returned 1 [0091.837] GetProcessHeap () returned 0x580000 [0091.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d07cb0 | out: hHeap=0x580000) returned 1 [0091.837] GetProcessHeap () returned 0x580000 [0091.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0091.837] GetProcessHeap () returned 0x580000 [0091.837] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0091.837] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e590740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x664fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0091.840] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.411] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", len=0x43 | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 1 [0092.411] GetProcessHeap () returned 0x580000 [0092.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x28) returned 0x5dc550 [0092.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0092.413] CloseHandle (hObject=0x468) returned 1 [0092.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id_1622540890_.your_last_chance")) returned 1 [0092.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICEELM~1.YOU")) returned 0x5b96f0 [0092.414] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0092.414] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0092.414] GetProcessHeap () returned 0x580000 [0092.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x109e1) returned 0x6db6670 [0092.414] GetProcessHeap () returned 0x580000 [0092.414] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x109e1) returned 0x6ecf008 [0092.415] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.415] ReadFile (in: hFile=0x468, lpBuffer=0x6db6670, nNumberOfBytesToRead=0x109c0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6db6670*, lpNumberOfBytesRead=0x664ff14*=0x109c0, lpOverlapped=0x0) returned 1 [0098.675] GetProcessHeap () returned 0x580000 [0098.675] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0098.675] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.675] WriteFile (in: hFile=0x468, lpBuffer=0x6ecf008*, nNumberOfBytesToWrite=0x109c0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecf008*, lpNumberOfBytesWritten=0x664ff14*=0x109c0, lpOverlapped=0x0) returned 1 [0098.675] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.675] WriteFile (in: hFile=0x468, lpBuffer=0x6edf9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6edf9c7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0098.676] SetFilePointerEx (in: hFile=0x468, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0098.676] WriteFile (in: hFile=0x468, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0098.676] CloseHandle (hObject=0x468) returned 1 [0098.676] GetProcessHeap () returned 0x580000 [0098.676] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ecf008 | out: hHeap=0x580000) returned 1 [0098.680] GetProcessHeap () returned 0x580000 [0098.680] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db6670 | out: hHeap=0x580000) returned 1 [0098.680] GetProcessHeap () returned 0x580000 [0098.680] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0098.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x726e02e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x109f4, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="ICE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ICEELM~1.YOU")) returned 0x5b96b0 [0098.681] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.766] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", len=0x4c | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 1 [0101.767] GetProcessHeap () returned 0x580000 [0101.767] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0101.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0101.768] CloseHandle (hObject=0x46c) returned 1 [0101.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0101.768] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0101.768] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0101.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.769] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0101.769] GetProcessHeap () returned 0x580000 [0101.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6d06ca8 [0101.769] GetProcessHeap () returned 0x580000 [0101.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1381) returned 0x6d0e508 [0101.769] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.769] ReadFile (in: hFile=0x46c, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x1360, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x664ff14*=0x1360, lpOverlapped=0x0) returned 1 [0101.827] GetProcessHeap () returned 0x580000 [0101.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0101.827] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x46c, lpBuffer=0x6d0e508*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0e508*, lpNumberOfBytesWritten=0x664ff14*=0x1360, lpOverlapped=0x0) returned 1 [0101.827] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.827] WriteFile (in: hFile=0x46c, lpBuffer=0x6d0f867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0f867*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0101.828] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0101.828] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0101.828] CloseHandle (hObject=0x46c) returned 1 [0101.828] GetProcessHeap () returned 0x580000 [0101.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0e508 | out: hHeap=0x580000) returned 1 [0101.828] GetProcessHeap () returned 0x580000 [0101.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0101.828] GetProcessHeap () returned 0x580000 [0101.828] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0101.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x744ed8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13a3, dwReserved0=0x664fd28, dwReserved1=0x6d06ca8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0101.828] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0104.040] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", len=0x42 | out: pbstr=0x664ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 1 [0104.040] GetProcessHeap () returned 0x580000 [0104.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e85f8, Size=0x10) returned 0x5e92d0 [0104.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0104.040] CloseHandle (hObject=0x3f8) returned 1 [0104.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0104.041] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id_1622540890_.your_last_chance")) returned 1 [0104.041] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0104.041] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1AR~1.YOU")) returned 0x5b9630 [0104.041] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0104.042] GetProcessHeap () returned 0x580000 [0104.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d340b0 [0104.042] GetProcessHeap () returned 0x580000 [0104.042] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d10048 [0104.042] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0104.042] ReadFile (in: hFile=0x3f8, lpBuffer=0x6d340b0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d340b0*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.891] GetProcessHeap () returned 0x580000 [0106.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0106.893] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.893] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d10048*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d10048*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0106.893] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.893] WriteFile (in: hFile=0x3f8, lpBuffer=0x6d21847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21847*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0106.988] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0106.988] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0106.989] CloseHandle (hObject=0x3f8) returned 1 [0106.989] GetProcessHeap () returned 0x580000 [0106.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d10048 | out: hHeap=0x580000) returned 1 [0106.993] GetProcessHeap () returned 0x580000 [0106.993] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d340b0 | out: hHeap=0x580000) returned 1 [0106.994] GetProcessHeap () returned 0x580000 [0106.994] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0106.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7762bfc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x205b2f, dwReserved0=0x580000, dwReserved1=0x67ec58, cFileName="MSB1AR.LEX.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSB1AR~1.YOU")) returned 0x5b9630 [0106.994] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.078] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x664ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.078] GetProcessHeap () returned 0x580000 [0112.078] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x1c) returned 0x615190 [0112.079] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.079] Sleep (dwMilliseconds=0x1) [0112.095] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", len=0x60 | out: pbstr=0x664ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.095] GetProcessHeap () returned 0x580000 [0112.095] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.099] Sleep (dwMilliseconds=0x1) [0112.194] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.208] Sleep (dwMilliseconds=0x1) [0112.318] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", len=0x55 | out: pbstr=0x664ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 1 [0112.318] GetProcessHeap () returned 0x580000 [0112.318] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8b8, Size=0x2c) returned 0x61f880 [0112.318] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.329] Sleep (dwMilliseconds=0x1) [0113.333] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", len=0x3f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 1 [0113.333] GetProcessHeap () returned 0x580000 [0113.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x94) returned 0x6f0ceb8 [0113.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0113.479] CloseHandle (hObject=0x3f4) returned 1 [0113.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.427] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.428] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0001~2.YOU")) returned 0x5b9630 [0114.428] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0114.428] GetProcessHeap () returned 0x580000 [0114.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x6d035f8 [0114.428] GetProcessHeap () returned 0x580000 [0114.428] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1281) returned 0x6d06ca8 [0114.428] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.428] ReadFile (in: hFile=0x3f4, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1260, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x664ff14*=0x1260, lpOverlapped=0x0) returned 1 [0114.446] GetProcessHeap () returned 0x580000 [0114.446] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.446] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.446] WriteFile (in: hFile=0x3f4, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x664ff14*=0x1260, lpOverlapped=0x0) returned 1 [0114.446] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.446] WriteFile (in: hFile=0x3f4, lpBuffer=0x6d07f07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07f07*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0114.446] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.446] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0114.446] CloseHandle (hObject=0x3f4) returned 1 [0114.446] GetProcessHeap () returned 0x580000 [0114.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0114.446] GetProcessHeap () returned 0x580000 [0114.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0114.446] GetProcessHeap () returned 0x580000 [0114.446] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bd49100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12a2, dwReserved0=0x664fd28, dwReserved1=0x6d035f8, cFileName="AN00015_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0001~2.YOU")) returned 0x5b9630 [0115.607] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0115.650] CloseHandle (hObject=0x458) returned 1 [0115.650] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.650] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.651] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0020~1.YOU")) returned 0x5b9630 [0115.651] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0115.651] GetProcessHeap () returned 0x580000 [0115.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2941) returned 0x6cfec68 [0115.651] GetProcessHeap () returned 0x580000 [0115.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2941) returned 0x6c51c28 [0115.651] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.651] ReadFile (in: hFile=0x458, lpBuffer=0x6cfec68, nNumberOfBytesToRead=0x2920, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfec68*, lpNumberOfBytesRead=0x664ff14*=0x2920, lpOverlapped=0x0) returned 1 [0116.975] GetProcessHeap () returned 0x580000 [0116.975] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0116.975] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] WriteFile (in: hFile=0x458, lpBuffer=0x6c51c28*, nNumberOfBytesToWrite=0x2920, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c51c28*, lpNumberOfBytesWritten=0x664ff14*=0x2920, lpOverlapped=0x0) returned 1 [0116.975] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.975] WriteFile (in: hFile=0x458, lpBuffer=0x6c54547*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c54547*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0116.976] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.976] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0116.976] CloseHandle (hObject=0x458) returned 1 [0116.976] GetProcessHeap () returned 0x580000 [0116.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c51c28 | out: hHeap=0x580000) returned 1 [0116.976] GetProcessHeap () returned 0x580000 [0116.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfec68 | out: hHeap=0x580000) returned 1 [0116.976] GetProcessHeap () returned 0x580000 [0116.976] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0117.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d562fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x294a, dwReserved0=0x664fd28, dwReserved1=0x6cfec68, cFileName="SO00200_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0020~1.YOU")) returned 0x5b9630 [0117.997] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0117.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0118.000] CloseHandle (hObject=0x48c) returned 1 [0118.000] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.001] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0288~1.YOU")) returned 0x5b9630 [0118.001] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0118.001] GetProcessHeap () returned 0x580000 [0118.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9681) returned 0x6cf6cd8 [0118.001] GetProcessHeap () returned 0x580000 [0118.001] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9681) returned 0x6c4a808 [0118.002] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.002] ReadFile (in: hFile=0x48c, lpBuffer=0x6cf6cd8, nNumberOfBytesToRead=0x9660, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf6cd8*, lpNumberOfBytesRead=0x664ff14*=0x9660, lpOverlapped=0x0) returned 1 [0118.325] GetProcessHeap () returned 0x580000 [0118.325] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0118.325] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.325] WriteFile (in: hFile=0x48c, lpBuffer=0x6c4a808*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4a808*, lpNumberOfBytesWritten=0x664ff14*=0x9660, lpOverlapped=0x0) returned 1 [0118.326] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.326] WriteFile (in: hFile=0x48c, lpBuffer=0x6c53e67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c53e67*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0118.326] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.326] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0118.326] CloseHandle (hObject=0x48c) returned 1 [0118.341] GetProcessHeap () returned 0x580000 [0118.341] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4a808 | out: hHeap=0x580000) returned 1 [0118.345] GetProcessHeap () returned 0x580000 [0118.345] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf6cd8 | out: hHeap=0x580000) returned 1 [0118.361] GetProcessHeap () returned 0x580000 [0118.361] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e22e600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x969e, dwReserved0=0x664fd28, dwReserved1=0x6cf6cd8, cFileName="SO02886_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0288~1.YOU")) returned 0x5b96f0 [0120.123] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.148] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", len=0x4c | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 1 [0120.149] GetProcessHeap () returned 0x580000 [0120.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e8) returned 0x6d06ca8 [0120.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.222] CloseHandle (hObject=0x470) returned 1 [0120.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.id_1622540890_.your_last_chance")) returned 1 [0120.222] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.223] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0220~1.YOU")) returned 0x5b9630 [0120.223] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.223] GetProcessHeap () returned 0x580000 [0120.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1661) returned 0x6d035f8 [0120.223] GetProcessHeap () returned 0x580000 [0120.223] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1661) returned 0x6c6e0f8 [0120.223] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.223] ReadFile (in: hFile=0x470, lpBuffer=0x6d035f8, nNumberOfBytesToRead=0x1640, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d035f8*, lpNumberOfBytesRead=0x664ff14*=0x1640, lpOverlapped=0x0) returned 1 [0120.254] GetProcessHeap () returned 0x580000 [0120.254] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0120.254] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.254] WriteFile (in: hFile=0x470, lpBuffer=0x6c6e0f8*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6e0f8*, lpNumberOfBytesWritten=0x664ff14*=0x1640, lpOverlapped=0x0) returned 1 [0120.254] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.254] WriteFile (in: hFile=0x470, lpBuffer=0x6c6f737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6f737*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.254] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.254] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.254] CloseHandle (hObject=0x470) returned 1 [0120.254] GetProcessHeap () returned 0x580000 [0120.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6e0f8 | out: hHeap=0x580000) returned 1 [0120.254] GetProcessHeap () returned 0x580000 [0120.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d035f8 | out: hHeap=0x580000) returned 1 [0120.254] GetProcessHeap () returned 0x580000 [0120.254] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0120.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f4a1080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1677, dwReserved0=0x664fd28, dwReserved1=0x6d035f8, cFileName="WB02201_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0220~1.YOU")) returned 0x5b9630 [0120.255] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.261] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", len=0x3f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF") returned 1 [0120.261] GetProcessHeap () returned 0x580000 [0120.261] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1754) returned 0x6d06ca8 [0120.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.262] CloseHandle (hObject=0x470) returned 1 [0120.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0120.263] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.id_1622540890_.your_last_chance")) returned 1 [0120.263] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0120.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0130~1.YOU")) returned 0x5b9630 [0120.263] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0120.264] GetProcessHeap () returned 0x580000 [0120.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2081) returned 0x6cfecd8 [0120.264] GetProcessHeap () returned 0x580000 [0120.264] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2081) returned 0x6f3bea8 [0120.264] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.264] ReadFile (in: hFile=0x470, lpBuffer=0x6cfecd8, nNumberOfBytesToRead=0x2060, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfecd8*, lpNumberOfBytesRead=0x664ff14*=0x2060, lpOverlapped=0x0) returned 1 [0120.786] GetProcessHeap () returned 0x580000 [0120.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0120.786] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.786] WriteFile (in: hFile=0x470, lpBuffer=0x6f3bea8*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bea8*, lpNumberOfBytesWritten=0x664ff14*=0x2060, lpOverlapped=0x0) returned 1 [0120.787] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.787] WriteFile (in: hFile=0x470, lpBuffer=0x6f3df07*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3df07*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0120.787] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0120.787] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0120.787] CloseHandle (hObject=0x470) returned 1 [0121.010] GetProcessHeap () returned 0x580000 [0121.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bea8 | out: hHeap=0x580000) returned 1 [0121.010] GetProcessHeap () returned 0x580000 [0121.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfecd8 | out: hHeap=0x580000) returned 1 [0121.010] GetProcessHeap () returned 0x580000 [0121.010] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0121.911] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f9aff40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x209a, dwReserved0=0x664fd28, dwReserved1=0x6cfecd8, cFileName="WB01304G.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0130~1.YOU")) returned 0x5b9730 [0121.911] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.351] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", len=0x3f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned 1 [0122.351] GetProcessHeap () returned 0x580000 [0122.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1968) returned 0x6f42f08 [0122.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0122.361] CloseHandle (hObject=0x488) returned 1 [0122.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.362] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.id_1622540890_.your_last_chance")) returned 1 [0122.362] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANT~1.YOU")) returned 0x5b9730 [0122.362] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0122.363] GetProcessHeap () returned 0x580000 [0122.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc81) returned 0x6f468d8 [0122.363] GetProcessHeap () returned 0x580000 [0122.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfc81) returned 0x6f56568 [0122.363] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.363] ReadFile (in: hFile=0x488, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0xfc60, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x664ff14*=0xfc60, lpOverlapped=0x0) returned 1 [0124.152] GetProcessHeap () returned 0x580000 [0124.152] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0124.152] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.152] WriteFile (in: hFile=0x488, lpBuffer=0x6f56568*, nNumberOfBytesToWrite=0xfc60, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f56568*, lpNumberOfBytesWritten=0x664ff14*=0xfc60, lpOverlapped=0x0) returned 1 [0124.153] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.153] WriteFile (in: hFile=0x488, lpBuffer=0x6f661c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f661c7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0124.153] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.153] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0124.153] CloseHandle (hObject=0x488) returned 1 [0124.153] GetProcessHeap () returned 0x580000 [0124.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f56568 | out: hHeap=0x580000) returned 1 [0124.153] GetProcessHeap () returned 0x580000 [0124.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0124.153] GetProcessHeap () returned 0x580000 [0124.153] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x819d2840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfc94, dwReserved0=0x664fd28, dwReserved1=0x6f468d8, cFileName="Urban.thmx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANT~1.YOU")) returned 0x5b9730 [0124.853] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.929] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", len=0x52 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 1 [0124.929] GetProcessHeap () returned 0x580000 [0124.929] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a8) returned 0x6f42f08 [0124.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0124.988] CloseHandle (hObject=0x3fc) returned 1 [0124.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0124.989] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id_1622540890_.your_last_chance")) returned 1 [0124.989] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0124.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x5f0054, dwReserved1=0x480043, cFileName="Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0124.990] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0124.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0124.990] GetProcessHeap () returned 0x580000 [0124.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ca1) returned 0x6f5fb98 [0124.990] GetProcessHeap () returned 0x580000 [0124.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6ca1) returned 0x636970 [0124.991] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0124.991] ReadFile (in: hFile=0x3fc, lpBuffer=0x6f5fb98, nNumberOfBytesToRead=0x6c80, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f5fb98*, lpNumberOfBytesRead=0x664ff14*=0x6c80, lpOverlapped=0x0) returned 1 [0126.413] GetProcessHeap () returned 0x580000 [0126.413] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0126.413] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0x3fc, lpBuffer=0x636970*, nNumberOfBytesToWrite=0x6c80, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x636970*, lpNumberOfBytesWritten=0x664ff14*=0x6c80, lpOverlapped=0x0) returned 1 [0126.414] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0x3fc, lpBuffer=0x63d5ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x63d5ef*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0126.414] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0126.414] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0126.414] CloseHandle (hObject=0x3fc) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x636970 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f5fb98 | out: hHeap=0x580000) returned 1 [0126.705] GetProcessHeap () returned 0x580000 [0126.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0126.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82f64fa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6cb1, dwReserved0=0x664fd28, dwReserved1=0x6f5fb98, cFileName="Slipstream.eftx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SLIPST~1.YOU")) returned 0x5b9730 [0126.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0126.720] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", len=0x3d | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned 1 [0126.720] GetProcessHeap () returned 0x580000 [0126.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d4) returned 0x667250 [0126.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0128.873] CloseHandle (hObject=0x39c) returned 1 [0128.873] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.792] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.793] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03009~1.YOU")) returned 0x5b9730 [0129.793] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0129.793] GetProcessHeap () returned 0x580000 [0129.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdb01) returned 0x6f58108 [0129.793] GetProcessHeap () returned 0x580000 [0129.793] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xdb01) returned 0x6dc0a00 [0129.793] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.793] ReadFile (in: hFile=0x39c, lpBuffer=0x6f58108, nNumberOfBytesToRead=0xdae0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesRead=0x664ff14*=0xdae0, lpOverlapped=0x0) returned 1 [0133.842] GetProcessHeap () returned 0x580000 [0133.842] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0133.843] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.843] WriteFile (in: hFile=0x39c, lpBuffer=0x6dc0a00*, nNumberOfBytesToWrite=0xdae0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc0a00*, lpNumberOfBytesWritten=0x664ff14*=0xdae0, lpOverlapped=0x0) returned 1 [0133.843] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.843] WriteFile (in: hFile=0x39c, lpBuffer=0x6dce4df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dce4df*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0133.844] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0133.844] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0133.844] CloseHandle (hObject=0x39c) returned 1 [0134.753] GetProcessHeap () returned 0x580000 [0134.753] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc0a00 | out: hHeap=0x580000) returned 1 [0134.914] GetProcessHeap () returned 0x580000 [0134.914] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0134.915] GetProcessHeap () returned 0x580000 [0134.915] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0135.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x87635e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdb20, dwReserved0=0x664fd28, dwReserved1=0x6f58108, cFileName="J0300912.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J03009~1.YOU")) returned 0x5b96b0 [0135.618] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.627] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x5d | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0135.627] GetProcessHeap () returned 0x580000 [0135.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0136.845] CloseHandle (hObject=0x450) returned 1 [0136.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.845] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0136.845] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0136.846] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0136.846] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0136.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0136.846] GetProcessHeap () returned 0x580000 [0136.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad8a0 [0136.846] GetProcessHeap () returned 0x580000 [0136.846] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ad990 [0136.846] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0136.846] ReadFile (in: hFile=0x450, lpBuffer=0x5ad8a0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad8a0*, lpNumberOfBytesRead=0x664ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.434] GetProcessHeap () returned 0x580000 [0138.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce008 [0138.434] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.434] WriteFile (in: hFile=0x450, lpBuffer=0x5ad990*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ad990*, lpNumberOfBytesWritten=0x664ff14*=0xc0, lpOverlapped=0x0) returned 1 [0138.438] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.438] WriteFile (in: hFile=0x450, lpBuffer=0x5ada4f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5ada4f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.439] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.439] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.439] CloseHandle (hObject=0x450) returned 1 [0138.439] GetProcessHeap () returned 0x580000 [0138.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad990 | out: hHeap=0x580000) returned 1 [0138.439] GetProcessHeap () returned 0x580000 [0138.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ad8a0 | out: hHeap=0x580000) returned 1 [0138.439] GetProcessHeap () returned 0x580000 [0138.439] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce008 | out: hHeap=0x580000) returned 1 [0138.439] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a2193c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x664fd28, dwReserved1=0x5ad8a0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b96b0 [0138.439] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.455] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", len=0x43 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned 1 [0138.455] GetProcessHeap () returned 0x580000 [0138.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0138.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.981] CloseHandle (hObject=0x3b4) returned 1 [0139.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0139.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.id_1622540890_.your_last_chance")) returned 1 [0139.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0139.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5c3b00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f5c3b00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~4.YOU")) returned 0x5b9770 [0139.982] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0139.982] GetProcessHeap () returned 0x580000 [0139.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6c758b0 [0139.982] GetProcessHeap () returned 0x580000 [0139.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4e1) returned 0x6c75db8 [0139.982] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.982] ReadFile (in: hFile=0x3b4, lpBuffer=0x6c758b0, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c758b0*, lpNumberOfBytesRead=0x664ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0139.988] GetProcessHeap () returned 0x580000 [0139.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0139.988] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.988] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c75db8*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75db8*, lpNumberOfBytesWritten=0x664ff14*=0x4c0, lpOverlapped=0x0) returned 1 [0139.988] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.988] WriteFile (in: hFile=0x3b4, lpBuffer=0x6c76277*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c76277*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0139.988] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.988] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0139.988] CloseHandle (hObject=0x3b4) returned 1 [0139.989] GetProcessHeap () returned 0x580000 [0139.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75db8 | out: hHeap=0x580000) returned 1 [0139.989] GetProcessHeap () returned 0x580000 [0139.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c758b0 | out: hHeap=0x580000) returned 1 [0139.989] GetProcessHeap () returned 0x580000 [0139.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5c3b00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b0d3be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f7, dwReserved0=0x664fd28, dwReserved1=0x6c758b0, cFileName="BD21322_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2132~4.YOU")) returned 0x5b9770 [0140.406] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.433] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", len=0x58 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned 1 [0140.433] GetProcessHeap () returned 0x580000 [0140.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.434] CloseHandle (hObject=0x3a8) returned 1 [0140.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.434] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0140.434] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x520055, dwReserved1=0x4c005f, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.435] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0140.435] GetProcessHeap () returned 0x580000 [0140.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0a9f0 [0140.435] GetProcessHeap () returned 0x580000 [0140.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6f0ab28 [0140.435] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.435] ReadFile (in: hFile=0x3a8, lpBuffer=0x6f0a9f0, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0a9f0*, lpNumberOfBytesRead=0x664ff14*=0x100, lpOverlapped=0x0) returned 1 [0140.437] GetProcessHeap () returned 0x580000 [0140.437] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.437] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.437] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f0ab28*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ab28*, lpNumberOfBytesWritten=0x664ff14*=0x100, lpOverlapped=0x0) returned 1 [0140.437] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.437] WriteFile (in: hFile=0x3a8, lpBuffer=0x6f0ac27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0ac27*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.437] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.437] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.437] CloseHandle (hObject=0x3a8) returned 1 [0140.437] GetProcessHeap () returned 0x580000 [0140.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0ab28 | out: hHeap=0x580000) returned 1 [0140.437] GetProcessHeap () returned 0x580000 [0140.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a9f0 | out: hHeap=0x580000) returned 1 [0140.437] GetProcessHeap () returned 0x580000 [0140.437] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0140.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b5243c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x664fd28, dwReserved1=0x6f0a9f0, cFileName="TAB_ON.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0140.438] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.686] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK", len=0x42 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 1 [0140.686] GetProcessHeap () returned 0x580000 [0140.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0140.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.705] CloseHandle (hObject=0x478) returned 1 [0140.705] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.705] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0140.706] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.706] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b9730 [0140.706] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0140.706] GetProcessHeap () returned 0x580000 [0140.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0140.706] GetProcessHeap () returned 0x580000 [0140.706] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0140.706] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.706] ReadFile (in: hFile=0x478, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x664ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.707] GetProcessHeap () returned 0x580000 [0140.707] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0140.707] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.707] WriteFile (in: hFile=0x478, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x664ff14*=0x60, lpOverlapped=0x0) returned 1 [0140.708] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.708] WriteFile (in: hFile=0x478, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.708] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.708] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.708] CloseHandle (hObject=0x478) returned 1 [0140.708] GetProcessHeap () returned 0x580000 [0140.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0140.708] GetProcessHeap () returned 0x580000 [0140.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0140.708] GetProcessHeap () returned 0x580000 [0140.708] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0141.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b7abb20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x664fd28, dwReserved1=0x61b540, cFileName="INFOPATH_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="INFOPA~1.YOU")) returned 0x5b9730 [0141.541] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.555] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL", len=0x36 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 1 [0141.555] GetProcessHeap () returned 0x580000 [0141.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0141.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0141.584] CloseHandle (hObject=0x478) returned 1 [0141.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id_1622540890_.your_last_chance")) returned 1 [0141.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PEVSLI~1.YOU")) returned 0x5b9730 [0141.585] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0141.585] GetProcessHeap () returned 0x580000 [0141.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6481a0 [0141.586] GetProcessHeap () returned 0x580000 [0141.586] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0141.587] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.587] ReadFile (in: hFile=0x478, lpBuffer=0x6481a0, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6481a0*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.889] GetProcessHeap () returned 0x580000 [0143.889] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf700 [0143.889] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.889] WriteFile (in: hFile=0x478, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.890] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.890] WriteFile (in: hFile=0x478, lpBuffer=0x6fc4737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4737*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0143.890] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.890] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0143.890] CloseHandle (hObject=0x478) returned 1 [0144.012] GetProcessHeap () returned 0x580000 [0144.012] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0144.016] GetProcessHeap () returned 0x580000 [0144.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6481a0 | out: hHeap=0x580000) returned 1 [0144.017] GetProcessHeap () returned 0x580000 [0144.017] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf700 | out: hHeap=0x580000) returned 1 [0146.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8d6053a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x149a4, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PE.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PEVSLI~1.YOU")) returned 0x5b96f0 [0146.862] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.876] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", len=0x44 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned 1 [0146.876] GetProcessHeap () returned 0x580000 [0146.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.083] CloseHandle (hObject=0x480) returned 1 [0153.083] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0153.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.id_1622540890_.your_last_chance")) returned 1 [0153.084] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0153.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x684, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR28~2.YOU")) returned 0x5b9730 [0153.084] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0153.084] GetProcessHeap () returned 0x580000 [0153.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c758b0 [0153.084] GetProcessHeap () returned 0x580000 [0153.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6a1) returned 0x6c75f78 [0153.084] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.084] ReadFile (in: hFile=0x480, lpBuffer=0x6c758b0, nNumberOfBytesToRead=0x680, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c758b0*, lpNumberOfBytesRead=0x664ff14*=0x680, lpOverlapped=0x0) returned 1 [0153.092] GetProcessHeap () returned 0x580000 [0153.092] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] WriteFile (in: hFile=0x480, lpBuffer=0x6c75f78*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c75f78*, lpNumberOfBytesWritten=0x664ff14*=0x680, lpOverlapped=0x0) returned 1 [0153.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] WriteFile (in: hFile=0x480, lpBuffer=0x6c765f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c765f7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.092] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.092] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.092] CloseHandle (hObject=0x480) returned 1 [0153.092] GetProcessHeap () returned 0x580000 [0153.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c75f78 | out: hHeap=0x580000) returned 1 [0153.092] GetProcessHeap () returned 0x580000 [0153.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c758b0 | out: hHeap=0x580000) returned 1 [0153.092] GetProcessHeap () returned 0x580000 [0153.092] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0153.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92dcbee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6a8, dwReserved0=0x664fd28, dwReserved1=0x6c758b0, cFileName="PDIR28B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR28~2.YOU")) returned 0x5b9630 [0153.753] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.091] CloseHandle (hObject=0x448) returned 1 [0159.091] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.092] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0159.092] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.092] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI96E5~1.YOU")) returned 0x5b9630 [0159.092] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0159.093] GetProcessHeap () returned 0x580000 [0159.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2798 [0159.093] GetProcessHeap () returned 0x580000 [0159.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6df2a40 [0159.093] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.093] ReadFile (in: hFile=0x448, lpBuffer=0x6df2798, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2798*, lpNumberOfBytesRead=0x664ff14*=0x260, lpOverlapped=0x0) returned 1 [0159.096] GetProcessHeap () returned 0x580000 [0159.096] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.096] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.096] WriteFile (in: hFile=0x448, lpBuffer=0x6df2a40*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2a40*, lpNumberOfBytesWritten=0x664ff14*=0x260, lpOverlapped=0x0) returned 1 [0159.096] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.096] WriteFile (in: hFile=0x448, lpBuffer=0x6df2c9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df2c9f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0159.097] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.097] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0159.097] CloseHandle (hObject=0x448) returned 1 [0159.097] GetProcessHeap () returned 0x580000 [0159.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2a40 | out: hHeap=0x580000) returned 1 [0159.097] GetProcessHeap () returned 0x580000 [0159.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df2798 | out: hHeap=0x580000) returned 1 [0159.097] GetProcessHeap () returned 0x580000 [0159.097] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96713040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x664fd28, dwReserved1=0x6df2798, cFileName="WINWORD_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WI96E5~1.YOU")) returned 0x5b9730 [0164.393] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.433] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", len=0x38 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 1 [0164.434] GetProcessHeap () returned 0x580000 [0164.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0164.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0166.079] CloseHandle (hObject=0x490) returned 1 [0166.079] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.079] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id_1622540890_.your_last_chance")) returned 1 [0166.080] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCSEVE~1.YOU")) returned 0x5b9730 [0166.080] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0166.080] GetProcessHeap () returned 0x580000 [0166.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d61) returned 0x6de0f50 [0166.081] GetProcessHeap () returned 0x580000 [0166.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8d61) returned 0x6fd5f98 [0166.081] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.081] ReadFile (in: hFile=0x490, lpBuffer=0x6de0f50, nNumberOfBytesToRead=0x8d40, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de0f50*, lpNumberOfBytesRead=0x664ff14*=0x8d40, lpOverlapped=0x0) returned 1 [0167.688] GetProcessHeap () returned 0x580000 [0167.688] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0167.688] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x490, lpBuffer=0x6fd5f98*, nNumberOfBytesToWrite=0x8d40, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesWritten=0x664ff14*=0x8d40, lpOverlapped=0x0) returned 1 [0167.688] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x490, lpBuffer=0x6fdecd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fdecd7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0167.688] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.688] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0167.689] CloseHandle (hObject=0x490) returned 1 [0167.689] GetProcessHeap () returned 0x580000 [0167.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0167.689] GetProcessHeap () returned 0x580000 [0167.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de0f50 | out: hHeap=0x580000) returned 1 [0167.689] GetProcessHeap () returned 0x580000 [0167.689] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b90c5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x8d75, dwReserved0=0x664fd28, dwReserved1=0x6de0f50, cFileName="BCSEvents.man.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCSEVE~1.YOU")) returned 0x5b9730 [0170.128] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.165] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", len=0x34 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 1 [0170.165] GetProcessHeap () returned 0x580000 [0170.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22c4) returned 0x6f14048 [0170.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.170] CloseHandle (hObject=0x458) returned 1 [0170.170] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.170] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id_1622540890_.your_last_chance")) returned 1 [0170.181] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPHI~1.YOU")) returned 0x5b9630 [0170.182] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0170.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.182] GetProcessHeap () returned 0x580000 [0170.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x67c940 [0170.182] GetProcessHeap () returned 0x580000 [0170.182] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x301) returned 0x6df6780 [0170.182] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.182] ReadFile (in: hFile=0x458, lpBuffer=0x67c940, nNumberOfBytesToRead=0x2e0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x67c940*, lpNumberOfBytesRead=0x664ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0170.187] GetProcessHeap () returned 0x580000 [0170.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.187] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.187] WriteFile (in: hFile=0x458, lpBuffer=0x6df6780*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesWritten=0x664ff14*=0x2e0, lpOverlapped=0x0) returned 1 [0170.188] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.188] WriteFile (in: hFile=0x458, lpBuffer=0x6df6a5f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6a5f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0170.188] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.188] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0170.188] CloseHandle (hObject=0x458) returned 1 [0170.188] GetProcessHeap () returned 0x580000 [0170.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0170.188] GetProcessHeap () returned 0x580000 [0170.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67c940 | out: hHeap=0x580000) returned 1 [0170.188] GetProcessHeap () returned 0x580000 [0170.188] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d0da1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x322, dwReserved0=0x664fd28, dwReserved1=0x67c940, cFileName="GRAPH.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GRAPHI~1.YOU")) returned 0x5b9770 [0172.816] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.863] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", len=0x42 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 1 [0172.863] GetProcessHeap () returned 0x580000 [0172.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2250) returned 0x6f14048 [0172.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0172.935] CloseHandle (hObject=0x46c) returned 1 [0172.935] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0172.935] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id_1622540890_.your_last_chance")) returned 1 [0172.977] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0172.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~2.YOU")) returned 0x5b9770 [0172.978] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0172.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0172.978] GetProcessHeap () returned 0x580000 [0172.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0172.978] GetProcessHeap () returned 0x580000 [0172.978] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0172.978] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] ReadFile (in: hFile=0x46c, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x664ff14*=0x340, lpOverlapped=0x0) returned 1 [0172.990] GetProcessHeap () returned 0x580000 [0172.990] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0172.990] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.990] WriteFile (in: hFile=0x46c, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x664ff14*=0x340, lpOverlapped=0x0) returned 1 [0172.990] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] WriteFile (in: hFile=0x46c, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0172.991] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0172.991] CloseHandle (hObject=0x46c) returned 1 [0172.991] GetProcessHeap () returned 0x580000 [0172.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0172.991] GetProcessHeap () returned 0x580000 [0172.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0172.991] GetProcessHeap () returned 0x580000 [0172.991] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0172.991] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eba1960, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x664fd28, dwReserved1=0x6dcfb90, cFileName="SCHDRESP.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDRE~2.YOU")) returned 0x5b9770 [0172.991] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.007] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", len=0x42 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 1 [0173.008] GetProcessHeap () returned 0x580000 [0173.008] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2244) returned 0x6f14048 [0173.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.010] CloseHandle (hObject=0x43c) returned 1 [0173.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.010] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.010] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDCN~1.YOU")) returned 0x5b9770 [0173.011] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0173.011] GetProcessHeap () returned 0x580000 [0173.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0173.011] GetProcessHeap () returned 0x580000 [0173.011] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0173.011] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.011] ReadFile (in: hFile=0x43c, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.015] GetProcessHeap () returned 0x580000 [0173.015] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.015] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.015] WriteFile (in: hFile=0x43c, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.015] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.015] WriteFile (in: hFile=0x43c, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.016] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.016] CloseHandle (hObject=0x43c) returned 1 [0173.016] GetProcessHeap () returned 0x580000 [0173.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0173.016] GetProcessHeap () returned 0x580000 [0173.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0173.016] GetProcessHeap () returned 0x580000 [0173.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ebc7ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x359, dwReserved0=0x664fd28, dwReserved1=0x6c59120, cFileName="SCHDCNCL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SCHDCN~1.YOU")) returned 0x5b9770 [0173.252] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.255] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", len=0x40 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 1 [0173.255] GetProcessHeap () returned 0x580000 [0173.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0173.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.278] CloseHandle (hObject=0x3fc) returned 1 [0173.278] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.278] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.281] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RCLRPT~1.YOU")) returned 0x5b9770 [0173.281] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0173.282] GetProcessHeap () returned 0x580000 [0173.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0173.282] GetProcessHeap () returned 0x580000 [0173.282] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0173.282] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.282] ReadFile (in: hFile=0x3fc, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.329] GetProcessHeap () returned 0x580000 [0173.329] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.329] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.329] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0173.330] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.330] WriteFile (in: hFile=0x3fc, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.330] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.330] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.330] CloseHandle (hObject=0x3fc) returned 1 [0173.330] GetProcessHeap () returned 0x580000 [0173.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0173.330] GetProcessHeap () returned 0x580000 [0173.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0173.330] GetProcessHeap () returned 0x580000 [0173.330] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eec1640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x664fd28, dwReserved1=0x6c59120, cFileName="RCLRPT.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RCLRPT~1.YOU")) returned 0x5b9770 [0173.330] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.368] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", len=0x3e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 1 [0173.368] GetProcessHeap () returned 0x580000 [0173.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0173.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.368] CloseHandle (hObject=0x46c) returned 1 [0173.368] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.369] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id_1622540890_.your_last_chance")) returned 1 [0173.369] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFSIC~1.YOU")) returned 0x5b9770 [0173.369] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0173.370] GetProcessHeap () returned 0x580000 [0173.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.370] GetProcessHeap () returned 0x580000 [0173.370] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.370] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.370] ReadFile (in: hFile=0x46c, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x664ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.408] GetProcessHeap () returned 0x580000 [0173.408] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0173.408] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.408] WriteFile (in: hFile=0x46c, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x664ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] WriteFile (in: hFile=0x46c, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] WriteFile (in: hFile=0x46c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.409] CloseHandle (hObject=0x46c) returned 1 [0174.011] GetProcessHeap () returned 0x580000 [0174.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0174.011] GetProcessHeap () returned 0x580000 [0174.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0174.011] GetProcessHeap () returned 0x580000 [0174.011] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0176.712] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef7fd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x664fd28, dwReserved1=0x662288, cFileName="OOFS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFSIC~1.YOU")) returned 0x5b96f0 [0176.712] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.752] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", len=0x48 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned 1 [0176.753] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0176.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0177.981] CloseHandle (hObject=0x4ac) returned 1 [0177.981] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0177.981] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.id_1622540890_.your_last_chance")) returned 1 [0177.982] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0177.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TOOTWA~1.YOU")) returned 0x5b96f0 [0177.982] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0177.982] GetProcessHeap () returned 0x580000 [0177.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd661) returned 0x6d8e818 [0177.982] GetProcessHeap () returned 0x580000 [0177.982] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd661) returned 0x712c118 [0177.982] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.982] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d8e818, nNumberOfBytesToRead=0xd640, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesRead=0x664ff14*=0xd640, lpOverlapped=0x0) returned 1 [0179.349] GetProcessHeap () returned 0x580000 [0179.349] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a340 [0179.349] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.349] WriteFile (in: hFile=0x4ac, lpBuffer=0x712c118*, nNumberOfBytesToWrite=0xd640, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x712c118*, lpNumberOfBytesWritten=0x664ff14*=0xd640, lpOverlapped=0x0) returned 1 [0179.350] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.350] WriteFile (in: hFile=0x4ac, lpBuffer=0x7139757*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7139757*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.350] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.350] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.350] CloseHandle (hObject=0x4ac) returned 1 [0179.350] GetProcessHeap () returned 0x580000 [0179.350] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x712c118 | out: hHeap=0x580000) returned 1 [0179.351] GetProcessHeap () returned 0x580000 [0179.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0179.351] GetProcessHeap () returned 0x580000 [0179.351] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a340 | out: hHeap=0x580000) returned 1 [0180.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa282e900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd66e, dwReserved0=0x664fd28, dwReserved1=0x6d8e818, cFileName="TOOT.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TOOTWA~1.YOU")) returned 0x5b96b0 [0180.355] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.423] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", len=0x70 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned 1 [0180.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0180.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.423] CloseHandle (hObject=0x4a8) returned 1 [0180.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.424] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.424] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.424] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x6c006c, dwReserved1=0x62002e, cFileName="CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~2.YOU")) returned 0x5b96b0 [0180.425] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0180.425] GetProcessHeap () returned 0x580000 [0180.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0180.425] GetProcessHeap () returned 0x580000 [0180.425] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0180.425] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.425] ReadFile (in: hFile=0x4a8, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x664ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.459] GetProcessHeap () returned 0x580000 [0180.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.460] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.460] WriteFile (in: hFile=0x4a8, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x664ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.460] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.460] WriteFile (in: hFile=0x4a8, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.460] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.460] WriteFile (in: hFile=0x4a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.460] CloseHandle (hObject=0x4a8) returned 1 [0180.460] GetProcessHeap () returned 0x580000 [0180.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0180.460] GetProcessHeap () returned 0x580000 [0180.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0180.460] GetProcessHeap () returned 0x580000 [0180.460] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa32beaa0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x654, dwReserved0=0x664fd28, dwReserved1=0x626d30, cFileName="CommsOutgoingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSO~2.YOU")) returned 0x5b96b0 [0180.461] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.471] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", len=0x70 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned 1 [0180.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0180.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.471] CloseHandle (hObject=0x450) returned 1 [0180.471] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.id_1622540890_.your_last_chance")) returned 1 [0180.472] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x6c006c, dwReserved1=0x62002e, cFileName="CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~2.YOU")) returned 0x5b96b0 [0180.472] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.473] GetProcessHeap () returned 0x580000 [0180.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x626d30 [0180.473] GetProcessHeap () returned 0x580000 [0180.473] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x641) returned 0x6273b8 [0180.473] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.473] ReadFile (in: hFile=0x450, lpBuffer=0x626d30, nNumberOfBytesToRead=0x620, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesRead=0x664ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.558] GetProcessHeap () returned 0x580000 [0180.558] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.558] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.558] WriteFile (in: hFile=0x450, lpBuffer=0x6273b8*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6273b8*, lpNumberOfBytesWritten=0x664ff14*=0x620, lpOverlapped=0x0) returned 1 [0180.558] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.558] WriteFile (in: hFile=0x450, lpBuffer=0x6279d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6279d7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0180.558] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.558] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0180.558] CloseHandle (hObject=0x450) returned 1 [0180.558] GetProcessHeap () returned 0x580000 [0180.558] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6273b8 | out: hHeap=0x580000) returned 1 [0180.558] GetProcessHeap () returned 0x580000 [0180.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0180.559] GetProcessHeap () returned 0x580000 [0180.559] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.559] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa33c9440, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x654, dwReserved0=0x664fd28, dwReserved1=0x626d30, cFileName="CommsIncomingImageMaskSmall.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~2.YOU")) returned 0x5b96b0 [0180.559] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0181.360] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", len=0x68 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned 1 [0181.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0181.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.626] CloseHandle (hObject=0x488) returned 1 [0182.626] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0182.626] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.id_1622540890_.your_last_chance")) returned 1 [0182.627] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0182.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3390df00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x5f0064, dwReserved1=0x360031, cFileName="AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALB26E~1.YOU")) returned 0x5b9770 [0182.627] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0182.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0182.627] GetProcessHeap () returned 0x580000 [0182.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbc098 [0182.627] GetProcessHeap () returned 0x580000 [0182.627] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1c81) returned 0x6cbdda0 [0182.628] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.628] ReadFile (in: hFile=0x488, lpBuffer=0x6cbc098, nNumberOfBytesToRead=0x1c60, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbc098*, lpNumberOfBytesRead=0x664ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.652] GetProcessHeap () returned 0x580000 [0182.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0182.652] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.652] WriteFile (in: hFile=0x488, lpBuffer=0x6cbdda0*, nNumberOfBytesToWrite=0x1c60, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbdda0*, lpNumberOfBytesWritten=0x664ff14*=0x1c60, lpOverlapped=0x0) returned 1 [0182.653] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.653] WriteFile (in: hFile=0x488, lpBuffer=0x6cbf9ff*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cbf9ff*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0182.653] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0182.653] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0182.653] CloseHandle (hObject=0x488) returned 1 [0182.653] GetProcessHeap () returned 0x580000 [0182.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbdda0 | out: hHeap=0x580000) returned 1 [0182.653] GetProcessHeap () returned 0x580000 [0182.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cbc098 | out: hHeap=0x580000) returned 1 [0182.653] GetProcessHeap () returned 0x580000 [0182.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0183.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b8c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1c92, dwReserved0=0x664fd28, dwReserved1=0x6cbc098, cFileName="AlertImage_AutoMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALB26E~1.YOU")) returned 0x5b9770 [0183.802] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.817] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", len=0x6f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned 1 [0183.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0183.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.370] CloseHandle (hObject=0x48c) returned 1 [0186.370] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.370] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.371] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.371] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4139, dwReserved0=0x2e0045, dwReserved1=0x50004a, cFileName="DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATETI~1.YOU")) returned 0x5b96b0 [0186.371] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0186.371] GetProcessHeap () returned 0x580000 [0186.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x706a658 [0186.371] GetProcessHeap () returned 0x580000 [0186.371] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4141) returned 0x6fc4928 [0186.372] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.372] ReadFile (in: hFile=0x48c, lpBuffer=0x706a658, nNumberOfBytesToRead=0x4120, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x706a658*, lpNumberOfBytesRead=0x664ff14*=0x4120, lpOverlapped=0x0) returned 1 [0187.541] GetProcessHeap () returned 0x580000 [0187.541] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0187.541] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.541] WriteFile (in: hFile=0x48c, lpBuffer=0x6fc4928*, nNumberOfBytesToWrite=0x4120, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4928*, lpNumberOfBytesWritten=0x664ff14*=0x4120, lpOverlapped=0x0) returned 1 [0187.541] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.541] WriteFile (in: hFile=0x48c, lpBuffer=0x6fc8a47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc8a47*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.541] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.541] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.542] CloseHandle (hObject=0x48c) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4928 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.780] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706a658 | out: hHeap=0x580000) returned 1 [0187.780] GetProcessHeap () returned 0x580000 [0187.781] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0188.060] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7649ae0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x415d, dwReserved0=0x664fd28, dwReserved1=0x706a658, cFileName="DATETIME.JPG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DATETI~1.YOU")) returned 0x5b9770 [0188.060] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.079] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", len=0x45 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned 1 [0188.080] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x206c) returned 0x6f14048 [0188.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0191.913] CloseHandle (hObject=0x4ac) returned 1 [0191.913] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.913] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.id_1622540890_.your_last_chance")) returned 1 [0194.620] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0194.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7517, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP195F~1.YOU")) returned 0x5b97b0 [0194.620] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0194.621] GetProcessHeap () returned 0x580000 [0194.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7521) returned 0x6fa5ca8 [0194.621] GetProcessHeap () returned 0x580000 [0194.621] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7521) returned 0x715c008 [0194.621] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.621] ReadFile (in: hFile=0x4ac, lpBuffer=0x6fa5ca8, nNumberOfBytesToRead=0x7500, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa5ca8*, lpNumberOfBytesRead=0x664ff14*=0x7500, lpOverlapped=0x0) returned 1 [0196.055] GetProcessHeap () returned 0x580000 [0196.055] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.055] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.055] WriteFile (in: hFile=0x4ac, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x7500, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x664ff14*=0x7500, lpOverlapped=0x0) returned 1 [0196.055] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.055] WriteFile (in: hFile=0x4ac, lpBuffer=0x7163507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7163507*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.055] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.056] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.056] CloseHandle (hObject=0x4ac) returned 1 [0196.056] GetProcessHeap () returned 0x580000 [0196.056] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0196.056] GetProcessHeap () returned 0x580000 [0196.056] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa5ca8 | out: hHeap=0x580000) returned 1 [0196.056] GetProcessHeap () returned 0x580000 [0196.056] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0198.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac7849a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x753b, dwReserved0=0x664fd28, dwReserved1=0x6fa5ca8, cFileName="ZPDIR47B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP195F~1.YOU")) returned 0x5b97f0 [0198.916] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.950] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", len=0x44 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned 1 [0198.951] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0198.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0198.951] CloseHandle (hObject=0x4ac) returned 1 [0198.951] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0198.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.id_1622540890_.your_last_chance")) returned 1 [0198.952] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0198.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3026, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR44~1.YOU")) returned 0x5b97f0 [0198.952] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0198.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0198.952] GetProcessHeap () returned 0x580000 [0198.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3041) returned 0x6c59108 [0198.952] GetProcessHeap () returned 0x580000 [0198.952] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3041) returned 0x6d06ca8 [0198.952] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.952] ReadFile (in: hFile=0x4ac, lpBuffer=0x6c59108, nNumberOfBytesToRead=0x3020, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59108*, lpNumberOfBytesRead=0x664ff14*=0x3020, lpOverlapped=0x0) returned 1 [0199.022] GetProcessHeap () returned 0x580000 [0199.022] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0199.023] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x664ff14*=0x3020, lpOverlapped=0x0) returned 1 [0199.023] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x6d09cc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09cc7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0199.023] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.023] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0199.023] CloseHandle (hObject=0x4ac) returned 1 [0199.056] GetProcessHeap () returned 0x580000 [0199.056] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0199.088] GetProcessHeap () returned 0x580000 [0199.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59108 | out: hHeap=0x580000) returned 1 [0199.088] GetProcessHeap () returned 0x580000 [0199.088] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0199.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae3c8ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x304a, dwReserved0=0x664fd28, dwReserved1=0x6c59108, cFileName="PDIR44F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR44~1.YOU")) returned 0x5b96b0 [0199.656] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0201.039] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", len=0x6e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned 1 [0201.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0201.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.040] CloseHandle (hObject=0x4ac) returned 1 [0201.040] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.040] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance")) returned 1 [0201.953] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x67002e, dwReserved1=0x660069, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0201.953] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0201.953] GetProcessHeap () returned 0x580000 [0201.953] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6e0f7d8 [0201.954] GetProcessHeap () returned 0x580000 [0201.954] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x121) returned 0x6e0f910 [0201.954] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.954] ReadFile (in: hFile=0x4ac, lpBuffer=0x6e0f7d8, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0f7d8*, lpNumberOfBytesRead=0x664ff14*=0x100, lpOverlapped=0x0) returned 1 [0201.956] GetProcessHeap () returned 0x580000 [0201.956] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.956] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.956] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e0f910*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0f910*, lpNumberOfBytesWritten=0x664ff14*=0x100, lpOverlapped=0x0) returned 1 [0201.956] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.956] WriteFile (in: hFile=0x4ac, lpBuffer=0x6e0fa0f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0fa0f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.956] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.956] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.956] CloseHandle (hObject=0x4ac) returned 1 [0201.956] GetProcessHeap () returned 0x580000 [0201.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0f910 | out: hHeap=0x580000) returned 1 [0201.956] GetProcessHeap () returned 0x580000 [0201.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e0f7d8 | out: hHeap=0x580000) returned 1 [0201.956] GetProcessHeap () returned 0x580000 [0201.956] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0203.104] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaffc1160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x664fd28, dwReserved1=0x6e0f7d8, cFileName="tab_on.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_ON~1.YOU")) returned 0x5b9770 [0203.104] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.124] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned 1 [0203.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0203.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0209.157] CloseHandle (hObject=0x47c) returned 1 [0209.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.157] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.id_1622540890_.your_last_chance")) returned 1 [0209.157] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b9830 [0209.158] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0209.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0209.158] GetProcessHeap () returned 0x580000 [0209.158] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x6c79898 [0209.574] GetProcessHeap () returned 0x580000 [0209.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x861) returned 0x706ecb0 [0209.574] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.575] ReadFile (in: hFile=0x47c, lpBuffer=0x6c79898, nNumberOfBytesToRead=0x840, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c79898*, lpNumberOfBytesRead=0x664ff14*=0x840, lpOverlapped=0x0) returned 1 [0209.609] GetProcessHeap () returned 0x580000 [0209.609] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0209.609] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.609] WriteFile (in: hFile=0x47c, lpBuffer=0x706ecb0*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x706ecb0*, lpNumberOfBytesWritten=0x664ff14*=0x840, lpOverlapped=0x0) returned 1 [0209.609] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.609] WriteFile (in: hFile=0x47c, lpBuffer=0x706f4ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x706f4ef*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.609] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.609] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.609] CloseHandle (hObject=0x47c) returned 1 [0209.609] GetProcessHeap () returned 0x580000 [0209.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706ecb0 | out: hHeap=0x580000) returned 1 [0209.609] GetProcessHeap () returned 0x580000 [0209.609] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c79898 | out: hHeap=0x580000) returned 1 [0209.610] GetProcessHeap () returned 0x580000 [0209.610] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0209.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb48cd480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x87c, dwReserved0=0x664fd28, dwReserved1=0x6c79898, cFileName="FormsMacroTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSM~1.YOU")) returned 0x5b97f0 [0209.610] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.630] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x76 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0209.630] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0209.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.631] CloseHandle (hObject=0x3b8) returned 1 [0209.631] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.631] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance")) returned 1 [0209.632] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x5c0077, dwReserved1=0x450048, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0209.632] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0209.632] GetProcessHeap () returned 0x580000 [0209.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5b8df0 [0209.632] GetProcessHeap () returned 0x580000 [0209.632] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0209.632] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.632] ReadFile (in: hFile=0x3b8, lpBuffer=0x5b8df0, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5b8df0*, lpNumberOfBytesRead=0x664ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.650] GetProcessHeap () returned 0x580000 [0209.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0209.650] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.650] WriteFile (in: hFile=0x3b8, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x664ff14*=0x160, lpOverlapped=0x0) returned 1 [0209.650] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.650] WriteFile (in: hFile=0x3b8, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.650] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.650] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.650] CloseHandle (hObject=0x3b8) returned 1 [0209.650] GetProcessHeap () returned 0x580000 [0209.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0209.650] GetProcessHeap () returned 0x580000 [0209.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b8df0 | out: hHeap=0x580000) returned 1 [0209.650] GetProcessHeap () returned 0x580000 [0209.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0209.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb493f8a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x664fd28, dwReserved1=0x5b8df0, cFileName="HEADER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HEADER~1.YOU")) returned 0x5b97f0 [0209.651] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.679] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0209.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0209.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.680] CloseHandle (hObject=0x484) returned 1 [0209.680] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0209.709] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.709] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x46004f, dwReserved1=0x2e0046, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.709] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.709] GetProcessHeap () returned 0x580000 [0209.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0209.710] GetProcessHeap () returned 0x580000 [0209.710] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0209.710] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.710] ReadFile (in: hFile=0x484, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x664ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.712] GetProcessHeap () returned 0x580000 [0209.712] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0209.712] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.712] WriteFile (in: hFile=0x484, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x664ff14*=0x140, lpOverlapped=0x0) returned 1 [0209.712] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.712] WriteFile (in: hFile=0x484, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.714] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.714] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.714] CloseHandle (hObject=0x484) returned 1 [0209.715] GetProcessHeap () returned 0x580000 [0209.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0209.715] GetProcessHeap () returned 0x580000 [0209.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0209.715] GetProcessHeap () returned 0x580000 [0209.715] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0209.715] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49d7e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x664fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97f0 [0209.715] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.766] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", len=0x66 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned 1 [0209.766] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f0c) returned 0x6f14048 [0209.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.766] CloseHandle (hObject=0x458) returned 1 [0209.766] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.766] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.id_1622540890_.your_last_chance")) returned 1 [0209.767] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x360031, dwReserved1=0x320032, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b97f0 [0209.767] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0209.767] GetProcessHeap () returned 0x580000 [0209.767] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e8a8 [0209.768] GetProcessHeap () returned 0x580000 [0209.768] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc1) returned 0x60e978 [0209.768] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.768] ReadFile (in: hFile=0x458, lpBuffer=0x60e8a8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e8a8*, lpNumberOfBytesRead=0x664ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.769] GetProcessHeap () returned 0x580000 [0209.769] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0209.769] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.769] WriteFile (in: hFile=0x458, lpBuffer=0x60e978*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x60e978*, lpNumberOfBytesWritten=0x664ff14*=0xa0, lpOverlapped=0x0) returned 1 [0209.769] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.769] WriteFile (in: hFile=0x458, lpBuffer=0x60ea17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x60ea17*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0209.769] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.769] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0209.769] CloseHandle (hObject=0x458) returned 1 [0209.769] GetProcessHeap () returned 0x580000 [0209.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e978 | out: hHeap=0x580000) returned 1 [0209.769] GetProcessHeap () returned 0x580000 [0209.769] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60e8a8 | out: hHeap=0x580000) returned 1 [0209.769] GetProcessHeap () returned 0x580000 [0209.770] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0209.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4a4a240, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x664fd28, dwReserved1=0x60e8a8, cFileName="button_mid_over.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BUTTON~3.YOU")) returned 0x5b97f0 [0209.770] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.810] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", len=0x61 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned 1 [0209.811] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0209.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.811] CloseHandle (hObject=0x484) returned 1 [0209.811] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0209.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.id_1622540890_.your_last_chance")) returned 1 [0209.812] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0209.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b97f0 [0209.812] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0209.812] GetProcessHeap () returned 0x580000 [0209.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6f1bec0 [0209.812] GetProcessHeap () returned 0x580000 [0209.812] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1861) returned 0x6f1d7c8 [0209.812] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0209.813] ReadFile (in: hFile=0x484, lpBuffer=0x6f1bec0, nNumberOfBytesToRead=0x1840, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesRead=0x664ff14*=0x1840, lpOverlapped=0x0) returned 1 [0210.024] GetProcessHeap () returned 0x580000 [0210.024] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0210.024] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.024] WriteFile (in: hFile=0x484, lpBuffer=0x6f1d7c8*, nNumberOfBytesToWrite=0x1840, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1d7c8*, lpNumberOfBytesWritten=0x664ff14*=0x1840, lpOverlapped=0x0) returned 1 [0210.024] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.024] WriteFile (in: hFile=0x484, lpBuffer=0x6f1f007*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1f007*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0210.025] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.025] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0210.025] CloseHandle (hObject=0x484) returned 1 [0210.025] GetProcessHeap () returned 0x580000 [0210.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1d7c8 | out: hHeap=0x580000) returned 1 [0210.025] GetProcessHeap () returned 0x580000 [0210.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0210.025] GetProcessHeap () returned 0x580000 [0210.025] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0214.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4cd19a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1869, dwReserved0=0x664fd28, dwReserved1=0x6f1bec0, cFileName="bg_Premium.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_PRE~1.YOU")) returned 0x5b97b0 [0214.536] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.554] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned 1 [0214.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0214.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.567] CloseHandle (hObject=0x448) returned 1 [0214.567] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0214.567] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0214.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0214.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0042, dwReserved1=0x46004f, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0214.603] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0214.603] GetProcessHeap () returned 0x580000 [0214.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0214.603] GetProcessHeap () returned 0x580000 [0214.603] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0214.603] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.603] ReadFile (in: hFile=0x448, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x664ff14*=0x140, lpOverlapped=0x0) returned 1 [0214.605] GetProcessHeap () returned 0x580000 [0214.605] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0214.605] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.605] WriteFile (in: hFile=0x448, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x664ff14*=0x140, lpOverlapped=0x0) returned 1 [0214.605] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.606] WriteFile (in: hFile=0x448, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0214.606] SetFilePointerEx (in: hFile=0x448, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.606] WriteFile (in: hFile=0x448, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0214.606] CloseHandle (hObject=0x448) returned 1 [0214.606] GetProcessHeap () returned 0x580000 [0214.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0214.606] GetProcessHeap () returned 0x580000 [0214.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0214.606] GetProcessHeap () returned 0x580000 [0214.606] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0217.167] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7868c80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x664fd28, dwReserved1=0x6dec6f8, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b97b0 [0217.167] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.213] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned 1 [0217.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0217.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.258] CloseHandle (hObject=0x490) returned 1 [0217.258] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.258] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0217.259] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.259] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e0046, dwReserved1=0x490047, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0217.259] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0217.259] GetProcessHeap () returned 0x580000 [0217.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0217.259] GetProcessHeap () returned 0x580000 [0217.259] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0217.259] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.259] ReadFile (in: hFile=0x490, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x664ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0217.262] GetProcessHeap () returned 0x580000 [0217.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.265] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.271] WriteFile (in: hFile=0x490, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x664ff14*=0x1c0, lpOverlapped=0x0) returned 1 [0217.271] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.271] WriteFile (in: hFile=0x490, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.271] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.272] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.272] CloseHandle (hObject=0x490) returned 1 [0217.272] GetProcessHeap () returned 0x580000 [0217.272] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0217.272] GetProcessHeap () returned 0x580000 [0217.272] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0217.272] GetProcessHeap () returned 0x580000 [0217.272] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91d97a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x664fd28, dwReserved1=0x6f3ef20, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0217.272] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.386] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned 1 [0217.387] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0217.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.387] CloseHandle (hObject=0x454) returned 1 [0217.387] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.387] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.id_1622540890_.your_last_chance")) returned 1 [0217.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~2.YOU")) returned 0x5b9770 [0217.388] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.389] GetProcessHeap () returned 0x580000 [0217.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13c1) returned 0x7461878 [0217.389] GetProcessHeap () returned 0x580000 [0217.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x13c1) returned 0x6de8f50 [0217.389] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.389] ReadFile (in: hFile=0x454, lpBuffer=0x7461878, nNumberOfBytesToRead=0x13a0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7461878*, lpNumberOfBytesRead=0x664ff14*=0x13a0, lpOverlapped=0x0) returned 1 [0217.427] GetProcessHeap () returned 0x580000 [0217.427] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.427] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.427] WriteFile (in: hFile=0x454, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x664ff14*=0x13a0, lpOverlapped=0x0) returned 1 [0217.428] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.428] WriteFile (in: hFile=0x454, lpBuffer=0x6dea2ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea2ef*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.428] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.428] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.428] CloseHandle (hObject=0x454) returned 1 [0217.433] GetProcessHeap () returned 0x580000 [0217.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0217.433] GetProcessHeap () returned 0x580000 [0217.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7461878 | out: hHeap=0x580000) returned 1 [0217.433] GetProcessHeap () returned 0x580000 [0217.433] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.057] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9356560, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x13df, dwReserved0=0x664fd28, dwReserved1=0x7461878, cFileName="FormsFormTemplate.html.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSF~2.YOU")) returned 0x5b9770 [0221.058] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.097] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", len=0x62 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned 1 [0221.097] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0221.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.098] CloseHandle (hObject=0x47c) returned 1 [0221.098] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0221.098] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.id_1622540890_.your_last_chance")) returned 1 [0221.110] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0221.110] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b9770 [0221.110] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0221.111] GetProcessHeap () returned 0x580000 [0221.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x65a138 [0221.111] GetProcessHeap () returned 0x580000 [0221.111] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x65a4e0 [0221.111] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.111] ReadFile (in: hFile=0x47c, lpBuffer=0x65a138, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a138*, lpNumberOfBytesRead=0x664ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.140] GetProcessHeap () returned 0x580000 [0221.140] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0221.140] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.140] WriteFile (in: hFile=0x47c, lpBuffer=0x65a4e0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a4e0*, lpNumberOfBytesWritten=0x664ff14*=0x360, lpOverlapped=0x0) returned 1 [0221.140] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.140] WriteFile (in: hFile=0x47c, lpBuffer=0x65a83f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x65a83f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0221.140] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0221.140] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0221.140] CloseHandle (hObject=0x47c) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65a4e0 | out: hHeap=0x580000) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65a138 | out: hHeap=0x580000) returned 1 [0221.240] GetProcessHeap () returned 0x580000 [0221.240] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0222.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb6beca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x389, dwReserved0=0x664fd28, dwReserved1=0x65a138, cFileName="rtf_bullets.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_BU~1.YOU")) returned 0x5b96f0 [0222.751] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.767] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", len=0x6a | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned 1 [0222.767] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0222.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0223.191] CloseHandle (hObject=0x460) returned 1 [0223.191] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.id_1622540890_.your_last_chance")) returned 1 [0223.192] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x69002e, dwReserved1=0x5f0064, cFileName="CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIRCLE~1.YOU")) returned 0x5b96b0 [0223.193] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0223.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460 [0223.193] GetProcessHeap () returned 0x580000 [0223.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32e1) returned 0x6f976f8 [0223.193] GetProcessHeap () returned 0x580000 [0223.193] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32e1) returned 0x6e063d0 [0223.193] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.193] ReadFile (in: hFile=0x460, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x32c0, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x664ff14*=0x32c0, lpOverlapped=0x0) returned 1 [0223.857] GetProcessHeap () returned 0x580000 [0223.857] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.857] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.857] WriteFile (in: hFile=0x460, lpBuffer=0x6e063d0*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesWritten=0x664ff14*=0x32c0, lpOverlapped=0x0) returned 1 [0223.858] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.858] WriteFile (in: hFile=0x460, lpBuffer=0x6e0968f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0968f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.858] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.858] WriteFile (in: hFile=0x460, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.858] CloseHandle (hObject=0x460) returned 1 [0223.858] GetProcessHeap () returned 0x580000 [0223.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0223.858] GetProcessHeap () returned 0x580000 [0223.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0223.858] GetProcessHeap () returned 0x580000 [0223.858] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd0a1be0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x32f1, dwReserved0=0x664fd28, dwReserved1=0x6f976f8, cFileName="CircleIcons.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CIRCLE~1.YOU")) returned 0x5b9630 [0226.154] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.173] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", len=0x35 | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 1 [0226.173] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0226.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0226.174] CloseHandle (hObject=0x4a4) returned 1 [0226.174] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.id_1622540890_.your_last_chance")) returned 1 [0226.175] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LATIN1~1.YOU")) returned 0x5b9730 [0226.176] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\latin1.shp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0226.176] GetProcessHeap () returned 0x580000 [0226.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71d8c98 [0226.176] GetProcessHeap () returned 0x580000 [0226.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71ea4c8 [0226.177] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.177] ReadFile (in: hFile=0x4a4, lpBuffer=0x71d8c98, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x71d8c98*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.452] GetProcessHeap () returned 0x580000 [0236.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0236.453] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.453] WriteFile (in: hFile=0x4a4, lpBuffer=0x71ea4c8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x71ea4c8*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0236.453] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.453] WriteFile (in: hFile=0x4a4, lpBuffer=0x71fbcc7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x71fbcc7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.156] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.156] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.156] CloseHandle (hObject=0x4a4) returned 1 [0239.394] GetProcessHeap () returned 0x580000 [0239.394] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71ea4c8 | out: hHeap=0x580000) returned 1 [0239.401] GetProcessHeap () returned 0x580000 [0239.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71d8c98 | out: hHeap=0x580000) returned 1 [0239.404] GetProcessHeap () returned 0x580000 [0239.404] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0240.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6117300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x89e92, dwReserved0=0x580000, dwReserved1=0x580000, cFileName="LATIN1.SHP.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LATIN1~1.YOU")) returned 0x5b9730 [0240.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.656] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML", len=0x4e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned 1 [0240.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0240.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.696] CloseHandle (hObject=0x45c) returned 1 [0240.696] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.696] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml.id_1622540890_.your_last_chance")) returned 1 [0240.697] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YADDEF~1.YOU")) returned 0x5b9730 [0240.697] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0240.697] GetProcessHeap () returned 0x580000 [0240.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08800 [0240.697] GetProcessHeap () returned 0x580000 [0240.697] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08b68 [0240.697] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.697] ReadFile (in: hFile=0x45c, lpBuffer=0x6d08800, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08800*, lpNumberOfBytesRead=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.750] GetProcessHeap () returned 0x580000 [0240.750] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.750] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.750] WriteFile (in: hFile=0x45c, lpBuffer=0x6d08b68*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08b68*, lpNumberOfBytesWritten=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.750] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.750] WriteFile (in: hFile=0x45c, lpBuffer=0x6d08e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08e87*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.750] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.750] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.750] CloseHandle (hObject=0x45c) returned 1 [0240.751] GetProcessHeap () returned 0x580000 [0240.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08b68 | out: hHeap=0x580000) returned 1 [0240.751] GetProcessHeap () returned 0x580000 [0240.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08800 | out: hHeap=0x580000) returned 1 [0240.751] GetProcessHeap () returned 0x580000 [0240.751] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7043f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x664fd28, dwReserved1=0x6d08800, cFileName="YAHOO.CO.KR.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YADDEF~1.YOU")) returned 0x5b9730 [0240.751] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.806] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML", len=0x4e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned 1 [0240.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0240.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.888] CloseHandle (hObject=0x264) returned 1 [0240.888] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.888] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.id_1622540890_.your_last_chance")) returned 1 [0240.889] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PACBEL~1.YOU")) returned 0x5b9730 [0240.890] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x264 [0240.890] GetProcessHeap () returned 0x580000 [0240.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0240.890] GetProcessHeap () returned 0x580000 [0240.890] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0240.890] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.890] ReadFile (in: hFile=0x264, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.894] GetProcessHeap () returned 0x580000 [0240.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.894] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.894] WriteFile (in: hFile=0x264, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x664ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.894] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.894] WriteFile (in: hFile=0x264, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.895] SetFilePointerEx (in: hFile=0x264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.895] WriteFile (in: hFile=0x264, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.895] CloseHandle (hObject=0x264) returned 1 [0240.895] GetProcessHeap () returned 0x580000 [0240.895] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0240.895] GetProcessHeap () returned 0x580000 [0240.895] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0240.895] GetProcessHeap () returned 0x580000 [0240.895] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.849] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc719aba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x664fd28, dwReserved1=0x6d0a340, cFileName="PACBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PACBEL~1.YOU")) returned 0x5b9630 [0241.849] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.863] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML", len=0x3f | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned 1 [0241.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0241.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0245.015] CloseHandle (hObject=0x48c) returned 1 [0245.015] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0245.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml.id_1622540890_.your_last_chance")) returned 1 [0245.016] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0245.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4233cc00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4233cc00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x9c4ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN04~1.YOU")) returned 0x5b96f0 [0245.016] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0245.016] GetProcessHeap () returned 0x580000 [0245.016] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x729b028 [0245.017] GetProcessHeap () returned 0x580000 [0245.017] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x72ac858 [0245.017] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0245.017] ReadFile (in: hFile=0x48c, lpBuffer=0x729b028, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x729b028*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.106] GetProcessHeap () returned 0x580000 [0248.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615df0 [0248.107] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.107] WriteFile (in: hFile=0x48c, lpBuffer=0x72ac858*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x72ac858*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0248.107] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.107] WriteFile (in: hFile=0x48c, lpBuffer=0x72be057*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x72be057*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0248.212] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.212] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0248.212] CloseHandle (hObject=0x48c) returned 1 [0248.249] GetProcessHeap () returned 0x580000 [0248.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72ac858 | out: hHeap=0x580000) returned 1 [0248.249] GetProcessHeap () returned 0x580000 [0248.249] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x729b028 | out: hHeap=0x580000) returned 1 [0248.255] GetProcessHeap () returned 0x580000 [0248.255] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615df0 | out: hHeap=0x580000) returned 1 [0253.197] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4233cc00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb7871e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9c4ee, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PGMN048.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGMN04~1.YOU")) returned 0x5b9730 [0253.198] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.271] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV", len=0x3d | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 1 [0253.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0253.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0253.361] CloseHandle (hObject=0x3a8) returned 1 [0253.361] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0253.361] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.id_1622540890_.your_last_chance")) returned 1 [0253.363] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0253.363] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x3f40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZCAR~2.YOU")) returned 0x5b9730 [0253.363] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0253.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0253.363] GetProcessHeap () returned 0x580000 [0253.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x70a1cf8 [0253.363] GetProcessHeap () returned 0x580000 [0253.363] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7007128 [0253.363] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0253.363] ReadFile (in: hFile=0x3a8, lpBuffer=0x70a1cf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x70a1cf8*, lpNumberOfBytesRead=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.078] GetProcessHeap () returned 0x580000 [0258.078] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0258.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x7007128*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7007128*, lpNumberOfBytesWritten=0x664ff14*=0x11800, lpOverlapped=0x0) returned 1 [0258.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x7018927*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7018927*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0258.079] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0258.079] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0258.080] CloseHandle (hObject=0x3a8) returned 1 [0258.290] GetProcessHeap () returned 0x580000 [0258.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7007128 | out: hHeap=0x580000) returned 1 [0258.290] GetProcessHeap () returned 0x580000 [0258.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70a1cf8 | out: hHeap=0x580000) returned 1 [0258.290] GetProcessHeap () returned 0x580000 [0258.290] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0259.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd158d6e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3f430, dwReserved0=0x664fd28, dwReserved1=0x70a1cf8, cFileName="BIZCARD.DPV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BIZCAR~2.YOU")) returned 0x5b9630 [0259.219] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.231] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML", len=0x3e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML") returned 1 [0259.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d8) returned 0x72e5948 [0259.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0259.408] CloseHandle (hObject=0x494) returned 1 [0259.408] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml.id_1622540890_.your_last_chance")) returned 1 [0259.409] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5d2b500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5d2b500, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x1716, dwReserved0=0x0, dwReserved1=0x0, cFileName="WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WITHCO~1.YOU")) returned 0x5b9630 [0259.409] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0259.409] GetProcessHeap () returned 0x580000 [0259.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x706d508 [0259.409] GetProcessHeap () returned 0x580000 [0259.409] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1721) returned 0x6de8f50 [0259.409] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.409] ReadFile (in: hFile=0x494, lpBuffer=0x706d508, nNumberOfBytesToRead=0x1700, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x706d508*, lpNumberOfBytesRead=0x664ff14*=0x1700, lpOverlapped=0x0) returned 1 [0260.174] GetProcessHeap () returned 0x580000 [0260.174] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0260.174] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.175] WriteFile (in: hFile=0x494, lpBuffer=0x6de8f50*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6de8f50*, lpNumberOfBytesWritten=0x664ff14*=0x1700, lpOverlapped=0x0) returned 1 [0260.175] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.175] WriteFile (in: hFile=0x494, lpBuffer=0x6dea64f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dea64f*, lpNumberOfBytesWritten=0x664ff14*=0x20, lpOverlapped=0x0) returned 1 [0260.175] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.175] WriteFile (in: hFile=0x494, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x664ff14*=0x4, lpOverlapped=0x0) returned 1 [0260.175] CloseHandle (hObject=0x494) returned 1 [0260.175] GetProcessHeap () returned 0x580000 [0260.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6de8f50 | out: hHeap=0x580000) returned 1 [0260.175] GetProcessHeap () returned 0x580000 [0260.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706d508 | out: hHeap=0x580000) returned 1 [0260.175] GetProcessHeap () returned 0x580000 [0260.175] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0260.175] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fccc | out: lpFindFileData=0x664fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5d2b500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd297cf20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x173a, dwReserved0=0x664fd28, dwReserved1=0x706d508, cFileName="WITHCOMP.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WITHCO~1.YOU")) returned 0x5b9630 [0260.176] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.274] SysReAllocStringLen (in: pbstr=0x664ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC", len=0x3e | out: pbstr=0x664ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC") returned 1 [0260.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0260.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0260.275] CloseHandle (hObject=0x3f4) returned 1 [0260.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.276] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc.id_1622540890_.your_last_chance")) returned 1 [0260.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x664ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.277] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x664fc74 | out: lpFindFileData=0x664fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17db9900, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17db9900, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDBAR98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIDBAR~1.YOU")) returned 0x5b9630 [0260.277] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0260.277] GetProcessHeap () returned 0x580000 [0260.277] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10761) returned 0x7237b58 [0260.278] GetProcessHeap () returned 0x580000 [0260.278] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10761) returned 0x72482c8 [0260.278] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.278] ReadFile (in: hFile=0x3f4, lpBuffer=0x7237b58, nNumberOfBytesToRead=0x10740, lpNumberOfBytesRead=0x664ff14, lpOverlapped=0x0 | out: lpBuffer=0x7237b58*, lpNumberOfBytesRead=0x664ff14*=0x10740, lpOverlapped=0x0) returned 1 Thread: id = 59 os_tid = 0xae4 [0039.071] Sleep (dwMilliseconds=0x1) [0039.093] Sleep (dwMilliseconds=0x1) [0039.114] Sleep (dwMilliseconds=0x1) [0039.151] Sleep (dwMilliseconds=0x1) [0039.286] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.581] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.813] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.292] Sleep (dwMilliseconds=0x1) [0040.350] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.506] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.326] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.103] Sleep (dwMilliseconds=0x1) [0043.118] Sleep (dwMilliseconds=0x1) [0043.142] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.557] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.696] Sleep (dwMilliseconds=0x1) [0043.702] Sleep (dwMilliseconds=0x1) [0043.718] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.902] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.362] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.399] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.539] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.570] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.069] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.147] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.304] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.459] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.506] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.052] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.208] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.364] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.973] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.066] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.331] Sleep (dwMilliseconds=0x1) [0047.354] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.487] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.784] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.002] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.158] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.267] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.314] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.579] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.735] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.891] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.094] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.203] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.344] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.687] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.874] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.498] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.919] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.997] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.075] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.231] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.543] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.779] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.060] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.138] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.169] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.263] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.512] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.550] Sleep (dwMilliseconds=0x1) [0052.559] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.668] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.715] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.871] Sleep (dwMilliseconds=0x1) [0052.887] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.136] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.183] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.292] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.495] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.620] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.807] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.509] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.634] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.977] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.055] Sleep (dwMilliseconds=0x1) [0055.071] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.200] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.336] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.367] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.431] Sleep (dwMilliseconds=0x1) [0055.445] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.492] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.671] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", len=0x4d | out: pbstr=0x678ff84*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 1 [0059.671] GetProcessHeap () returned 0x580000 [0059.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x668fa8, Size=0x4c) returned 0x669580 [0059.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0060.721] CloseHandle (hObject=0x454) returned 1 [0060.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.721] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id_1622540890_.your_last_chance")) returned 1 [0060.721] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.721] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b9630 [0060.722] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.722] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0060.722] GetProcessHeap () returned 0x580000 [0060.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x5f3908 [0060.722] GetProcessHeap () returned 0x580000 [0060.722] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5c1) returned 0x6c56108 [0060.722] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.722] ReadFile (in: hFile=0x454, lpBuffer=0x5f3908, nNumberOfBytesToRead=0x5a0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5f3908*, lpNumberOfBytesRead=0x678ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0060.728] GetProcessHeap () returned 0x580000 [0060.728] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0060.728] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.728] WriteFile (in: hFile=0x454, lpBuffer=0x6c56108*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c56108*, lpNumberOfBytesWritten=0x678ff14*=0x5a0, lpOverlapped=0x0) returned 1 [0060.728] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.729] WriteFile (in: hFile=0x454, lpBuffer=0x6c566a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c566a7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0060.729] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.729] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0060.729] CloseHandle (hObject=0x454) returned 1 [0060.730] GetProcessHeap () returned 0x580000 [0060.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c56108 | out: hHeap=0x580000) returned 1 [0060.730] GetProcessHeap () returned 0x580000 [0060.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0060.730] GetProcessHeap () returned 0x580000 [0060.730] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0060.730] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0x5bfe2d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x678fd28, dwReserved1=0x5f3908, cFileName="ProjectMUI.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~1.YOU")) returned 0x5b9630 [0060.730] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.873] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x678ff84*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0060.876] GetProcessHeap () returned 0x580000 [0060.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f768, Size=0x2c) returned 0x61f730 [0060.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0060.891] CloseHandle (hObject=0x430) returned 1 [0060.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.892] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance")) returned 1 [0060.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.892] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9630 [0060.892] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0060.892] GetProcessHeap () returned 0x580000 [0060.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x6ea9ca0 [0060.892] GetProcessHeap () returned 0x580000 [0060.892] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24a1) returned 0x6eac150 [0060.893] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.893] ReadFile (in: hFile=0x430, lpBuffer=0x6ea9ca0, nNumberOfBytesToRead=0x2480, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea9ca0*, lpNumberOfBytesRead=0x678ff14*=0x2480, lpOverlapped=0x0) returned 1 [0062.097] GetProcessHeap () returned 0x580000 [0062.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615bc0 [0062.097] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.097] WriteFile (in: hFile=0x430, lpBuffer=0x6eac150*, nNumberOfBytesToWrite=0x2480, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eac150*, lpNumberOfBytesWritten=0x678ff14*=0x2480, lpOverlapped=0x0) returned 1 [0062.097] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.097] WriteFile (in: hFile=0x430, lpBuffer=0x6eae5cf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6eae5cf*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0062.097] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.097] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0062.097] CloseHandle (hObject=0x430) returned 1 [0062.098] GetProcessHeap () returned 0x580000 [0062.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eac150 | out: hHeap=0x580000) returned 1 [0062.098] GetProcessHeap () returned 0x580000 [0062.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea9ca0 | out: hHeap=0x580000) returned 1 [0062.098] GetProcessHeap () returned 0x580000 [0062.098] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615bc0 | out: hHeap=0x580000) returned 1 [0062.098] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x5ccd44a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x24ac, dwReserved0=0x678fd28, dwReserved1=0x6ea9ca0, cFileName="Setup.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETUPX~1.YOU")) returned 0x5b9670 [0062.099] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0063.167] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", len=0x55 | out: pbstr=0x678ff84*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 1 [0063.167] GetProcessHeap () returned 0x580000 [0063.167] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5bc8, Size=0x28) returned 0x5b5bc8 [0063.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0064.539] CloseHandle (hObject=0x408) returned 1 [0064.539] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0064.540] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id_1622540890_.your_last_chance")) returned 1 [0065.458] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0065.458] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCLRC~1.YOU")) returned 0x5b9630 [0065.459] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0065.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x408 [0065.459] GetProcessHeap () returned 0x580000 [0065.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f468d8 [0065.460] GetProcessHeap () returned 0x580000 [0065.460] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f58108 [0065.460] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.460] ReadFile (in: hFile=0x408, lpBuffer=0x6f468d8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f468d8*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0069.204] GetProcessHeap () returned 0x580000 [0069.204] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0069.204] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0069.204] WriteFile (in: hFile=0x408, lpBuffer=0x6f58108*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f58108*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0070.031] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.031] WriteFile (in: hFile=0x408, lpBuffer=0x6f69907*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69907*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0070.051] SetFilePointerEx (in: hFile=0x408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0070.051] WriteFile (in: hFile=0x408, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0070.051] CloseHandle (hObject=0x408) returned 1 [0075.375] GetProcessHeap () returned 0x580000 [0075.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f58108 | out: hHeap=0x580000) returned 1 [0075.375] GetProcessHeap () returned 0x580000 [0075.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f468d8 | out: hHeap=0x580000) returned 1 [0075.375] GetProcessHeap () returned 0x580000 [0075.375] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0079.340] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x6489bca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7eb8, dwReserved0=0x678fd28, dwReserved1=0x6f468d8, cFileName="AccLR.cab.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACCLRC~1.YOU")) returned 0x5b96f0 [0079.340] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.455] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", len=0x47 | out: pbstr=0x678ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 1 [0079.455] GetProcessHeap () returned 0x580000 [0079.455] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e94e0 | out: hHeap=0x580000) returned 1 [0079.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0080.062] CloseHandle (hObject=0x498) returned 1 [0080.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0080.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id_1622540890_.your_last_chance")) returned 1 [0080.063] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0080.063] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADO210~1.YOU")) returned 0x5b9730 [0080.063] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0080.063] GetProcessHeap () returned 0x580000 [0080.063] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f6a940 [0080.064] GetProcessHeap () returned 0x580000 [0080.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f7c170 [0080.064] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0080.064] ReadFile (in: hFile=0x498, lpBuffer=0x6f6a940, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a940*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.549] GetProcessHeap () returned 0x580000 [0081.549] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615aa8 [0081.550] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.550] WriteFile (in: hFile=0x498, lpBuffer=0x6f7c170*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f7c170*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0081.550] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.550] WriteFile (in: hFile=0x498, lpBuffer=0x6f8d96f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f8d96f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0081.560] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0081.560] WriteFile (in: hFile=0x498, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0081.560] CloseHandle (hObject=0x498) returned 1 [0081.560] GetProcessHeap () returned 0x580000 [0081.560] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f7c170 | out: hHeap=0x580000) returned 1 [0081.561] GetProcessHeap () returned 0x580000 [0081.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a940 | out: hHeap=0x580000) returned 1 [0081.561] GetProcessHeap () returned 0x580000 [0081.561] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615aa8 | out: hHeap=0x580000) returned 1 [0081.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x683abe80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x19a423, dwReserved0=0x678fd28, dwReserved1=0x6f6a940, cFileName="ADO210.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADO210~1.YOU")) returned 0x5b9730 [0081.670] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.475] Sleep (dwMilliseconds=0x1) [0084.497] Sleep (dwMilliseconds=0x1) [0091.675] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", len=0x45 | out: pbstr=0x678ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 1 [0091.675] GetProcessHeap () returned 0x580000 [0091.675] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0091.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.693] CloseHandle (hObject=0x3f4) returned 1 [0091.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0091.693] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id_1622540890_.your_last_chance")) returned 1 [0091.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0091.694] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECHOEL~1.YOU")) returned 0x5b96f0 [0091.694] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0091.694] GetProcessHeap () returned 0x580000 [0091.694] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb0e1) returned 0x626d18 [0091.695] GetProcessHeap () returned 0x580000 [0091.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb0e1) returned 0x6c6a0f8 [0091.695] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.695] ReadFile (in: hFile=0x3f4, lpBuffer=0x626d18, nNumberOfBytesToRead=0xb0c0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x678ff14*=0xb0c0, lpOverlapped=0x0) returned 1 [0095.346] GetProcessHeap () returned 0x580000 [0095.346] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0095.346] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.346] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c6a0f8*, nNumberOfBytesToWrite=0xb0c0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c6a0f8*, lpNumberOfBytesWritten=0x678ff14*=0xb0c0, lpOverlapped=0x0) returned 1 [0095.347] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.347] WriteFile (in: hFile=0x3f4, lpBuffer=0x6c751b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c751b7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0095.347] SetFilePointerEx (in: hFile=0x3f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0095.347] WriteFile (in: hFile=0x3f4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0095.347] CloseHandle (hObject=0x3f4) returned 1 [0095.347] GetProcessHeap () returned 0x580000 [0095.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c6a0f8 | out: hHeap=0x580000) returned 1 [0095.347] GetProcessHeap () returned 0x580000 [0095.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0095.347] GetProcessHeap () returned 0x580000 [0095.347] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0095.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70709ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0f2, dwReserved0=0x678fd28, dwReserved1=0x626d18, cFileName="ECHO.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ECHOEL~1.YOU")) returned 0x5b96f0 [0095.348] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0096.781] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", len=0x48 | out: pbstr=0x678ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 1 [0096.781] GetProcessHeap () returned 0x580000 [0096.781] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x18) returned 0x5a5888 [0096.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0099.076] CloseHandle (hObject=0x3f8) returned 1 [0099.076] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0099.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0099.077] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0099.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0099.077] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0099.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0099.077] GetProcessHeap () returned 0x580000 [0099.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6f0c4f8 [0099.077] GetProcessHeap () returned 0x580000 [0099.077] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x5a1) returned 0x6c676b8 [0099.077] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.078] ReadFile (in: hFile=0x3f8, lpBuffer=0x6f0c4f8, nNumberOfBytesToRead=0x580, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c4f8*, lpNumberOfBytesRead=0x678ff14*=0x580, lpOverlapped=0x0) returned 1 [0099.084] GetProcessHeap () returned 0x580000 [0099.084] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0099.084] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.084] WriteFile (in: hFile=0x3f8, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x678ff14*=0x580, lpOverlapped=0x0) returned 1 [0099.084] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.084] WriteFile (in: hFile=0x3f8, lpBuffer=0x6c67c37*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c67c37*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0099.084] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0099.084] WriteFile (in: hFile=0x3f8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0099.084] CloseHandle (hObject=0x3f8) returned 1 [0099.084] GetProcessHeap () returned 0x580000 [0099.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0099.084] GetProcessHeap () returned 0x580000 [0099.084] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c4f8 | out: hHeap=0x580000) returned 1 [0099.084] GetProcessHeap () returned 0x580000 [0099.085] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0099.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72abe6a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x5c3, dwReserved0=0x678fd28, dwReserved1=0x6f0c4f8, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96b0 [0099.085] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0099.154] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", len=0x49 | out: pbstr=0x678ff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 1 [0099.155] GetProcessHeap () returned 0x580000 [0099.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0xc) returned 0x5e9528 [0099.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0100.621] CloseHandle (hObject=0x474) returned 1 [0100.621] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0100.621] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id_1622540890_.your_last_chance")) returned 1 [0100.622] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0100.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SONORA~2.YOU")) returned 0x5b9730 [0100.622] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0100.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0100.622] GetProcessHeap () returned 0x580000 [0100.622] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd5a1) returned 0x6c57108 [0100.623] GetProcessHeap () returned 0x580000 [0100.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd5a1) returned 0x6f1bea8 [0100.623] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.624] ReadFile (in: hFile=0x474, lpBuffer=0x6c57108, nNumberOfBytesToRead=0xd580, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x678ff14*=0xd580, lpOverlapped=0x0) returned 1 [0103.372] GetProcessHeap () returned 0x580000 [0103.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0103.373] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.373] WriteFile (in: hFile=0x474, lpBuffer=0x6f1bea8*, nNumberOfBytesToWrite=0xd580, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesWritten=0x678ff14*=0xd580, lpOverlapped=0x0) returned 1 [0103.373] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.373] WriteFile (in: hFile=0x474, lpBuffer=0x6f29427*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f29427*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0103.373] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0103.373] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0103.374] CloseHandle (hObject=0x474) returned 1 [0103.374] GetProcessHeap () returned 0x580000 [0103.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0103.374] GetProcessHeap () returned 0x580000 [0103.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0103.374] GetProcessHeap () returned 0x580000 [0103.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0103.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x753a80c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd5c3, dwReserved0=0x678fd28, dwReserved1=0x6c57108, cFileName="SONORA.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SONORA~2.YOU")) returned 0x5b9630 [0103.374] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.053] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", len=0x4f | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 1 [0112.053] GetProcessHeap () returned 0x580000 [0112.053] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x2c) returned 0x61f8f0 [0112.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.066] Sleep (dwMilliseconds=0x1) [0112.160] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", len=0x51 | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 1 [0112.160] GetProcessHeap () returned 0x580000 [0112.160] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x3c) returned 0x61abb8 [0112.160] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.186] Sleep (dwMilliseconds=0x1) [0112.323] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", len=0x4d | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned 1 [0112.323] GetProcessHeap () returned 0x580000 [0112.323] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9510 | out: hHeap=0x580000) returned 1 [0112.323] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.323] Sleep (dwMilliseconds=0x1) [0112.339] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.339] GetProcessHeap () returned 0x580000 [0112.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.339] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.339] Sleep (dwMilliseconds=0x1) [0112.357] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv", len=0x48 | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv") returned 1 [0112.357] GetProcessHeap () returned 0x580000 [0112.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c562c0, Size=0x5c) returned 0x6c561f0 [0112.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.357] Sleep (dwMilliseconds=0x1) [0112.387] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", len=0x42 | out: pbstr=0x678ff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned 1 [0112.387] GetProcessHeap () returned 0x580000 [0112.388] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x30) returned 0x61f810 [0112.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.388] Sleep (dwMilliseconds=0x1) [0113.314] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", len=0x3f | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 1 [0113.315] GetProcessHeap () returned 0x580000 [0113.315] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xec) returned 0x6f0ceb8 [0113.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0113.492] CloseHandle (hObject=0x49c) returned 1 [0113.492] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.493] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.985] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.986] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0411~1.YOU")) returned 0x5b9630 [0114.986] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0114.986] GetProcessHeap () returned 0x580000 [0114.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6d06ca8 [0114.986] GetProcessHeap () returned 0x580000 [0114.986] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6e00ac0 [0114.986] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.986] ReadFile (in: hFile=0x49c, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x17a0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x678ff14*=0x17a0, lpOverlapped=0x0) returned 1 [0115.008] GetProcessHeap () returned 0x580000 [0115.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0115.008] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.008] WriteFile (in: hFile=0x49c, lpBuffer=0x6e00ac0*, nNumberOfBytesToWrite=0x17a0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesWritten=0x678ff14*=0x17a0, lpOverlapped=0x0) returned 1 [0115.008] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.008] WriteFile (in: hFile=0x49c, lpBuffer=0x6e0225f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0225f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0115.008] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.008] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0115.008] CloseHandle (hObject=0x49c) returned 1 [0115.008] GetProcessHeap () returned 0x580000 [0115.008] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0115.008] GetProcessHeap () returned 0x580000 [0115.008] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0115.009] GetProcessHeap () returned 0x580000 [0115.009] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0116.113] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c2a4280, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17d0, dwReserved0=0x678fd28, dwReserved1=0x6d06ca8, cFileName="AN04117_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0411~1.YOU")) returned 0x5b9630 [0116.113] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0116.143] CloseHandle (hObject=0x430) returned 1 [0116.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0116.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.id_1622540890_.your_last_chance")) returned 1 [0116.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0116.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0001~1.YOU")) returned 0x5b9630 [0116.144] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0116.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0116.144] GetProcessHeap () returned 0x580000 [0116.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3301) returned 0x6dbe1b0 [0116.144] GetProcessHeap () returned 0x580000 [0116.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3301) returned 0x6dc14c0 [0116.144] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0116.144] ReadFile (in: hFile=0x430, lpBuffer=0x6dbe1b0, nNumberOfBytesToRead=0x32e0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dbe1b0*, lpNumberOfBytesRead=0x678ff14*=0x32e0, lpOverlapped=0x0) returned 1 [0117.163] GetProcessHeap () returned 0x580000 [0117.163] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0117.163] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.164] WriteFile (in: hFile=0x430, lpBuffer=0x6dc14c0*, nNumberOfBytesToWrite=0x32e0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc14c0*, lpNumberOfBytesWritten=0x678ff14*=0x32e0, lpOverlapped=0x0) returned 1 [0117.164] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.164] WriteFile (in: hFile=0x430, lpBuffer=0x6dc479f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc479f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0117.164] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0117.164] WriteFile (in: hFile=0x430, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0117.164] CloseHandle (hObject=0x430) returned 1 [0117.164] GetProcessHeap () returned 0x580000 [0117.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc14c0 | out: hHeap=0x580000) returned 1 [0117.164] GetProcessHeap () returned 0x580000 [0117.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dbe1b0 | out: hHeap=0x580000) returned 1 [0117.164] GetProcessHeap () returned 0x580000 [0117.164] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0118.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d72c040, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x331a, dwReserved0=0x678fd28, dwReserved1=0x6dbe1b0, cFileName="SO00018_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0001~1.YOU")) returned 0x5b9630 [0118.891] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0118.986] CloseHandle (hObject=0x454) returned 1 [0118.986] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.987] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~2.YOU")) returned 0x5b9630 [0118.987] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0118.987] GetProcessHeap () returned 0x580000 [0118.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0118.987] GetProcessHeap () returned 0x580000 [0118.987] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x6c553a8 [0118.987] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.987] ReadFile (in: hFile=0x454, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x678ff14*=0xae0, lpOverlapped=0x0) returned 1 [0119.014] GetProcessHeap () returned 0x580000 [0119.014] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0119.014] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.014] WriteFile (in: hFile=0x454, lpBuffer=0x6c553a8*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c553a8*, lpNumberOfBytesWritten=0x678ff14*=0xae0, lpOverlapped=0x0) returned 1 [0119.014] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.014] WriteFile (in: hFile=0x454, lpBuffer=0x6c55e87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55e87*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.014] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.014] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.016] CloseHandle (hObject=0x454) returned 1 [0119.016] GetProcessHeap () returned 0x580000 [0119.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c553a8 | out: hHeap=0x580000) returned 1 [0119.016] GetProcessHeap () returned 0x580000 [0119.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0119.016] GetProcessHeap () returned 0x580000 [0119.016] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0119.016] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e8e03e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb14, dwReserved0=0x678fd28, dwReserved1=0x677cd0, cFileName="SO02269_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0226~2.YOU")) returned 0x5b9630 [0119.016] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0119.113] CloseHandle (hObject=0x3fc) returned 1 [0119.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0119.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.id_1622540890_.your_last_chance")) returned 1 [0119.113] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0119.114] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0222~2.YOU")) returned 0x5b9630 [0119.114] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0119.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0119.114] GetProcessHeap () returned 0x580000 [0119.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6dd8f68 [0119.114] GetProcessHeap () returned 0x580000 [0119.114] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x561) returned 0x6dd94f0 [0119.114] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.114] ReadFile (in: hFile=0x3fc, lpBuffer=0x6dd8f68, nNumberOfBytesToRead=0x540, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd8f68*, lpNumberOfBytesRead=0x678ff14*=0x540, lpOverlapped=0x0) returned 1 [0119.139] GetProcessHeap () returned 0x580000 [0119.139] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616368 [0119.139] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.139] WriteFile (in: hFile=0x3fc, lpBuffer=0x6dd94f0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd94f0*, lpNumberOfBytesWritten=0x678ff14*=0x540, lpOverlapped=0x0) returned 1 [0119.139] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.139] WriteFile (in: hFile=0x3fc, lpBuffer=0x6dd9a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd9a2f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0119.139] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0119.139] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0119.139] CloseHandle (hObject=0x3fc) returned 1 [0119.545] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd94f0 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dd8f68 | out: hHeap=0x580000) returned 1 [0119.546] GetProcessHeap () returned 0x580000 [0119.546] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616368 | out: hHeap=0x580000) returned 1 [0120.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ea10ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x678fd28, dwReserved1=0x6dd8f68, cFileName="SO02227_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0222~2.YOU")) returned 0x5b96f0 [0120.126] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.154] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", len=0x4c | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 1 [0120.154] GetProcessHeap () returned 0x580000 [0120.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ac) returned 0x6d06ca8 [0120.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.143] CloseHandle (hObject=0x440) returned 1 [0122.143] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.143] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.id_1622540890_.your_last_chance")) returned 1 [0122.144] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0078~1.YOU")) returned 0x5b9730 [0122.144] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x440 [0122.144] GetProcessHeap () returned 0x580000 [0122.144] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fa1) returned 0x6cfecd8 [0122.145] GetProcessHeap () returned 0x580000 [0122.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1fa1) returned 0x6f3bea8 [0122.145] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.145] ReadFile (in: hFile=0x440, lpBuffer=0x6cfecd8, nNumberOfBytesToRead=0x1f80, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cfecd8*, lpNumberOfBytesRead=0x678ff14*=0x1f80, lpOverlapped=0x0) returned 1 [0122.709] GetProcessHeap () returned 0x580000 [0122.709] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.709] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.710] WriteFile (in: hFile=0x440, lpBuffer=0x6f3bea8*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3bea8*, lpNumberOfBytesWritten=0x678ff14*=0x1f80, lpOverlapped=0x0) returned 1 [0122.710] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.710] WriteFile (in: hFile=0x440, lpBuffer=0x6f3de27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3de27*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0122.710] SetFilePointerEx (in: hFile=0x440, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.710] WriteFile (in: hFile=0x440, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0122.710] CloseHandle (hObject=0x440) returned 1 [0122.710] GetProcessHeap () returned 0x580000 [0122.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3bea8 | out: hHeap=0x580000) returned 1 [0122.710] GetProcessHeap () returned 0x580000 [0122.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cfecd8 | out: hHeap=0x580000) returned 1 [0122.710] GetProcessHeap () returned 0x580000 [0122.710] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80c229c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x678fd28, dwReserved1=0x6cfecd8, cFileName="WB00780L.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0078~1.YOU")) returned 0x5b9730 [0124.722] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.328] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", len=0x3d | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned 1 [0125.328] GetProcessHeap () returned 0x580000 [0125.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e8) returned 0x6f42f08 [0125.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0128.593] CloseHandle (hObject=0x488) returned 1 [0128.595] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.599] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.id_1622540890_.your_last_chance")) returned 1 [0129.062] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01997~1.YOU")) returned 0x5b96f0 [0129.062] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0129.062] GetProcessHeap () returned 0x580000 [0129.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6c676b8 [0129.066] GetProcessHeap () returned 0x580000 [0129.066] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x921) returned 0x6c2a820 [0129.066] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.066] ReadFile (in: hFile=0x488, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x900, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x678ff14*=0x900, lpOverlapped=0x0) returned 1 [0129.075] GetProcessHeap () returned 0x580000 [0129.075] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.075] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.075] WriteFile (in: hFile=0x488, lpBuffer=0x6c2a820*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesWritten=0x678ff14*=0x900, lpOverlapped=0x0) returned 1 [0129.075] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.075] WriteFile (in: hFile=0x488, lpBuffer=0x6c2b11f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2b11f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0129.076] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.076] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0129.076] CloseHandle (hObject=0x488) returned 1 [0129.076] GetProcessHeap () returned 0x580000 [0129.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0129.076] GetProcessHeap () returned 0x580000 [0129.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0129.076] GetProcessHeap () returned 0x580000 [0129.076] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.488] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848d5ac0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x678fd28, dwReserved1=0x6c676b8, cFileName="J0199727.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J01997~1.YOU")) returned 0x5b9730 [0129.489] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.699] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta", len=0x3e | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 1 [0129.699] GetProcessHeap () returned 0x580000 [0129.699] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0129.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0132.311] CloseHandle (hObject=0x480) returned 1 [0132.311] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0132.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id_1622540890_.your_last_chance")) returned 1 [0132.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0132.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b9730 [0132.313] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0132.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0132.313] GetProcessHeap () returned 0x580000 [0132.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e7e640 [0132.314] GetProcessHeap () returned 0x580000 [0132.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8fe70 [0132.315] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0132.315] ReadFile (in: hFile=0x480, lpBuffer=0x6e7e640, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e7e640*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0137.608] GetProcessHeap () returned 0x580000 [0137.608] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0137.609] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0137.609] WriteFile (in: hFile=0x480, lpBuffer=0x6e8fe70*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8fe70*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0138.495] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.495] WriteFile (in: hFile=0x480, lpBuffer=0x6ea166f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea166f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0138.495] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.495] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0138.495] CloseHandle (hObject=0x480) returned 1 [0138.572] GetProcessHeap () returned 0x580000 [0138.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8fe70 | out: hHeap=0x580000) returned 1 [0138.572] GetProcessHeap () returned 0x580000 [0138.572] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e7e640 | out: hHeap=0x580000) returned 1 [0138.575] GetProcessHeap () returned 0x580000 [0138.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0139.877] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a28b7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x199a8, dwReserved0=0x678fd28, dwReserved1=0x580000, cFileName="Discussion.gta.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DISCUS~1.YOU")) returned 0x5b9770 [0139.877] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.903] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", len=0x57 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css") returned 1 [0139.903] GetProcessHeap () returned 0x580000 [0139.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0139.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.095] CloseHandle (hObject=0x3b4) returned 1 [0140.095] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.096] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance")) returned 1 [0140.096] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74f, dwReserved0=0x5f0052, dwReserved1=0x41004c, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0140.096] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0140.097] GetProcessHeap () returned 0x580000 [0140.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cda390 [0140.097] GetProcessHeap () returned 0x580000 [0140.097] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x761) returned 0x6cdab18 [0140.097] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.097] ReadFile (in: hFile=0x3b4, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x740, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x678ff14*=0x740, lpOverlapped=0x0) returned 1 [0140.104] GetProcessHeap () returned 0x580000 [0140.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0140.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x6cdab18*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab18*, lpNumberOfBytesWritten=0x678ff14*=0x740, lpOverlapped=0x0) returned 1 [0140.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x6cdb257*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb257*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.105] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.105] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.105] CloseHandle (hObject=0x3b4) returned 1 [0140.105] GetProcessHeap () returned 0x580000 [0140.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab18 | out: hHeap=0x580000) returned 1 [0140.105] GetProcessHeap () returned 0x580000 [0140.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0140.105] GetProcessHeap () returned 0x580000 [0140.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0140.408] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b2046e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x773, dwReserved0=0x678fd28, dwReserved1=0x6cda390, cFileName="OliveGreen.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLIVEG~1.YOU")) returned 0x5b9770 [0140.408] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.449] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", len=0x43 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned 1 [0140.449] GetProcessHeap () returned 0x580000 [0140.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc0) returned 0x6f14048 [0140.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.570] CloseHandle (hObject=0x428) returned 1 [0140.570] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.570] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.id_1622540890_.your_last_chance")) returned 1 [0140.571] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1503~1.YOU")) returned 0x5b9770 [0140.571] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0140.571] GetProcessHeap () returned 0x580000 [0140.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x5aa990 [0140.571] GetProcessHeap () returned 0x580000 [0140.571] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x181) returned 0x65f0b0 [0140.571] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.571] ReadFile (in: hFile=0x428, lpBuffer=0x5aa990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5aa990*, lpNumberOfBytesRead=0x678ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.573] GetProcessHeap () returned 0x580000 [0140.573] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcee40 [0140.573] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.573] WriteFile (in: hFile=0x428, lpBuffer=0x65f0b0*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f0b0*, lpNumberOfBytesWritten=0x678ff14*=0x160, lpOverlapped=0x0) returned 1 [0140.573] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.574] WriteFile (in: hFile=0x428, lpBuffer=0x65f20f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x65f20f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0140.574] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.574] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0140.574] CloseHandle (hObject=0x428) returned 1 [0140.574] GetProcessHeap () returned 0x580000 [0140.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f0b0 | out: hHeap=0x580000) returned 1 [0140.574] GetProcessHeap () returned 0x580000 [0140.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5aa990 | out: hHeap=0x580000) returned 1 [0140.574] GetProcessHeap () returned 0x580000 [0140.574] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcee40 | out: hHeap=0x580000) returned 1 [0141.010] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b67b020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x678fd28, dwReserved1=0x5aa990, cFileName="BD15035_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD1503~1.YOU")) returned 0x5b9730 [0141.010] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0142.031] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK", len=0x41 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 1 [0142.032] GetProcessHeap () returned 0x580000 [0142.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea4) returned 0x6f14048 [0142.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.122] CloseHandle (hObject=0x4a4) returned 1 [0144.122] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0144.122] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0144.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0144.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~2.YOU")) returned 0x5b96f0 [0144.123] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0144.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0144.124] GetProcessHeap () returned 0x580000 [0144.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0144.124] GetProcessHeap () returned 0x580000 [0144.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0144.124] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.124] ReadFile (in: hFile=0x4a4, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x678ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.125] GetProcessHeap () returned 0x580000 [0144.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0144.125] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.125] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x678ff14*=0x60, lpOverlapped=0x0) returned 1 [0144.125] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.125] WriteFile (in: hFile=0x4a4, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0144.125] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0144.125] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0144.125] CloseHandle (hObject=0x4a4) returned 1 [0144.125] GetProcessHeap () returned 0x580000 [0144.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0144.125] GetProcessHeap () returned 0x580000 [0144.125] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0144.126] GetProcessHeap () returned 0x580000 [0144.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0146.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d840840, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x678fd28, dwReserved1=0x61b540, cFileName="OUTLOOK_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OUTLOO~2.YOU")) returned 0x5b96f0 [0146.863] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.878] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", len=0x44 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned 1 [0146.878] GetProcessHeap () returned 0x580000 [0146.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0146.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.483] CloseHandle (hObject=0x4a4) returned 1 [0152.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0152.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.id_1622540890_.your_last_chance")) returned 1 [0152.483] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0152.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x313b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR23~1.YOU")) returned 0x5b9730 [0152.484] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0152.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0152.484] GetProcessHeap () returned 0x580000 [0152.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3141) returned 0x6d991c8 [0152.484] GetProcessHeap () returned 0x580000 [0152.484] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3141) returned 0x6f62ab8 [0152.484] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.484] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d991c8, nNumberOfBytesToRead=0x3120, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d991c8*, lpNumberOfBytesRead=0x678ff14*=0x3120, lpOverlapped=0x0) returned 1 [0153.912] GetProcessHeap () returned 0x580000 [0153.912] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0153.912] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.912] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f62ab8*, nNumberOfBytesToWrite=0x3120, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62ab8*, lpNumberOfBytesWritten=0x678ff14*=0x3120, lpOverlapped=0x0) returned 1 [0153.912] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x4a4, lpBuffer=0x6f65bd7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f65bd7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0153.913] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.913] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0153.913] CloseHandle (hObject=0x4a4) returned 1 [0153.913] GetProcessHeap () returned 0x580000 [0153.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f62ab8 | out: hHeap=0x580000) returned 1 [0153.913] GetProcessHeap () returned 0x580000 [0153.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d991c8 | out: hHeap=0x580000) returned 1 [0153.913] GetProcessHeap () returned 0x580000 [0153.913] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0153.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x935ae7c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x315f, dwReserved0=0x678fd28, dwReserved1=0x6d991c8, cFileName="PDIR23F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR23~1.YOU")) returned 0x5b9630 [0153.913] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.676] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", len=0x40 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE") returned 1 [0154.676] GetProcessHeap () returned 0x580000 [0154.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0154.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0159.146] CloseHandle (hObject=0x4a4) returned 1 [0159.146] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id_1622540890_.your_last_chance")) returned 1 [0159.147] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZTO~1.YOU")) returned 0x5b9630 [0159.147] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0159.147] GetProcessHeap () returned 0x580000 [0159.147] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fbfce8 [0159.147] GetProcessHeap () returned 0x580000 [0159.147] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd1518 [0159.147] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.147] ReadFile (in: hFile=0x4a4, lpBuffer=0x6fbfce8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbfce8*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.372] GetProcessHeap () returned 0x580000 [0165.372] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09850 [0165.372] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.372] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fd1518*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd1518*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0165.373] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.373] WriteFile (in: hFile=0x4a4, lpBuffer=0x6fe2d17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe2d17*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0165.374] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0165.374] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0165.374] CloseHandle (hObject=0x4a4) returned 1 [0165.374] GetProcessHeap () returned 0x580000 [0165.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd1518 | out: hHeap=0x580000) returned 1 [0165.374] GetProcessHeap () returned 0x580000 [0165.374] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbfce8 | out: hHeap=0x580000) returned 1 [0165.379] GetProcessHeap () returned 0x580000 [0165.379] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09850 | out: hHeap=0x580000) returned 1 [0169.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a2e1900, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb39024, dwReserved0=0x580000, dwReserved1=0x6dd7c28, cFileName="ACWZTOOL.ACCDE.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACWZTO~1.YOU")) returned 0x5b9730 [0169.810] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0169.870] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", len=0x3f | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 1 [0169.870] GetProcessHeap () returned 0x580000 [0169.870] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0169.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0170.007] CloseHandle (hObject=0x464) returned 1 [0170.007] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.007] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id_1622540890_.your_last_chance")) returned 1 [0170.008] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLRSAM~1.YOU")) returned 0x5b9730 [0170.008] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0170.008] GetProcessHeap () returned 0x580000 [0170.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3da1) returned 0x6fa8f28 [0170.008] GetProcessHeap () returned 0x580000 [0170.008] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3da1) returned 0x70479c8 [0170.009] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.009] ReadFile (in: hFile=0x464, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x3d80, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x678ff14*=0x3d80, lpOverlapped=0x0) returned 1 [0171.125] GetProcessHeap () returned 0x580000 [0171.125] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0171.125] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x464, lpBuffer=0x70479c8*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x70479c8*, lpNumberOfBytesWritten=0x678ff14*=0x3d80, lpOverlapped=0x0) returned 1 [0171.125] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x464, lpBuffer=0x704b747*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x704b747*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0171.125] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.125] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0171.125] CloseHandle (hObject=0x464) returned 1 [0171.126] GetProcessHeap () returned 0x580000 [0171.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70479c8 | out: hHeap=0x580000) returned 1 [0171.126] GetProcessHeap () returned 0x580000 [0171.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0171.126] GetProcessHeap () returned 0x580000 [0171.126] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d9c7460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3db4, dwReserved0=0x678fd28, dwReserved1=0x6fa8f28, cFileName="OLR.SAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OLRSAM~1.YOU")) returned 0x5b9770 [0173.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.085] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", len=0x42 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 1 [0173.085] GetProcessHeap () returned 0x580000 [0173.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0173.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.123] CloseHandle (hObject=0x490) returned 1 [0173.123] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.123] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id_1622540890_.your_last_chance")) returned 1 [0173.124] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3081d900, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~2.YOU")) returned 0x5b9770 [0173.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.124] GetProcessHeap () returned 0x580000 [0173.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662288 [0173.124] GetProcessHeap () returned 0x580000 [0173.124] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xbc1) returned 0x662e90 [0173.124] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.124] ReadFile (in: hFile=0x490, lpBuffer=0x662288, nNumberOfBytesToRead=0xba0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x662288*, lpNumberOfBytesRead=0x678ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.176] GetProcessHeap () returned 0x580000 [0173.176] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.176] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.176] WriteFile (in: hFile=0x490, lpBuffer=0x662e90*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x662e90*, lpNumberOfBytesWritten=0x678ff14*=0xba0, lpOverlapped=0x0) returned 1 [0173.176] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.176] WriteFile (in: hFile=0x490, lpBuffer=0x663a2f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x663a2f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0173.176] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.176] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0173.176] CloseHandle (hObject=0x490) returned 1 [0173.176] GetProcessHeap () returned 0x580000 [0173.176] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662e90 | out: hHeap=0x580000) returned 1 [0173.176] GetProcessHeap () returned 0x580000 [0173.176] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x662288 | out: hHeap=0x580000) returned 1 [0173.177] GetProcessHeap () returned 0x580000 [0173.177] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ed6a9e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xbda, dwReserved0=0x678fd28, dwReserved1=0x662288, cFileName="RSSITEMS.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RSSITE~2.YOU")) returned 0x5b9770 [0173.177] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.424] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", len=0x76 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned 1 [0174.424] GetProcessHeap () returned 0x580000 [0174.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0174.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0174.425] CloseHandle (hObject=0x41c) returned 1 [0174.425] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.425] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.id_1622540890_.your_last_chance")) returned 1 [0174.426] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x6d0072, dwReserved1=0x640065, cFileName="VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VS_COM~1.YOU")) returned 0x5b96f0 [0174.426] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0174.426] GetProcessHeap () returned 0x580000 [0174.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c61120 [0174.426] GetProcessHeap () returned 0x580000 [0174.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a1) returned 0x6c614e8 [0174.426] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.426] ReadFile (in: hFile=0x41c, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x380, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x678ff14*=0x380, lpOverlapped=0x0) returned 1 [0174.448] GetProcessHeap () returned 0x580000 [0174.448] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.449] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.449] WriteFile (in: hFile=0x41c, lpBuffer=0x6c614e8*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c614e8*, lpNumberOfBytesWritten=0x678ff14*=0x380, lpOverlapped=0x0) returned 1 [0174.449] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.449] WriteFile (in: hFile=0x41c, lpBuffer=0x6c61867*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61867*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.449] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.449] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.449] CloseHandle (hObject=0x41c) returned 1 [0174.449] GetProcessHeap () returned 0x580000 [0174.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c614e8 | out: hHeap=0x580000) returned 1 [0174.449] GetProcessHeap () returned 0x580000 [0174.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0174.449] GetProcessHeap () returned 0x580000 [0174.449] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.449] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f977940, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3af, dwReserved0=0x678fd28, dwReserved1=0x6c61120, cFileName="VS_ComponentSigningIntermediate.cer.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VS_COM~1.YOU")) returned 0x5b9730 [0174.450] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.477] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK", len=0x43 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 1 [0174.477] GetProcessHeap () returned 0x580000 [0174.477] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0174.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.478] CloseHandle (hObject=0x484) returned 1 [0174.478] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.478] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0174.479] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~4.YOU")) returned 0x5b9730 [0174.479] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0174.479] GetProcessHeap () returned 0x580000 [0174.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0174.479] GetProcessHeap () returned 0x580000 [0174.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0174.479] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.479] ReadFile (in: hFile=0x484, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x678ff14*=0x60, lpOverlapped=0x0) returned 1 [0174.480] GetProcessHeap () returned 0x580000 [0174.480] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a110 [0174.480] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.480] WriteFile (in: hFile=0x484, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x678ff14*=0x60, lpOverlapped=0x0) returned 1 [0174.481] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.481] WriteFile (in: hFile=0x484, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0174.481] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.481] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0174.481] CloseHandle (hObject=0x484) returned 1 [0174.481] GetProcessHeap () returned 0x580000 [0174.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0174.481] GetProcessHeap () returned 0x580000 [0174.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0174.481] GetProcessHeap () returned 0x580000 [0174.481] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a110 | out: hHeap=0x580000) returned 1 [0174.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9f9c3c00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x678fd28, dwReserved1=0x61b540, cFileName="VISIO_STD_F_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VISIO_~4.YOU")) returned 0x5b9730 [0174.481] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.550] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", len=0x4a | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned 1 [0174.550] GetProcessHeap () returned 0x580000 [0174.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0174.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0174.972] CloseHandle (hObject=0x48c) returned 1 [0174.972] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0174.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.id_1622540890_.your_last_chance")) returned 1 [0174.973] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0174.973] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HICCUP~1.YOU")) returned 0x5b96f0 [0174.973] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0174.973] GetProcessHeap () returned 0x580000 [0174.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3901) returned 0x6d996c8 [0174.973] GetProcessHeap () returned 0x580000 [0174.973] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3901) returned 0x6f62fb8 [0174.973] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.974] ReadFile (in: hFile=0x48c, lpBuffer=0x6d996c8, nNumberOfBytesToRead=0x38e0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d996c8*, lpNumberOfBytesRead=0x678ff14*=0x38e0, lpOverlapped=0x0) returned 1 [0175.740] GetProcessHeap () returned 0x580000 [0175.740] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0175.740] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.740] WriteFile (in: hFile=0x48c, lpBuffer=0x6f62fb8*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f62fb8*, lpNumberOfBytesWritten=0x678ff14*=0x38e0, lpOverlapped=0x0) returned 1 [0175.741] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.741] WriteFile (in: hFile=0x48c, lpBuffer=0x6f66897*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f66897*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0175.741] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.741] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0175.741] CloseHandle (hObject=0x48c) returned 1 [0175.741] GetProcessHeap () returned 0x580000 [0175.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f62fb8 | out: hHeap=0x580000) returned 1 [0175.741] GetProcessHeap () returned 0x580000 [0175.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d996c8 | out: hHeap=0x580000) returned 1 [0175.741] GetProcessHeap () returned 0x580000 [0175.741] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.896] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa05d0b60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x390e, dwReserved0=0x678fd28, dwReserved1=0x6d996c8, cFileName="HICCUP.WAV.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="HICCUP~1.YOU")) returned 0x5b96f0 [0176.897] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.060] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", len=0x47 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx") returned 1 [0179.060] GetProcessHeap () returned 0x580000 [0179.060] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0179.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.061] CloseHandle (hObject=0x3fc) returned 1 [0179.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.id_1622540890_.your_last_chance")) returned 1 [0179.061] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.062] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIMPLE~1.YOU")) returned 0x5b96f0 [0179.062] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0179.062] GetProcessHeap () returned 0x580000 [0179.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6dcb1d0 [0179.062] GetProcessHeap () returned 0x580000 [0179.062] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2101) returned 0x6f1bec0 [0179.063] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.063] ReadFile (in: hFile=0x3fc, lpBuffer=0x6dcb1d0, nNumberOfBytesToRead=0x20e0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcb1d0*, lpNumberOfBytesRead=0x678ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0179.132] GetProcessHeap () returned 0x580000 [0179.133] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0179.133] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.133] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f1bec0*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bec0*, lpNumberOfBytesWritten=0x678ff14*=0x20e0, lpOverlapped=0x0) returned 1 [0179.133] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.133] WriteFile (in: hFile=0x3fc, lpBuffer=0x6f1df9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1df9f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0179.133] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.133] WriteFile (in: hFile=0x3fc, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0179.133] CloseHandle (hObject=0x3fc) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bec0 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcb1d0 | out: hHeap=0x580000) returned 1 [0180.795] GetProcessHeap () returned 0x580000 [0180.795] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0182.211] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa26195c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x211c, dwReserved0=0x678fd28, dwReserved1=0x6dcb1d0, cFileName="Simple.dotx.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SIMPLE~1.YOU")) returned 0x5b9770 [0182.211] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.552] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", len=0x71 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned 1 [0183.552] GetProcessHeap () returned 0x580000 [0183.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0184.099] CloseHandle (hObject=0x478) returned 1 [0184.099] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.id_1622540890_.your_last_chance")) returned 1 [0184.100] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.100] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x730061, dwReserved1=0x2e006b, cFileName="ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVE~2.YOU")) returned 0x5b9770 [0184.101] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0184.101] GetProcessHeap () returned 0x580000 [0184.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x6fc42a8 [0184.101] GetProcessHeap () returned 0x580000 [0184.101] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xcc1) returned 0x635768 [0184.101] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.101] ReadFile (in: hFile=0x478, lpBuffer=0x6fc42a8, nNumberOfBytesToRead=0xca0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc42a8*, lpNumberOfBytesRead=0x678ff14*=0xca0, lpOverlapped=0x0) returned 1 [0184.169] GetProcessHeap () returned 0x580000 [0184.169] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0184.169] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.169] WriteFile (in: hFile=0x478, lpBuffer=0x635768*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesWritten=0x678ff14*=0xca0, lpOverlapped=0x0) returned 1 [0184.169] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.169] WriteFile (in: hFile=0x478, lpBuffer=0x636407*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x636407*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.170] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.170] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.170] CloseHandle (hObject=0x478) returned 1 [0184.170] GetProcessHeap () returned 0x580000 [0184.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0184.170] GetProcessHeap () returned 0x580000 [0184.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc42a8 | out: hHeap=0x580000) returned 1 [0184.170] GetProcessHeap () returned 0x580000 [0184.170] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0184.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa56271e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xccc, dwReserved0=0x678fd28, dwReserved1=0x6fc42a8, cFileName="ActiveTabImageMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ACTIVE~2.YOU")) returned 0x5b9770 [0184.170] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.176] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", len=0x5f | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned 1 [0184.190] GetProcessHeap () returned 0x580000 [0184.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0184.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.197] CloseHandle (hObject=0x454) returned 1 [0184.197] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.197] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.id_1622540890_.your_last_chance")) returned 1 [0184.199] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b9770 [0184.200] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0184.200] GetProcessHeap () returned 0x580000 [0184.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x67ec60 [0184.200] GetProcessHeap () returned 0x580000 [0184.200] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1341) returned 0x7066b08 [0184.200] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.200] ReadFile (in: hFile=0x454, lpBuffer=0x67ec60, nNumberOfBytesToRead=0x1320, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x67ec60*, lpNumberOfBytesRead=0x678ff14*=0x1320, lpOverlapped=0x0) returned 1 [0184.218] GetProcessHeap () returned 0x580000 [0184.218] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0184.219] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.219] WriteFile (in: hFile=0x454, lpBuffer=0x7066b08*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7066b08*, lpNumberOfBytesWritten=0x678ff14*=0x1320, lpOverlapped=0x0) returned 1 [0184.219] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.219] WriteFile (in: hFile=0x454, lpBuffer=0x7067e27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7067e27*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0184.219] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.219] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0184.219] CloseHandle (hObject=0x454) returned 1 [0184.219] GetProcessHeap () returned 0x580000 [0184.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7066b08 | out: hHeap=0x580000) returned 1 [0184.219] GetProcessHeap () returned 0x580000 [0184.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67ec60 | out: hHeap=0x580000) returned 1 [0184.219] GetProcessHeap () returned 0x580000 [0184.219] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0184.219] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5699600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x134e, dwReserved0=0x678fd28, dwReserved1=0x67ec60, cFileName="bg_Earthy.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_EAR~1.YOU")) returned 0x5b9770 [0184.220] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.220] Sleep (dwMilliseconds=0x1) [0184.705] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", len=0x50 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned 1 [0184.705] GetProcessHeap () returned 0x580000 [0184.705] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2130) returned 0x6f14048 [0184.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.089] CloseHandle (hObject=0x43c) returned 1 [0185.089] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.090] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.090] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x864d3600, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x480043, dwReserved1=0x4e0041, cFileName="NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~4.YOU")) returned 0x5b9770 [0185.090] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0185.091] GetProcessHeap () returned 0x580000 [0185.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4e820 [0185.091] GetProcessHeap () returned 0x580000 [0185.091] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6c4ebc8 [0185.091] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.091] ReadFile (in: hFile=0x43c, lpBuffer=0x6c4e820, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4e820*, lpNumberOfBytesRead=0x678ff14*=0x360, lpOverlapped=0x0) returned 1 [0185.095] GetProcessHeap () returned 0x580000 [0185.095] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce9e0 [0185.095] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.095] WriteFile (in: hFile=0x43c, lpBuffer=0x6c4ebc8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ebc8*, lpNumberOfBytesWritten=0x678ff14*=0x360, lpOverlapped=0x0) returned 1 [0185.095] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.095] WriteFile (in: hFile=0x43c, lpBuffer=0x6c4ef27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c4ef27*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0185.095] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.095] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0185.095] CloseHandle (hObject=0x43c) returned 1 [0185.096] GetProcessHeap () returned 0x580000 [0185.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4ebc8 | out: hHeap=0x580000) returned 1 [0185.096] GetProcessHeap () returned 0x580000 [0185.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c4e820 | out: hHeap=0x580000) returned 1 [0185.096] GetProcessHeap () returned 0x580000 [0185.096] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce9e0 | out: hHeap=0x580000) returned 1 [0185.534] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5f14460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x678fd28, dwReserved1=0x6c4e820, cFileName="NotifierDownArrow.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NOTIFI~4.YOU")) returned 0x5b9770 [0185.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.581] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", len=0x4f | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned 1 [0185.582] GetProcessHeap () returned 0x580000 [0185.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0185.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0185.725] CloseHandle (hObject=0x41c) returned 1 [0185.725] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.726] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.id_1622540890_.your_last_chance")) returned 1 [0185.726] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a0f, dwReserved0=0x410048, dwReserved1=0x43004e, cFileName="Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_S~1.YOU")) returned 0x5b9770 [0185.727] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0185.727] GetProcessHeap () returned 0x580000 [0185.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x7162178 [0185.727] GetProcessHeap () returned 0x580000 [0185.727] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2a21) returned 0x6dec6e0 [0185.727] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.727] ReadFile (in: hFile=0x41c, lpBuffer=0x7162178, nNumberOfBytesToRead=0x2a00, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7162178*, lpNumberOfBytesRead=0x678ff14*=0x2a00, lpOverlapped=0x0) returned 1 [0187.299] GetProcessHeap () returned 0x580000 [0187.299] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0187.299] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.299] WriteFile (in: hFile=0x41c, lpBuffer=0x6dec6e0*, nNumberOfBytesToWrite=0x2a00, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesWritten=0x678ff14*=0x2a00, lpOverlapped=0x0) returned 1 [0187.299] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.299] WriteFile (in: hFile=0x41c, lpBuffer=0x6def0df*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6def0df*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0187.299] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.299] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0187.299] CloseHandle (hObject=0x41c) returned 1 [0187.299] GetProcessHeap () returned 0x580000 [0187.299] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0187.299] GetProcessHeap () returned 0x580000 [0187.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7162178 | out: hHeap=0x580000) returned 1 [0187.300] GetProcessHeap () returned 0x580000 [0187.300] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0187.300] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa740e640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2a33, dwReserved0=0x678fd28, dwReserved1=0x7162178, cFileName="Form_StatusImage.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORM_S~1.YOU")) returned 0x5b96b0 [0187.300] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0191.029] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", len=0x45 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned 1 [0191.029] GetProcessHeap () returned 0x580000 [0191.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0191.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0191.031] CloseHandle (hObject=0x4a0) returned 1 [0191.031] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.031] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.id_1622540890_.your_last_chance")) returned 1 [0191.032] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x98a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~3.YOU")) returned 0x5b9770 [0191.032] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0191.033] GetProcessHeap () returned 0x580000 [0191.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6dcd1d0 [0191.033] GetProcessHeap () returned 0x580000 [0191.033] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6c676b8 [0191.033] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.033] ReadFile (in: hFile=0x4a0, lpBuffer=0x6dcd1d0, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesRead=0x678ff14*=0x980, lpOverlapped=0x0) returned 1 [0191.105] GetProcessHeap () returned 0x580000 [0191.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0191.105] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.105] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x678ff14*=0x980, lpOverlapped=0x0) returned 1 [0191.105] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.105] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c68037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68037*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0191.105] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.105] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0191.105] CloseHandle (hObject=0x4a0) returned 1 [0191.105] GetProcessHeap () returned 0x580000 [0191.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0191.105] GetProcessHeap () returned 0x580000 [0191.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0191.106] GetProcessHeap () returned 0x580000 [0191.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0191.106] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa985b5c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ae, dwReserved0=0x678fd28, dwReserved1=0x6dcd1d0, cFileName="ZPDIR43B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR4~3.YOU")) returned 0x5b9770 [0191.106] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.179] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", len=0x44 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned 1 [0191.179] GetProcessHeap () returned 0x580000 [0191.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0191.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0191.179] CloseHandle (hObject=0x4a4) returned 1 [0191.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.id_1622540890_.your_last_chance")) returned 1 [0191.180] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.181] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3a1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~2.YOU")) returned 0x5b9770 [0191.181] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0191.181] GetProcessHeap () returned 0x580000 [0191.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a21) returned 0x6dec6e0 [0191.181] GetProcessHeap () returned 0x580000 [0191.181] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3a21) returned 0x710ae18 [0191.182] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.182] ReadFile (in: hFile=0x4a4, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x3a00, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x678ff14*=0x3a00, lpOverlapped=0x0) returned 1 [0192.131] GetProcessHeap () returned 0x580000 [0192.131] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0192.131] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.131] WriteFile (in: hFile=0x4a4, lpBuffer=0x710ae18*, nNumberOfBytesToWrite=0x3a00, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x710ae18*, lpNumberOfBytesWritten=0x678ff14*=0x3a00, lpOverlapped=0x0) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] WriteFile (in: hFile=0x4a4, lpBuffer=0x710e817*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x710e817*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0192.133] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.133] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0192.133] CloseHandle (hObject=0x4a4) returned 1 [0194.432] GetProcessHeap () returned 0x580000 [0194.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x710ae18 | out: hHeap=0x580000) returned 1 [0194.432] GetProcessHeap () returned 0x580000 [0194.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0194.432] GetProcessHeap () returned 0x580000 [0194.432] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0194.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa22d080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3a42, dwReserved0=0x678fd28, dwReserved1=0x6dec6e0, cFileName="ZPDIR3B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR3~2.YOU")) returned 0x5b97b0 [0194.432] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.797] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", len=0x44 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned 1 [0196.797] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd8) returned 0x6f14048 [0196.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.833] CloseHandle (hObject=0x4a0) returned 1 [0196.833] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.id_1622540890_.your_last_chance")) returned 1 [0196.834] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.834] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~2.YOU")) returned 0x5b97b0 [0196.834] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.835] GetProcessHeap () returned 0x580000 [0196.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x6c29878 [0196.835] GetProcessHeap () returned 0x580000 [0196.835] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf01) returned 0x658970 [0196.835] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.835] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x678ff14*=0xee0, lpOverlapped=0x0) returned 1 [0196.901] GetProcessHeap () returned 0x580000 [0196.901] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.901] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.901] WriteFile (in: hFile=0x4a0, lpBuffer=0x658970*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x658970*, lpNumberOfBytesWritten=0x678ff14*=0xee0, lpOverlapped=0x0) returned 1 [0196.901] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.901] WriteFile (in: hFile=0x4a0, lpBuffer=0x65984f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x65984f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0196.901] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.901] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0196.901] CloseHandle (hObject=0x4a0) returned 1 [0196.901] GetProcessHeap () returned 0x580000 [0196.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x658970 | out: hHeap=0x580000) returned 1 [0196.901] GetProcessHeap () returned 0x580000 [0196.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0196.901] GetProcessHeap () returned 0x580000 [0196.901] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacf8d3e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x678fd28, dwReserved1=0x6c29878, cFileName="ZPDIR1B.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPDIR1~2.YOU")) returned 0x5b97b0 [0196.902] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.982] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", len=0x45 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned 1 [0196.982] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb8) returned 0x6f14048 [0196.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0197.021] CloseHandle (hObject=0x43c) returned 1 [0197.021] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.021] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.022] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.022] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6499, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP85FA~1.YOU")) returned 0x5b97b0 [0197.022] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0197.023] GetProcessHeap () returned 0x580000 [0197.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x64a1) returned 0x6f9f118 [0197.023] GetProcessHeap () returned 0x580000 [0197.023] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x64a1) returned 0x6fa55c8 [0197.023] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.023] ReadFile (in: hFile=0x43c, lpBuffer=0x6f9f118, nNumberOfBytesToRead=0x6480, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f118*, lpNumberOfBytesRead=0x678ff14*=0x6480, lpOverlapped=0x0) returned 1 [0197.758] GetProcessHeap () returned 0x580000 [0197.758] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x617088 [0197.758] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.758] WriteFile (in: hFile=0x43c, lpBuffer=0x6fa55c8*, nNumberOfBytesToWrite=0x6480, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa55c8*, lpNumberOfBytesWritten=0x678ff14*=0x6480, lpOverlapped=0x0) returned 1 [0197.758] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.758] WriteFile (in: hFile=0x43c, lpBuffer=0x6faba47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6faba47*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0197.758] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.758] WriteFile (in: hFile=0x43c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0197.759] CloseHandle (hObject=0x43c) returned 1 [0197.790] GetProcessHeap () returned 0x580000 [0197.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa55c8 | out: hHeap=0x580000) returned 1 [0197.790] GetProcessHeap () returned 0x580000 [0197.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9f118 | out: hHeap=0x580000) returned 1 [0197.790] GetProcessHeap () returned 0x580000 [0197.790] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x617088 | out: hHeap=0x580000) returned 1 [0199.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7bbf80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x64bd, dwReserved0=0x678fd28, dwReserved1=0x6f9f118, cFileName="ZPDIR12F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP85FA~1.YOU")) returned 0x5b96b0 [0199.651] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0200.956] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned 1 [0200.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe0) returned 0x6f14048 [0200.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.667] CloseHandle (hObject=0x3e4) returned 1 [0201.667] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.id_1622540890_.your_last_chance")) returned 1 [0201.668] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b97b0 [0201.668] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0201.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0201.668] GetProcessHeap () returned 0x580000 [0201.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6dcfb90 [0201.668] GetProcessHeap () returned 0x580000 [0201.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x6c65108 [0201.669] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.669] ReadFile (in: hFile=0x3e4, lpBuffer=0x6dcfb90, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcfb90*, lpNumberOfBytesRead=0x678ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.673] GetProcessHeap () returned 0x580000 [0201.673] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0201.673] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.673] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65108*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65108*, lpNumberOfBytesWritten=0x678ff14*=0x340, lpOverlapped=0x0) returned 1 [0201.673] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.673] WriteFile (in: hFile=0x3e4, lpBuffer=0x6c65447*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c65447*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0201.673] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.673] WriteFile (in: hFile=0x3e4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0201.673] CloseHandle (hObject=0x3e4) returned 1 [0201.674] GetProcessHeap () returned 0x580000 [0201.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c65108 | out: hHeap=0x580000) returned 1 [0201.674] GetProcessHeap () returned 0x580000 [0201.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcfb90 | out: hHeap=0x580000) returned 1 [0201.674] GetProcessHeap () returned 0x580000 [0201.674] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0202.489] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd138a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x374, dwReserved0=0x678fd28, dwReserved1=0x6dcfb90, cFileName="rtf_alignleft.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_AL~1.YOU")) returned 0x5b9770 [0202.489] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.541] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS", len=0x45 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS") returned 1 [0202.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee4) returned 0x6f14048 [0202.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0202.542] CloseHandle (hObject=0x39c) returned 1 [0202.542] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.542] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css.id_1622540890_.your_last_chance")) returned 1 [0202.543] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94315400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94315400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC996A~1.YOU")) returned 0x5b9770 [0202.543] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0202.543] GetProcessHeap () returned 0x580000 [0202.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e78e10 [0202.544] GetProcessHeap () returned 0x580000 [0202.544] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e8a640 [0202.545] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.545] ReadFile (in: hFile=0x39c, lpBuffer=0x6e78e10, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e78e10*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.924] GetProcessHeap () returned 0x580000 [0208.924] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0208.924] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.925] WriteFile (in: hFile=0x39c, lpBuffer=0x6e8a640*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e8a640*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0208.925] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.925] WriteFile (in: hFile=0x39c, lpBuffer=0x6e9be3f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be3f*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0208.925] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0208.925] WriteFile (in: hFile=0x39c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0208.926] CloseHandle (hObject=0x39c) returned 1 [0208.926] GetProcessHeap () returned 0x580000 [0208.926] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e8a640 | out: hHeap=0x580000) returned 1 [0209.521] GetProcessHeap () returned 0x580000 [0209.521] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e78e10 | out: hHeap=0x580000) returned 1 [0209.522] GetProcessHeap () returned 0x580000 [0209.522] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0210.089] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94315400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4241800, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e150, dwReserved0=0x678fd28, dwReserved1=0x6e78e10, cFileName="SCHEME36.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC996A~1.YOU")) returned 0x5b97b0 [0210.089] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.123] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", len=0x61 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned 1 [0210.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0210.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.347] CloseHandle (hObject=0x3b8) returned 1 [0215.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.347] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.id_1622540890_.your_last_chance")) returned 1 [0215.348] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x300034, dwReserved1=0x390038, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b97b0 [0215.348] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.348] GetProcessHeap () returned 0x580000 [0215.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x6ff8ff8 [0215.348] GetProcessHeap () returned 0x580000 [0215.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x7de1) returned 0x70b3528 [0215.349] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.349] ReadFile (in: hFile=0x3b8, lpBuffer=0x6ff8ff8, nNumberOfBytesToRead=0x7dc0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ff8ff8*, lpNumberOfBytesRead=0x678ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0217.925] GetProcessHeap () returned 0x580000 [0217.925] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf4d0 [0217.925] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.925] WriteFile (in: hFile=0x3b8, lpBuffer=0x70b3528*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x70b3528*, lpNumberOfBytesWritten=0x678ff14*=0x7dc0, lpOverlapped=0x0) returned 1 [0217.926] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.926] WriteFile (in: hFile=0x3b8, lpBuffer=0x70bb2e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x70bb2e7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0217.926] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.926] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0217.926] CloseHandle (hObject=0x3b8) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x70b3528 | out: hHeap=0x580000) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ff8ff8 | out: hHeap=0x580000) returned 1 [0219.228] GetProcessHeap () returned 0x580000 [0219.228] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf4d0 | out: hHeap=0x580000) returned 1 [0221.391] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9819160, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x7df7, dwReserved0=0x678fd28, dwReserved1=0x6ff8ff8, cFileName="bg_Country.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BG_COU~1.YOU")) returned 0x5b97b0 [0221.391] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0223.311] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", len=0x70 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned 1 [0223.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0223.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.312] CloseHandle (hObject=0x458) returned 1 [0223.312] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.id_1622540890_.your_last_chance")) returned 1 [0223.313] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf76, dwReserved0=0x6b0073, dwReserved1=0x62002e, cFileName="BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIEFC~1.YOU")) returned 0x5b96f0 [0223.313] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0223.313] GetProcessHeap () returned 0x580000 [0223.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6c29878 [0223.313] GetProcessHeap () returned 0x580000 [0223.313] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xf81) returned 0x6ece008 [0223.313] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.313] ReadFile (in: hFile=0x458, lpBuffer=0x6c29878, nNumberOfBytesToRead=0xf60, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6c29878*, lpNumberOfBytesRead=0x678ff14*=0xf60, lpOverlapped=0x0) returned 1 [0223.332] GetProcessHeap () returned 0x580000 [0223.332] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.332] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.332] WriteFile (in: hFile=0x458, lpBuffer=0x6ece008*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ece008*, lpNumberOfBytesWritten=0x678ff14*=0xf60, lpOverlapped=0x0) returned 1 [0223.332] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.332] WriteFile (in: hFile=0x458, lpBuffer=0x6ecef67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6ecef67*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0223.332] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.333] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0223.333] CloseHandle (hObject=0x458) returned 1 [0223.333] GetProcessHeap () returned 0x580000 [0223.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ece008 | out: hHeap=0x580000) returned 1 [0223.333] GetProcessHeap () returned 0x580000 [0223.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c29878 | out: hHeap=0x580000) returned 1 [0223.333] GetProcessHeap () returned 0x580000 [0223.333] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0223.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb8e80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xf9a, dwReserved0=0x678fd28, dwReserved1=0x6c29878, cFileName="BriefcaseIconMask.bmp.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRIEFC~1.YOU")) returned 0x5b96f0 [0223.333] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.377] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", len=0x5c | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned 1 [0223.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0223.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.378] CloseHandle (hObject=0x480) returned 1 [0223.378] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js.id_1622540890_.your_last_chance")) returned 1 [0223.379] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27739b00, ftLastWriteTime.dwHighDateTime=0x1ca408b, nFileSizeHigh=0x0, nFileSizeLow=0x15162, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b96f0 [0223.379] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0223.379] GetProcessHeap () returned 0x580000 [0223.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0223.379] GetProcessHeap () returned 0x580000 [0223.379] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0223.379] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.380] ReadFile (in: hFile=0x480, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.351] GetProcessHeap () returned 0x580000 [0228.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0228.352] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.352] WriteFile (in: hFile=0x480, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0228.352] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.352] WriteFile (in: hFile=0x480, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0228.352] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0228.353] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0228.353] CloseHandle (hObject=0x480) returned 1 [0228.353] GetProcessHeap () returned 0x580000 [0228.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0228.353] GetProcessHeap () returned 0x580000 [0228.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0228.353] GetProcessHeap () returned 0x580000 [0228.353] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0230.730] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf9fda20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x15186, dwReserved0=0x678fd28, dwReserved1=0x6d630a8, cFileName="SUBMIT.JS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SUBMIT~1.YOU")) returned 0x5b9630 [0230.730] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.807] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", len=0x36 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 1 [0230.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0230.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0230.808] CloseHandle (hObject=0x418) returned 1 [0230.808] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0230.808] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id_1622540890_.your_last_chance")) returned 1 [0230.809] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0230.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7G~1.YOU")) returned 0x5b9630 [0230.809] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x418 [0230.809] GetProcessHeap () returned 0x580000 [0230.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7568e78 [0230.810] GetProcessHeap () returned 0x580000 [0230.810] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x757a6a8 [0230.811] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0230.811] ReadFile (in: hFile=0x418, lpBuffer=0x7568e78, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7568e78*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0237.983] GetProcessHeap () returned 0x580000 [0237.983] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615990 [0237.983] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0237.983] WriteFile (in: hFile=0x418, lpBuffer=0x757a6a8*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x757a6a8*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0239.272] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.272] WriteFile (in: hFile=0x418, lpBuffer=0x758bea7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x758bea7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0239.274] SetFilePointerEx (in: hFile=0x418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0239.274] WriteFile (in: hFile=0x418, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0239.274] CloseHandle (hObject=0x418) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x757a6a8 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7568e78 | out: hHeap=0x580000) returned 1 [0239.393] GetProcessHeap () returned 0x580000 [0239.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615990 | out: hHeap=0x580000) returned 1 [0240.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6247e00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3567ca, dwReserved0=0x678fd28, dwReserved1=0x7568e78, cFileName="mset7ge.kic.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSET7G~1.YOU")) returned 0x5b9730 [0240.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.656] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML", len=0x4e | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned 1 [0240.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0240.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0240.699] CloseHandle (hObject=0x420) returned 1 [0240.699] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml.id_1622540890_.your_last_chance")) returned 1 [0240.700] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.700] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x4e0041, dwReserved1=0x450043, cFileName="YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA9DBE~1.YOU")) returned 0x5b9730 [0240.700] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0240.700] GetProcessHeap () returned 0x580000 [0240.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d08ed0 [0240.700] GetProcessHeap () returned 0x580000 [0240.700] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d09238 [0240.700] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.700] ReadFile (in: hFile=0x420, lpBuffer=0x6d08ed0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08ed0*, lpNumberOfBytesRead=0x678ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.754] GetProcessHeap () returned 0x580000 [0240.754] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.754] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.754] WriteFile (in: hFile=0x420, lpBuffer=0x6d09238*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09238*, lpNumberOfBytesWritten=0x678ff14*=0x320, lpOverlapped=0x0) returned 1 [0240.754] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.754] WriteFile (in: hFile=0x420, lpBuffer=0x6d09557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d09557*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0240.754] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.754] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0240.754] CloseHandle (hObject=0x420) returned 1 [0240.754] GetProcessHeap () returned 0x580000 [0240.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d09238 | out: hHeap=0x580000) returned 1 [0240.754] GetProcessHeap () returned 0x580000 [0240.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08ed0 | out: hHeap=0x580000) returned 1 [0240.754] GetProcessHeap () returned 0x580000 [0240.754] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0240.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7043f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x678fd28, dwReserved1=0x6d08ed0, cFileName="YAHOO.CO.NZ.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YA9DBE~1.YOU")) returned 0x5b9730 [0240.754] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.807] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML", len=0x4d | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned 1 [0240.807] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0240.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.892] CloseHandle (hObject=0x470) returned 1 [0241.892] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.id_1622540890_.your_last_chance")) returned 1 [0241.893] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.893] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NVBELL~1.YOU")) returned 0x5b9630 [0241.893] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0241.893] GetProcessHeap () returned 0x580000 [0241.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a340 [0241.894] GetProcessHeap () returned 0x580000 [0241.894] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d0a6a8 [0241.894] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.894] ReadFile (in: hFile=0x470, lpBuffer=0x6d0a340, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a340*, lpNumberOfBytesRead=0x678ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.898] GetProcessHeap () returned 0x580000 [0241.898] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0241.898] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.898] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a6a8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a6a8*, lpNumberOfBytesWritten=0x678ff14*=0x320, lpOverlapped=0x0) returned 1 [0241.898] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.898] WriteFile (in: hFile=0x470, lpBuffer=0x6d0a9c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d0a9c7*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0241.898] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.898] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0241.899] CloseHandle (hObject=0x470) returned 1 [0241.899] GetProcessHeap () returned 0x580000 [0241.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a6a8 | out: hHeap=0x580000) returned 1 [0241.899] GetProcessHeap () returned 0x580000 [0241.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d0a340 | out: hHeap=0x580000) returned 1 [0241.899] GetProcessHeap () returned 0x580000 [0241.899] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.899] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7b46500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x678fd28, dwReserved1=0x6d0a340, cFileName="NVBELL.NET.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NVBELL~1.YOU")) returned 0x5b9630 [0241.899] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.929] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML", len=0x40 | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned 1 [0241.929] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0241.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0244.781] CloseHandle (hObject=0x390) returned 1 [0244.781] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0244.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml.id_1622540890_.your_last_chance")) returned 1 [0244.782] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0244.782] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fb7700, ftLastWriteTime.dwHighDateTime=0x1ca1b41, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~3.YOU")) returned 0x5b96f0 [0244.782] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0244.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0244.783] GetProcessHeap () returned 0x580000 [0244.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9b01) returned 0x7061928 [0244.783] GetProcessHeap () returned 0x580000 [0244.783] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9b01) returned 0x6d21878 [0244.783] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0244.783] ReadFile (in: hFile=0x390, lpBuffer=0x7061928, nNumberOfBytesToRead=0x9ae0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesRead=0x678ff14*=0x9ae0, lpOverlapped=0x0) returned 1 [0246.891] GetProcessHeap () returned 0x580000 [0246.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615760 [0246.892] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.892] WriteFile (in: hFile=0x390, lpBuffer=0x6d21878*, nNumberOfBytesToWrite=0x9ae0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d21878*, lpNumberOfBytesWritten=0x678ff14*=0x9ae0, lpOverlapped=0x0) returned 1 [0246.892] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.892] WriteFile (in: hFile=0x390, lpBuffer=0x6d2b357*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2b357*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0246.892] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0246.892] WriteFile (in: hFile=0x390, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0246.892] CloseHandle (hObject=0x390) returned 1 [0247.917] GetProcessHeap () returned 0x580000 [0247.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d21878 | out: hHeap=0x580000) returned 1 [0247.918] GetProcessHeap () returned 0x580000 [0247.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0247.918] GetProcessHeap () returned 0x580000 [0247.918] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615760 | out: hHeap=0x580000) returned 1 [0249.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaae1d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9b08, dwReserved0=0x678fd28, dwReserved1=0x7061928, cFileName="PGLBL106.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PGLBL1~3.YOU")) returned 0x5b9730 [0249.413] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0249.543] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC", len=0x3e | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 1 [0249.543] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0249.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0252.920] CloseHandle (hObject=0x4ac) returned 1 [0252.920] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0252.921] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.id_1622540890_.your_last_chance")) returned 1 [0252.922] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0252.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba931800, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba931800, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x98f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCHUR~1.YOU")) returned 0x5b96f0 [0252.922] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0252.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0252.922] GetProcessHeap () returned 0x580000 [0252.922] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6d630a8 [0252.923] GetProcessHeap () returned 0x580000 [0252.923] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x7100718 [0252.923] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0252.923] ReadFile (in: hFile=0x4ac, lpBuffer=0x6d630a8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6d630a8*, lpNumberOfBytesRead=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.314] GetProcessHeap () returned 0x580000 [0257.314] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0257.315] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.315] WriteFile (in: hFile=0x4ac, lpBuffer=0x7100718*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7100718*, lpNumberOfBytesWritten=0x678ff14*=0x11800, lpOverlapped=0x0) returned 1 [0257.315] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.316] WriteFile (in: hFile=0x4ac, lpBuffer=0x7111f17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x7111f17*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0257.869] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0257.869] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0257.869] CloseHandle (hObject=0x4ac) returned 1 [0258.312] GetProcessHeap () returned 0x580000 [0258.312] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7100718 | out: hHeap=0x580000) returned 1 [0258.312] GetProcessHeap () returned 0x580000 [0258.312] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d630a8 | out: hHeap=0x580000) returned 1 [0258.312] GetProcessHeap () returned 0x580000 [0258.312] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0259.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fccc | out: lpFindFileData=0x678fccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba931800, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd139e500, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x98f96, dwReserved0=0x678fd28, dwReserved1=0x6d630a8, cFileName="BRCHUR11.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BRCHUR~1.YOU")) returned 0x5b9630 [0259.221] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.233] SysReAllocStringLen (in: pbstr=0x678ff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC", len=0x3e | out: pbstr=0x678ff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC") returned 1 [0259.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20bc) returned 0x72e5948 [0259.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0259.380] CloseHandle (hObject=0x454) returned 1 [0259.380] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0259.380] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc.id_1622540890_.your_last_chance")) returned 1 [0259.381] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x678ef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0259.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x678fc74 | out: lpFindFileData=0x678fc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBEMAIL.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WEBEMA~1.YOU")) returned 0x5b9630 [0259.381] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0259.381] GetProcessHeap () returned 0x580000 [0259.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x6e9be70 [0259.381] GetProcessHeap () returned 0x580000 [0259.381] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x31e1) returned 0x72e09a8 [0259.382] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0259.382] ReadFile (in: hFile=0x454, lpBuffer=0x6e9be70, nNumberOfBytesToRead=0x31c0, lpNumberOfBytesRead=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x6e9be70*, lpNumberOfBytesRead=0x678ff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.623] GetProcessHeap () returned 0x580000 [0261.623] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0261.623] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.623] WriteFile (in: hFile=0x454, lpBuffer=0x72e09a8*, nNumberOfBytesToWrite=0x31c0, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e09a8*, lpNumberOfBytesWritten=0x678ff14*=0x31c0, lpOverlapped=0x0) returned 1 [0261.623] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.623] WriteFile (in: hFile=0x454, lpBuffer=0x72e3b67*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x72e3b67*, lpNumberOfBytesWritten=0x678ff14*=0x20, lpOverlapped=0x0) returned 1 [0261.623] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0261.623] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x678ff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x678ff14*=0x4, lpOverlapped=0x0) returned 1 [0261.624] CloseHandle (hObject=0x454) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x72e09a8 | out: hHeap=0x580000) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e9be70 | out: hHeap=0x580000) returned 1 [0264.705] GetProcessHeap () returned 0x580000 [0264.705] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 Thread: id = 60 os_tid = 0xae8 [0039.071] Sleep (dwMilliseconds=0x1) [0039.093] Sleep (dwMilliseconds=0x1) [0039.114] Sleep (dwMilliseconds=0x1) [0039.151] Sleep (dwMilliseconds=0x1) [0039.286] Sleep (dwMilliseconds=0x1) [0039.412] Sleep (dwMilliseconds=0x1) [0039.582] Sleep (dwMilliseconds=0x1) [0039.674] Sleep (dwMilliseconds=0x1) [0039.722] Sleep (dwMilliseconds=0x1) [0039.742] Sleep (dwMilliseconds=0x1) [0039.752] Sleep (dwMilliseconds=0x1) [0039.814] Sleep (dwMilliseconds=0x1) [0039.835] Sleep (dwMilliseconds=0x1) [0039.865] Sleep (dwMilliseconds=0x1) [0039.919] Sleep (dwMilliseconds=0x1) [0039.927] Sleep (dwMilliseconds=0x1) [0040.057] Sleep (dwMilliseconds=0x1) [0040.293] Sleep (dwMilliseconds=0x1) [0040.351] Sleep (dwMilliseconds=0x1) [0040.374] Sleep (dwMilliseconds=0x1) [0040.507] Sleep (dwMilliseconds=0x1) [0040.535] Sleep (dwMilliseconds=0x1) [0040.550] Sleep (dwMilliseconds=0x1) [0040.590] Sleep (dwMilliseconds=0x1) [0042.163] Sleep (dwMilliseconds=0x1) [0042.327] Sleep (dwMilliseconds=0x1) [0042.352] Sleep (dwMilliseconds=0x1) [0042.470] Sleep (dwMilliseconds=0x1) [0042.513] Sleep (dwMilliseconds=0x1) [0042.556] Sleep (dwMilliseconds=0x1) [0042.648] Sleep (dwMilliseconds=0x1) [0042.660] Sleep (dwMilliseconds=0x1) [0042.700] Sleep (dwMilliseconds=0x1) [0042.794] Sleep (dwMilliseconds=0x1) [0042.825] Sleep (dwMilliseconds=0x1) [0042.843] Sleep (dwMilliseconds=0x1) [0042.857] Sleep (dwMilliseconds=0x1) [0042.912] Sleep (dwMilliseconds=0x1) [0042.921] Sleep (dwMilliseconds=0x1) [0042.998] Sleep (dwMilliseconds=0x1) [0043.013] Sleep (dwMilliseconds=0x1) [0043.084] Sleep (dwMilliseconds=0x1) [0043.103] Sleep (dwMilliseconds=0x1) [0043.118] Sleep (dwMilliseconds=0x1) [0043.142] Sleep (dwMilliseconds=0x1) [0043.199] Sleep (dwMilliseconds=0x1) [0043.279] Sleep (dwMilliseconds=0x1) [0043.292] Sleep (dwMilliseconds=0x1) [0043.308] Sleep (dwMilliseconds=0x1) [0043.323] Sleep (dwMilliseconds=0x1) [0043.339] Sleep (dwMilliseconds=0x1) [0043.355] Sleep (dwMilliseconds=0x1) [0043.370] Sleep (dwMilliseconds=0x1) [0043.386] Sleep (dwMilliseconds=0x1) [0043.401] Sleep (dwMilliseconds=0x1) [0043.417] Sleep (dwMilliseconds=0x1) [0043.432] Sleep (dwMilliseconds=0x1) [0043.448] Sleep (dwMilliseconds=0x1) [0043.464] Sleep (dwMilliseconds=0x1) [0043.479] Sleep (dwMilliseconds=0x1) [0043.495] Sleep (dwMilliseconds=0x1) [0043.511] Sleep (dwMilliseconds=0x1) [0043.526] Sleep (dwMilliseconds=0x1) [0043.542] Sleep (dwMilliseconds=0x1) [0043.558] Sleep (dwMilliseconds=0x1) [0043.573] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.696] Sleep (dwMilliseconds=0x1) [0043.703] Sleep (dwMilliseconds=0x1) [0043.718] Sleep (dwMilliseconds=0x1) [0043.744] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0043.776] Sleep (dwMilliseconds=0x1) [0043.791] Sleep (dwMilliseconds=0x1) [0043.806] Sleep (dwMilliseconds=0x1) [0043.822] Sleep (dwMilliseconds=0x1) [0043.837] Sleep (dwMilliseconds=0x1) [0043.853] Sleep (dwMilliseconds=0x1) [0043.868] Sleep (dwMilliseconds=0x1) [0043.884] Sleep (dwMilliseconds=0x1) [0043.903] Sleep (dwMilliseconds=0x1) [0043.915] Sleep (dwMilliseconds=0x1) [0043.931] Sleep (dwMilliseconds=0x1) [0043.947] Sleep (dwMilliseconds=0x1) [0043.962] Sleep (dwMilliseconds=0x1) [0043.978] Sleep (dwMilliseconds=0x1) [0043.997] Sleep (dwMilliseconds=0x1) [0044.015] Sleep (dwMilliseconds=0x1) [0044.026] Sleep (dwMilliseconds=0x1) [0044.040] Sleep (dwMilliseconds=0x1) [0044.059] Sleep (dwMilliseconds=0x1) [0044.363] Sleep (dwMilliseconds=0x1) [0044.389] Sleep (dwMilliseconds=0x1) [0044.400] Sleep (dwMilliseconds=0x1) [0044.415] Sleep (dwMilliseconds=0x1) [0044.430] Sleep (dwMilliseconds=0x1) [0044.446] Sleep (dwMilliseconds=0x1) [0044.461] Sleep (dwMilliseconds=0x1) [0044.477] Sleep (dwMilliseconds=0x1) [0044.492] Sleep (dwMilliseconds=0x1) [0044.508] Sleep (dwMilliseconds=0x1) [0044.524] Sleep (dwMilliseconds=0x1) [0044.540] Sleep (dwMilliseconds=0x1) [0044.555] Sleep (dwMilliseconds=0x1) [0044.571] Sleep (dwMilliseconds=0x1) [0044.586] Sleep (dwMilliseconds=0x1) [0044.602] Sleep (dwMilliseconds=0x1) [0044.617] Sleep (dwMilliseconds=0x1) [0044.633] Sleep (dwMilliseconds=0x1) [0044.648] Sleep (dwMilliseconds=0x1) [0044.664] Sleep (dwMilliseconds=0x1) [0044.680] Sleep (dwMilliseconds=0x1) [0044.695] Sleep (dwMilliseconds=0x1) [0044.711] Sleep (dwMilliseconds=0x1) [0044.727] Sleep (dwMilliseconds=0x1) [0044.742] Sleep (dwMilliseconds=0x1) [0044.758] Sleep (dwMilliseconds=0x1) [0044.773] Sleep (dwMilliseconds=0x1) [0044.789] Sleep (dwMilliseconds=0x1) [0044.804] Sleep (dwMilliseconds=0x1) [0044.820] Sleep (dwMilliseconds=0x1) [0044.836] Sleep (dwMilliseconds=0x1) [0044.851] Sleep (dwMilliseconds=0x1) [0044.867] Sleep (dwMilliseconds=0x1) [0044.882] Sleep (dwMilliseconds=0x1) [0044.898] Sleep (dwMilliseconds=0x1) [0044.914] Sleep (dwMilliseconds=0x1) [0044.929] Sleep (dwMilliseconds=0x1) [0044.945] Sleep (dwMilliseconds=0x1) [0044.960] Sleep (dwMilliseconds=0x1) [0044.976] Sleep (dwMilliseconds=0x1) [0044.992] Sleep (dwMilliseconds=0x1) [0045.007] Sleep (dwMilliseconds=0x1) [0045.023] Sleep (dwMilliseconds=0x1) [0045.038] Sleep (dwMilliseconds=0x1) [0045.054] Sleep (dwMilliseconds=0x1) [0045.070] Sleep (dwMilliseconds=0x1) [0045.085] Sleep (dwMilliseconds=0x1) [0045.101] Sleep (dwMilliseconds=0x1) [0045.116] Sleep (dwMilliseconds=0x1) [0045.132] Sleep (dwMilliseconds=0x1) [0045.148] Sleep (dwMilliseconds=0x1) [0045.163] Sleep (dwMilliseconds=0x1) [0045.179] Sleep (dwMilliseconds=0x1) [0045.201] Sleep (dwMilliseconds=0x1) [0045.210] Sleep (dwMilliseconds=0x1) [0045.226] Sleep (dwMilliseconds=0x1) [0045.241] Sleep (dwMilliseconds=0x1) [0045.257] Sleep (dwMilliseconds=0x1) [0045.272] Sleep (dwMilliseconds=0x1) [0045.288] Sleep (dwMilliseconds=0x1) [0045.305] Sleep (dwMilliseconds=0x1) [0045.319] Sleep (dwMilliseconds=0x1) [0045.335] Sleep (dwMilliseconds=0x1) [0045.350] Sleep (dwMilliseconds=0x1) [0045.366] Sleep (dwMilliseconds=0x1) [0045.382] Sleep (dwMilliseconds=0x1) [0045.397] Sleep (dwMilliseconds=0x1) [0045.413] Sleep (dwMilliseconds=0x1) [0045.428] Sleep (dwMilliseconds=0x1) [0045.444] Sleep (dwMilliseconds=0x1) [0045.460] Sleep (dwMilliseconds=0x1) [0045.475] Sleep (dwMilliseconds=0x1) [0045.493] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.522] Sleep (dwMilliseconds=0x1) [0045.538] Sleep (dwMilliseconds=0x1) [0045.553] Sleep (dwMilliseconds=0x1) [0045.569] Sleep (dwMilliseconds=0x1) [0045.585] Sleep (dwMilliseconds=0x1) [0045.650] Sleep (dwMilliseconds=0x1) [0045.673] Sleep (dwMilliseconds=0x1) [0045.679] Sleep (dwMilliseconds=0x1) [0045.725] Sleep (dwMilliseconds=0x1) [0045.789] Sleep (dwMilliseconds=0x1) [0045.803] Sleep (dwMilliseconds=0x1) [0045.820] Sleep (dwMilliseconds=0x1) [0045.834] Sleep (dwMilliseconds=0x1) [0045.850] Sleep (dwMilliseconds=0x1) [0045.865] Sleep (dwMilliseconds=0x1) [0045.883] Sleep (dwMilliseconds=0x1) [0045.897] Sleep (dwMilliseconds=0x1) [0045.912] Sleep (dwMilliseconds=0x1) [0045.928] Sleep (dwMilliseconds=0x1) [0045.943] Sleep (dwMilliseconds=0x1) [0045.959] Sleep (dwMilliseconds=0x1) [0045.975] Sleep (dwMilliseconds=0x1) [0045.990] Sleep (dwMilliseconds=0x1) [0046.006] Sleep (dwMilliseconds=0x1) [0046.021] Sleep (dwMilliseconds=0x1) [0046.037] Sleep (dwMilliseconds=0x1) [0046.053] Sleep (dwMilliseconds=0x1) [0046.068] Sleep (dwMilliseconds=0x1) [0046.084] Sleep (dwMilliseconds=0x1) [0046.100] Sleep (dwMilliseconds=0x1) [0046.115] Sleep (dwMilliseconds=0x1) [0046.131] Sleep (dwMilliseconds=0x1) [0046.146] Sleep (dwMilliseconds=0x1) [0046.162] Sleep (dwMilliseconds=0x1) [0046.177] Sleep (dwMilliseconds=0x1) [0046.199] Sleep (dwMilliseconds=0x1) [0046.209] Sleep (dwMilliseconds=0x1) [0046.224] Sleep (dwMilliseconds=0x1) [0046.240] Sleep (dwMilliseconds=0x1) [0046.255] Sleep (dwMilliseconds=0x1) [0046.273] Sleep (dwMilliseconds=0x1) [0046.287] Sleep (dwMilliseconds=0x1) [0046.302] Sleep (dwMilliseconds=0x1) [0046.318] Sleep (dwMilliseconds=0x1) [0046.333] Sleep (dwMilliseconds=0x1) [0046.349] Sleep (dwMilliseconds=0x1) [0046.365] Sleep (dwMilliseconds=0x1) [0046.380] Sleep (dwMilliseconds=0x1) [0046.396] Sleep (dwMilliseconds=0x1) [0046.412] Sleep (dwMilliseconds=0x1) [0046.427] Sleep (dwMilliseconds=0x1) [0046.443] Sleep (dwMilliseconds=0x1) [0046.458] Sleep (dwMilliseconds=0x1) [0046.476] Sleep (dwMilliseconds=0x1) [0046.489] Sleep (dwMilliseconds=0x1) [0046.505] Sleep (dwMilliseconds=0x1) [0046.528] Sleep (dwMilliseconds=0x1) [0046.537] Sleep (dwMilliseconds=0x1) [0046.552] Sleep (dwMilliseconds=0x1) [0046.567] Sleep (dwMilliseconds=0x1) [0046.584] Sleep (dwMilliseconds=0x1) [0046.599] Sleep (dwMilliseconds=0x1) [0046.614] Sleep (dwMilliseconds=0x1) [0046.630] Sleep (dwMilliseconds=0x1) [0046.645] Sleep (dwMilliseconds=0x1) [0046.661] Sleep (dwMilliseconds=0x1) [0046.677] Sleep (dwMilliseconds=0x1) [0046.692] Sleep (dwMilliseconds=0x1) [0046.708] Sleep (dwMilliseconds=0x1) [0046.724] Sleep (dwMilliseconds=0x1) [0046.739] Sleep (dwMilliseconds=0x1) [0046.755] Sleep (dwMilliseconds=0x1) [0046.770] Sleep (dwMilliseconds=0x1) [0046.786] Sleep (dwMilliseconds=0x1) [0046.801] Sleep (dwMilliseconds=0x1) [0046.817] Sleep (dwMilliseconds=0x1) [0046.833] Sleep (dwMilliseconds=0x1) [0046.848] Sleep (dwMilliseconds=0x1) [0046.864] Sleep (dwMilliseconds=0x1) [0046.879] Sleep (dwMilliseconds=0x1) [0046.895] Sleep (dwMilliseconds=0x1) [0046.911] Sleep (dwMilliseconds=0x1) [0046.931] Sleep (dwMilliseconds=0x1) [0046.942] Sleep (dwMilliseconds=0x1) [0046.957] Sleep (dwMilliseconds=0x1) [0046.974] Sleep (dwMilliseconds=0x1) [0046.988] Sleep (dwMilliseconds=0x1) [0047.004] Sleep (dwMilliseconds=0x1) [0047.020] Sleep (dwMilliseconds=0x1) [0047.035] Sleep (dwMilliseconds=0x1) [0047.051] Sleep (dwMilliseconds=0x1) [0047.067] Sleep (dwMilliseconds=0x1) [0047.082] Sleep (dwMilliseconds=0x1) [0047.098] Sleep (dwMilliseconds=0x1) [0047.113] Sleep (dwMilliseconds=0x1) [0047.129] Sleep (dwMilliseconds=0x1) [0047.144] Sleep (dwMilliseconds=0x1) [0047.160] Sleep (dwMilliseconds=0x1) [0047.176] Sleep (dwMilliseconds=0x1) [0047.197] Sleep (dwMilliseconds=0x1) [0047.207] Sleep (dwMilliseconds=0x1) [0047.222] Sleep (dwMilliseconds=0x1) [0047.238] Sleep (dwMilliseconds=0x1) [0047.254] Sleep (dwMilliseconds=0x1) [0047.269] Sleep (dwMilliseconds=0x1) [0047.285] Sleep (dwMilliseconds=0x1) [0047.300] Sleep (dwMilliseconds=0x1) [0047.316] Sleep (dwMilliseconds=0x1) [0047.332] Sleep (dwMilliseconds=0x1) [0047.355] Sleep (dwMilliseconds=0x1) [0047.363] Sleep (dwMilliseconds=0x1) [0047.379] Sleep (dwMilliseconds=0x1) [0047.394] Sleep (dwMilliseconds=0x1) [0047.410] Sleep (dwMilliseconds=0x1) [0047.425] Sleep (dwMilliseconds=0x1) [0047.441] Sleep (dwMilliseconds=0x1) [0047.456] Sleep (dwMilliseconds=0x1) [0047.472] Sleep (dwMilliseconds=0x1) [0047.488] Sleep (dwMilliseconds=0x1) [0047.503] Sleep (dwMilliseconds=0x1) [0047.519] Sleep (dwMilliseconds=0x1) [0047.536] Sleep (dwMilliseconds=0x1) [0047.550] Sleep (dwMilliseconds=0x1) [0047.566] Sleep (dwMilliseconds=0x1) [0047.582] Sleep (dwMilliseconds=0x1) [0047.597] Sleep (dwMilliseconds=0x1) [0047.664] Sleep (dwMilliseconds=0x1) [0047.682] Sleep (dwMilliseconds=0x1) [0047.690] Sleep (dwMilliseconds=0x1) [0047.706] Sleep (dwMilliseconds=0x1) [0047.722] Sleep (dwMilliseconds=0x1) [0047.737] Sleep (dwMilliseconds=0x1) [0047.753] Sleep (dwMilliseconds=0x1) [0047.769] Sleep (dwMilliseconds=0x1) [0047.785] Sleep (dwMilliseconds=0x1) [0047.803] Sleep (dwMilliseconds=0x1) [0047.815] Sleep (dwMilliseconds=0x1) [0047.831] Sleep (dwMilliseconds=0x1) [0047.847] Sleep (dwMilliseconds=0x1) [0047.895] Sleep (dwMilliseconds=0x1) [0047.909] Sleep (dwMilliseconds=0x1) [0047.924] Sleep (dwMilliseconds=0x1) [0047.940] Sleep (dwMilliseconds=0x1) [0047.956] Sleep (dwMilliseconds=0x1) [0047.971] Sleep (dwMilliseconds=0x1) [0047.987] Sleep (dwMilliseconds=0x1) [0048.003] Sleep (dwMilliseconds=0x1) [0048.018] Sleep (dwMilliseconds=0x1) [0048.034] Sleep (dwMilliseconds=0x1) [0048.049] Sleep (dwMilliseconds=0x1) [0048.065] Sleep (dwMilliseconds=0x1) [0048.080] Sleep (dwMilliseconds=0x1) [0048.097] Sleep (dwMilliseconds=0x1) [0048.112] Sleep (dwMilliseconds=0x1) [0048.127] Sleep (dwMilliseconds=0x1) [0048.143] Sleep (dwMilliseconds=0x1) [0048.159] Sleep (dwMilliseconds=0x1) [0048.174] Sleep (dwMilliseconds=0x1) [0048.195] Sleep (dwMilliseconds=0x1) [0048.205] Sleep (dwMilliseconds=0x1) [0048.221] Sleep (dwMilliseconds=0x1) [0048.236] Sleep (dwMilliseconds=0x1) [0048.252] Sleep (dwMilliseconds=0x1) [0048.268] Sleep (dwMilliseconds=0x1) [0048.283] Sleep (dwMilliseconds=0x1) [0048.299] Sleep (dwMilliseconds=0x1) [0048.315] Sleep (dwMilliseconds=0x1) [0048.332] Sleep (dwMilliseconds=0x1) [0048.346] Sleep (dwMilliseconds=0x1) [0048.361] Sleep (dwMilliseconds=0x1) [0048.377] Sleep (dwMilliseconds=0x1) [0048.400] Sleep (dwMilliseconds=0x1) [0048.408] Sleep (dwMilliseconds=0x1) [0048.424] Sleep (dwMilliseconds=0x1) [0048.439] Sleep (dwMilliseconds=0x1) [0048.455] Sleep (dwMilliseconds=0x1) [0048.471] Sleep (dwMilliseconds=0x1) [0048.486] Sleep (dwMilliseconds=0x1) [0048.502] Sleep (dwMilliseconds=0x1) [0048.517] Sleep (dwMilliseconds=0x1) [0048.533] Sleep (dwMilliseconds=0x1) [0048.548] Sleep (dwMilliseconds=0x1) [0048.564] Sleep (dwMilliseconds=0x1) [0048.580] Sleep (dwMilliseconds=0x1) [0048.595] Sleep (dwMilliseconds=0x1) [0048.611] Sleep (dwMilliseconds=0x1) [0048.627] Sleep (dwMilliseconds=0x1) [0048.642] Sleep (dwMilliseconds=0x1) [0048.658] Sleep (dwMilliseconds=0x1) [0048.673] Sleep (dwMilliseconds=0x1) [0048.689] Sleep (dwMilliseconds=0x1) [0048.704] Sleep (dwMilliseconds=0x1) [0048.722] Sleep (dwMilliseconds=0x1) [0048.736] Sleep (dwMilliseconds=0x1) [0048.751] Sleep (dwMilliseconds=0x1) [0048.767] Sleep (dwMilliseconds=0x1) [0048.783] Sleep (dwMilliseconds=0x1) [0048.798] Sleep (dwMilliseconds=0x1) [0048.814] Sleep (dwMilliseconds=0x1) [0048.829] Sleep (dwMilliseconds=0x1) [0048.845] Sleep (dwMilliseconds=0x1) [0048.860] Sleep (dwMilliseconds=0x1) [0048.876] Sleep (dwMilliseconds=0x1) [0048.892] Sleep (dwMilliseconds=0x1) [0048.907] Sleep (dwMilliseconds=0x1) [0048.923] Sleep (dwMilliseconds=0x1) [0048.939] Sleep (dwMilliseconds=0x1) [0048.954] Sleep (dwMilliseconds=0x1) [0048.970] Sleep (dwMilliseconds=0x1) [0048.985] Sleep (dwMilliseconds=0x1) [0049.001] Sleep (dwMilliseconds=0x1) [0049.016] Sleep (dwMilliseconds=0x1) [0049.032] Sleep (dwMilliseconds=0x1) [0049.048] Sleep (dwMilliseconds=0x1) [0049.063] Sleep (dwMilliseconds=0x1) [0049.079] Sleep (dwMilliseconds=0x1) [0049.095] Sleep (dwMilliseconds=0x1) [0049.112] Sleep (dwMilliseconds=0x1) [0049.126] Sleep (dwMilliseconds=0x1) [0049.141] Sleep (dwMilliseconds=0x1) [0049.157] Sleep (dwMilliseconds=0x1) [0049.172] Sleep (dwMilliseconds=0x1) [0049.194] Sleep (dwMilliseconds=0x1) [0049.204] Sleep (dwMilliseconds=0x1) [0049.219] Sleep (dwMilliseconds=0x1) [0049.235] Sleep (dwMilliseconds=0x1) [0049.251] Sleep (dwMilliseconds=0x1) [0049.266] Sleep (dwMilliseconds=0x1) [0049.282] Sleep (dwMilliseconds=0x1) [0049.297] Sleep (dwMilliseconds=0x1) [0049.313] Sleep (dwMilliseconds=0x1) [0049.328] Sleep (dwMilliseconds=0x1) [0049.345] Sleep (dwMilliseconds=0x1) [0049.360] Sleep (dwMilliseconds=0x1) [0049.375] Sleep (dwMilliseconds=0x1) [0049.391] Sleep (dwMilliseconds=0x1) [0049.407] Sleep (dwMilliseconds=0x1) [0049.422] Sleep (dwMilliseconds=0x1) [0049.440] Sleep (dwMilliseconds=0x1) [0049.460] Sleep (dwMilliseconds=0x1) [0049.469] Sleep (dwMilliseconds=0x1) [0049.485] Sleep (dwMilliseconds=0x1) [0049.500] Sleep (dwMilliseconds=0x1) [0049.516] Sleep (dwMilliseconds=0x1) [0049.531] Sleep (dwMilliseconds=0x1) [0049.547] Sleep (dwMilliseconds=0x1) [0049.563] Sleep (dwMilliseconds=0x1) [0049.578] Sleep (dwMilliseconds=0x1) [0049.594] Sleep (dwMilliseconds=0x1) [0049.615] Sleep (dwMilliseconds=0x1) [0049.625] Sleep (dwMilliseconds=0x1) [0049.640] Sleep (dwMilliseconds=0x1) [0049.656] Sleep (dwMilliseconds=0x1) [0049.672] Sleep (dwMilliseconds=0x1) [0049.688] Sleep (dwMilliseconds=0x1) [0049.703] Sleep (dwMilliseconds=0x1) [0049.719] Sleep (dwMilliseconds=0x1) [0049.734] Sleep (dwMilliseconds=0x1) [0049.750] Sleep (dwMilliseconds=0x1) [0049.765] Sleep (dwMilliseconds=0x1) [0049.781] Sleep (dwMilliseconds=0x1) [0049.797] Sleep (dwMilliseconds=0x1) [0049.812] Sleep (dwMilliseconds=0x1) [0049.830] Sleep (dwMilliseconds=0x1) [0049.843] Sleep (dwMilliseconds=0x1) [0049.859] Sleep (dwMilliseconds=0x1) [0049.875] Sleep (dwMilliseconds=0x1) [0049.890] Sleep (dwMilliseconds=0x1) [0049.906] Sleep (dwMilliseconds=0x1) [0049.921] Sleep (dwMilliseconds=0x1) [0049.937] Sleep (dwMilliseconds=0x1) [0049.952] Sleep (dwMilliseconds=0x1) [0049.968] Sleep (dwMilliseconds=0x1) [0049.984] Sleep (dwMilliseconds=0x1) [0049.999] Sleep (dwMilliseconds=0x1) [0050.015] Sleep (dwMilliseconds=0x1) [0050.031] Sleep (dwMilliseconds=0x1) [0050.046] Sleep (dwMilliseconds=0x1) [0050.062] Sleep (dwMilliseconds=0x1) [0050.077] Sleep (dwMilliseconds=0x1) [0050.093] Sleep (dwMilliseconds=0x1) [0050.108] Sleep (dwMilliseconds=0x1) [0050.124] Sleep (dwMilliseconds=0x1) [0050.140] Sleep (dwMilliseconds=0x1) [0050.155] Sleep (dwMilliseconds=0x1) [0050.171] Sleep (dwMilliseconds=0x1) [0050.191] Sleep (dwMilliseconds=0x1) [0050.202] Sleep (dwMilliseconds=0x1) [0050.220] Sleep (dwMilliseconds=0x1) [0050.233] Sleep (dwMilliseconds=0x1) [0050.249] Sleep (dwMilliseconds=0x1) [0050.264] Sleep (dwMilliseconds=0x1) [0050.280] Sleep (dwMilliseconds=0x1) [0050.296] Sleep (dwMilliseconds=0x1) [0050.311] Sleep (dwMilliseconds=0x1) [0050.327] Sleep (dwMilliseconds=0x1) [0050.343] Sleep (dwMilliseconds=0x1) [0050.358] Sleep (dwMilliseconds=0x1) [0050.374] Sleep (dwMilliseconds=0x1) [0050.389] Sleep (dwMilliseconds=0x1) [0050.405] Sleep (dwMilliseconds=0x1) [0050.420] Sleep (dwMilliseconds=0x1) [0050.436] Sleep (dwMilliseconds=0x1) [0050.453] Sleep (dwMilliseconds=0x1) [0050.477] Sleep (dwMilliseconds=0x1) [0050.483] Sleep (dwMilliseconds=0x1) [0050.499] Sleep (dwMilliseconds=0x1) [0050.514] Sleep (dwMilliseconds=0x1) [0050.530] Sleep (dwMilliseconds=0x1) [0050.547] Sleep (dwMilliseconds=0x1) [0050.561] Sleep (dwMilliseconds=0x1) [0050.576] Sleep (dwMilliseconds=0x1) [0050.592] Sleep (dwMilliseconds=0x1) [0050.608] Sleep (dwMilliseconds=0x1) [0050.623] Sleep (dwMilliseconds=0x1) [0050.639] Sleep (dwMilliseconds=0x1) [0050.655] Sleep (dwMilliseconds=0x1) [0050.670] Sleep (dwMilliseconds=0x1) [0050.686] Sleep (dwMilliseconds=0x1) [0050.701] Sleep (dwMilliseconds=0x1) [0050.717] Sleep (dwMilliseconds=0x1) [0050.732] Sleep (dwMilliseconds=0x1) [0050.748] Sleep (dwMilliseconds=0x1) [0050.764] Sleep (dwMilliseconds=0x1) [0050.779] Sleep (dwMilliseconds=0x1) [0050.795] Sleep (dwMilliseconds=0x1) [0050.811] Sleep (dwMilliseconds=0x1) [0050.826] Sleep (dwMilliseconds=0x1) [0050.845] Sleep (dwMilliseconds=0x1) [0050.857] Sleep (dwMilliseconds=0x1) [0050.873] Sleep (dwMilliseconds=0x1) [0050.888] Sleep (dwMilliseconds=0x1) [0050.904] Sleep (dwMilliseconds=0x1) [0050.920] Sleep (dwMilliseconds=0x1) [0050.937] Sleep (dwMilliseconds=0x1) [0050.956] Sleep (dwMilliseconds=0x1) [0050.967] Sleep (dwMilliseconds=0x1) [0050.982] Sleep (dwMilliseconds=0x1) [0050.998] Sleep (dwMilliseconds=0x1) [0051.013] Sleep (dwMilliseconds=0x1) [0051.029] Sleep (dwMilliseconds=0x1) [0051.044] Sleep (dwMilliseconds=0x1) [0051.060] Sleep (dwMilliseconds=0x1) [0051.076] Sleep (dwMilliseconds=0x1) [0051.093] Sleep (dwMilliseconds=0x1) [0051.107] Sleep (dwMilliseconds=0x1) [0051.122] Sleep (dwMilliseconds=0x1) [0051.138] Sleep (dwMilliseconds=0x1) [0051.154] Sleep (dwMilliseconds=0x1) [0051.169] Sleep (dwMilliseconds=0x1) [0051.191] Sleep (dwMilliseconds=0x1) [0051.200] Sleep (dwMilliseconds=0x1) [0051.216] Sleep (dwMilliseconds=0x1) [0051.232] Sleep (dwMilliseconds=0x1) [0051.247] Sleep (dwMilliseconds=0x1) [0051.263] Sleep (dwMilliseconds=0x1) [0051.279] Sleep (dwMilliseconds=0x1) [0051.294] Sleep (dwMilliseconds=0x1) [0051.310] Sleep (dwMilliseconds=0x1) [0051.327] Sleep (dwMilliseconds=0x1) [0051.341] Sleep (dwMilliseconds=0x1) [0051.356] Sleep (dwMilliseconds=0x1) [0051.372] Sleep (dwMilliseconds=0x1) [0051.388] Sleep (dwMilliseconds=0x1) [0051.403] Sleep (dwMilliseconds=0x1) [0051.419] Sleep (dwMilliseconds=0x1) [0051.434] Sleep (dwMilliseconds=0x1) [0051.450] Sleep (dwMilliseconds=0x1) [0051.466] Sleep (dwMilliseconds=0x1) [0051.481] Sleep (dwMilliseconds=0x1) [0051.497] Sleep (dwMilliseconds=0x1) [0051.512] Sleep (dwMilliseconds=0x1) [0051.528] Sleep (dwMilliseconds=0x1) [0051.544] Sleep (dwMilliseconds=0x1) [0051.559] Sleep (dwMilliseconds=0x1) [0051.575] Sleep (dwMilliseconds=0x1) [0051.591] Sleep (dwMilliseconds=0x1) [0051.606] Sleep (dwMilliseconds=0x1) [0051.632] Sleep (dwMilliseconds=0x1) [0051.642] Sleep (dwMilliseconds=0x1) [0051.655] Sleep (dwMilliseconds=0x1) [0051.668] Sleep (dwMilliseconds=0x1) [0051.697] Sleep (dwMilliseconds=0x1) [0051.702] Sleep (dwMilliseconds=0x1) [0051.717] Sleep (dwMilliseconds=0x1) [0051.733] Sleep (dwMilliseconds=0x1) [0051.749] Sleep (dwMilliseconds=0x1) [0051.764] Sleep (dwMilliseconds=0x1) [0051.780] Sleep (dwMilliseconds=0x1) [0051.795] Sleep (dwMilliseconds=0x1) [0051.811] Sleep (dwMilliseconds=0x1) [0051.827] Sleep (dwMilliseconds=0x1) [0051.842] Sleep (dwMilliseconds=0x1) [0051.857] Sleep (dwMilliseconds=0x1) [0051.873] Sleep (dwMilliseconds=0x1) [0051.889] Sleep (dwMilliseconds=0x1) [0051.905] Sleep (dwMilliseconds=0x1) [0051.920] Sleep (dwMilliseconds=0x1) [0051.935] Sleep (dwMilliseconds=0x1) [0051.951] Sleep (dwMilliseconds=0x1) [0051.967] Sleep (dwMilliseconds=0x1) [0051.982] Sleep (dwMilliseconds=0x1) [0051.998] Sleep (dwMilliseconds=0x1) [0052.013] Sleep (dwMilliseconds=0x1) [0052.029] Sleep (dwMilliseconds=0x1) [0052.045] Sleep (dwMilliseconds=0x1) [0052.061] Sleep (dwMilliseconds=0x1) [0052.076] Sleep (dwMilliseconds=0x1) [0052.093] Sleep (dwMilliseconds=0x1) [0052.107] Sleep (dwMilliseconds=0x1) [0052.123] Sleep (dwMilliseconds=0x1) [0052.139] Sleep (dwMilliseconds=0x1) [0052.154] Sleep (dwMilliseconds=0x1) [0052.170] Sleep (dwMilliseconds=0x1) [0052.191] Sleep (dwMilliseconds=0x1) [0052.201] Sleep (dwMilliseconds=0x1) [0052.217] Sleep (dwMilliseconds=0x1) [0052.232] Sleep (dwMilliseconds=0x1) [0052.248] Sleep (dwMilliseconds=0x1) [0052.264] Sleep (dwMilliseconds=0x1) [0052.279] Sleep (dwMilliseconds=0x1) [0052.294] Sleep (dwMilliseconds=0x1) [0052.310] Sleep (dwMilliseconds=0x1) [0052.325] Sleep (dwMilliseconds=0x1) [0052.341] Sleep (dwMilliseconds=0x1) [0052.357] Sleep (dwMilliseconds=0x1) [0052.373] Sleep (dwMilliseconds=0x1) [0052.388] Sleep (dwMilliseconds=0x1) [0052.403] Sleep (dwMilliseconds=0x1) [0052.419] Sleep (dwMilliseconds=0x1) [0052.435] Sleep (dwMilliseconds=0x1) [0052.450] Sleep (dwMilliseconds=0x1) [0052.466] Sleep (dwMilliseconds=0x1) [0052.481] Sleep (dwMilliseconds=0x1) [0052.500] Sleep (dwMilliseconds=0x1) [0052.513] Sleep (dwMilliseconds=0x1) [0052.528] Sleep (dwMilliseconds=0x1) [0052.551] Sleep (dwMilliseconds=0x1) [0052.560] Sleep (dwMilliseconds=0x1) [0052.575] Sleep (dwMilliseconds=0x1) [0052.591] Sleep (dwMilliseconds=0x1) [0052.607] Sleep (dwMilliseconds=0x1) [0052.622] Sleep (dwMilliseconds=0x1) [0052.637] Sleep (dwMilliseconds=0x1) [0052.653] Sleep (dwMilliseconds=0x1) [0052.669] Sleep (dwMilliseconds=0x1) [0052.685] Sleep (dwMilliseconds=0x1) [0052.700] Sleep (dwMilliseconds=0x1) [0052.716] Sleep (dwMilliseconds=0x1) [0052.731] Sleep (dwMilliseconds=0x1) [0052.747] Sleep (dwMilliseconds=0x1) [0052.762] Sleep (dwMilliseconds=0x1) [0052.778] Sleep (dwMilliseconds=0x1) [0052.794] Sleep (dwMilliseconds=0x1) [0052.809] Sleep (dwMilliseconds=0x1) [0052.825] Sleep (dwMilliseconds=0x1) [0052.841] Sleep (dwMilliseconds=0x1) [0052.856] Sleep (dwMilliseconds=0x1) [0052.872] Sleep (dwMilliseconds=0x1) [0052.888] Sleep (dwMilliseconds=0x1) [0052.903] Sleep (dwMilliseconds=0x1) [0052.918] Sleep (dwMilliseconds=0x1) [0052.934] Sleep (dwMilliseconds=0x1) [0052.949] Sleep (dwMilliseconds=0x1) [0052.965] Sleep (dwMilliseconds=0x1) [0052.981] Sleep (dwMilliseconds=0x1) [0052.997] Sleep (dwMilliseconds=0x1) [0053.012] Sleep (dwMilliseconds=0x1) [0053.028] Sleep (dwMilliseconds=0x1) [0053.043] Sleep (dwMilliseconds=0x1) [0053.059] Sleep (dwMilliseconds=0x1) [0053.074] Sleep (dwMilliseconds=0x1) [0053.090] Sleep (dwMilliseconds=0x1) [0053.114] Sleep (dwMilliseconds=0x1) [0053.121] Sleep (dwMilliseconds=0x1) [0053.137] Sleep (dwMilliseconds=0x1) [0053.152] Sleep (dwMilliseconds=0x1) [0053.168] Sleep (dwMilliseconds=0x1) [0053.184] Sleep (dwMilliseconds=0x1) [0053.203] Sleep (dwMilliseconds=0x1) [0053.216] Sleep (dwMilliseconds=0x1) [0053.230] Sleep (dwMilliseconds=0x1) [0053.246] Sleep (dwMilliseconds=0x1) [0053.261] Sleep (dwMilliseconds=0x1) [0053.277] Sleep (dwMilliseconds=0x1) [0053.293] Sleep (dwMilliseconds=0x1) [0053.308] Sleep (dwMilliseconds=0x1) [0053.324] Sleep (dwMilliseconds=0x1) [0053.339] Sleep (dwMilliseconds=0x1) [0053.364] Sleep (dwMilliseconds=0x1) [0053.371] Sleep (dwMilliseconds=0x1) [0053.386] Sleep (dwMilliseconds=0x1) [0053.402] Sleep (dwMilliseconds=0x1) [0053.417] Sleep (dwMilliseconds=0x1) [0053.433] Sleep (dwMilliseconds=0x1) [0053.449] Sleep (dwMilliseconds=0x1) [0053.465] Sleep (dwMilliseconds=0x1) [0053.480] Sleep (dwMilliseconds=0x1) [0053.496] Sleep (dwMilliseconds=0x1) [0053.511] Sleep (dwMilliseconds=0x1) [0053.527] Sleep (dwMilliseconds=0x1) [0053.543] Sleep (dwMilliseconds=0x1) [0053.558] Sleep (dwMilliseconds=0x1) [0053.574] Sleep (dwMilliseconds=0x1) [0053.590] Sleep (dwMilliseconds=0x1) [0053.605] Sleep (dwMilliseconds=0x1) [0053.621] Sleep (dwMilliseconds=0x1) [0053.636] Sleep (dwMilliseconds=0x1) [0053.652] Sleep (dwMilliseconds=0x1) [0053.667] Sleep (dwMilliseconds=0x1) [0053.683] Sleep (dwMilliseconds=0x1) [0053.698] Sleep (dwMilliseconds=0x1) [0053.714] Sleep (dwMilliseconds=0x1) [0053.729] Sleep (dwMilliseconds=0x1) [0053.745] Sleep (dwMilliseconds=0x1) [0053.761] Sleep (dwMilliseconds=0x1) [0053.777] Sleep (dwMilliseconds=0x1) [0053.792] Sleep (dwMilliseconds=0x1) [0053.808] Sleep (dwMilliseconds=0x1) [0053.823] Sleep (dwMilliseconds=0x1) [0053.839] Sleep (dwMilliseconds=0x1) [0053.855] Sleep (dwMilliseconds=0x1) [0053.870] Sleep (dwMilliseconds=0x1) [0053.886] Sleep (dwMilliseconds=0x1) [0053.901] Sleep (dwMilliseconds=0x1) [0053.917] Sleep (dwMilliseconds=0x1) [0053.934] Sleep (dwMilliseconds=0x1) [0053.948] Sleep (dwMilliseconds=0x1) [0053.964] Sleep (dwMilliseconds=0x1) [0053.979] Sleep (dwMilliseconds=0x1) [0053.995] Sleep (dwMilliseconds=0x1) [0054.010] Sleep (dwMilliseconds=0x1) [0054.026] Sleep (dwMilliseconds=0x1) [0054.042] Sleep (dwMilliseconds=0x1) [0054.057] Sleep (dwMilliseconds=0x1) [0054.073] Sleep (dwMilliseconds=0x1) [0054.089] Sleep (dwMilliseconds=0x1) [0054.104] Sleep (dwMilliseconds=0x1) [0054.120] Sleep (dwMilliseconds=0x1) [0054.135] Sleep (dwMilliseconds=0x1) [0054.151] Sleep (dwMilliseconds=0x1) [0054.166] Sleep (dwMilliseconds=0x1) [0054.182] Sleep (dwMilliseconds=0x1) [0054.202] Sleep (dwMilliseconds=0x1) [0054.213] Sleep (dwMilliseconds=0x1) [0054.229] Sleep (dwMilliseconds=0x1) [0054.245] Sleep (dwMilliseconds=0x1) [0054.260] Sleep (dwMilliseconds=0x1) [0054.276] Sleep (dwMilliseconds=0x1) [0054.291] Sleep (dwMilliseconds=0x1) [0054.307] Sleep (dwMilliseconds=0x1) [0054.324] Sleep (dwMilliseconds=0x1) [0054.339] Sleep (dwMilliseconds=0x1) [0054.354] Sleep (dwMilliseconds=0x1) [0054.369] Sleep (dwMilliseconds=0x1) [0054.385] Sleep (dwMilliseconds=0x1) [0054.401] Sleep (dwMilliseconds=0x1) [0054.416] Sleep (dwMilliseconds=0x1) [0054.432] Sleep (dwMilliseconds=0x1) [0054.447] Sleep (dwMilliseconds=0x1) [0054.463] Sleep (dwMilliseconds=0x1) [0054.478] Sleep (dwMilliseconds=0x1) [0054.494] Sleep (dwMilliseconds=0x1) [0054.510] Sleep (dwMilliseconds=0x1) [0054.525] Sleep (dwMilliseconds=0x1) [0054.541] Sleep (dwMilliseconds=0x1) [0054.564] Sleep (dwMilliseconds=0x1) [0054.572] Sleep (dwMilliseconds=0x1) [0054.588] Sleep (dwMilliseconds=0x1) [0054.603] Sleep (dwMilliseconds=0x1) [0054.619] Sleep (dwMilliseconds=0x1) [0054.635] Sleep (dwMilliseconds=0x1) [0054.650] Sleep (dwMilliseconds=0x1) [0054.665] Sleep (dwMilliseconds=0x1) [0054.681] Sleep (dwMilliseconds=0x1) [0054.697] Sleep (dwMilliseconds=0x1) [0054.712] Sleep (dwMilliseconds=0x1) [0054.728] Sleep (dwMilliseconds=0x1) [0054.744] Sleep (dwMilliseconds=0x1) [0054.759] Sleep (dwMilliseconds=0x1) [0054.775] Sleep (dwMilliseconds=0x1) [0054.790] Sleep (dwMilliseconds=0x1) [0054.806] Sleep (dwMilliseconds=0x1) [0054.821] Sleep (dwMilliseconds=0x1) [0054.837] Sleep (dwMilliseconds=0x1) [0054.853] Sleep (dwMilliseconds=0x1) [0054.869] Sleep (dwMilliseconds=0x1) [0054.884] Sleep (dwMilliseconds=0x1) [0054.900] Sleep (dwMilliseconds=0x1) [0054.915] Sleep (dwMilliseconds=0x1) [0054.931] Sleep (dwMilliseconds=0x1) [0054.946] Sleep (dwMilliseconds=0x1) [0054.962] Sleep (dwMilliseconds=0x1) [0054.978] Sleep (dwMilliseconds=0x1) [0054.993] Sleep (dwMilliseconds=0x1) [0055.009] Sleep (dwMilliseconds=0x1) [0055.024] Sleep (dwMilliseconds=0x1) [0055.041] Sleep (dwMilliseconds=0x1) [0055.056] Sleep (dwMilliseconds=0x1) [0055.072] Sleep (dwMilliseconds=0x1) [0055.087] Sleep (dwMilliseconds=0x1) [0055.102] Sleep (dwMilliseconds=0x1) [0055.118] Sleep (dwMilliseconds=0x1) [0055.134] Sleep (dwMilliseconds=0x1) [0055.149] Sleep (dwMilliseconds=0x1) [0055.165] Sleep (dwMilliseconds=0x1) [0055.181] Sleep (dwMilliseconds=0x1) [0055.201] Sleep (dwMilliseconds=0x1) [0055.212] Sleep (dwMilliseconds=0x1) [0055.227] Sleep (dwMilliseconds=0x1) [0055.243] Sleep (dwMilliseconds=0x1) [0055.258] Sleep (dwMilliseconds=0x1) [0055.274] Sleep (dwMilliseconds=0x1) [0055.290] Sleep (dwMilliseconds=0x1) [0055.305] Sleep (dwMilliseconds=0x1) [0055.321] Sleep (dwMilliseconds=0x1) [0055.337] Sleep (dwMilliseconds=0x1) [0055.352] Sleep (dwMilliseconds=0x1) [0055.368] Sleep (dwMilliseconds=0x1) [0055.383] Sleep (dwMilliseconds=0x1) [0055.399] Sleep (dwMilliseconds=0x1) [0055.414] Sleep (dwMilliseconds=0x1) [0055.432] Sleep (dwMilliseconds=0x1) [0055.446] Sleep (dwMilliseconds=0x1) [0055.461] Sleep (dwMilliseconds=0x1) [0055.477] Sleep (dwMilliseconds=0x1) [0055.493] Sleep (dwMilliseconds=0x1) [0055.543] Sleep (dwMilliseconds=0x1) [0055.594] Sleep (dwMilliseconds=0x1) [0055.652] Sleep (dwMilliseconds=0x1) [0055.699] Sleep (dwMilliseconds=0x1) [0059.672] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", len=0x4d | out: pbstr=0x68cff84*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 1 [0059.672] GetProcessHeap () returned 0x580000 [0059.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669580, Size=0x48) returned 0x596cd8 [0059.672] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0060.730] CloseHandle (hObject=0x454) returned 1 [0060.730] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0060.730] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id_1622540890_.your_last_chance")) returned 1 [0060.731] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0060.731] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x43004e, dwReserved1=0x45, cFileName="ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~2.YOU")) returned 0x5b9630 [0060.731] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0060.732] GetProcessHeap () returned 0x580000 [0060.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e86c40 [0060.732] GetProcessHeap () returned 0x580000 [0060.732] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6e98470 [0060.733] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.733] ReadFile (in: hFile=0x454, lpBuffer=0x6e86c40, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e86c40*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.073] GetProcessHeap () returned 0x580000 [0066.073] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616250 [0066.074] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.074] WriteFile (in: hFile=0x454, lpBuffer=0x6e98470*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e98470*, lpNumberOfBytesWritten=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0066.823] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.823] WriteFile (in: hFile=0x454, lpBuffer=0x6ea9c6f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea9c6f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0067.580] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.580] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0067.580] CloseHandle (hObject=0x454) returned 1 [0067.626] GetProcessHeap () returned 0x580000 [0067.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e98470 | out: hHeap=0x580000) returned 1 [0067.626] GetProcessHeap () returned 0x580000 [0067.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e86c40 | out: hHeap=0x580000) returned 1 [0067.626] GetProcessHeap () returned 0x580000 [0067.626] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616250 | out: hHeap=0x580000) returned 1 [0067.626] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0x600c0480, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x265424, dwReserved0=0x68cfd28, dwReserved1=0x6e86c40, cFileName="ProjectMUI.msi.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROJEC~2.YOU")) returned 0x5b96b0 [0068.633] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0072.134] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", len=0x47 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 1 [0072.134] GetProcessHeap () returned 0x580000 [0072.134] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x44) returned 0x5f7468 [0072.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.135] Sleep (dwMilliseconds=0x1) [0072.151] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", len=0x4f | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 1 [0072.151] GetProcessHeap () returned 0x580000 [0072.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x68) returned 0x5b5d08 [0072.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.001] Sleep (dwMilliseconds=0x1) [0073.073] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", len=0x4a | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 1 [0073.073] GetProcessHeap () returned 0x580000 [0073.073] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0073.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.076] Sleep (dwMilliseconds=0x1) [0073.088] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", len=0x43 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 1 [0073.088] GetProcessHeap () returned 0x580000 [0073.088] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x18) returned 0x5b5d08 [0073.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0074.600] CloseHandle (hObject=0x41c) returned 1 [0074.600] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0074.600] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id_1622540890_.your_last_chance")) returned 1 [0074.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0074.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GIFIMP~1.YOU")) returned 0x5b9730 [0074.601] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0074.601] GetProcessHeap () returned 0x580000 [0074.601] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f10048 [0074.602] GetProcessHeap () returned 0x580000 [0074.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6f21878 [0074.602] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0074.602] ReadFile (in: hFile=0x41c, lpBuffer=0x6f10048, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f10048*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.459] GetProcessHeap () returned 0x580000 [0078.459] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615878 [0078.459] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.459] WriteFile (in: hFile=0x41c, lpBuffer=0x6f21878*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f21878*, lpNumberOfBytesWritten=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0078.460] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.460] WriteFile (in: hFile=0x41c, lpBuffer=0x6f33077*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f33077*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0078.853] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0078.853] WriteFile (in: hFile=0x41c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0078.853] CloseHandle (hObject=0x41c) returned 1 [0079.287] GetProcessHeap () returned 0x580000 [0079.287] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f21878 | out: hHeap=0x580000) returned 1 [0079.328] GetProcessHeap () returned 0x580000 [0079.328] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f10048 | out: hHeap=0x580000) returned 1 [0079.329] GetProcessHeap () returned 0x580000 [0079.329] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615878 | out: hHeap=0x580000) returned 1 [0079.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x669c8f40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4e3a4, dwReserved0=0x580000, dwReserved1=0x6d0e500, cFileName="GIFIMP32.FLT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GIFIMP~1.YOU")) returned 0x5b96f0 [0079.479] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.474] Sleep (dwMilliseconds=0x1) [0084.496] Sleep (dwMilliseconds=0x1) [0085.966] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", len=0x48 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 1 [0085.966] GetProcessHeap () returned 0x580000 [0085.966] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x88) returned 0x614a48 [0085.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.967] Sleep (dwMilliseconds=0x1) [0085.982] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", len=0x4a | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 1 [0085.982] GetProcessHeap () returned 0x580000 [0085.982] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0x18) returned 0x614a48 [0085.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0085.992] Sleep (dwMilliseconds=0x1) [0088.371] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", len=0x4b | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 1 [0088.371] GetProcessHeap () returned 0x580000 [0088.371] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9528 | out: hHeap=0x580000) returned 1 [0088.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0088.469] CloseHandle (hObject=0x44c) returned 1 [0088.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0088.470] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id_1622540890_.your_last_chance")) returned 1 [0088.470] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0088.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x45, dwReserved1=0x0, cFileName="COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPAS~2.YOU")) returned 0x5b96b0 [0088.470] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0088.471] GetProcessHeap () returned 0x580000 [0088.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd621) returned 0x6db9750 [0088.471] GetProcessHeap () returned 0x580000 [0088.471] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd621) returned 0x6dc6d80 [0088.471] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0088.471] ReadFile (in: hFile=0x44c, lpBuffer=0x6db9750, nNumberOfBytesToRead=0xd600, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6db9750*, lpNumberOfBytesRead=0x68cff14*=0xd600, lpOverlapped=0x0) returned 1 [0091.265] GetProcessHeap () returned 0x580000 [0091.265] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6169f8 [0091.265] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.265] WriteFile (in: hFile=0x44c, lpBuffer=0x6dc6d80*, nNumberOfBytesToWrite=0xd600, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc6d80*, lpNumberOfBytesWritten=0x68cff14*=0xd600, lpOverlapped=0x0) returned 1 [0091.266] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.266] WriteFile (in: hFile=0x44c, lpBuffer=0x6dd437f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd437f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0091.597] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0091.597] WriteFile (in: hFile=0x44c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0091.597] CloseHandle (hObject=0x44c) returned 1 [0091.597] GetProcessHeap () returned 0x580000 [0091.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc6d80 | out: hHeap=0x580000) returned 1 [0091.597] GetProcessHeap () returned 0x580000 [0091.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6db9750 | out: hHeap=0x580000) returned 1 [0091.597] GetProcessHeap () returned 0x580000 [0091.597] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6169f8 | out: hHeap=0x580000) returned 1 [0091.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3552a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd637, dwReserved0=0x68cfd28, dwReserved1=0x6db9750, cFileName="COMPASS.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMPAS~2.YOU")) returned 0x5b96b0 [0091.628] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.188] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", len=0x4b | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 1 [0092.188] GetProcessHeap () returned 0x580000 [0092.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x64) returned 0x6f09578 [0092.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0092.207] CloseHandle (hObject=0x488) returned 1 [0092.208] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0092.208] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id_1622540890_.your_last_chance")) returned 1 [0092.306] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0092.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x45, dwReserved1=0x0, cFileName="NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~1.YOU")) returned 0x5b96b0 [0092.306] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0092.306] GetProcessHeap () returned 0x580000 [0092.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x67fc68 [0092.306] GetProcessHeap () returned 0x580000 [0092.306] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6f1bea8 [0092.307] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.307] ReadFile (in: hFile=0x488, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0092.321] GetProcessHeap () returned 0x580000 [0092.321] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615f08 [0092.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.321] WriteFile (in: hFile=0x488, lpBuffer=0x6f1bea8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1bea8*, lpNumberOfBytesWritten=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0092.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.321] WriteFile (in: hFile=0x488, lpBuffer=0x6f1c0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1c0e7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0092.321] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0092.321] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0092.321] CloseHandle (hObject=0x488) returned 1 [0092.322] GetProcessHeap () returned 0x580000 [0092.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f1bea8 | out: hHeap=0x580000) returned 1 [0092.322] GetProcessHeap () returned 0x580000 [0092.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0092.322] GetProcessHeap () returned 0x580000 [0092.322] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615f08 | out: hHeap=0x580000) returned 1 [0092.322] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea53340, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x68cfd28, dwReserved1=0x67fc68, cFileName="NETWORK.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="NETWOR~1.YOU")) returned 0x5b96b0 [0092.322] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.408] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", len=0x4a | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 1 [0092.408] GetProcessHeap () returned 0x580000 [0092.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x38) returned 0x5b96b0 [0092.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0093.523] CloseHandle (hObject=0x490) returned 1 [0093.523] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0093.523] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id_1622540890_.your_last_chance")) returned 1 [0093.524] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0093.524] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0093.524] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0093.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0093.524] GetProcessHeap () returned 0x580000 [0093.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1441) returned 0x6d9bb80 [0093.524] GetProcessHeap () returned 0x580000 [0093.524] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1441) returned 0x6d06ca8 [0093.524] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.524] ReadFile (in: hFile=0x490, lpBuffer=0x6d9bb80, nNumberOfBytesToRead=0x1420, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d9bb80*, lpNumberOfBytesRead=0x68cff14*=0x1420, lpOverlapped=0x0) returned 1 [0093.543] GetProcessHeap () returned 0x580000 [0093.543] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0093.543] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.543] WriteFile (in: hFile=0x490, lpBuffer=0x6d06ca8*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesWritten=0x68cff14*=0x1420, lpOverlapped=0x0) returned 1 [0093.543] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.543] WriteFile (in: hFile=0x490, lpBuffer=0x6d080c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d080c7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0093.544] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0093.544] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0093.544] CloseHandle (hObject=0x490) returned 1 [0093.544] GetProcessHeap () returned 0x580000 [0093.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0093.544] GetProcessHeap () returned 0x580000 [0093.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d9bb80 | out: hHeap=0x580000) returned 1 [0093.544] GetProcessHeap () returned 0x580000 [0093.544] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.168] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f5ede80, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x145f, dwReserved0=0x68cfd28, dwReserved1=0x6d9bb80, cFileName="PREVIEW.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PREVIE~1.YOU")) returned 0x5b96f0 [0094.169] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.186] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", len=0x49 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 1 [0094.186] GetProcessHeap () returned 0x580000 [0094.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x30) returned 0x61f6c0 [0094.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0094.334] CloseHandle (hObject=0x40c) returned 1 [0094.334] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.334] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id_1622540890_.your_last_chance")) returned 1 [0094.347] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIAL~2.YOU")) returned 0x5b96b0 [0094.348] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x40c [0094.348] GetProcessHeap () returned 0x580000 [0094.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c55ca8 [0094.348] GetProcessHeap () returned 0x580000 [0094.348] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6c676b8 [0094.348] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.348] ReadFile (in: hFile=0x40c, lpBuffer=0x6c55ca8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c55ca8*, lpNumberOfBytesRead=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0094.389] GetProcessHeap () returned 0x580000 [0094.389] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.389] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x40c, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x40c, lpBuffer=0x6c678f7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c678f7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.389] SetFilePointerEx (in: hFile=0x40c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.389] WriteFile (in: hFile=0x40c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.390] CloseHandle (hObject=0x40c) returned 1 [0094.390] GetProcessHeap () returned 0x580000 [0094.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0094.390] GetProcessHeap () returned 0x580000 [0094.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c55ca8 | out: hHeap=0x580000) returned 1 [0094.390] GetProcessHeap () returned 0x580000 [0094.390] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fdf68c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x68cfd28, dwReserved1=0x6c55ca8, cFileName="RADIAL.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RADIAL~2.YOU")) returned 0x5b96b0 [0094.390] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.439] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", len=0x4b | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 1 [0094.439] GetProcessHeap () returned 0x580000 [0094.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669420, Size=0x4c) returned 0x669b00 [0094.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.444] CloseHandle (hObject=0x4a4) returned 1 [0094.444] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.445] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id_1622540890_.your_last_chance")) returned 1 [0094.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x45, dwReserved1=0x0, cFileName="RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RMNSQU~1.YOU")) returned 0x5b96b0 [0094.452] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.452] GetProcessHeap () returned 0x580000 [0094.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d08520 [0094.452] GetProcessHeap () returned 0x580000 [0094.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6d087c8 [0094.452] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.452] ReadFile (in: hFile=0x4a4, lpBuffer=0x6d08520, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08520*, lpNumberOfBytesRead=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0094.458] GetProcessHeap () returned 0x580000 [0094.458] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.458] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d087c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d087c8*, lpNumberOfBytesWritten=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0094.458] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x6d08a27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d08a27*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.458] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.458] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.458] CloseHandle (hObject=0x4a4) returned 1 [0094.458] GetProcessHeap () returned 0x580000 [0094.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d087c8 | out: hHeap=0x580000) returned 1 [0094.458] GetProcessHeap () returned 0x580000 [0094.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d08520 | out: hHeap=0x580000) returned 1 [0094.458] GetProcessHeap () returned 0x580000 [0094.458] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fe8ee40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x68cfd28, dwReserved1=0x6d08520, cFileName="RMNSQUE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RMNSQU~1.YOU")) returned 0x5b96b0 [0094.459] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.474] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", len=0x49 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 1 [0094.474] GetProcessHeap () returned 0x580000 [0094.474] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x40) returned 0x61a468 [0094.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.475] CloseHandle (hObject=0x4a4) returned 1 [0094.475] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.475] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id_1622540890_.your_last_chance")) returned 1 [0094.476] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RIPPLE~1.YOU")) returned 0x5b96b0 [0094.476] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.476] GetProcessHeap () returned 0x580000 [0094.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x60c210 [0094.476] GetProcessHeap () returned 0x580000 [0094.476] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x201) returned 0x608e50 [0094.476] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.476] ReadFile (in: hFile=0x4a4, lpBuffer=0x60c210, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x60c210*, lpNumberOfBytesRead=0x68cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0094.479] GetProcessHeap () returned 0x580000 [0094.479] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616e58 [0094.479] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.479] WriteFile (in: hFile=0x4a4, lpBuffer=0x608e50*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x608e50*, lpNumberOfBytesWritten=0x68cff14*=0x1e0, lpOverlapped=0x0) returned 1 [0094.479] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.479] WriteFile (in: hFile=0x4a4, lpBuffer=0x60902f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x60902f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0094.479] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.479] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0094.479] CloseHandle (hObject=0x4a4) returned 1 [0094.480] GetProcessHeap () returned 0x580000 [0094.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x608e50 | out: hHeap=0x580000) returned 1 [0094.480] GetProcessHeap () returned 0x580000 [0094.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x60c210 | out: hHeap=0x580000) returned 1 [0094.480] GetProcessHeap () returned 0x580000 [0094.480] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616e58 | out: hHeap=0x580000) returned 1 [0094.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fedb100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x20b, dwReserved0=0x68cfd28, dwReserved1=0x60c210, cFileName="RIPPLE.INF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RIPPLE~1.YOU")) returned 0x5b96b0 [0094.480] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.490] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", len=0x49 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 1 [0094.490] GetProcessHeap () returned 0x580000 [0094.490] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x3c) returned 0x61aa08 [0094.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.490] CloseHandle (hObject=0x4a4) returned 1 [0094.490] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0094.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id_1622540890_.your_last_chance")) returned 1 [0094.491] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0094.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RIPPLE~2.YOU")) returned 0x5b96b0 [0094.491] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0094.492] GetProcessHeap () returned 0x580000 [0094.492] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10201) returned 0x6e3b5c0 [0094.521] GetProcessHeap () returned 0x580000 [0094.521] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10201) returned 0x6e4b7d0 [0094.522] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0094.522] ReadFile (in: hFile=0x4a4, lpBuffer=0x6e3b5c0, nNumberOfBytesToRead=0x101e0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e3b5c0*, lpNumberOfBytesRead=0x68cff14*=0x101e0, lpOverlapped=0x0) returned 1 [0100.435] GetProcessHeap () returned 0x580000 [0100.435] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0100.435] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.435] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e4b7d0*, nNumberOfBytesToWrite=0x101e0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e4b7d0*, lpNumberOfBytesWritten=0x68cff14*=0x101e0, lpOverlapped=0x0) returned 1 [0100.436] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.436] WriteFile (in: hFile=0x4a4, lpBuffer=0x6e5b9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e5b9af*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0100.436] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0100.436] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0100.436] CloseHandle (hObject=0x4a4) returned 1 [0100.436] GetProcessHeap () returned 0x580000 [0100.436] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e4b7d0 | out: hHeap=0x580000) returned 1 [0100.535] GetProcessHeap () returned 0x580000 [0100.535] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e3b5c0 | out: hHeap=0x580000) returned 1 [0100.536] GetProcessHeap () returned 0x580000 [0100.536] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0101.840] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x737afe40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x10204, dwReserved0=0x580000, dwReserved1=0x6d035f0, cFileName="RIPPLE.ELM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RIPPLE~2.YOU")) returned 0x5b96b0 [0101.840] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0106.165] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", len=0x46 | out: pbstr=0x68cff84*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 1 [0106.165] GetProcessHeap () returned 0x580000 [0106.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x14) returned 0x5a5888 [0106.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0107.215] CloseHandle (hObject=0x474) returned 1 [0107.215] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0107.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id_1622540890_.your_last_chance")) returned 1 [0107.216] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0107.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBHW6C~1.YOU")) returned 0x5b9630 [0107.216] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0107.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474 [0107.216] GetProcessHeap () returned 0x580000 [0107.216] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe2c1) returned 0x6c57108 [0107.217] GetProcessHeap () returned 0x580000 [0107.217] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe2c1) returned 0x626d18 [0107.217] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0107.217] ReadFile (in: hFile=0x474, lpBuffer=0x6c57108, nNumberOfBytesToRead=0xe2a0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c57108*, lpNumberOfBytesRead=0x68cff14*=0xe2a0, lpOverlapped=0x0) returned 1 [0110.316] GetProcessHeap () returned 0x580000 [0110.316] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0110.317] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.317] WriteFile (in: hFile=0x474, lpBuffer=0x626d18*, nNumberOfBytesToWrite=0xe2a0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesWritten=0x68cff14*=0xe2a0, lpOverlapped=0x0) returned 1 [0110.317] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.317] WriteFile (in: hFile=0x474, lpBuffer=0x634fb7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x634fb7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0110.317] SetFilePointerEx (in: hFile=0x474, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0110.317] WriteFile (in: hFile=0x474, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0110.317] CloseHandle (hObject=0x474) returned 1 [0110.318] GetProcessHeap () returned 0x580000 [0110.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0110.318] GetProcessHeap () returned 0x580000 [0110.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c57108 | out: hHeap=0x580000) returned 1 [0110.318] GetProcessHeap () returned 0x580000 [0110.318] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0110.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x795dc4a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe2ce, dwReserved0=0x68cfd28, dwReserved1=0x6c57108, cFileName="VBHW6.CHM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VBHW6C~1.YOU")) returned 0x5b9630 [0110.318] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.110] Sleep (dwMilliseconds=0x1) [0112.123] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", len=0x4d | out: pbstr=0x68cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.123] GetProcessHeap () returned 0x580000 [0112.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x54) returned 0x5a47d8 [0112.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.123] Sleep (dwMilliseconds=0x1) [0112.264] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", len=0x5c | out: pbstr=0x68cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned 1 [0112.264] GetProcessHeap () returned 0x580000 [0112.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x20) returned 0x615078 [0112.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.264] Sleep (dwMilliseconds=0x1) [0112.304] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", len=0x50 | out: pbstr=0x68cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 1 [0112.304] GetProcessHeap () returned 0x580000 [0112.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x80) returned 0x5fa1f0 [0112.304] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.325] Sleep (dwMilliseconds=0x1) [0112.392] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x68cff84*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.392] GetProcessHeap () returned 0x580000 [0112.392] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x10) returned 0x5e92e8 [0112.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.393] Sleep (dwMilliseconds=0x1) [0113.323] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", len=0x3f | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 1 [0113.323] GetProcessHeap () returned 0x580000 [0113.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0xc8) returned 0x6f0ceb8 [0113.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0113.487] CloseHandle (hObject=0x478) returned 1 [0113.487] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0113.487] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id_1622540890_.your_last_chance")) returned 1 [0114.786] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0114.786] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0121~1.YOU")) returned 0x5b9630 [0114.786] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0114.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0114.786] GetProcessHeap () returned 0x580000 [0114.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x6d06ca8 [0114.786] GetProcessHeap () returned 0x580000 [0114.786] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x16e1) returned 0x6e00ac0 [0114.786] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.786] ReadFile (in: hFile=0x478, lpBuffer=0x6d06ca8, nNumberOfBytesToRead=0x16c0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06ca8*, lpNumberOfBytesRead=0x68cff14*=0x16c0, lpOverlapped=0x0) returned 1 [0114.808] GetProcessHeap () returned 0x580000 [0114.808] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616138 [0114.808] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.808] WriteFile (in: hFile=0x478, lpBuffer=0x6e00ac0*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e00ac0*, lpNumberOfBytesWritten=0x68cff14*=0x16c0, lpOverlapped=0x0) returned 1 [0114.808] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.808] WriteFile (in: hFile=0x478, lpBuffer=0x6e0217f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e0217f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0114.808] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0114.809] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0114.809] CloseHandle (hObject=0x478) returned 1 [0114.809] GetProcessHeap () returned 0x580000 [0114.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e00ac0 | out: hHeap=0x580000) returned 1 [0114.809] GetProcessHeap () returned 0x580000 [0114.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06ca8 | out: hHeap=0x580000) returned 1 [0114.809] GetProcessHeap () returned 0x580000 [0114.809] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616138 | out: hHeap=0x580000) returned 1 [0115.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c0b50a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x16f0, dwReserved0=0x68cfd28, dwReserved1=0x6d06ca8, cFileName="AN01216_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AN0121~1.YOU")) returned 0x5b9630 [0115.813] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.831] CloseHandle (hObject=0x4a0) returned 1 [0115.831] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0115.831] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.id_1622540890_.your_last_chance")) returned 1 [0115.832] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0115.832] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0018~1.YOU")) returned 0x5b9630 [0115.832] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0115.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0115.832] GetProcessHeap () returned 0x580000 [0115.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2841) returned 0x626d18 [0115.832] GetProcessHeap () returned 0x580000 [0115.832] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2841) returned 0x629568 [0115.832] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.832] ReadFile (in: hFile=0x4a0, lpBuffer=0x626d18, nNumberOfBytesToRead=0x2820, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d18*, lpNumberOfBytesRead=0x68cff14*=0x2820, lpOverlapped=0x0) returned 1 [0115.869] GetProcessHeap () returned 0x580000 [0115.869] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6167c8 [0115.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x629568*, nNumberOfBytesToWrite=0x2820, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x629568*, lpNumberOfBytesWritten=0x68cff14*=0x2820, lpOverlapped=0x0) returned 1 [0115.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x62bd87*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x62bd87*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0115.869] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0115.869] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0115.869] CloseHandle (hObject=0x4a0) returned 1 [0115.869] GetProcessHeap () returned 0x580000 [0115.869] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x629568 | out: hHeap=0x580000) returned 1 [0115.869] GetProcessHeap () returned 0x580000 [0115.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d18 | out: hHeap=0x580000) returned 1 [0115.870] GetProcessHeap () returned 0x580000 [0115.870] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6167c8 | out: hHeap=0x580000) returned 1 [0115.870] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cad2e20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x2860, dwReserved0=0x68cfd28, dwReserved1=0x626d18, cFileName="SO00183_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0018~1.YOU")) returned 0x5b9630 [0115.870] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0118.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.428] CloseHandle (hObject=0x4a0) returned 1 [0118.435] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0118.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.id_1622540890_.your_last_chance")) returned 1 [0118.440] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0118.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x0, dwReserved1=0x0, cFileName="SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0246~1.YOU")) returned 0x5b9730 [0118.440] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0118.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0118.440] GetProcessHeap () returned 0x580000 [0118.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x6c676b8 [0118.440] GetProcessHeap () returned 0x580000 [0118.440] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x581) returned 0x626d30 [0118.441] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.441] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c676b8, nNumberOfBytesToRead=0x560, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesRead=0x68cff14*=0x560, lpOverlapped=0x0) returned 1 [0118.447] GetProcessHeap () returned 0x580000 [0118.447] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0118.447] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.447] WriteFile (in: hFile=0x4a0, lpBuffer=0x626d30*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x626d30*, lpNumberOfBytesWritten=0x68cff14*=0x560, lpOverlapped=0x0) returned 1 [0118.447] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.447] WriteFile (in: hFile=0x4a0, lpBuffer=0x62728f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x62728f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0118.447] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0118.447] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0118.448] CloseHandle (hObject=0x4a0) returned 1 [0118.448] GetProcessHeap () returned 0x580000 [0118.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x626d30 | out: hHeap=0x580000) returned 1 [0118.448] GetProcessHeap () returned 0x580000 [0118.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0118.448] GetProcessHeap () returned 0x580000 [0118.448] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0120.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e35f100, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x598, dwReserved0=0x68cfd28, dwReserved1=0x6c676b8, cFileName="SO02465_.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SO0246~1.YOU")) returned 0x5b96f0 [0120.124] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0120.149] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", len=0x4c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 1 [0120.149] GetProcessHeap () returned 0x580000 [0120.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17dc) returned 0x6d06ca8 [0120.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0121.415] CloseHandle (hObject=0x48c) returned 1 [0121.415] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0121.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.id_1622540890_.your_last_chance")) returned 1 [0121.416] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0121.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x450043, dwReserved1=0x0, cFileName="WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0213~1.YOU")) returned 0x5b9730 [0121.416] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0121.417] GetProcessHeap () returned 0x580000 [0121.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6c10060 [0121.417] GetProcessHeap () returned 0x580000 [0121.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6c10a68 [0121.417] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.417] ReadFile (in: hFile=0x48c, lpBuffer=0x6c10060, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x68cff14*=0x960, lpOverlapped=0x0) returned 1 [0121.426] GetProcessHeap () returned 0x580000 [0121.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616d40 [0121.427] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.427] WriteFile (in: hFile=0x48c, lpBuffer=0x6c10a68*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10a68*, lpNumberOfBytesWritten=0x68cff14*=0x960, lpOverlapped=0x0) returned 1 [0121.427] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.427] WriteFile (in: hFile=0x48c, lpBuffer=0x6c113c7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c113c7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0121.427] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0121.427] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0121.427] CloseHandle (hObject=0x48c) returned 1 [0121.427] GetProcessHeap () returned 0x580000 [0121.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10a68 | out: hHeap=0x580000) returned 1 [0121.427] GetProcessHeap () returned 0x580000 [0121.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0121.427] GetProcessHeap () returned 0x580000 [0121.427] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616d40 | out: hHeap=0x580000) returned 1 [0121.912] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffc97a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x68cfd28, dwReserved1=0x6c10060, cFileName="WB02134_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WB0213~1.YOU")) returned 0x5b9730 [0121.912] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.560] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", len=0x4a | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned 1 [0122.560] GetProcessHeap () returned 0x580000 [0122.560] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1958) returned 0x6f42f08 [0122.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.584] CloseHandle (hObject=0x484) returned 1 [0122.584] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0122.584] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.id_1622540890_.your_last_chance")) returned 1 [0122.585] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0122.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANX~1.YOU")) returned 0x5b9730 [0122.585] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0122.585] GetProcessHeap () returned 0x580000 [0122.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f69420 [0122.588] GetProcessHeap () returned 0x580000 [0122.588] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe21) returned 0x6f6a2a8 [0122.588] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.588] ReadFile (in: hFile=0x484, lpBuffer=0x6f69420, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f69420*, lpNumberOfBytesRead=0x68cff14*=0xe00, lpOverlapped=0x0) returned 1 [0122.620] GetProcessHeap () returned 0x580000 [0122.620] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0122.620] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.620] WriteFile (in: hFile=0x484, lpBuffer=0x6f6a2a8*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6a2a8*, lpNumberOfBytesWritten=0x68cff14*=0xe00, lpOverlapped=0x0) returned 1 [0122.620] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.620] WriteFile (in: hFile=0x484, lpBuffer=0x6f6b0a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f6b0a7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0122.621] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0122.621] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0122.621] CloseHandle (hObject=0x484) returned 1 [0122.636] GetProcessHeap () returned 0x580000 [0122.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f6a2a8 | out: hHeap=0x580000) returned 1 [0122.636] GetProcessHeap () returned 0x580000 [0122.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f69420 | out: hHeap=0x580000) returned 1 [0122.636] GetProcessHeap () returned 0x580000 [0122.636] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0124.421] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b3e180, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xe3d, dwReserved0=0x68cfd28, dwReserved1=0x6f69420, cFileName="Urban.xml.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="URBANX~1.YOU")) returned 0x5b9730 [0124.519] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0125.344] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", len=0x3d | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned 1 [0125.344] GetProcessHeap () returned 0x580000 [0125.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x193c) returned 0x6f42f08 [0125.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0128.734] CloseHandle (hObject=0x4a4) returned 1 [0128.734] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0128.734] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.id_1622540890_.your_last_chance")) returned 1 [0128.735] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0128.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02308~1.YOU")) returned 0x5b96f0 [0128.735] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0128.735] GetProcessHeap () returned 0x580000 [0128.735] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30e1) returned 0x6f14048 [0128.736] GetProcessHeap () returned 0x580000 [0128.736] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x30e1) returned 0x6dccfe0 [0128.736] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.736] ReadFile (in: hFile=0x4a4, lpBuffer=0x6f14048, nNumberOfBytesToRead=0x30c0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f14048*, lpNumberOfBytesRead=0x68cff14*=0x30c0, lpOverlapped=0x0) returned 1 [0128.920] GetProcessHeap () returned 0x580000 [0128.920] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616480 [0128.920] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.920] WriteFile (in: hFile=0x4a4, lpBuffer=0x6dccfe0*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dccfe0*, lpNumberOfBytesWritten=0x68cff14*=0x30c0, lpOverlapped=0x0) returned 1 [0128.920] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.920] WriteFile (in: hFile=0x4a4, lpBuffer=0x6dd009f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dd009f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0128.920] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0128.920] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0128.920] CloseHandle (hObject=0x4a4) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dccfe0 | out: hHeap=0x580000) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f14048 | out: hHeap=0x580000) returned 1 [0128.978] GetProcessHeap () returned 0x580000 [0128.978] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616480 | out: hHeap=0x580000) returned 1 [0129.448] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84758d00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x30fe, dwReserved0=0x68cfd28, dwReserved1=0x6f14048, cFileName="J0230876.WMF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="J02308~1.YOU")) returned 0x5b96f0 [0129.449] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.473] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", len=0x43 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned 1 [0129.474] GetProcessHeap () returned 0x580000 [0129.474] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0129.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.482] CloseHandle (hObject=0x4a4) returned 1 [0129.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.id_1622540890_.your_last_chance")) returned 1 [0129.482] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.483] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15814600, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15814600, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2154~1.YOU")) returned 0x5b9730 [0129.483] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0129.483] GetProcessHeap () returned 0x580000 [0129.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x65f268 [0129.483] GetProcessHeap () returned 0x580000 [0129.483] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x65f9f0 [0129.483] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.483] ReadFile (in: hFile=0x4a4, lpBuffer=0x65f268, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f268*, lpNumberOfBytesRead=0x68cff14*=0x720, lpOverlapped=0x0) returned 1 [0129.520] GetProcessHeap () returned 0x580000 [0129.520] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616020 [0129.520] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.520] WriteFile (in: hFile=0x4a4, lpBuffer=0x65f9f0*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x65f9f0*, lpNumberOfBytesWritten=0x68cff14*=0x720, lpOverlapped=0x0) returned 1 [0129.520] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.520] WriteFile (in: hFile=0x4a4, lpBuffer=0x66010f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x66010f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0129.520] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.520] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0129.520] CloseHandle (hObject=0x4a4) returned 1 [0129.520] GetProcessHeap () returned 0x580000 [0129.520] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f9f0 | out: hHeap=0x580000) returned 1 [0129.521] GetProcessHeap () returned 0x580000 [0129.521] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x65f268 | out: hHeap=0x580000) returned 1 [0129.521] GetProcessHeap () returned 0x580000 [0129.521] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616020 | out: hHeap=0x580000) returned 1 [0129.521] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15814600, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84d00140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x761, dwReserved0=0x68cfd28, dwReserved1=0x65f268, cFileName="BD21548_.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BD2154~1.YOU")) returned 0x5b9630 [0129.574] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.600] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML", len=0x3c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML") returned 1 [0129.600] GetProcessHeap () returned 0x580000 [0129.601] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0129.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0129.601] CloseHandle (hObject=0x45c) returned 1 [0129.601] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0129.601] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.id_1622540890_.your_last_chance")) returned 1 [0129.602] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0129.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CT_ROO~1.YOU")) returned 0x5b9730 [0129.602] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0129.602] GetProcessHeap () returned 0x580000 [0129.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6cf54a8 [0129.602] GetProcessHeap () returned 0x580000 [0129.602] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x17c1) returned 0x6c2a820 [0129.602] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0129.602] ReadFile (in: hFile=0x45c, lpBuffer=0x6cf54a8, nNumberOfBytesToRead=0x17a0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cf54a8*, lpNumberOfBytesRead=0x68cff14*=0x17a0, lpOverlapped=0x0) returned 1 [0131.093] GetProcessHeap () returned 0x580000 [0131.093] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0131.093] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.093] WriteFile (in: hFile=0x45c, lpBuffer=0x6c2a820*, nNumberOfBytesToWrite=0x17a0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2a820*, lpNumberOfBytesWritten=0x68cff14*=0x17a0, lpOverlapped=0x0) returned 1 [0131.093] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.093] WriteFile (in: hFile=0x45c, lpBuffer=0x6c2bfbf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c2bfbf*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0131.093] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0131.093] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0131.093] CloseHandle (hObject=0x45c) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c2a820 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cf54a8 | out: hHeap=0x580000) returned 1 [0131.783] GetProcessHeap () returned 0x580000 [0131.783] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0132.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x85c06c20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x17d9, dwReserved0=0x68cfd28, dwReserved1=0x6cf54a8, cFileName="CT_ROOTS.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CT_ROO~1.YOU")) returned 0x5b9730 [0132.642] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0135.082] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", len=0x3c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 1 [0135.082] GetProcessHeap () returned 0x580000 [0135.083] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0135.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0136.563] CloseHandle (hObject=0x454) returned 1 [0136.563] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0136.563] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id_1622540890_.your_last_chance")) returned 1 [0138.794] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0138.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DRILLD~1.YOU")) returned 0x5b9770 [0138.794] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0138.795] GetProcessHeap () returned 0x580000 [0138.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfd81) returned 0x6ea1008 [0138.795] GetProcessHeap () returned 0x580000 [0138.795] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xfd81) returned 0x6eb0d98 [0138.795] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0138.795] ReadFile (in: hFile=0x454, lpBuffer=0x6ea1008, nNumberOfBytesToRead=0xfd60, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ea1008*, lpNumberOfBytesRead=0x68cff14*=0xfd60, lpOverlapped=0x0) returned 1 [0139.751] GetProcessHeap () returned 0x580000 [0139.751] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcddd8 [0139.751] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.752] WriteFile (in: hFile=0x454, lpBuffer=0x6eb0d98*, nNumberOfBytesToWrite=0xfd60, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eb0d98*, lpNumberOfBytesWritten=0x68cff14*=0xfd60, lpOverlapped=0x0) returned 1 [0139.752] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.752] WriteFile (in: hFile=0x454, lpBuffer=0x6ec0af7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ec0af7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0139.752] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0139.752] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0139.752] CloseHandle (hObject=0x454) returned 1 [0139.752] GetProcessHeap () returned 0x580000 [0139.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eb0d98 | out: hHeap=0x580000) returned 1 [0139.752] GetProcessHeap () returned 0x580000 [0139.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ea1008 | out: hHeap=0x580000) returned 1 [0139.752] GetProcessHeap () returned 0x580000 [0139.752] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcddd8 | out: hHeap=0x580000) returned 1 [0140.124] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8ae98740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfd8c, dwReserved0=0x68cfd28, dwReserved1=0x6ea1008, cFileName="DRILLDWN.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="DRILLD~1.YOU")) returned 0x5b9770 [0140.124] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.172] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", len=0x5d | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned 1 [0140.172] GetProcessHeap () returned 0x580000 [0140.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0140.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.755] CloseHandle (hObject=0x490) returned 1 [0140.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0140.755] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.id_1622540890_.your_last_chance")) returned 1 [0140.755] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0140.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x5f0030, dwReserved1=0x59002e, cFileName="Person.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSON~1.YOU")) returned 0x5b9730 [0140.756] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0140.756] GetProcessHeap () returned 0x580000 [0140.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6ce54c0 [0140.756] GetProcessHeap () returned 0x580000 [0140.756] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x981) returned 0x6ce5ec8 [0140.756] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.756] ReadFile (in: hFile=0x490, lpBuffer=0x6ce54c0, nNumberOfBytesToRead=0x960, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce54c0*, lpNumberOfBytesRead=0x68cff14*=0x960, lpOverlapped=0x0) returned 1 [0140.765] GetProcessHeap () returned 0x580000 [0140.765] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0140.765] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.766] WriteFile (in: hFile=0x490, lpBuffer=0x6ce5ec8*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce5ec8*, lpNumberOfBytesWritten=0x68cff14*=0x960, lpOverlapped=0x0) returned 1 [0140.766] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.766] WriteFile (in: hFile=0x490, lpBuffer=0x6ce6827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6ce6827*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0140.766] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0140.766] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0140.766] CloseHandle (hObject=0x490) returned 1 [0140.766] GetProcessHeap () returned 0x580000 [0140.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce5ec8 | out: hHeap=0x580000) returned 1 [0140.766] GetProcessHeap () returned 0x580000 [0140.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6ce54c0 | out: hHeap=0x580000) returned 1 [0140.766] GetProcessHeap () returned 0x580000 [0140.766] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0141.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b8440a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x98e, dwReserved0=0x68cfd28, dwReserved1=0x6ce54c0, cFileName="Person.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PERSON~1.YOU")) returned 0x5b9730 [0141.711] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.804] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL", len=0x3b | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 1 [0141.805] GetProcessHeap () returned 0x580000 [0141.805] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee8) returned 0x6f14048 [0141.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.852] CloseHandle (hObject=0x3a8) returned 1 [0141.852] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0141.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id_1622540890_.your_last_chance")) returned 1 [0141.853] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0141.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x21788, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRP~2.YOU")) returned 0x5b9730 [0141.853] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0141.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0141.853] GetProcessHeap () returned 0x580000 [0141.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fc4768 [0141.853] GetProcessHeap () returned 0x580000 [0141.853] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fd5f98 [0141.853] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0141.853] ReadFile (in: hFile=0x3a8, lpBuffer=0x6fc4768, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4768*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.738] GetProcessHeap () returned 0x580000 [0143.738] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09620 [0143.738] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.738] WriteFile (in: hFile=0x3a8, lpBuffer=0x6fd5f98*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd5f98*, lpNumberOfBytesWritten=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0143.739] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.739] WriteFile (in: hFile=0x3a8, lpBuffer=0x6fe7797*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fe7797*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0143.739] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0143.739] WriteFile (in: hFile=0x3a8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0143.739] CloseHandle (hObject=0x3a8) returned 1 [0143.964] GetProcessHeap () returned 0x580000 [0143.964] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fd5f98 | out: hHeap=0x580000) returned 1 [0143.970] GetProcessHeap () returned 0x580000 [0143.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc4768 | out: hHeap=0x580000) returned 1 [0143.971] GetProcessHeap () returned 0x580000 [0143.971] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09620 | out: hHeap=0x580000) returned 1 [0146.862] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8d4ae740, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x217ac, dwReserved0=0x580000, dwReserved1=0x6ce2370, cFileName="PROPRPT.VSL.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PROPRP~2.YOU")) returned 0x5b96f0 [0146.862] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.876] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", len=0x44 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned 1 [0146.876] GetProcessHeap () returned 0x580000 [0146.876] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0146.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0150.940] CloseHandle (hObject=0x488) returned 1 [0150.940] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0150.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.id_1622540890_.your_last_chance")) returned 1 [0151.992] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0151.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x59bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR29~1.YOU")) returned 0x5b9730 [0151.993] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0151.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0151.993] GetProcessHeap () returned 0x580000 [0151.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x59c1) returned 0x6dec6e0 [0151.993] GetProcessHeap () returned 0x580000 [0151.993] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x59c1) returned 0x6dc68c0 [0151.993] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.993] ReadFile (in: hFile=0x488, lpBuffer=0x6dec6e0, nNumberOfBytesToRead=0x59a0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6e0*, lpNumberOfBytesRead=0x68cff14*=0x59a0, lpOverlapped=0x0) returned 1 [0153.309] GetProcessHeap () returned 0x580000 [0153.309] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09968 [0153.309] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.309] WriteFile (in: hFile=0x488, lpBuffer=0x6dc68c0*, nNumberOfBytesToWrite=0x59a0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dc68c0*, lpNumberOfBytesWritten=0x68cff14*=0x59a0, lpOverlapped=0x0) returned 1 [0153.309] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.310] WriteFile (in: hFile=0x488, lpBuffer=0x6dcc25f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcc25f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0154.191] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.191] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0154.191] CloseHandle (hObject=0x488) returned 1 [0154.191] GetProcessHeap () returned 0x580000 [0154.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dc68c0 | out: hHeap=0x580000) returned 1 [0154.191] GetProcessHeap () returned 0x580000 [0154.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6e0 | out: hHeap=0x580000) returned 1 [0154.191] GetProcessHeap () returned 0x580000 [0154.191] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09968 | out: hHeap=0x580000) returned 1 [0154.191] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9385c080, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x59e0, dwReserved0=0x68cfd28, dwReserved1=0x6dec6e0, cFileName="PDIR29F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PDIR29~1.YOU")) returned 0x5b9630 [0154.192] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.703] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD", len=0x3c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 1 [0154.703] GetProcessHeap () returned 0x580000 [0154.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0154.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0159.103] CloseHandle (hObject=0x4a4) returned 1 [0159.103] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0159.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id_1622540890_.your_last_chance")) returned 1 [0159.137] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0159.137] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDERRL~1.YOU")) returned 0x5b9630 [0159.137] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0159.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0159.137] GetProcessHeap () returned 0x580000 [0159.137] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6cda390 [0159.138] GetProcessHeap () returned 0x580000 [0159.138] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x741) returned 0x6cdab18 [0159.138] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.138] ReadFile (in: hFile=0x4a4, lpBuffer=0x6cda390, nNumberOfBytesToRead=0x720, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cda390*, lpNumberOfBytesRead=0x68cff14*=0x720, lpOverlapped=0x0) returned 1 [0159.145] GetProcessHeap () returned 0x580000 [0159.145] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0159.145] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.145] WriteFile (in: hFile=0x4a4, lpBuffer=0x6cdab18*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdab18*, lpNumberOfBytesWritten=0x68cff14*=0x720, lpOverlapped=0x0) returned 1 [0159.145] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.145] WriteFile (in: hFile=0x4a4, lpBuffer=0x6cdb237*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6cdb237*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0159.145] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.145] WriteFile (in: hFile=0x4a4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0159.145] CloseHandle (hObject=0x4a4) returned 1 [0159.145] GetProcessHeap () returned 0x580000 [0159.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cdab18 | out: hHeap=0x580000) returned 1 [0159.145] GetProcessHeap () returned 0x580000 [0159.145] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6cda390 | out: hHeap=0x580000) returned 1 [0159.146] GetProcessHeap () returned 0x580000 [0159.146] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0164.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96785460, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x746, dwReserved0=0x68cfd28, dwReserved1=0x6cda390, cFileName="WDERRLNK.VRD.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="WDERRL~1.YOU")) returned 0x5b9730 [0164.393] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0164.434] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", len=0x40 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 1 [0164.434] GetProcessHeap () returned 0x580000 [0164.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0164.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0166.125] CloseHandle (hObject=0x470) returned 1 [0166.125] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0166.126] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id_1622540890_.your_last_chance")) returned 1 [0166.126] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0166.126] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCSCLI~1.YOU")) returned 0x5b9730 [0166.127] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0166.127] GetProcessHeap () returned 0x580000 [0166.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x68a1) returned 0x6fa8f28 [0166.127] GetProcessHeap () returned 0x580000 [0166.127] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x68a1) returned 0x6d8e818 [0166.128] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.128] ReadFile (in: hFile=0x470, lpBuffer=0x6fa8f28, nNumberOfBytesToRead=0x6880, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fa8f28*, lpNumberOfBytesRead=0x68cff14*=0x6880, lpOverlapped=0x0) returned 1 [0167.693] GetProcessHeap () returned 0x580000 [0167.693] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0167.693] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.693] WriteFile (in: hFile=0x470, lpBuffer=0x6d8e818*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d8e818*, lpNumberOfBytesWritten=0x68cff14*=0x6880, lpOverlapped=0x0) returned 1 [0167.694] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.694] WriteFile (in: hFile=0x470, lpBuffer=0x6d95097*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d95097*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0167.694] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0167.694] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0167.694] CloseHandle (hObject=0x470) returned 1 [0167.694] GetProcessHeap () returned 0x580000 [0167.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d8e818 | out: hHeap=0x580000) returned 1 [0167.694] GetProcessHeap () returned 0x580000 [0167.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fa8f28 | out: hHeap=0x580000) returned 1 [0167.694] GetProcessHeap () returned 0x580000 [0167.694] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.128] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b90c5e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x68aa, dwReserved0=0x68cfd28, dwReserved1=0x6fa8f28, cFileName="BCSClientManifest.man.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="BCSCLI~1.YOU")) returned 0x5b9730 [0170.129] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.183] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", len=0x41 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 1 [0170.183] GetProcessHeap () returned 0x580000 [0170.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22bc) returned 0x6f14048 [0170.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.189] CloseHandle (hObject=0x458) returned 1 [0170.189] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.189] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id_1622540890_.your_last_chance")) returned 1 [0170.190] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKUP~1.YOU")) returned 0x5b96f0 [0170.190] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0170.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0170.190] GetProcessHeap () returned 0x580000 [0170.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0170.190] GetProcessHeap () returned 0x580000 [0170.190] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0170.190] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.190] ReadFile (in: hFile=0x458, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0170.195] GetProcessHeap () returned 0x580000 [0170.195] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.195] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.195] WriteFile (in: hFile=0x458, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0170.196] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.196] WriteFile (in: hFile=0x458, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.196] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.196] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.196] CloseHandle (hObject=0x458) returned 1 [0170.196] GetProcessHeap () returned 0x580000 [0170.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0170.196] GetProcessHeap () returned 0x580000 [0170.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0170.196] GetProcessHeap () returned 0x580000 [0170.196] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.196] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d0da1e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34a, dwReserved0=0x68cfd28, dwReserved1=0x6c59120, cFileName="TASKUPD.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKUP~1.YOU")) returned 0x5b9730 [0170.196] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0170.235] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", len=0x41 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 1 [0170.235] GetProcessHeap () returned 0x580000 [0170.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22ac) returned 0x6f14048 [0170.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.236] CloseHandle (hObject=0x45c) returned 1 [0170.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id_1622540890_.your_last_chance")) returned 1 [0170.236] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~3.YOU")) returned 0x5b96b0 [0170.237] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0170.237] GetProcessHeap () returned 0x580000 [0170.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6df6780 [0170.237] GetProcessHeap () returned 0x580000 [0170.237] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x321) returned 0x6f0c8f8 [0170.237] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.237] ReadFile (in: hFile=0x45c, lpBuffer=0x6df6780, nNumberOfBytesToRead=0x300, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6df6780*, lpNumberOfBytesRead=0x68cff14*=0x300, lpOverlapped=0x0) returned 1 [0170.241] GetProcessHeap () returned 0x580000 [0170.241] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.241] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.241] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0c8f8*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0c8f8*, lpNumberOfBytesWritten=0x68cff14*=0x300, lpOverlapped=0x0) returned 1 [0170.241] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.241] WriteFile (in: hFile=0x45c, lpBuffer=0x6f0cbf7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f0cbf7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.241] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.242] WriteFile (in: hFile=0x45c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.242] CloseHandle (hObject=0x45c) returned 1 [0170.242] GetProcessHeap () returned 0x580000 [0170.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0c8f8 | out: hHeap=0x580000) returned 1 [0170.242] GetProcessHeap () returned 0x580000 [0170.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6df6780 | out: hHeap=0x580000) returned 1 [0170.242] GetProcessHeap () returned 0x580000 [0170.242] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0170.242] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d14c600, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x68cfd28, dwReserved1=0x6df6780, cFileName="TASKREQ.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKRE~3.YOU")) returned 0x5b96b0 [0170.242] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.245] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", len=0x42 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 1 [0170.245] GetProcessHeap () returned 0x580000 [0170.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a0) returned 0x6f14048 [0170.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0170.268] CloseHandle (hObject=0x3b4) returned 1 [0170.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0170.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id_1622540890_.your_last_chance")) returned 1 [0170.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0170.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~2.YOU")) returned 0x5b96b0 [0170.269] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0170.269] GetProcessHeap () returned 0x580000 [0170.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d09a0 [0170.269] GetProcessHeap () returned 0x580000 [0170.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0e28 [0170.269] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.269] ReadFile (in: hFile=0x3b4, lpBuffer=0x5d09a0, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d09a0*, lpNumberOfBytesRead=0x68cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.305] GetProcessHeap () returned 0x580000 [0170.305] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0170.305] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.305] WriteFile (in: hFile=0x3b4, lpBuffer=0x5d0e28*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0e28*, lpNumberOfBytesWritten=0x68cff14*=0x420, lpOverlapped=0x0) returned 1 [0170.305] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.305] WriteFile (in: hFile=0x3b4, lpBuffer=0x5d1247*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d1247*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0170.305] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0170.305] WriteFile (in: hFile=0x3b4, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0170.306] CloseHandle (hObject=0x3b4) returned 1 [0170.306] GetProcessHeap () returned 0x580000 [0170.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0e28 | out: hHeap=0x580000) returned 1 [0170.306] GetProcessHeap () returned 0x580000 [0170.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d09a0 | out: hHeap=0x580000) returned 1 [0170.306] GetProcessHeap () returned 0x580000 [0170.306] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.006] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d20ace0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x68cfd28, dwReserved1=0x5d09a0, cFileName="TASKDECL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TASKDE~2.YOU")) returned 0x5b9770 [0173.006] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.253] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", len=0x41 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 1 [0173.253] GetProcessHeap () returned 0x580000 [0173.253] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0173.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.275] CloseHandle (hObject=0x490) returned 1 [0173.275] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.275] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id_1622540890_.your_last_chance")) returned 1 [0173.276] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~3.YOU")) returned 0x5b9770 [0173.276] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.276] GetProcessHeap () returned 0x580000 [0173.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0090 [0173.276] GetProcessHeap () returned 0x580000 [0173.276] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x441) returned 0x5d0518 [0173.276] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.277] ReadFile (in: hFile=0x490, lpBuffer=0x5d0090, nNumberOfBytesToRead=0x420, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0090*, lpNumberOfBytesRead=0x68cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.326] GetProcessHeap () returned 0x580000 [0173.326] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0173.326] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.326] WriteFile (in: hFile=0x490, lpBuffer=0x5d0518*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0518*, lpNumberOfBytesWritten=0x68cff14*=0x420, lpOverlapped=0x0) returned 1 [0173.326] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.326] WriteFile (in: hFile=0x490, lpBuffer=0x5d0937*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5d0937*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.326] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.326] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.326] CloseHandle (hObject=0x490) returned 1 [0173.326] GetProcessHeap () returned 0x580000 [0173.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0518 | out: hHeap=0x580000) returned 1 [0173.326] GetProcessHeap () returned 0x580000 [0173.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5d0090 | out: hHeap=0x580000) returned 1 [0173.326] GetProcessHeap () returned 0x580000 [0173.326] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0173.327] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eec1640, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x68cfd28, dwReserved1=0x5d0090, cFileName="REMOTEL.ICO.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="REMOTE~3.YOU")) returned 0x5b9770 [0173.327] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.365] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", len=0x41 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 1 [0173.365] GetProcessHeap () returned 0x580000 [0173.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0173.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.365] CloseHandle (hObject=0x490) returned 1 [0173.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0173.366] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id_1622540890_.your_last_chance")) returned 1 [0173.366] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0173.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4466a600, ftLastWriteTime.dwHighDateTime=0x1c9449a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFTMP~1.YOU")) returned 0x5b9770 [0173.366] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0173.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x490 [0173.367] GetProcessHeap () returned 0x580000 [0173.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59120 [0173.367] GetProcessHeap () returned 0x580000 [0173.367] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6c59488 [0173.367] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.367] ReadFile (in: hFile=0x490, lpBuffer=0x6c59120, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59120*, lpNumberOfBytesRead=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0173.398] GetProcessHeap () returned 0x580000 [0173.398] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09ee0 [0173.398] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.398] WriteFile (in: hFile=0x490, lpBuffer=0x6c59488*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c59488*, lpNumberOfBytesWritten=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0173.398] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.399] WriteFile (in: hFile=0x490, lpBuffer=0x6c597a7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c597a7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0173.399] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.399] WriteFile (in: hFile=0x490, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0173.399] CloseHandle (hObject=0x490) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59488 | out: hHeap=0x580000) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c59120 | out: hHeap=0x580000) returned 1 [0173.415] GetProcessHeap () returned 0x580000 [0173.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09ee0 | out: hHeap=0x580000) returned 1 [0174.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef7fd20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x360, dwReserved0=0x68cfd28, dwReserved1=0x6c59120, cFileName="OOFTMPL.CFG.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OOFTMP~1.YOU")) returned 0x5b96f0 [0174.662] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.799] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK", len=0x43 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 1 [0176.799] GetProcessHeap () returned 0x580000 [0176.799] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0176.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.800] CloseHandle (hObject=0x49c) returned 1 [0176.800] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0176.800] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0176.801] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0176.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI06BA~1.YOU")) returned 0x5b96f0 [0176.801] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0176.801] GetProcessHeap () returned 0x580000 [0176.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0176.801] GetProcessHeap () returned 0x580000 [0176.801] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0176.801] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.801] ReadFile (in: hFile=0x49c, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x68cff14*=0x60, lpOverlapped=0x0) returned 1 [0176.802] GetProcessHeap () returned 0x580000 [0176.802] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09cb0 [0176.802] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.802] WriteFile (in: hFile=0x49c, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x68cff14*=0x60, lpOverlapped=0x0) returned 1 [0176.802] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.803] WriteFile (in: hFile=0x49c, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0176.803] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.803] WriteFile (in: hFile=0x49c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0176.803] CloseHandle (hObject=0x49c) returned 1 [0176.803] GetProcessHeap () returned 0x580000 [0176.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0176.803] GetProcessHeap () returned 0x580000 [0176.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0176.803] GetProcessHeap () returned 0x580000 [0176.803] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09cb0 | out: hHeap=0x580000) returned 1 [0176.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0fee8e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x68cfd28, dwReserved1=0x61b540, cFileName="VISIO_PRM_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="VI06BA~1.YOU")) returned 0x5b96f0 [0176.803] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0176.844] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", len=0x41 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 1 [0176.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2114) returned 0x6f14048 [0176.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.388] CloseHandle (hObject=0x470) returned 1 [0179.388] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0179.389] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id_1622540890_.your_last_chance")) returned 1 [0179.432] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0179.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~1.YOU")) returned 0x5b96f0 [0179.433] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0179.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x470 [0179.433] GetProcessHeap () returned 0x580000 [0179.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b540 [0179.433] GetProcessHeap () returned 0x580000 [0179.433] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x81) returned 0x61b4b0 [0179.433] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.433] ReadFile (in: hFile=0x470, lpBuffer=0x61b540, nNumberOfBytesToRead=0x60, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b540*, lpNumberOfBytesRead=0x68cff14*=0x60, lpOverlapped=0x0) returned 1 [0179.434] GetProcessHeap () returned 0x580000 [0179.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0179.434] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] WriteFile (in: hFile=0x470, lpBuffer=0x61b4b0*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b4b0*, lpNumberOfBytesWritten=0x68cff14*=0x60, lpOverlapped=0x0) returned 1 [0179.434] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] WriteFile (in: hFile=0x470, lpBuffer=0x61b50f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x61b50f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0179.434] SetFilePointerEx (in: hFile=0x470, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.434] WriteFile (in: hFile=0x470, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0179.435] CloseHandle (hObject=0x470) returned 1 [0179.435] GetProcessHeap () returned 0x580000 [0179.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b4b0 | out: hHeap=0x580000) returned 1 [0179.435] GetProcessHeap () returned 0x580000 [0179.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61b540 | out: hHeap=0x580000) returned 1 [0179.435] GetProcessHeap () returned 0x580000 [0179.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0180.426] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2913140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x95, dwReserved0=0x68cfd28, dwReserved1=0x61b540, cFileName="SETLANG_K_COL.HXK.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SETLAN~1.YOU")) returned 0x5b96b0 [0180.426] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.467] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", len=0x6c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned 1 [0180.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0180.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.468] CloseHandle (hObject=0x464) returned 1 [0180.468] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.468] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.469] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.469] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x670070, dwReserved1=0x69002e, cFileName="CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~1.YOU")) returned 0x5b96b0 [0180.469] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0180.469] GetProcessHeap () returned 0x580000 [0180.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6d2e538 [0180.469] GetProcessHeap () returned 0x580000 [0180.469] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e01) returned 0x6d430c0 [0180.469] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.469] ReadFile (in: hFile=0x464, lpBuffer=0x6d2e538, nNumberOfBytesToRead=0x1de0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2e538*, lpNumberOfBytesRead=0x68cff14*=0x1de0, lpOverlapped=0x0) returned 1 [0180.550] GetProcessHeap () returned 0x580000 [0180.550] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09b98 [0180.550] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x464, lpBuffer=0x6d430c0*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430c0*, lpNumberOfBytesWritten=0x68cff14*=0x1de0, lpOverlapped=0x0) returned 1 [0180.550] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.550] WriteFile (in: hFile=0x464, lpBuffer=0x6d44e9f*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d44e9f*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0180.551] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.551] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0180.551] CloseHandle (hObject=0x464) returned 1 [0180.552] GetProcessHeap () returned 0x580000 [0180.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430c0 | out: hHeap=0x580000) returned 1 [0180.552] GetProcessHeap () returned 0x580000 [0180.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2e538 | out: hHeap=0x580000) returned 1 [0180.552] GetProcessHeap () returned 0x580000 [0180.552] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09b98 | out: hHeap=0x580000) returned 1 [0180.552] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa33a32e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1e07, dwReserved0=0x68cfd28, dwReserved1=0x6d2e538, cFileName="CommsIncomingImageSmall.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="COMMSI~1.YOU")) returned 0x5b96b0 [0180.552] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.573] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", len=0x63 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned 1 [0180.573] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0180.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.605] CloseHandle (hObject=0x450) returned 1 [0180.605] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0180.605] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.id_1622540890_.your_last_chance")) returned 1 [0180.606] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0180.606] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e983f00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x350032, dwReserved1=0x300034, cFileName="AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~1.YOU")) returned 0x5b96b0 [0180.606] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0180.606] GetProcessHeap () returned 0x580000 [0180.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e81) returned 0x6d29f58 [0180.606] GetProcessHeap () returned 0x580000 [0180.606] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3e81) returned 0x6d2dde8 [0180.606] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.606] ReadFile (in: hFile=0x450, lpBuffer=0x6d29f58, nNumberOfBytesToRead=0x3e60, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d29f58*, lpNumberOfBytesRead=0x68cff14*=0x3e60, lpOverlapped=0x0) returned 1 [0181.451] GetProcessHeap () returned 0x580000 [0181.451] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09dc8 [0181.451] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.451] WriteFile (in: hFile=0x450, lpBuffer=0x6d2dde8*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d2dde8*, lpNumberOfBytesWritten=0x68cff14*=0x3e60, lpOverlapped=0x0) returned 1 [0181.451] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.451] WriteFile (in: hFile=0x450, lpBuffer=0x6d31c47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d31c47*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0181.451] SetFilePointerEx (in: hFile=0x450, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.452] WriteFile (in: hFile=0x450, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0181.452] CloseHandle (hObject=0x450) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d2dde8 | out: hHeap=0x580000) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d29f58 | out: hHeap=0x580000) returned 1 [0182.117] GetProcessHeap () returned 0x580000 [0182.117] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09dc8 | out: hHeap=0x580000) returned 1 [0183.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3c442a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3e9c, dwReserved0=0x68cfd28, dwReserved1=0x6d29f58, cFileName="AlertImage_Off.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ALERTI~1.YOU")) returned 0x5b96b0 [0183.460] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.472] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", len=0x6f | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned 1 [0183.472] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0183.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.603] CloseHandle (hObject=0x428) returned 1 [0184.603] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0184.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0184.604] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0184.604] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x98b, dwReserved0=0x2e0073, dwReserved1=0x70006a, cFileName="MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MARKUP~2.YOU")) returned 0x5b9770 [0184.604] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428 [0184.604] GetProcessHeap () returned 0x580000 [0184.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6dcd1d0 [0184.604] GetProcessHeap () returned 0x580000 [0184.604] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9a1) returned 0x6c676b8 [0184.604] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.605] ReadFile (in: hFile=0x428, lpBuffer=0x6dcd1d0, nNumberOfBytesToRead=0x980, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dcd1d0*, lpNumberOfBytesRead=0x68cff14*=0x980, lpOverlapped=0x0) returned 1 [0184.614] GetProcessHeap () returned 0x580000 [0184.614] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce580 [0184.614] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.614] WriteFile (in: hFile=0x428, lpBuffer=0x6c676b8*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c676b8*, lpNumberOfBytesWritten=0x68cff14*=0x980, lpOverlapped=0x0) returned 1 [0184.614] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.615] WriteFile (in: hFile=0x428, lpBuffer=0x6c68037*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c68037*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0184.615] SetFilePointerEx (in: hFile=0x428, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.615] WriteFile (in: hFile=0x428, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0184.615] CloseHandle (hObject=0x428) returned 1 [0184.615] GetProcessHeap () returned 0x580000 [0184.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c676b8 | out: hHeap=0x580000) returned 1 [0184.615] GetProcessHeap () returned 0x580000 [0184.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcd1d0 | out: hHeap=0x580000) returned 1 [0184.615] GetProcessHeap () returned 0x580000 [0184.615] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce580 | out: hHeap=0x580000) returned 1 [0184.615] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5a779c0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9af, dwReserved0=0x68cfd28, dwReserved1=0x6dcd1d0, cFileName="MarkupIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MARKUP~2.YOU")) returned 0x5b9770 [0184.615] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0184.626] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", len=0x5f | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned 1 [0184.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x213c) returned 0x6f14048 [0184.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.413] CloseHandle (hObject=0x484) returned 1 [0185.413] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0185.413] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.id_1622540890_.your_last_chance")) returned 1 [0185.414] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0185.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x390038, dwReserved1=0x5f0030, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b9770 [0185.414] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0185.415] GetProcessHeap () returned 0x580000 [0185.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x677cd0 [0185.415] GetProcessHeap () returned 0x580000 [0185.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xb01) returned 0x706e008 [0185.415] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.415] ReadFile (in: hFile=0x484, lpBuffer=0x677cd0, nNumberOfBytesToRead=0xae0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x677cd0*, lpNumberOfBytesRead=0x68cff14*=0xae0, lpOverlapped=0x0) returned 1 [0185.426] GetProcessHeap () returned 0x580000 [0185.426] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dce350 [0185.426] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.426] WriteFile (in: hFile=0x484, lpBuffer=0x706e008*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x706e008*, lpNumberOfBytesWritten=0x68cff14*=0xae0, lpOverlapped=0x0) returned 1 [0185.426] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.426] WriteFile (in: hFile=0x484, lpBuffer=0x706eae7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x706eae7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0185.426] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.426] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0185.426] CloseHandle (hObject=0x484) returned 1 [0185.426] GetProcessHeap () returned 0x580000 [0185.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x706e008 | out: hHeap=0x580000) returned 1 [0185.426] GetProcessHeap () returned 0x580000 [0185.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x677cd0 | out: hHeap=0x580000) returned 1 [0185.426] GetProcessHeap () returned 0x580000 [0185.426] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dce350 | out: hHeap=0x580000) returned 1 [0185.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6234140, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xb0c, dwReserved0=0x68cfd28, dwReserved1=0x677cd0, cFileName="attention.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ATTENT~1.YOU")) returned 0x5b9770 [0185.536] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.584] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", len=0x55 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned 1 [0185.584] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0185.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.837] CloseHandle (hObject=0x478) returned 1 [0186.837] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0186.838] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0186.838] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0186.838] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x41004c, dwReserved1=0x540053, cFileName="CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b96b0 [0186.838] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0186.839] GetProcessHeap () returned 0x580000 [0186.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14e1) returned 0x6efb008 [0186.839] GetProcessHeap () returned 0x580000 [0186.839] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14e1) returned 0x6f19958 [0186.839] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.839] ReadFile (in: hFile=0x478, lpBuffer=0x6efb008, nNumberOfBytesToRead=0x14c0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6efb008*, lpNumberOfBytesRead=0x68cff14*=0x14c0, lpOverlapped=0x0) returned 1 [0186.859] GetProcessHeap () returned 0x580000 [0186.859] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dceaf8 [0186.859] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.859] WriteFile (in: hFile=0x478, lpBuffer=0x6f19958*, nNumberOfBytesToWrite=0x14c0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f19958*, lpNumberOfBytesWritten=0x68cff14*=0x14c0, lpOverlapped=0x0) returned 1 [0186.859] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.859] WriteFile (in: hFile=0x478, lpBuffer=0x6f1ae17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f1ae17*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0186.859] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.859] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0186.859] CloseHandle (hObject=0x478) returned 1 [0186.859] GetProcessHeap () returned 0x580000 [0186.859] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f19958 | out: hHeap=0x580000) returned 1 [0186.859] GetProcessHeap () returned 0x580000 [0186.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6efb008 | out: hHeap=0x580000) returned 1 [0186.860] GetProcessHeap () returned 0x580000 [0186.860] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dceaf8 | out: hHeap=0x580000) returned 1 [0186.860] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6fe3fc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x14ed, dwReserved0=0x68cfd28, dwReserved1=0x6efb008, cFileName="CalendarToolIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="CALEND~1.YOU")) returned 0x5b96b0 [0186.860] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0186.886] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", len=0x5c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned 1 [0186.886] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0186.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.383] CloseHandle (hObject=0x464) returned 1 [0188.383] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0188.384] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.id_1622540890_.your_last_chance")) returned 1 [0188.384] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0188.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACER~1.YOU")) returned 0x5b9770 [0188.384] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0188.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0188.385] GetProcessHeap () returned 0x580000 [0188.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596cd8 [0188.385] GetProcessHeap () returned 0x580000 [0188.385] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x41) returned 0x596828 [0188.385] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.385] ReadFile (in: hFile=0x464, lpBuffer=0x596cd8, nNumberOfBytesToRead=0x20, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x596cd8*, lpNumberOfBytesRead=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.400] GetProcessHeap () returned 0x580000 [0188.400] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615cd8 [0188.400] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.400] WriteFile (in: hFile=0x464, lpBuffer=0x596828*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x596828*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.400] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.401] WriteFile (in: hFile=0x464, lpBuffer=0x596847*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x596847*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0188.401] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.401] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0188.401] CloseHandle (hObject=0x464) returned 1 [0188.401] GetProcessHeap () returned 0x580000 [0188.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596828 | out: hHeap=0x580000) returned 1 [0188.401] GetProcessHeap () returned 0x580000 [0188.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x596cd8 | out: hHeap=0x580000) returned 1 [0188.401] GetProcessHeap () returned 0x580000 [0188.401] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615cd8 | out: hHeap=0x580000) returned 1 [0191.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7e78680, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x68cfd28, dwReserved1=0x596cd8, cFileName="SPACER.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SPACER~1.YOU")) returned 0x5b9770 [0191.355] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.404] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", len=0x45 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned 1 [0191.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0191.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0191.405] CloseHandle (hObject=0x420) returned 1 [0191.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0191.405] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.id_1622540890_.your_last_chance")) returned 1 [0191.405] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0191.406] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP4BA7~1.YOU")) returned 0x5b9770 [0191.406] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0191.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x420 [0191.406] GetProcessHeap () returned 0x580000 [0191.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ec1) returned 0x6fbd948 [0191.406] GetProcessHeap () returned 0x580000 [0191.406] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x9ec1) returned 0x6fc7818 [0191.406] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.406] ReadFile (in: hFile=0x420, lpBuffer=0x6fbd948, nNumberOfBytesToRead=0x9ea0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fbd948*, lpNumberOfBytesRead=0x68cff14*=0x9ea0, lpOverlapped=0x0) returned 1 [0194.391] GetProcessHeap () returned 0x580000 [0194.391] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0194.392] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.392] WriteFile (in: hFile=0x420, lpBuffer=0x6fc7818*, nNumberOfBytesToWrite=0x9ea0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc7818*, lpNumberOfBytesWritten=0x68cff14*=0x9ea0, lpOverlapped=0x0) returned 1 [0194.392] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.392] WriteFile (in: hFile=0x420, lpBuffer=0x6fd16b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fd16b7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0194.392] SetFilePointerEx (in: hFile=0x420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.392] WriteFile (in: hFile=0x420, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0194.392] CloseHandle (hObject=0x420) returned 1 [0194.392] GetProcessHeap () returned 0x580000 [0194.392] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fc7818 | out: hHeap=0x580000) returned 1 [0194.392] GetProcessHeap () returned 0x580000 [0194.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fbd948 | out: hHeap=0x580000) returned 1 [0194.393] GetProcessHeap () returned 0x580000 [0194.393] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0194.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab7bf7e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x9ed5, dwReserved0=0x68cfd28, dwReserved1=0x6fbd948, cFileName="ZPDIR32F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP4BA7~1.YOU")) returned 0x5b97b0 [0194.393] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.648] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", len=0x6c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned 1 [0196.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0196.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.649] CloseHandle (hObject=0x4a0) returned 1 [0196.649] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.id_1622540890_.your_last_chance")) returned 1 [0196.685] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.685] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x730073, dwReserved1=0x69002e, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b97b0 [0196.685] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0196.685] GetProcessHeap () returned 0x580000 [0196.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10060 [0196.685] GetProcessHeap () returned 0x580000 [0196.685] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa41) returned 0x6c10ae8 [0196.685] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.685] ReadFile (in: hFile=0x4a0, lpBuffer=0x6c10060, nNumberOfBytesToRead=0xa20, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10060*, lpNumberOfBytesRead=0x68cff14*=0xa20, lpOverlapped=0x0) returned 1 [0196.695] GetProcessHeap () returned 0x580000 [0196.695] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0196.695] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c10ae8*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c10ae8*, lpNumberOfBytesWritten=0x68cff14*=0xa20, lpOverlapped=0x0) returned 1 [0196.695] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.695] WriteFile (in: hFile=0x4a0, lpBuffer=0x6c11507*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c11507*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.696] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.696] CloseHandle (hObject=0x4a0) returned 1 [0196.696] GetProcessHeap () returned 0x580000 [0196.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10ae8 | out: hHeap=0x580000) returned 1 [0196.696] GetProcessHeap () returned 0x580000 [0196.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c10060 | out: hHeap=0x580000) returned 1 [0196.696] GetProcessHeap () returned 0x580000 [0196.696] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0196.696] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacd9e200, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xa56, dwReserved0=0x68cfd28, dwReserved1=0x6c10060, cFileName="Americana.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="AMERIC~1.YOU")) returned 0x5b97b0 [0196.696] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.701] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", len=0x45 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned 1 [0196.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe0) returned 0x6f14048 [0196.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.826] CloseHandle (hObject=0x4ac) returned 1 [0196.826] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0196.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.id_1622540890_.your_last_chance")) returned 1 [0196.827] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0196.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc85, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5166~1.YOU")) returned 0x5b97b0 [0196.827] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0196.827] GetProcessHeap () returned 0x580000 [0196.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x635768 [0196.827] GetProcessHeap () returned 0x580000 [0196.827] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xca1) returned 0x6f668d8 [0196.827] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.827] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xc80, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x68cff14*=0xc80, lpOverlapped=0x0) returned 1 [0196.855] GetProcessHeap () returned 0x580000 [0196.855] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616598 [0196.855] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.855] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x68cff14*=0xc80, lpOverlapped=0x0) returned 1 [0196.855] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.855] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f67557*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f67557*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0196.856] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.856] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0196.856] CloseHandle (hObject=0x4ac) returned 1 [0196.856] GetProcessHeap () returned 0x580000 [0196.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0196.856] GetProcessHeap () returned 0x580000 [0196.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0196.856] GetProcessHeap () returned 0x580000 [0196.856] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616598 | out: hHeap=0x580000) returned 1 [0196.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xacf1afc0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xca9, dwReserved0=0x68cfd28, dwReserved1=0x635768, cFileName="ZPDIR20F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZP5166~1.YOU")) returned 0x5b97b0 [0196.856] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0196.951] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", len=0x45 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned 1 [0196.951] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fbc) returned 0x6f14048 [0196.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0197.018] CloseHandle (hObject=0x414) returned 1 [0197.018] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0197.018] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.id_1622540890_.your_last_chance")) returned 1 [0197.019] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0197.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPF849~1.YOU")) returned 0x5b97b0 [0197.019] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0197.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0197.020] GetProcessHeap () returned 0x580000 [0197.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d01) returned 0x6f976f8 [0197.020] GetProcessHeap () returned 0x580000 [0197.020] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x3d01) returned 0x6f9b408 [0197.020] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.020] ReadFile (in: hFile=0x414, lpBuffer=0x6f976f8, nNumberOfBytesToRead=0x3ce0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f976f8*, lpNumberOfBytesRead=0x68cff14*=0x3ce0, lpOverlapped=0x0) returned 1 [0197.553] GetProcessHeap () returned 0x580000 [0197.553] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615418 [0197.553] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.553] WriteFile (in: hFile=0x414, lpBuffer=0x6f9b408*, nNumberOfBytesToWrite=0x3ce0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9b408*, lpNumberOfBytesWritten=0x68cff14*=0x3ce0, lpOverlapped=0x0) returned 1 [0197.553] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.553] WriteFile (in: hFile=0x414, lpBuffer=0x6f9f0e7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f9f0e7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0197.554] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.554] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0197.554] CloseHandle (hObject=0x414) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f9b408 | out: hHeap=0x580000) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f976f8 | out: hHeap=0x580000) returned 1 [0197.759] GetProcessHeap () returned 0x580000 [0197.759] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615418 | out: hHeap=0x580000) returned 1 [0199.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad5ccda0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d0c, dwReserved0=0x68cfd28, dwReserved1=0x6f976f8, cFileName="ZPDIR13F.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ZPF849~1.YOU")) returned 0x5b96b0 [0199.593] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.623] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", len=0x64 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned 1 [0199.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0199.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0200.890] CloseHandle (hObject=0x4ac) returned 1 [0200.890] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0200.890] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.id_1622540890_.your_last_chance")) returned 1 [0200.891] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0200.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x320032, dwReserved1=0x340035, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b9770 [0200.891] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0200.891] GetProcessHeap () returned 0x580000 [0200.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x67fc68 [0200.891] GetProcessHeap () returned 0x580000 [0200.891] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x361) returned 0x705f4e8 [0200.891] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.891] ReadFile (in: hFile=0x4ac, lpBuffer=0x67fc68, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x67fc68*, lpNumberOfBytesRead=0x68cff14*=0x340, lpOverlapped=0x0) returned 1 [0200.895] GetProcessHeap () returned 0x580000 [0200.895] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0200.895] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.895] WriteFile (in: hFile=0x4ac, lpBuffer=0x705f4e8*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x705f4e8*, lpNumberOfBytesWritten=0x68cff14*=0x340, lpOverlapped=0x0) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.896] WriteFile (in: hFile=0x4ac, lpBuffer=0x705f827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x705f827*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.896] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0200.896] CloseHandle (hObject=0x4ac) returned 1 [0200.896] GetProcessHeap () returned 0x580000 [0200.896] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x705f4e8 | out: hHeap=0x580000) returned 1 [0200.896] GetProcessHeap () returned 0x580000 [0200.896] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x67fc68 | out: hHeap=0x580000) returned 1 [0200.896] GetProcessHeap () returned 0x580000 [0200.896] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0201.396] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf5a33e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x68cfd28, dwReserved1=0x67fc68, cFileName="rtf_underline.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_UN~1.YOU")) returned 0x5b9770 [0201.396] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.403] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", len=0x73 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned 1 [0201.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0201.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0201.430] CloseHandle (hObject=0x414) returned 1 [0201.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0201.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0201.431] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0201.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x5f0062, dwReserved1=0x66006f, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0201.432] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0201.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0201.432] GetProcessHeap () returned 0x580000 [0201.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec6f8 [0201.432] GetProcessHeap () returned 0x580000 [0201.432] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x161) returned 0x6dec870 [0201.432] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.432] ReadFile (in: hFile=0x414, lpBuffer=0x6dec6f8, nNumberOfBytesToRead=0x140, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec6f8*, lpNumberOfBytesRead=0x68cff14*=0x140, lpOverlapped=0x0) returned 1 [0201.434] GetProcessHeap () returned 0x580000 [0201.434] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09a80 [0201.434] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.434] WriteFile (in: hFile=0x414, lpBuffer=0x6dec870*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec870*, lpNumberOfBytesWritten=0x68cff14*=0x140, lpOverlapped=0x0) returned 1 [0201.434] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.434] WriteFile (in: hFile=0x414, lpBuffer=0x6dec9af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6dec9af*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0201.434] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.434] WriteFile (in: hFile=0x414, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0201.434] CloseHandle (hObject=0x414) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec870 | out: hHeap=0x580000) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dec6f8 | out: hHeap=0x580000) returned 1 [0201.435] GetProcessHeap () returned 0x580000 [0201.435] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09a80 | out: hHeap=0x580000) returned 1 [0201.435] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafad8400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x68cfd28, dwReserved1=0x6dec6f8, cFileName="tab_off.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0201.435] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.043] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", len=0x67 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned 1 [0202.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0202.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.044] CloseHandle (hObject=0x4ac) returned 1 [0202.044] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.044] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.id_1622540890_.your_last_chance")) returned 1 [0202.045] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfb, dwReserved0=0x31005f, dwReserved1=0x320036, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b9770 [0202.045] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.045] GetProcessHeap () returned 0x580000 [0202.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x635768 [0202.045] GetProcessHeap () returned 0x580000 [0202.045] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xd01) returned 0x6f668d8 [0202.045] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.045] ReadFile (in: hFile=0x4ac, lpBuffer=0x635768, nNumberOfBytesToRead=0xce0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x635768*, lpNumberOfBytesRead=0x68cff14*=0xce0, lpOverlapped=0x0) returned 1 [0202.064] GetProcessHeap () returned 0x580000 [0202.064] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.064] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.064] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f668d8*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f668d8*, lpNumberOfBytesWritten=0x68cff14*=0xce0, lpOverlapped=0x0) returned 1 [0202.064] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.064] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f675b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f675b7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0202.065] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.065] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0202.065] CloseHandle (hObject=0x4ac) returned 1 [0202.065] GetProcessHeap () returned 0x580000 [0202.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f668d8 | out: hHeap=0x580000) returned 1 [0202.065] GetProcessHeap () returned 0x580000 [0202.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x635768 | out: hHeap=0x580000) returned 1 [0202.065] GetProcessHeap () returned 0x580000 [0202.065] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.065] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb00cbb00, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xd1f, dwReserved0=0x68cfd28, dwReserved1=0x635768, cFileName="Lime.css.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="LIMECS~1.YOU")) returned 0x5b9770 [0202.065] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.071] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0202.071] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0202.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.071] CloseHandle (hObject=0x4ac) returned 1 [0202.071] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0202.071] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance")) returned 1 [0202.073] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0202.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x2e0046, dwReserved1=0x490047, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0202.074] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0202.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac [0202.074] GetProcessHeap () returned 0x580000 [0202.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3ef20 [0202.074] GetProcessHeap () returned 0x580000 [0202.074] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e1) returned 0x6f3f118 [0202.074] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.074] ReadFile (in: hFile=0x4ac, lpBuffer=0x6f3ef20, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3ef20*, lpNumberOfBytesRead=0x68cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0202.076] GetProcessHeap () returned 0x580000 [0202.076] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f0a228 [0202.077] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.077] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f3f118*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f118*, lpNumberOfBytesWritten=0x68cff14*=0x1c0, lpOverlapped=0x0) returned 1 [0202.077] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.077] WriteFile (in: hFile=0x4ac, lpBuffer=0x6f3f2d7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6f3f2d7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0202.077] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.077] WriteFile (in: hFile=0x4ac, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0202.077] CloseHandle (hObject=0x4ac) returned 1 [0202.077] GetProcessHeap () returned 0x580000 [0202.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3f118 | out: hHeap=0x580000) returned 1 [0202.077] GetProcessHeap () returned 0x580000 [0202.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f3ef20 | out: hHeap=0x580000) returned 1 [0202.077] GetProcessHeap () returned 0x580000 [0202.077] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f0a228 | out: hHeap=0x580000) returned 1 [0202.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb00f1c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x68cfd28, dwReserved1=0x6f3ef20, cFileName="TAB_OFF.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="TAB_OF~1.YOU")) returned 0x5b9770 [0202.077] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0203.162] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", len=0x69 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned 1 [0203.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0203.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0203.712] CloseHandle (hObject=0x448) returned 1 [0203.712] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0203.712] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.id_1622540890_.your_last_chance")) returned 1 [0203.713] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0203.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e87, dwReserved0=0x640069, dwReserved1=0x31005f, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b97b0 [0203.716] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484 [0203.718] GetProcessHeap () returned 0x580000 [0203.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6d430c0 [0203.718] GetProcessHeap () returned 0x580000 [0203.718] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1ea1) returned 0x6d44fc8 [0203.718] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.718] ReadFile (in: hFile=0x484, lpBuffer=0x6d430c0, nNumberOfBytesToRead=0x1e80, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d430c0*, lpNumberOfBytesRead=0x68cff14*=0x1e80, lpOverlapped=0x0) returned 1 [0205.053] GetProcessHeap () returned 0x580000 [0205.053] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf5e8 [0205.053] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.053] WriteFile (in: hFile=0x484, lpBuffer=0x6d44fc8*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d44fc8*, lpNumberOfBytesWritten=0x68cff14*=0x1e80, lpOverlapped=0x0) returned 1 [0205.054] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.054] WriteFile (in: hFile=0x484, lpBuffer=0x6d46e47*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d46e47*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0205.054] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0205.054] WriteFile (in: hFile=0x484, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0205.054] CloseHandle (hObject=0x484) returned 1 [0205.054] GetProcessHeap () returned 0x580000 [0205.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d44fc8 | out: hHeap=0x580000) returned 1 [0205.054] GetProcessHeap () returned 0x580000 [0205.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d430c0 | out: hHeap=0x580000) returned 1 [0205.054] GetProcessHeap () returned 0x580000 [0205.054] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf5e8 | out: hHeap=0x580000) returned 1 [0205.054] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1d5c300, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1eab, dwReserved0=0x68cfd28, dwReserved1=0x6d430c0, cFileName="FormsHomePageScript.js.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="FORMSH~1.YOU")) returned 0x5b97f0 [0208.198] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0210.413] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS", len=0x45 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS") returned 1 [0210.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0210.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0210.480] CloseHandle (hObject=0x478) returned 1 [0210.480] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0210.480] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css.id_1622540890_.your_last_chance")) returned 1 [0210.481] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0210.481] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ec9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3671~1.YOU")) returned 0x5b97b0 [0210.481] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0210.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478 [0210.481] GetProcessHeap () returned 0x580000 [0210.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x703b9b8 [0210.481] GetProcessHeap () returned 0x580000 [0210.481] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x6fb2f38 [0210.483] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0210.483] ReadFile (in: hFile=0x478, lpBuffer=0x703b9b8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x703b9b8*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.080] GetProcessHeap () returned 0x580000 [0214.080] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09508 [0214.080] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.080] WriteFile (in: hFile=0x478, lpBuffer=0x6fb2f38*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fb2f38*, lpNumberOfBytesWritten=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0214.081] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.081] WriteFile (in: hFile=0x478, lpBuffer=0x6fc4737*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6fc4737*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0214.081] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0214.081] WriteFile (in: hFile=0x478, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0214.081] CloseHandle (hObject=0x478) returned 1 [0214.082] GetProcessHeap () returned 0x580000 [0214.082] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6fb2f38 | out: hHeap=0x580000) returned 1 [0214.262] GetProcessHeap () returned 0x580000 [0214.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x703b9b8 | out: hHeap=0x580000) returned 1 [0214.262] GetProcessHeap () returned 0x580000 [0214.262] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09508 | out: hHeap=0x580000) returned 1 [0215.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb737ff20, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x1ecbe, dwReserved0=0x580000, dwReserved1=0x6efb000, cFileName="SCHEME13.CSS.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SC3671~1.YOU")) returned 0x5b97b0 [0215.031] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.047] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC", len=0x3b | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 1 [0215.047] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0215.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.047] CloseHandle (hObject=0x458) returned 1 [0215.048] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.048] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0215.081] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.081] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_CO~2.YOU")) returned 0x5b97b0 [0215.081] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0215.081] GetProcessHeap () returned 0x580000 [0215.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0215.081] GetProcessHeap () returned 0x580000 [0215.081] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0215.081] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.081] ReadFile (in: hFile=0x458, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.132] GetProcessHeap () returned 0x580000 [0215.132] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.132] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.132] WriteFile (in: hFile=0x458, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.132] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.132] WriteFile (in: hFile=0x458, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0215.132] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.132] WriteFile (in: hFile=0x458, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0215.132] CloseHandle (hObject=0x458) returned 1 [0215.132] GetProcessHeap () returned 0x580000 [0215.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0215.132] GetProcessHeap () returned 0x580000 [0215.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0215.132] GetProcessHeap () returned 0x580000 [0215.132] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0215.133] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xb7d77b40, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x68cfd28, dwReserved1=0x6c61120, cFileName="OIS_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="OIS_CO~2.YOU")) returned 0x5b97b0 [0215.133] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.192] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC", len=0x3d | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 1 [0215.193] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0215.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.270] CloseHandle (hObject=0x3b8) returned 1 [0215.270] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0215.270] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id_1622540890_.your_last_chance")) returned 1 [0215.271] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0215.271] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~3.YOU")) returned 0x5b97b0 [0215.272] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0215.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0215.272] GetProcessHeap () returned 0x580000 [0215.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c61120 [0215.272] GetProcessHeap () returned 0x580000 [0215.272] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x281) returned 0x6c613c8 [0215.272] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.272] ReadFile (in: hFile=0x3b8, lpBuffer=0x6c61120, nNumberOfBytesToRead=0x260, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61120*, lpNumberOfBytesRead=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.279] GetProcessHeap () returned 0x580000 [0215.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcdba8 [0215.279] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.280] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c613c8*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c613c8*, lpNumberOfBytesWritten=0x68cff14*=0x260, lpOverlapped=0x0) returned 1 [0215.280] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.280] WriteFile (in: hFile=0x3b8, lpBuffer=0x6c61627*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6c61627*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0215.280] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0215.280] WriteFile (in: hFile=0x3b8, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0215.280] CloseHandle (hObject=0x3b8) returned 1 [0215.280] GetProcessHeap () returned 0x580000 [0215.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c613c8 | out: hHeap=0x580000) returned 1 [0215.280] GetProcessHeap () returned 0x580000 [0215.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6c61120 | out: hHeap=0x580000) returned 1 [0215.280] GetProcessHeap () returned 0x580000 [0215.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcdba8 | out: hHeap=0x580000) returned 1 [0217.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ece7a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x291, dwReserved0=0x68cfd28, dwReserved1=0x6c61120, cFileName="MSPUB_COL.HXC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB_~3.YOU")) returned 0x5b9770 [0217.432] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.449] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", len=0x5c | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned 1 [0217.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0217.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.450] CloseHandle (hObject=0x454) returned 1 [0217.450] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.451] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.id_1622540890_.your_last_chance")) returned 1 [0217.451] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x2e005f, dwReserved1=0x4f0059, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b9770 [0217.452] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0217.452] GetProcessHeap () returned 0x580000 [0217.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef020 [0217.452] GetProcessHeap () returned 0x580000 [0217.452] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6eef3c8 [0217.452] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.452] ReadFile (in: hFile=0x454, lpBuffer=0x6eef020, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef020*, lpNumberOfBytesRead=0x68cff14*=0x360, lpOverlapped=0x0) returned 1 [0217.514] GetProcessHeap () returned 0x580000 [0217.514] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.514] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.514] WriteFile (in: hFile=0x454, lpBuffer=0x6eef3c8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef3c8*, lpNumberOfBytesWritten=0x68cff14*=0x360, lpOverlapped=0x0) returned 1 [0217.514] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.515] WriteFile (in: hFile=0x454, lpBuffer=0x6eef727*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6eef727*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0217.515] SetFilePointerEx (in: hFile=0x454, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.515] WriteFile (in: hFile=0x454, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0217.515] CloseHandle (hObject=0x454) returned 1 [0217.515] GetProcessHeap () returned 0x580000 [0217.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef3c8 | out: hHeap=0x580000) returned 1 [0217.515] GetProcessHeap () returned 0x580000 [0217.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6eef020 | out: hHeap=0x580000) returned 1 [0217.515] GetProcessHeap () returned 0x580000 [0217.515] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.515] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb943ada0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x68cfd28, dwReserved1=0x6eef020, cFileName="ERROR.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ERRORG~1.YOU")) returned 0x5b9770 [0217.515] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.540] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", len=0x5a | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned 1 [0217.540] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0217.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.540] CloseHandle (hObject=0x48c) returned 1 [0217.540] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0217.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.id_1622540890_.your_last_chance")) returned 1 [0217.546] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0217.546] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x4f0059, dwReserved1=0x520055, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b9770 [0217.546] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0217.546] GetProcessHeap () returned 0x580000 [0217.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e023e8 [0217.546] GetProcessHeap () returned 0x580000 [0217.546] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x261) returned 0x6e02670 [0217.546] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.546] ReadFile (in: hFile=0x48c, lpBuffer=0x6e023e8, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e023e8*, lpNumberOfBytesRead=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0217.576] GetProcessHeap () returned 0x580000 [0217.576] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcf818 [0217.576] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.576] WriteFile (in: hFile=0x48c, lpBuffer=0x6e02670*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e02670*, lpNumberOfBytesWritten=0x68cff14*=0x240, lpOverlapped=0x0) returned 1 [0217.576] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.576] WriteFile (in: hFile=0x48c, lpBuffer=0x6e028af*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e028af*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0217.576] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0217.576] WriteFile (in: hFile=0x48c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0217.576] CloseHandle (hObject=0x48c) returned 1 [0217.576] GetProcessHeap () returned 0x580000 [0217.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e02670 | out: hHeap=0x580000) returned 1 [0217.576] GetProcessHeap () returned 0x580000 [0217.576] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e023e8 | out: hHeap=0x580000) returned 1 [0217.577] GetProcessHeap () returned 0x580000 [0217.577] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcf818 | out: hHeap=0x580000) returned 1 [0217.577] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb94d3320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x68cfd28, dwReserved1=0x6e023e8, cFileName="ADD.GIF.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ADDGIF~1.YOU")) returned 0x5b9770 [0217.577] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.638] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", len=0x62 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned 1 [0217.638] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0217.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0220.937] CloseHandle (hObject=0x47c) returned 1 [0220.937] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0220.937] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.id_1622540890_.your_last_chance")) returned 1 [0220.983] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0220.983] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x340035, dwReserved1=0x380030, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b97f0 [0220.984] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0220.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c [0220.984] GetProcessHeap () returned 0x580000 [0220.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x6599e8 [0220.984] GetProcessHeap () returned 0x580000 [0220.984] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x381) returned 0x659d90 [0220.984] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.984] ReadFile (in: hFile=0x47c, lpBuffer=0x6599e8, nNumberOfBytesToRead=0x360, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6599e8*, lpNumberOfBytesRead=0x68cff14*=0x360, lpOverlapped=0x0) returned 1 [0220.988] GetProcessHeap () returned 0x580000 [0220.988] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6dcec10 [0220.988] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.988] WriteFile (in: hFile=0x47c, lpBuffer=0x659d90*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x659d90*, lpNumberOfBytesWritten=0x68cff14*=0x360, lpOverlapped=0x0) returned 1 [0220.988] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.989] WriteFile (in: hFile=0x47c, lpBuffer=0x65a0ef*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x65a0ef*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0220.989] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0220.989] WriteFile (in: hFile=0x47c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0220.989] CloseHandle (hObject=0x47c) returned 1 [0220.989] GetProcessHeap () returned 0x580000 [0220.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x659d90 | out: hHeap=0x580000) returned 1 [0220.989] GetProcessHeap () returned 0x580000 [0220.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6599e8 | out: hHeap=0x580000) returned 1 [0220.989] GetProcessHeap () returned 0x580000 [0220.989] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6dcec10 | out: hHeap=0x580000) returned 1 [0221.903] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb541ee0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x68cfd28, dwReserved1=0x6599e8, cFileName="rtf_pressed.gif.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="RTF_PR~1.YOU")) returned 0x5b9730 [0221.903] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.956] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", len=0x77 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned 1 [0221.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0221.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0223.238] CloseHandle (hObject=0x42c) returned 1 [0223.238] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0223.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.id_1622540890_.your_last_chance")) returned 1 [0223.240] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0223.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x6f0063, dwReserved1=0x49006e, cFileName="ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR29D1~1.YOU")) returned 0x5b96b0 [0223.240] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0223.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x42c [0223.240] GetProcessHeap () returned 0x580000 [0223.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4f21) returned 0x715c008 [0223.240] GetProcessHeap () returned 0x580000 [0223.240] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x4f21) returned 0x7061928 [0223.240] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.240] ReadFile (in: hFile=0x42c, lpBuffer=0x715c008, nNumberOfBytesToRead=0x4f00, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x68cff14*=0x4f00, lpOverlapped=0x0) returned 1 [0223.887] GetProcessHeap () returned 0x580000 [0223.887] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6f09738 [0223.887] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.887] WriteFile (in: hFile=0x42c, lpBuffer=0x7061928*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x7061928*, lpNumberOfBytesWritten=0x68cff14*=0x4f00, lpOverlapped=0x0) returned 1 [0223.888] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.888] WriteFile (in: hFile=0x42c, lpBuffer=0x7066827*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x7066827*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0223.888] SetFilePointerEx (in: hFile=0x42c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0223.888] WriteFile (in: hFile=0x42c, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0223.888] CloseHandle (hObject=0x42c) returned 1 [0223.890] GetProcessHeap () returned 0x580000 [0223.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7061928 | out: hHeap=0x580000) returned 1 [0223.890] GetProcessHeap () returned 0x580000 [0223.890] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0223.890] GetProcessHeap () returned 0x580000 [0223.891] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6f09738 | out: hHeap=0x580000) returned 1 [0226.160] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd0edea0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x4f2e, dwReserved0=0x68cfd28, dwReserved1=0x715c008, cFileName="ProjectToolsetIconImages.jpg.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PR29D1~1.YOU")) returned 0x5b9630 [0226.160] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.182] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", len=0x3e | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 1 [0226.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da4) returned 0x6dee6e0 [0226.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.183] CloseHandle (hObject=0x464) returned 1 [0226.183] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.183] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id_1622540890_.your_last_chance")) returned 1 [0226.184] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GR59AB~1.YOU")) returned 0x5b9730 [0226.185] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.185] GetProcessHeap () returned 0x580000 [0226.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae2f0 [0226.185] GetProcessHeap () returned 0x580000 [0226.185] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe1) returned 0x5ae200 [0226.185] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.185] ReadFile (in: hFile=0x464, lpBuffer=0x5ae2f0, nNumberOfBytesToRead=0xc0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2f0*, lpNumberOfBytesRead=0x68cff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.187] GetProcessHeap () returned 0x580000 [0226.187] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6168e0 [0226.187] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.187] WriteFile (in: hFile=0x464, lpBuffer=0x5ae200*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae200*, lpNumberOfBytesWritten=0x68cff14*=0xc0, lpOverlapped=0x0) returned 1 [0226.187] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.187] WriteFile (in: hFile=0x464, lpBuffer=0x5ae2bf*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5ae2bf*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0226.187] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.187] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0226.187] CloseHandle (hObject=0x464) returned 1 [0226.187] GetProcessHeap () returned 0x580000 [0226.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae200 | out: hHeap=0x580000) returned 1 [0226.187] GetProcessHeap () returned 0x580000 [0226.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5ae2f0 | out: hHeap=0x580000) returned 1 [0226.187] GetProcessHeap () returned 0x580000 [0226.187] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6168e0 | out: hHeap=0x580000) returned 1 [0226.188] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbe575c60, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x68cfd28, dwReserved1=0x5ae2f0, cFileName="GROOVE_COL.HXT.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="GR59AB~1.YOU")) returned 0x5b9730 [0226.188] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.267] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", len=0x45 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned 1 [0226.267] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db4) returned 0x6dee6e0 [0226.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.268] CloseHandle (hObject=0x464) returned 1 [0226.268] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0226.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam.id_1622540890_.your_last_chance")) returned 1 [0226.269] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0226.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLVER~1.YOU")) returned 0x5b9630 [0226.269] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0226.269] GetProcessHeap () returned 0x580000 [0226.269] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x71fbcf8 [0226.270] GetProcessHeap () returned 0x580000 [0226.270] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x720d528 [0226.270] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0226.270] ReadFile (in: hFile=0x464, lpBuffer=0x71fbcf8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x71fbcf8*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.336] GetProcessHeap () returned 0x580000 [0235.336] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6172b8 [0235.336] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.336] WriteFile (in: hFile=0x464, lpBuffer=0x720d528*, nNumberOfBytesToWrite=0x11800, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x720d528*, lpNumberOfBytesWritten=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 [0235.337] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0235.337] WriteFile (in: hFile=0x464, lpBuffer=0x721ed27*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x721ed27*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0236.575] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0236.575] WriteFile (in: hFile=0x464, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0236.575] CloseHandle (hObject=0x464) returned 1 [0236.575] GetProcessHeap () returned 0x580000 [0236.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x720d528 | out: hHeap=0x580000) returned 1 [0236.575] GetProcessHeap () returned 0x580000 [0236.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x71fbcf8 | out: hHeap=0x580000) returned 1 [0236.575] GetProcessHeap () returned 0x580000 [0236.575] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6172b8 | out: hHeap=0x580000) returned 1 [0240.548] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc488b020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6c364, dwReserved0=0x68cfd28, dwReserved1=0x71fbcf8, cFileName="SOLVER.XLAM.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="SOLVER~1.YOU")) returned 0x5b9730 [0240.548] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.565] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", len=0x4b | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned 1 [0240.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0240.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.573] CloseHandle (hObject=0x488) returned 1 [0240.573] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0240.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml.id_1622540890_.your_last_chance")) returned 1 [0240.574] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0240.574] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x45, dwReserved1=0x0, cFileName="YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOE~1.YOU")) returned 0x5b9730 [0240.574] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0240.574] GetProcessHeap () returned 0x580000 [0240.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d06cc0 [0240.574] GetProcessHeap () returned 0x580000 [0240.574] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x341) returned 0x6d076f8 [0240.574] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.574] ReadFile (in: hFile=0x488, lpBuffer=0x6d06cc0, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d06cc0*, lpNumberOfBytesRead=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.579] GetProcessHeap () returned 0x580000 [0240.579] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x6166b0 [0240.579] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.579] WriteFile (in: hFile=0x488, lpBuffer=0x6d076f8*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d076f8*, lpNumberOfBytesWritten=0x68cff14*=0x320, lpOverlapped=0x0) returned 1 [0240.579] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.579] WriteFile (in: hFile=0x488, lpBuffer=0x6d07a17*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6d07a17*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0240.579] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0240.579] WriteFile (in: hFile=0x488, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0240.579] CloseHandle (hObject=0x488) returned 1 [0240.579] GetProcessHeap () returned 0x580000 [0240.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d076f8 | out: hHeap=0x580000) returned 1 [0240.579] GetProcessHeap () returned 0x580000 [0240.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6d06cc0 | out: hHeap=0x580000) returned 1 [0240.579] GetProcessHeap () returned 0x580000 [0240.579] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6166b0 | out: hHeap=0x580000) returned 1 [0241.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6ea1020, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x68cfd28, dwReserved1=0x6d06cc0, cFileName="YAHOO.ES.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="YAHOOE~1.YOU")) returned 0x5b9630 [0241.353] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.364] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML", len=0x40 | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML") returned 1 [0241.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0241.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0241.364] CloseHandle (hObject=0x480) returned 1 [0241.364] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0241.365] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml.id_1622540890_.your_last_chance")) returned 1 [0241.365] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0241.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3aa00, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89d3aa00, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x878c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG_IND~1.YOU")) returned 0x5b9630 [0241.366] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480 [0241.366] GetProcessHeap () returned 0x580000 [0241.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x87a1) returned 0x715c008 [0241.366] GetProcessHeap () returned 0x580000 [0241.366] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x87a1) returned 0x7301a38 [0241.366] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0241.366] ReadFile (in: hFile=0x480, lpBuffer=0x715c008, nNumberOfBytesToRead=0x8780, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesRead=0x68cff14*=0x8780, lpOverlapped=0x0) returned 1 [0242.999] GetProcessHeap () returned 0x580000 [0242.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x616f70 [0243.000] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.000] WriteFile (in: hFile=0x480, lpBuffer=0x7301a38*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x7301a38*, lpNumberOfBytesWritten=0x68cff14*=0x8780, lpOverlapped=0x0) returned 1 [0243.000] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.000] WriteFile (in: hFile=0x480, lpBuffer=0x730a1b7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x730a1b7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0243.000] SetFilePointerEx (in: hFile=0x480, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0243.000] WriteFile (in: hFile=0x480, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0243.517] CloseHandle (hObject=0x480) returned 1 [0243.517] GetProcessHeap () returned 0x580000 [0243.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x7301a38 | out: hHeap=0x580000) returned 1 [0243.517] GetProcessHeap () returned 0x580000 [0243.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0243.517] GetProcessHeap () returned 0x580000 [0243.517] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x616f70 | out: hHeap=0x580000) returned 1 [0245.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3aa00, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8abf400, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x87b0, dwReserved0=0x68cfd28, dwReserved1=0x715c008, cFileName="PG_INDEX.XML.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="PG_IND~1.YOU")) returned 0x5b9730 [0248.257] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.284] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR", len=0x3b | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 1 [0248.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0248.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0248.284] CloseHandle (hObject=0x4a0) returned 1 [0248.284] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0248.285] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.id_1622540890_.your_last_chance")) returned 1 [0248.285] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0248.285] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB9~1.YOU")) returned 0x5b9630 [0248.286] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0248.286] GetProcessHeap () returned 0x580000 [0248.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6bc1) returned 0x6e063d0 [0248.286] GetProcessHeap () returned 0x580000 [0248.286] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x6bc1) returned 0x715c008 [0248.287] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0248.287] ReadFile (in: hFile=0x4a0, lpBuffer=0x6e063d0, nNumberOfBytesToRead=0x6ba0, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x6e063d0*, lpNumberOfBytesRead=0x68cff14*=0x6ba0, lpOverlapped=0x0) returned 1 [0250.122] GetProcessHeap () returned 0x580000 [0250.122] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10a) returned 0x615530 [0250.122] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.123] WriteFile (in: hFile=0x4a0, lpBuffer=0x715c008*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x715c008*, lpNumberOfBytesWritten=0x68cff14*=0x6ba0, lpOverlapped=0x0) returned 1 [0250.123] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.123] WriteFile (in: hFile=0x4a0, lpBuffer=0x7162ba7*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x7162ba7*, lpNumberOfBytesWritten=0x68cff14*=0x20, lpOverlapped=0x0) returned 1 [0250.123] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0250.123] WriteFile (in: hFile=0x4a0, lpBuffer=0x5dcfc8*, nNumberOfBytesToWrite=0x4, lpNumberOfBytesWritten=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x5dcfc8*, lpNumberOfBytesWritten=0x68cff14*=0x4, lpOverlapped=0x0) returned 1 [0250.123] CloseHandle (hObject=0x4a0) returned 1 [0250.123] GetProcessHeap () returned 0x580000 [0250.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x715c008 | out: hHeap=0x580000) returned 1 [0250.123] GetProcessHeap () returned 0x580000 [0250.123] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6e063d0 | out: hHeap=0x580000) returned 1 [0250.124] GetProcessHeap () returned 0x580000 [0250.124] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615530 | out: hHeap=0x580000) returned 1 [0253.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfccc | out: lpFindFileData=0x68cfccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9ad9a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x6be2, dwReserved0=0x68cfd28, dwReserved1=0x6e063d0, cFileName="MSPUB9.BDR.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="MSPUB9~1.YOU")) returned 0x5b9730 [0253.679] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0254.433] SysReAllocStringLen (in: pbstr=0x68cff84*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC", len=0x3b | out: pbstr=0x68cff84*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC") returned 1 [0254.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe0) returned 0x72e5948 [0254.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0260.350] CloseHandle (hObject=0x3fc) returned 1 [0260.350] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef18, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0260.350] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc.id_1622540890_.your_last_chance")) returned 1 [0260.351] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x68cef10, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEANCE") returned 31 [0260.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC.id_1622540890_.YOUR_LAST_CHANCE", lpFindFileData=0x68cfc74 | out: lpFindFileData=0x68cfc74*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2a052, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98.POC.id_1622540890_.YOUR_LAST_CHANCE", cAlternateFileName="ENV98P~1.YOU")) returned 0x5b9630 [0260.351] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0260.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC.id_1622540890_.YOUR_LAST_CHANCE" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc.id_1622540890_.your_last_chance"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0260.351] GetProcessHeap () returned 0x580000 [0260.351] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x745b0f8 [0260.352] GetProcessHeap () returned 0x580000 [0260.352] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x11821) returned 0x746c928 [0260.353] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0260.353] ReadFile (in: hFile=0x3fc, lpBuffer=0x745b0f8, nNumberOfBytesToRead=0x11800, lpNumberOfBytesRead=0x68cff14, lpOverlapped=0x0 | out: lpBuffer=0x745b0f8*, lpNumberOfBytesRead=0x68cff14*=0x11800, lpOverlapped=0x0) returned 1 Thread: id = 61 os_tid = 0xaec [0039.071] GetProcessHeap () returned 0x580000 [0039.071] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5e8478 [0039.071] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22) returned 0x5dc4c0 [0039.072] GetEnvironmentVariableA (in: lpName="COMPUTERNAME", lpBuffer=0x6a0fe48, nSize=0x100 | out: lpBuffer="XDUWTFONO") returned 0x9 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5e8498 [0039.072] GetEnvironmentVariableA (in: lpName="USERNAME", lpBuffer=0x6a0fe48, nSize=0x100 | out: lpBuffer="5p5NrGJn0jS HALPmcxz") returned 0x14 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1e) returned 0x5da1c8 [0039.072] GetEnvironmentVariableA (in: lpName="Temp", lpBuffer=0x6a0fe48, nSize=0x100 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp") returned 0x24 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2e) returned 0x5b45f0 [0039.072] GetVolumeInformationA (in: lpRootPathName="c:\\", lpVolumeNameBuffer=0x6a0faa0, nVolumeNameSize=0x100, lpVolumeSerialNumber=0x6a0fba8, lpMaximumComponentLength=0x6a0fba4, lpFileSystemFlags=0x6a0fba0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer="SYSTEM", lpVolumeSerialNumber=0x6a0fba8*=0x9c354b42, lpMaximumComponentLength=0x6a0fba4*=0xff, lpFileSystemFlags=0x6a0fba0*=0x3e700ff, lpFileSystemNameBuffer=0x0) returned 1 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5e84b8 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x32) returned 0x5b93b0 [0039.072] GetProcessHeap () returned 0x580000 [0039.072] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x14) returned 0x5e84d8 [0039.072] QueryPerformanceCounter (in: lpPerformanceCount=0x6a0fb80 | out: lpPerformanceCount=0x6a0fb80*=15937218923) returned 1 [0039.072] Sleep (dwMilliseconds=0x19) [0039.103] GetProcessHeap () returned 0x580000 [0039.103] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xb) returned 0x5dcfa8 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xc) returned 0x5dcea0 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xd) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xe) returned 0x5dcfa8 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xf) returned 0x5dcea0 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0x10) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0x11) returned 0x5e84f8 [0039.104] GetProcessHeap () returned 0x580000 [0039.104] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.104] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x12) returned 0x5e8518 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x13) returned 0x5e84f8 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x14) returned 0x5e8518 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x15) returned 0x5e84f8 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x16) returned 0x5e8518 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x17) returned 0x5e84f8 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x18) returned 0x5e8518 [0039.105] GetProcessHeap () returned 0x580000 [0039.105] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.105] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x19) returned 0x5da2b8 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1a) returned 0x5da2e0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2e0, Size=0x1b) returned 0x5da2b8 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1c) returned 0x5da2e0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2e0, Size=0x1d) returned 0x5da2b8 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1e) returned 0x5da2e0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2e0, Size=0x1f) returned 0x5da2b8 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.106] GetProcessHeap () returned 0x580000 [0039.106] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x20) returned 0x5da2e0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2e0, Size=0x21) returned 0x5dc430 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x22) returned 0x5dc4f0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x23) returned 0x5dc430 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x24) returned 0x5dc4f0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x25) returned 0x5dc430 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x26) returned 0x5dc4f0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.107] GetProcessHeap () returned 0x580000 [0039.107] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x27) returned 0x5dc430 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x28) returned 0x5dc4f0 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x29) returned 0x5b4628 [0039.108] GetProcessHeap () returned 0x580000 [0039.108] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.108] QueryPerformanceCounter (in: lpPerformanceCount=0x6a0fb80 | out: lpPerformanceCount=0x6a0fb80*=15940767854) returned 1 [0039.108] Sleep (dwMilliseconds=0x31) [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xb) returned 0x5dcfa8 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xc) returned 0x5dcf48 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xd) returned 0x5dcea0 [0039.279] GetProcessHeap () returned 0x580000 [0039.279] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xe) returned 0x5dcfa8 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xf) returned 0x5dcf48 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0x10) returned 0x5dcea0 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0x11) returned 0x5e8518 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x12) returned 0x5e84f8 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x13) returned 0x5e8518 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x14) returned 0x5e84f8 [0039.280] GetProcessHeap () returned 0x580000 [0039.280] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.280] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x15) returned 0x5e8518 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x16) returned 0x5e84f8 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x17) returned 0x5e8518 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x18) returned 0x5e84f8 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x19) returned 0x5da2e0 [0039.281] GetProcessHeap () returned 0x580000 [0039.281] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.281] QueryPerformanceCounter (in: lpPerformanceCount=0x6a0fb80 | out: lpPerformanceCount=0x6a0fb80*=15958108362) returned 1 [0039.281] Sleep (dwMilliseconds=0x39) [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xb) returned 0x5dcfa8 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xc) returned 0x5dcea0 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xd) returned 0x5dcf48 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.415] GetProcessHeap () returned 0x580000 [0039.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xe) returned 0x5dcfa8 [0039.415] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xf) returned 0x5dcea0 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0x10) returned 0x5dcf48 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0x11) returned 0x5e84f8 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x12) returned 0x5e8518 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x13) returned 0x5e84f8 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x14) returned 0x5e8518 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x15) returned 0x5e84f8 [0039.416] GetProcessHeap () returned 0x580000 [0039.416] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.416] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x16) returned 0x5e8518 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x17) returned 0x5e84f8 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x18) returned 0x5e8518 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x19) returned 0x5da2b8 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1a) returned 0x5da308 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1b) returned 0x5da2b8 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1c) returned 0x5da308 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.417] GetProcessHeap () returned 0x580000 [0039.417] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.417] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1d) returned 0x5da2b8 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1e) returned 0x5da308 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1f) returned 0x5da2b8 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x20) returned 0x5da308 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x21) returned 0x5dc4f0 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x22) returned 0x5dc430 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x23) returned 0x5dc4f0 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.418] GetProcessHeap () returned 0x580000 [0039.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x24) returned 0x5dc430 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x25) returned 0x5dc4f0 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x26) returned 0x5dc430 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x27) returned 0x5dc4f0 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x28) returned 0x5dc430 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x29) returned 0x5b4660 [0039.419] GetProcessHeap () returned 0x580000 [0039.419] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.419] QueryPerformanceCounter (in: lpPerformanceCount=0x6a0fb80 | out: lpPerformanceCount=0x6a0fb80*=15971900844) returned 1 [0039.419] Sleep (dwMilliseconds=0x52) [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xb) returned 0x5dcfa8 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xc) returned 0x5dcf48 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.640] GetProcessHeap () returned 0x580000 [0039.640] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0xd) returned 0x5dcea0 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0xe) returned 0x5dcfa8 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfa8, Size=0xf) returned 0x5dcf48 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfa8 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcf48, Size=0x10) returned 0x5dcea0 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfa8 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcea0, Size=0x11) returned 0x5e8518 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x12) returned 0x5e84f8 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x13) returned 0x5e8518 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.641] GetProcessHeap () returned 0x580000 [0039.641] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x14) returned 0x5e84f8 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x15) returned 0x5e8518 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x16) returned 0x5e84f8 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x17) returned 0x5e8518 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x18) returned 0x5e84f8 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e84f8, Size=0x19) returned 0x5da308 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1a) returned 0x5da2b8 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.642] GetProcessHeap () returned 0x580000 [0039.642] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1b) returned 0x5da308 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1c) returned 0x5da2b8 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1d) returned 0x5da308 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1e) returned 0x5da2b8 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1f) returned 0x5da308 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x20) returned 0x5da2b8 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x21) returned 0x5dc430 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.643] GetProcessHeap () returned 0x580000 [0039.643] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.643] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x22) returned 0x5dc4f0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x23) returned 0x5dc430 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x24) returned 0x5dc4f0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x25) returned 0x5dc430 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x26) returned 0x5dc4f0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x27) returned 0x5dc430 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc430, Size=0x28) returned 0x5dc4f0 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.644] GetProcessHeap () returned 0x580000 [0039.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x29) returned 0x5b4698 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4698, Size=0x2a) returned 0x5b46d0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b46d0, Size=0x2b) returned 0x5b4698 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4698, Size=0x2c) returned 0x5b46d0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b46d0, Size=0x2d) returned 0x5b4698 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4698, Size=0x2e) returned 0x5b46d0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b46d0, Size=0x2f) returned 0x5b4698 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.645] GetProcessHeap () returned 0x580000 [0039.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4698, Size=0x30) returned 0x5b46d0 [0039.645] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b46d0, Size=0x31) returned 0x5b93f0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b93f0, Size=0x32) returned 0x5b9430 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9430, Size=0x33) returned 0x5b93f0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b93f0, Size=0x34) returned 0x5b9430 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9430, Size=0x35) returned 0x5b93f0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b93f0, Size=0x36) returned 0x5b9430 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9430, Size=0x37) returned 0x5b93f0 [0039.646] GetProcessHeap () returned 0x580000 [0039.646] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b93f0, Size=0x38) returned 0x5b9430 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9430, Size=0x39) returned 0x5b3e28 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e28, Size=0x3a) returned 0x5b3e70 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e70, Size=0x3b) returned 0x5b3e28 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e28, Size=0x3c) returned 0x5b3e70 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e70, Size=0x3d) returned 0x5b3e28 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e28, Size=0x3e) returned 0x5b3e70 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.647] GetProcessHeap () returned 0x580000 [0039.647] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e70, Size=0x3f) returned 0x5b3e28 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e28, Size=0x40) returned 0x5b3e70 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b3e70, Size=0x41) returned 0x596a08 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596a08, Size=0x42) returned 0x596828 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x43) returned 0x596a08 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596a08, Size=0x44) returned 0x596828 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x45) returned 0x596a08 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.648] GetProcessHeap () returned 0x580000 [0039.648] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596a08, Size=0x46) returned 0x596828 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x47) returned 0x596a08 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596a08, Size=0x48) returned 0x596828 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x49) returned 0x5dcca8 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4a) returned 0x5dcca8 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4b) returned 0x5dcca8 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4c) returned 0x5dcca8 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.649] GetProcessHeap () returned 0x580000 [0039.649] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4d) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4e) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x4f) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x50) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x51) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x52) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x53) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.650] GetProcessHeap () returned 0x580000 [0039.650] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x54) returned 0x5dcca8 [0039.650] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x55) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x56) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x57) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x58) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x59) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5a) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.651] GetProcessHeap () returned 0x580000 [0039.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5b) returned 0x5dcca8 [0039.651] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5c) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5d) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5e) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x5f) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x60) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x61) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x62) returned 0x5dcca8 [0039.652] GetProcessHeap () returned 0x580000 [0039.652] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x63) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x64) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x65) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x66) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x67) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x68) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x69) returned 0x5dcca8 [0039.653] GetProcessHeap () returned 0x580000 [0039.653] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6a) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6b) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6c) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6d) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6e) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x6f) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.654] GetProcessHeap () returned 0x580000 [0039.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x70) returned 0x5dcca8 [0039.654] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x71) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x72) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x73) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x74) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x75) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x76) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x77) returned 0x5dcca8 [0039.655] GetProcessHeap () returned 0x580000 [0039.655] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x78) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x79) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7a) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7b) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7c) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7d) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7e) returned 0x5dcca8 [0039.656] GetProcessHeap () returned 0x580000 [0039.656] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x7f) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x80) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x81) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x82) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x83) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x84) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x85) returned 0x5dcca8 [0039.657] GetProcessHeap () returned 0x580000 [0039.657] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.657] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x86) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x87) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x88) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x89) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8a) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8b) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8c) returned 0x5dcca8 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.658] GetProcessHeap () returned 0x580000 [0039.658] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8d) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8e) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x8f) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x90) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x91) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x92) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x93) returned 0x5dcca8 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.659] GetProcessHeap () returned 0x580000 [0039.659] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.659] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x94) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x95) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x96) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x97) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x98) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x99) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9a) returned 0x5dcca8 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.660] GetProcessHeap () returned 0x580000 [0039.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9b) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9c) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9d) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9e) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0x9f) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0xa0) returned 0x5dcca8 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcca8, Size=0xa1) returned 0x5bcda0 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.661] GetProcessHeap () returned 0x580000 [0039.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa2) returned 0x5bcda0 [0039.661] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa3) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa4) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa5) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa6) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa7) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa8) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xa9) returned 0x5bcda0 [0039.662] GetProcessHeap () returned 0x580000 [0039.662] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xaa) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xab) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xac) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xad) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xae) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xaf) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb0) returned 0x5bcda0 [0039.663] GetProcessHeap () returned 0x580000 [0039.663] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb1) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb2) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb3) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb4) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb5) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcf48 | out: hHeap=0x580000) returned 1 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcda0, Size=0xb6) returned 0x5bcda0 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcf48 [0039.664] GetProcessHeap () returned 0x580000 [0039.664] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcea0 | out: hHeap=0x580000) returned 1 [0039.664] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcea0 [0039.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5b9438, cbMultiByte=47, lpWideCharStr=0x6a0eba0, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1622540890") returned 47 [0039.665] FindFirstFileW (in: lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1622540890", lpFindFileData=0x6a0f95c | out: lpFindFileData=0x6a0f95c*(dwFileAttributes=0x37739f, ftCreationTime.dwLowDateTime=0xfffffffe, ftCreationTime.dwHighDateTime=0x7715e36c, ftLastAccessTime.dwLowDateTime=0x7715e0d2, ftLastAccessTime.dwHighDateTime=0x580000, ftLastWriteTime.dwLowDateTime=0xc, ftLastWriteTime.dwHighDateTime=0x5dcf70, nFileSizeHigh=0x6a0f8b0, nFileSizeLow=0x771729ce, dwReserved0=0x6a0fab8, dwReserved1=0x771a1ecd, cFileName="\x6997\x37", cAlternateFileName="⹷@\x03")) returned 0xffffffff [0039.665] GetProcessHeap () returned 0x580000 [0039.665] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x38) returned 0x5b93f0 [0039.665] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5b93f8, cbMultiByte=47, lpWideCharStr=0x6a0eb98, cchWideChar=2047 | out: lpWideCharStr="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\16225408900890") returned 47 [0039.665] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\1622540890" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\1622540890"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x374 [0039.666] CloseHandle (hObject=0x374) returned 1 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x24) returned 0x5dc4f0 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc4f0, Size=0x1e) returned 0x5da2b8 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x28) returned 0x5dc4f0 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x59a518 | out: hHeap=0x580000) returned 1 [0039.667] GetNativeSystemInfo (in: lpSystemInfo=0x6a0fb88 | out: lpSystemInfo=0x6a0fb88*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0xfffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5e03)) [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcf78 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x10) returned 0x5dcfd8 [0039.667] GetVersionExA (in: lpVersionInformation=0x6a0fb10*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x6a0fb10*(dwOSVersionInfoSize=0x9c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x12) returned 0x5e84f8 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x168) returned 0x5b6040 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcff0 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd008 [0039.667] GetProcessHeap () returned 0x580000 [0039.667] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.667] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcff0 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcff0 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcff0 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dd008, Size=0xd) returned 0x5dcfd8 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd020 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcff0 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dcfd8, Size=0xf) returned 0x5dd008 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcff0 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcff0 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcff0 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dd008, Size=0x11) returned 0x5e8518 [0039.668] GetProcessHeap () returned 0x580000 [0039.668] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd020 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcfd8 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x13) returned 0x5e8538 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8538, Size=0x15) returned 0x5e8518 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd020 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcfd8 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8518, Size=0x17) returned 0x5e8538 [0039.669] GetProcessHeap () returned 0x580000 [0039.669] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.669] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8538, Size=0x19) returned 0x5da2b8 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd020 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcfd8 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1b) returned 0x5da308 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x1d) returned 0x5da2b8 [0039.670] GetProcessHeap () returned 0x580000 [0039.670] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.670] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd020 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dcfd8 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da2b8, Size=0x1f) returned 0x5da308 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dcfd8 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5dd008 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5dd020 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dcfd8 | out: hHeap=0x580000) returned 1 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd008 | out: hHeap=0x580000) returned 1 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5da308, Size=0x21) returned 0x59a518 [0039.671] GetProcessHeap () returned 0x580000 [0039.671] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5dd020 | out: hHeap=0x580000) returned 1 [0039.672] GetProcessHeap () returned 0x580000 [0039.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\temp000000.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\temp000000.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x374 [0039.714] WriteFile (in: hFile=0x374, lpBuffer=0x5b49b8*, nNumberOfBytesToWrite=0x2f3, lpNumberOfBytesWritten=0x6a0fba0, lpOverlapped=0x0 | out: lpBuffer=0x5b49b8*, lpNumberOfBytesWritten=0x6a0fba0*=0x2f3, lpOverlapped=0x0) returned 1 [0039.715] CloseHandle (hObject=0x374) returned 1 [0039.717] ShellExecuteExW (in: pExecInfo=0x6a0fb60*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\temp000000.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x6a0fb60*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb="open", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\temp000000.txt", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x3b0)) returned 1 [0039.995] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0eba8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txtocal\\Temp\\16225408900890") returned 19 [0039.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_RESTORE FILES_.txt", lpFindFileData=0x6a0f910 | out: lpFindFileData=0x6a0f910*(dwFileAttributes=0x8, ftCreationTime.dwLowDateTime=0x6a0f8dc, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x10004, ftLastAccessTime.dwHighDateTime=0x4, ftLastWriteTime.dwLowDateTime=0x6a0f8ec, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x7715014d, nFileSizeLow=0x75970962, dwReserved0=0x3, dwReserved1=0x6a0f97c, cFileName="\x01", cAlternateFileName="\x98ec\x5f\x97dc\x5f\x72")) returned 0xffffffff [0039.995] FindResourceA (hModule=0x400000, lpName="RWQPVNTDBOCP8XPUT", lpType=0xa) returned 0x41b090 [0039.996] LoadResource (hModule=0x400000, hResInfo=0x41b090) returned 0x41b234 [0039.996] LockResource (hResData=0x41b234) returned 0x41b234 [0039.996] SizeofResource (hModule=0x400000, hResInfo=0x41b090) returned 0x1d8 [0039.996] GetProcessHeap () returned 0x580000 [0039.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d8) returned 0x5b5bc8 [0039.996] GetProcessHeap () returned 0x580000 [0039.996] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x5b0d38 [0039.997] RtlGetCompressionWorkSpaceSize (in: CompressionFormatAndEngine=0x2, CompressBufferWorkSpaceSize=0x6a0fb54, CompressFragmentWorkSpaceSize=0x6a0fb50 | out: CompressBufferWorkSpaceSize=0x6a0fb54, CompressFragmentWorkSpaceSize=0x6a0fb50) returned 0x0 [0039.998] GetProcessHeap () returned 0x580000 [0039.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8010) returned 0x615400 [0039.998] GetProcessHeap () returned 0x580000 [0039.998] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c4) returned 0x5e8988 [0039.998] GetProcessHeap () returned 0x580000 [0039.998] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8988, Size=0x2c4) returned 0x5e8988 [0039.998] RtlDecompressFragment (in: CompressionFormat=0x2, UncompressedFragment=0x5e8988, UncompressedFragmentSize=0x2c4, CompressedBuffer=0x5b5bc8, CompressedBufferSize=0x1d8, FragmentOffset=0x0, FinalUncompressedSize=0x6a0fb4c, WorkSpace=0x615400 | out: UncompressedFragment=0x5e8988, FinalUncompressedSize=0x6a0fb4c) returned 0x0 [0039.998] GetProcessHeap () returned 0x580000 [0039.998] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x615400 | out: hHeap=0x580000) returned 1 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e8988, Size=0x225) returned 0x5e8988 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b5bc8 | out: hHeap=0x580000) returned 1 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e) returned 0x5e8bb8 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e) returned 0x6107d8 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6107d8, Size=0x228) returned 0x6147c0 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6147c0, Size=0x232) returned 0x6147c0 [0039.999] GetProcessHeap () returned 0x580000 [0039.999] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e8bb8 | out: hHeap=0x580000) returned 1 [0039.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\_RESTORE FILES_.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\_restore files_.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x374 [0040.001] WriteFile (in: hFile=0x374, lpBuffer=0x6147c8*, nNumberOfBytesToWrite=0x229, lpNumberOfBytesWritten=0x6a0fb54, lpOverlapped=0x0 | out: lpBuffer=0x6147c8*, lpNumberOfBytesWritten=0x6a0fb54*=0x229, lpOverlapped=0x0) returned 1 [0040.001] CloseHandle (hObject=0x374) returned 1 [0040.002] GetProcessHeap () returned 0x580000 [0040.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e8988 | out: hHeap=0x580000) returned 1 [0040.002] FreeResource (hResData=0x41b234) returned 0 [0040.002] GetProcessHeap () returned 0x580000 [0040.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b0d38 | out: hHeap=0x580000) returned 1 [0040.002] GetProcessHeap () returned 0x580000 [0040.002] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6147c0 | out: hHeap=0x580000) returned 1 [0040.003] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x6a0fb90 | out: lphEnum=0x6a0fb90*=0x5b9470) returned 0x0 [0042.928] GetProcessHeap () returned 0x580000 [0042.928] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x640) returned 0x5f3908 [0042.928] WNetEnumResourceW (in: hEnum=0x5b9470, lpcCount=0x6a0fb84, lpBuffer=0x5f3908, lpBufferSize=0x6a0fb88 | out: lpcCount=0x6a0fb84, lpBuffer=0x5f3908, lpBufferSize=0x6a0fb88) returned 0x0 [0042.928] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5f3908, lphEnum=0x6a0fb40 | out: lphEnum=0x6a0fb40*=0x5e8538) returned 0x0 [0042.931] GetProcessHeap () returned 0x580000 [0042.931] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x640) returned 0x5f5f50 [0042.931] WNetEnumResourceW (in: hEnum=0x5e8538, lpcCount=0x6a0fb34, lpBuffer=0x5f5f50, lpBufferSize=0x6a0fb38 | out: lpcCount=0x6a0fb34, lpBuffer=0x5f5f50, lpBufferSize=0x6a0fb38) returned 0x103 [0042.932] GetProcessHeap () returned 0x580000 [0042.932] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f5f50 | out: hHeap=0x580000) returned 1 [0042.932] WNetCloseEnum (hEnum=0x5e8538) returned 0x0 [0042.932] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5f3928, lphEnum=0x6a0fb40 | out: lphEnum=0x6a0fb40*=0x2) returned 0x4b8 [0055.503] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5f3948, lphEnum=0x6a0fb40 | out: lphEnum=0x6a0fb40*=0x1) returned 0x4c6 [0055.505] GetProcessHeap () returned 0x580000 [0055.505] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0055.505] WNetCloseEnum (hEnum=0x5b9470) returned 0x0 [0055.505] GetProcessHeap () returned 0x580000 [0055.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.505] GetProcessHeap () returned 0x580000 [0055.505] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.506] GetDriveTypeA (lpRootPathName="Z:\\") returned 0x1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.506] GetDriveTypeA (lpRootPathName="Y:\\") returned 0x1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.506] GetDriveTypeA (lpRootPathName="X:\\") returned 0x1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.506] GetProcessHeap () returned 0x580000 [0055.506] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.507] GetDriveTypeA (lpRootPathName="W:\\") returned 0x1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.507] GetDriveTypeA (lpRootPathName="V:\\") returned 0x1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.507] GetDriveTypeA (lpRootPathName="U:\\") returned 0x1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.507] GetProcessHeap () returned 0x580000 [0055.507] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.508] GetDriveTypeA (lpRootPathName="T:\\") returned 0x1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.508] GetDriveTypeA (lpRootPathName="S:\\") returned 0x1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.508] GetDriveTypeA (lpRootPathName="R:\\") returned 0x1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.508] GetProcessHeap () returned 0x580000 [0055.508] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.508] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.509] GetDriveTypeA (lpRootPathName="Q:\\") returned 0x1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.509] GetDriveTypeA (lpRootPathName="P:\\") returned 0x1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.509] GetDriveTypeA (lpRootPathName="O:\\") returned 0x1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.509] GetProcessHeap () returned 0x580000 [0055.509] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.509] GetDriveTypeA (lpRootPathName="N:\\") returned 0x1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.510] GetDriveTypeA (lpRootPathName="M:\\") returned 0x1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.510] GetDriveTypeA (lpRootPathName="L:\\") returned 0x1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.510] GetProcessHeap () returned 0x580000 [0055.510] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.510] GetDriveTypeA (lpRootPathName="K:\\") returned 0x1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.511] GetDriveTypeA (lpRootPathName="J:\\") returned 0x1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.511] GetDriveTypeA (lpRootPathName="I:\\") returned 0x1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.511] GetProcessHeap () returned 0x580000 [0055.511] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.511] GetDriveTypeA (lpRootPathName="H:\\") returned 0x1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.512] GetDriveTypeA (lpRootPathName="G:\\") returned 0x1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.512] GetDriveTypeA (lpRootPathName="F:\\") returned 0x1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9558 [0055.512] GetProcessHeap () returned 0x580000 [0055.512] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.512] GetDriveTypeA (lpRootPathName="E:\\") returned 0x1 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9570 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5cc538 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9558 | out: hHeap=0x580000) returned 1 [0055.513] GetDriveTypeA (lpRootPathName="D:\\") returned 0x1 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5e9558 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5e9570 | out: hHeap=0x580000) returned 1 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xe) returned 0x5e9570 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5cc538 | out: hHeap=0x580000) returned 1 [0055.513] GetDriveTypeA (lpRootPathName="C:\\") returned 0x3 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xa) returned 0x5cc538 [0055.513] GetProcessHeap () returned 0x580000 [0055.513] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5cc538, Size=0xc) returned 0x5e9540 [0055.513] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5e9548, cbMultiByte=3, lpWideCharStr=0x6a0eb9c, cchWideChar=2047 | out: lpWideCharStr="C:\\") returned 3 [0055.513] SysReAllocStringLen (in: pbstr=0x6a0f938*=0x0, psz="C:\\", len=0x3 | out: pbstr=0x6a0f938*="C:\\") returned 1 [0055.513] CharLowerBuffW (in: lpsz="C:\\", cchLength=0x3 | out: lpsz="c:\\") returned 0x3 [0055.514] SysReAllocStringLen (in: pbstr=0x6a0f8e0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f8e0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.514] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.514] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7715e36c, dwReserved1=0x7715e0d2, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5b9470 [0055.514] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\$Recycle.Bin\\", len=0x10 | out: pbstr=0x6a0f670*="C:\\$Recycle.Bin\\") returned 1 [0055.514] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\", cchLength=0x10 | out: lpsz="c:\\$recycle.bin\\") returned 0x10 [0055.514] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.514] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.514] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0055.515] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.515] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0055.515] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", len=0x3f | out: pbstr=0x6a0f3a8*="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 1 [0055.515] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", cchLength=0x3f | out: lpsz="c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\") returned 0x3f [0055.515] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.515] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.515] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3769b7, dwReserved1=0xfffffffe, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.516] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.516] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0055.516] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", len=0x4a | out: pbstr=0x6a0f3a0*="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 1 [0055.516] CharLowerBuffW (in: lpsz="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini", cchLength=0x4a | out: lpsz="c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 0x4a [0055.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCE") returned 19 [0055.516] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.516] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e344, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt") returned 19 [0055.516] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7c8, cbMultiByte=17, lpWideCharStr=0x6a0e340, cchWideChar=2047 | out: lpWideCharStr="RWQPVNTDBOCP8XPUT.txt") returned 17 [0055.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0f0ac | out: lpFindFileData=0x6a0f0ac*(dwFileAttributes=0x5ef300, ftCreationTime.dwLowDateTime=0x60002, ftCreationTime.dwHighDateTime=0x5ef386, ftLastAccessTime.dwLowDateTime=0x3f4, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x860086, ftLastWriteTime.dwHighDateTime=0x5ef300, nFileSizeHigh=0x63, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2dfdd420, cFileName="\xdd9c\x1d2\x4b00\xb63e\x37f4\x1d3\x4b00\xb63e\x37f4\x1d3\x4b00\xb63e\x37f4\x1d3", cAlternateFileName="\xf894\x5f\xf7dc\x5f\xa4")) returned 0xffffffff [0055.517] FindResourceA (hModule=0x400000, lpName="RWQPVNTDBOCP8XPUT", lpType=0xa) returned 0x41b090 [0055.517] LoadResource (hModule=0x400000, hResInfo=0x41b090) returned 0x41b234 [0055.517] LockResource (hResData=0x41b234) returned 0x41b234 [0055.517] SizeofResource (hModule=0x400000, hResInfo=0x41b090) returned 0x1d8 [0055.517] GetProcessHeap () returned 0x580000 [0055.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1d8) returned 0x5b5bc8 [0055.517] GetProcessHeap () returned 0x580000 [0055.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x1a) returned 0x6151b8 [0055.517] RtlGetCompressionWorkSpaceSize (in: CompressionFormatAndEngine=0x2, CompressBufferWorkSpaceSize=0x6a0f2f0, CompressFragmentWorkSpaceSize=0x6a0f2ec | out: CompressBufferWorkSpaceSize=0x6a0f2f0, CompressFragmentWorkSpaceSize=0x6a0f2ec) returned 0x0 [0055.517] GetProcessHeap () returned 0x580000 [0055.517] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x8010) returned 0x61f408 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x2c4) returned 0x5f7360 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7360, Size=0x2c4) returned 0x5f7360 [0055.518] RtlDecompressFragment (in: CompressionFormat=0x2, UncompressedFragment=0x5f7360, UncompressedFragmentSize=0x2c4, CompressedBuffer=0x5b5bc8, CompressedBufferSize=0x1d8, FragmentOffset=0x0, FinalUncompressedSize=0x6a0f2e8, WorkSpace=0x61f408 | out: UncompressedFragment=0x5f7360, FinalUncompressedSize=0x6a0f2e8) returned 0x0 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x61f408 | out: hHeap=0x580000) returned 1 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7360, Size=0x225) returned 0x5f7360 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5b5bc8 | out: hHeap=0x580000) returned 1 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e) returned 0x6107d8 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0x22e) returned 0x610a20 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x610a20, Size=0x228) returned 0x610c68 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x610c68, Size=0x232) returned 0x5f3908 [0055.518] GetProcessHeap () returned 0x580000 [0055.518] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6107d8 | out: hHeap=0x580000) returned 1 [0055.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), dwDesiredAccess=0x40000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f8 [0055.520] WriteFile (in: hFile=0x3f8, lpBuffer=0x5f3910*, nNumberOfBytesToWrite=0x229, lpNumberOfBytesWritten=0x6a0f2f0, lpOverlapped=0x0 | out: lpBuffer=0x5f3910*, lpNumberOfBytesWritten=0x6a0f2f0*=0x229, lpOverlapped=0x0) returned 1 [0055.520] CloseHandle (hObject=0x3f8) returned 1 [0055.522] GetProcessHeap () returned 0x580000 [0055.522] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f7360 | out: hHeap=0x580000) returned 1 [0055.522] FreeResource (hResData=0x41b234) returned 0 [0055.522] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\_RESTORE FILES_.txt" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\_restore files_.txt"), bFailIfExists=0) returned 1 [0055.525] GetProcessHeap () returned 0x580000 [0055.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x6151b8 | out: hHeap=0x580000) returned 1 [0055.525] GetProcessHeap () returned 0x580000 [0055.525] HeapFree (in: hHeap=0x580000, dwFlags=0x0, lpMem=0x5f3908 | out: hHeap=0x580000) returned 1 [0055.525] GetProcessHeap () returned 0x580000 [0055.525] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5e94b0 [0055.525] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.525] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.525] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.525] FindClose (in: hFindFile=0x5b95b0 | out: hFindFile=0x5b95b0) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0055.526] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\Boot\\", len=0x8 | out: pbstr=0x6a0f670*="C:\\Boot\\") returned 1 [0055.526] CharLowerBuffW (in: lpsz="C:\\Boot\\", cchLength=0x8 | out: lpsz="c:\\boot\\") returned 0x8 [0055.526] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.526] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.526] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0055.526] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.526] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0055.526] SysReAllocStringLen (in: pbstr=0x6a0f668*=0x0, psz="C:\\Boot\\BCD", len=0xb | out: pbstr=0x6a0f668*="C:\\Boot\\BCD") returned 1 [0055.527] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD", cchLength=0xb | out: lpsz="c:\\boot\\bcd") returned 0xb [0055.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCE") returned 31 [0055.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCE") returned 19 [0055.527] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.527] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e60c, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt") returned 19 [0055.527] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7c8, cbMultiByte=17, lpWideCharStr=0x6a0e608, cchWideChar=2047 | out: lpWideCharStr="RWQPVNTDBOCP8XPUT.txt") returned 17 [0055.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0f374 | out: lpFindFileData=0x6a0f374*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xac015040, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b95f0 [0055.527] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.527] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Boot\\_RESTORE FILES_.txt" (normalized: "c:\\boot\\_restore files_.txt"), bFailIfExists=0) returned 1 [0055.529] GetProcessHeap () returned 0x580000 [0055.529] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x10) returned 0x5e9588 [0055.530] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0055.530] SysReAllocStringLen (in: pbstr=0x6a0f668*="c:\\boot\\bcd", psz="C:\\Boot\\BCD.LOG", len=0xf | out: pbstr=0x6a0f668*="C:\\Boot\\BCD.LOG") returned 1 [0055.530] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG", cchLength=0xf | out: lpsz="c:\\boot\\bcd.log") returned 0xf [0055.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.530] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.530] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.530] GetProcessHeap () returned 0x580000 [0055.530] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9588, Size=0x14) returned 0x5e85f8 [0055.530] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0055.530] SysReAllocStringLen (in: pbstr=0x6a0f668*="c:\\boot\\bcd.log", psz="C:\\Boot\\BCD.LOG1", len=0x10 | out: pbstr=0x6a0f668*="C:\\Boot\\BCD.LOG1") returned 1 [0055.530] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG1", cchLength=0x10 | out: lpsz="c:\\boot\\bcd.log1") returned 0x10 [0055.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.531] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.531] GetProcessHeap () returned 0x580000 [0055.531] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e85f8, Size=0x18) returned 0x5a58e8 [0055.531] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0055.531] SysReAllocStringLen (in: pbstr=0x6a0f668*="c:\\boot\\bcd.log1", psz="C:\\Boot\\BCD.LOG2", len=0x10 | out: pbstr=0x6a0f668*="C:\\Boot\\BCD.LOG2") returned 1 [0055.531] CharLowerBuffW (in: lpsz="C:\\Boot\\BCD.LOG2", cchLength=0x10 | out: lpsz="c:\\boot\\bcd.log2") returned 0x10 [0055.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.531] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.531] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.532] GetProcessHeap () returned 0x580000 [0055.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615230 [0055.532] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0055.532] SysReAllocStringLen (in: pbstr=0x6a0f668*="c:\\boot\\bcd.log2", psz="C:\\Boot\\BOOTSTAT.DAT", len=0x14 | out: pbstr=0x6a0f668*="C:\\Boot\\BOOTSTAT.DAT") returned 1 [0055.532] CharLowerBuffW (in: lpsz="C:\\Boot\\BOOTSTAT.DAT", cchLength=0x14 | out: lpsz="c:\\boot\\bootstat.dat") returned 0x14 [0055.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.532] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e5d8, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.532] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.532] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.532] GetProcessHeap () returned 0x580000 [0055.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615230, Size=0x20) returned 0x615280 [0055.532] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0055.533] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\cs-CZ\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\cs-CZ\\") returned 1 [0055.533] CharLowerBuffW (in: lpsz="C:\\Boot\\cs-CZ\\", cchLength=0xe | out: lpsz="c:\\boot\\cs-cz\\") returned 0xe [0055.533] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.533] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.533] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.588] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.588] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.589] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 1 [0055.589] CharLowerBuffW (in: lpsz="C:\\Boot\\cs-CZ\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\cs-cz\\bootmgr.exe.mui") returned 0x1d [0055.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.589] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.589] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.589] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.589] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.589] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.589] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0055.589] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\da-DK\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\da-DK\\") returned 1 [0055.589] CharLowerBuffW (in: lpsz="C:\\Boot\\da-DK\\", cchLength=0xe | out: lpsz="c:\\boot\\da-dk\\") returned 0xe [0055.590] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.590] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.590] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.590] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.590] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.590] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\da-DK\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 1 [0055.590] CharLowerBuffW (in: lpsz="C:\\Boot\\da-DK\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\da-dk\\bootmgr.exe.mui") returned 0x1d [0055.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.590] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.590] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.590] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.591] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.591] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.591] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0055.591] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\de-DE\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\de-DE\\") returned 1 [0055.591] CharLowerBuffW (in: lpsz="C:\\Boot\\de-DE\\", cchLength=0xe | out: lpsz="c:\\boot\\de-de\\") returned 0xe [0055.591] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.591] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.591] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.646] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.646] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.646] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\de-DE\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 1 [0055.646] CharLowerBuffW (in: lpsz="C:\\Boot\\de-DE\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\de-de\\bootmgr.exe.mui") returned 0x1d [0055.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.647] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.647] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.647] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.647] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.647] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.647] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0055.647] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\el-GR\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\el-GR\\") returned 1 [0055.647] CharLowerBuffW (in: lpsz="C:\\Boot\\el-GR\\", cchLength=0xe | out: lpsz="c:\\boot\\el-gr\\") returned 0xe [0055.647] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.647] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.648] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.648] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.648] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.648] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\el-GR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 1 [0055.648] CharLowerBuffW (in: lpsz="C:\\Boot\\el-GR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\el-gr\\bootmgr.exe.mui") returned 0x1d [0055.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.648] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.648] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.648] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.648] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.648] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.649] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0055.649] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\en-US\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\en-US\\") returned 1 [0055.649] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\", cchLength=0xe | out: lpsz="c:\\boot\\en-us\\") returned 0xe [0055.649] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.649] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.649] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.693] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.693] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.693] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\en-US\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 1 [0055.693] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\en-us\\bootmgr.exe.mui") returned 0x1d [0055.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.693] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.693] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.693] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.693] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0055.694] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\boot\\en-us\\bootmgr.exe.mui", psz="C:\\Boot\\en-US\\memtest.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\en-US\\memtest.exe.mui") returned 1 [0055.694] CharLowerBuffW (in: lpsz="C:\\Boot\\en-US\\memtest.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\en-us\\memtest.exe.mui") returned 0x1d [0055.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.694] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.694] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.694] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.694] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.694] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.694] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0055.694] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\es-ES\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\es-ES\\") returned 1 [0055.694] CharLowerBuffW (in: lpsz="C:\\Boot\\es-ES\\", cchLength=0xe | out: lpsz="c:\\boot\\es-es\\") returned 0xe [0055.694] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.695] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.695] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.740] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.740] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.740] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\es-ES\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 1 [0055.740] CharLowerBuffW (in: lpsz="C:\\Boot\\es-ES\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\es-es\\bootmgr.exe.mui") returned 0x1d [0055.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x5dc4f8, cbMultiByte=31, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="id_1622540890_.YOUR_LAST_CHANCEDBOCP8XPUT.txt") returned 31 [0055.740] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x59f7f0, cbMultiByte=19, lpWideCharStr=0x6a0e310, cchWideChar=2047 | out: lpWideCharStr="_RESTORE FILES_.txt_LAST_CHANCEDBOCP8XPUT.txt") returned 19 [0055.740] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.740] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.740] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.740] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.740] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0055.740] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\fi-FI\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\fi-FI\\") returned 1 [0055.740] CharLowerBuffW (in: lpsz="C:\\Boot\\fi-FI\\", cchLength=0xe | out: lpsz="c:\\boot\\fi-fi\\") returned 0xe [0055.740] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.741] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.741] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.741] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.741] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\fi-FI\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 1 [0055.741] CharLowerBuffW (in: lpsz="C:\\Boot\\fi-FI\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fi-fi\\bootmgr.exe.mui") returned 0x1d [0055.741] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.741] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.741] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.741] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.741] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0055.741] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\Fonts\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\Fonts\\") returned 1 [0055.741] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\", cchLength=0xe | out: lpsz="c:\\boot\\fonts\\") returned 0xe [0055.741] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.741] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.741] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.786] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.786] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0055.787] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\Fonts\\chs_boot.ttf", len=0x1a | out: pbstr=0x6a0f3a0*="C:\\Boot\\Fonts\\chs_boot.ttf") returned 1 [0055.787] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\chs_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\chs_boot.ttf") returned 0x1a [0055.787] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.787] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0f0ac | out: lpFindFileData=0x6a0f0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xac0f9880, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0055.787] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.787] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Boot\\Fonts\\_RESTORE FILES_.txt" (normalized: "c:\\boot\\fonts\\_restore files_.txt"), bFailIfExists=0) returned 1 [0055.835] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\boot\\fonts\\chs_boot.ttf", psz="C:\\Boot\\Fonts\\cht_boot.ttf", len=0x1a | out: pbstr=0x6a0f3a0*="C:\\Boot\\Fonts\\cht_boot.ttf") returned 1 [0055.836] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\cht_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\cht_boot.ttf") returned 0x1a [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.836] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.836] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x10) returned 0x5e9588 [0055.836] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\boot\\fonts\\cht_boot.ttf", psz="C:\\Boot\\Fonts\\jpn_boot.ttf", len=0x1a | out: pbstr=0x6a0f3a0*="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 1 [0055.836] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\jpn_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\jpn_boot.ttf") returned 0x1a [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.836] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.836] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9588, Size=0x14) returned 0x5a5888 [0055.836] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\boot\\fonts\\jpn_boot.ttf", psz="C:\\Boot\\Fonts\\kor_boot.ttf", len=0x1a | out: pbstr=0x6a0f3a0*="C:\\Boot\\Fonts\\kor_boot.ttf") returned 1 [0055.836] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\kor_boot.ttf", cchLength=0x1a | out: lpsz="c:\\boot\\fonts\\kor_boot.ttf") returned 0x1a [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.836] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.836] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0055.836] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\boot\\fonts\\kor_boot.ttf", psz="C:\\Boot\\Fonts\\wgl4_boot.ttf", len=0x1b | out: pbstr=0x6a0f3a0*="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 1 [0055.836] CharLowerBuffW (in: lpsz="C:\\Boot\\Fonts\\wgl4_boot.ttf", cchLength=0x1b | out: lpsz="c:\\boot\\fonts\\wgl4_boot.ttf") returned 0x1b [0055.836] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.836] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.837] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x6152a8 [0055.837] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.837] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.837] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0055.837] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\fr-FR\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\fr-FR\\") returned 1 [0055.837] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-FR\\", cchLength=0xe | out: lpsz="c:\\boot\\fr-fr\\") returned 0xe [0055.837] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.837] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.837] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.844] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.844] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.844] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\fr-FR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 1 [0055.844] CharLowerBuffW (in: lpsz="C:\\Boot\\fr-FR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\fr-fr\\bootmgr.exe.mui") returned 0x1d [0055.844] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.844] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.844] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.844] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.844] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0055.844] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\hu-HU\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\hu-HU\\") returned 1 [0055.844] CharLowerBuffW (in: lpsz="C:\\Boot\\hu-HU\\", cchLength=0xe | out: lpsz="c:\\boot\\hu-hu\\") returned 0xe [0055.844] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.844] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.844] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.845] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.845] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.845] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\hu-HU\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 1 [0055.845] CharLowerBuffW (in: lpsz="C:\\Boot\\hu-HU\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\hu-hu\\bootmgr.exe.mui") returned 0x1d [0055.845] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.845] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.845] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.845] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0055.845] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\it-IT\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\it-IT\\") returned 1 [0055.845] CharLowerBuffW (in: lpsz="C:\\Boot\\it-IT\\", cchLength=0xe | out: lpsz="c:\\boot\\it-it\\") returned 0xe [0055.845] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.845] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.845] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.847] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.847] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.847] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\it-IT\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 1 [0055.847] CharLowerBuffW (in: lpsz="C:\\Boot\\it-IT\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\it-it\\bootmgr.exe.mui") returned 0x1d [0055.847] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.847] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.847] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.847] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.847] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0055.847] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\ja-JP\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\ja-JP\\") returned 1 [0055.847] CharLowerBuffW (in: lpsz="C:\\Boot\\ja-JP\\", cchLength=0xe | out: lpsz="c:\\boot\\ja-jp\\") returned 0xe [0055.847] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.847] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.847] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.848] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.848] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.848] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\ja-JP\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 1 [0055.848] CharLowerBuffW (in: lpsz="C:\\Boot\\ja-JP\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ja-jp\\bootmgr.exe.mui") returned 0x1d [0055.848] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.848] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.848] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.848] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.848] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0055.848] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\ko-KR\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\ko-KR\\") returned 1 [0055.848] CharLowerBuffW (in: lpsz="C:\\Boot\\ko-KR\\", cchLength=0xe | out: lpsz="c:\\boot\\ko-kr\\") returned 0xe [0055.848] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.848] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.848] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.850] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.851] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\ko-KR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 1 [0055.851] CharLowerBuffW (in: lpsz="C:\\Boot\\ko-KR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ko-kr\\bootmgr.exe.mui") returned 0x1d [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.851] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.851] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.851] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.851] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f668*="c:\\boot\\bootstat.dat", psz="C:\\Boot\\memtest.exe", len=0x13 | out: pbstr=0x6a0f668*="C:\\Boot\\memtest.exe") returned 1 [0055.851] CharLowerBuffW (in: lpsz="C:\\Boot\\memtest.exe", cchLength=0x13 | out: lpsz="c:\\boot\\memtest.exe") returned 0x13 [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0055.851] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.851] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\nb-NO\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\nb-NO\\") returned 1 [0055.851] CharLowerBuffW (in: lpsz="C:\\Boot\\nb-NO\\", cchLength=0xe | out: lpsz="c:\\boot\\nb-no\\") returned 0xe [0055.851] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.851] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.851] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.851] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.852] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.852] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\nb-NO\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 1 [0055.852] CharLowerBuffW (in: lpsz="C:\\Boot\\nb-NO\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nb-no\\bootmgr.exe.mui") returned 0x1d [0055.852] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.852] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.852] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.852] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.852] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0055.852] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\nl-NL\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\nl-NL\\") returned 1 [0055.852] CharLowerBuffW (in: lpsz="C:\\Boot\\nl-NL\\", cchLength=0xe | out: lpsz="c:\\boot\\nl-nl\\") returned 0xe [0055.852] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.852] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.852] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.853] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.853] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.853] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\nl-NL\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 1 [0055.853] CharLowerBuffW (in: lpsz="C:\\Boot\\nl-NL\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\nl-nl\\bootmgr.exe.mui") returned 0x1d [0055.853] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.853] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.853] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.853] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.853] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0055.853] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\pl-PL\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\pl-PL\\") returned 1 [0055.853] CharLowerBuffW (in: lpsz="C:\\Boot\\pl-PL\\", cchLength=0xe | out: lpsz="c:\\boot\\pl-pl\\") returned 0xe [0055.853] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.853] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.853] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.854] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.854] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.854] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\pl-PL\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 1 [0055.854] CharLowerBuffW (in: lpsz="C:\\Boot\\pl-PL\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pl-pl\\bootmgr.exe.mui") returned 0x1d [0055.854] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.854] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.854] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.854] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.854] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0055.854] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\pt-BR\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\pt-BR\\") returned 1 [0055.854] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-BR\\", cchLength=0xe | out: lpsz="c:\\boot\\pt-br\\") returned 0xe [0055.854] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.854] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.854] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.855] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.855] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.855] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\pt-BR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 1 [0055.855] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-BR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-br\\bootmgr.exe.mui") returned 0x1d [0055.855] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.855] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.855] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.855] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.855] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0055.855] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\pt-PT\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\pt-PT\\") returned 1 [0055.855] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-PT\\", cchLength=0xe | out: lpsz="c:\\boot\\pt-pt\\") returned 0xe [0055.855] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.855] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.856] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.856] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.856] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.856] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\pt-PT\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\pt-PT\\bootmgr.exe.mui") returned 1 [0055.856] CharLowerBuffW (in: lpsz="C:\\Boot\\pt-PT\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\pt-pt\\bootmgr.exe.mui") returned 0x1d [0055.856] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.856] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.856] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.856] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.856] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0055.856] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\ru-RU\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\ru-RU\\") returned 1 [0055.856] CharLowerBuffW (in: lpsz="C:\\Boot\\ru-RU\\", cchLength=0xe | out: lpsz="c:\\boot\\ru-ru\\") returned 0xe [0055.856] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.856] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.856] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.857] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.857] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.857] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\ru-RU\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 1 [0055.857] CharLowerBuffW (in: lpsz="C:\\Boot\\ru-RU\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\ru-ru\\bootmgr.exe.mui") returned 0x1d [0055.857] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.857] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.857] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.857] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.857] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0055.857] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\sv-SE\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\sv-SE\\") returned 1 [0055.858] CharLowerBuffW (in: lpsz="C:\\Boot\\sv-SE\\", cchLength=0xe | out: lpsz="c:\\boot\\sv-se\\") returned 0xe [0055.858] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.858] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.858] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.858] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.858] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.858] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\sv-SE\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\sv-SE\\bootmgr.exe.mui") returned 1 [0055.858] CharLowerBuffW (in: lpsz="C:\\Boot\\sv-SE\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\sv-se\\bootmgr.exe.mui") returned 0x1d [0055.858] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.858] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.858] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.858] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.858] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0055.858] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\tr-TR\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\tr-TR\\") returned 1 [0055.858] CharLowerBuffW (in: lpsz="C:\\Boot\\tr-TR\\", cchLength=0xe | out: lpsz="c:\\boot\\tr-tr\\") returned 0xe [0055.858] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.858] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.858] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.859] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.859] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.859] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\tr-TR\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\tr-TR\\bootmgr.exe.mui") returned 1 [0055.859] CharLowerBuffW (in: lpsz="C:\\Boot\\tr-TR\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\tr-tr\\bootmgr.exe.mui") returned 0x1d [0055.859] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.859] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.859] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.859] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.859] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0055.859] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\zh-CN\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\zh-CN\\") returned 1 [0055.860] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-CN\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-cn\\") returned 0xe [0055.860] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.860] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.860] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.860] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.860] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.860] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\zh-CN\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\zh-CN\\bootmgr.exe.mui") returned 1 [0055.860] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-CN\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-cn\\bootmgr.exe.mui") returned 0x1d [0055.860] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.860] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.860] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.860] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.860] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0055.860] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\zh-HK\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\zh-HK\\") returned 1 [0055.860] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-HK\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-hk\\") returned 0xe [0055.860] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.860] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.860] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.861] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.861] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.861] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\zh-HK\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\zh-HK\\bootmgr.exe.mui") returned 1 [0055.861] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-HK\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-hk\\bootmgr.exe.mui") returned 0x1d [0055.861] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.861] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.861] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.862] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0055.862] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Boot\\zh-TW\\", len=0xe | out: pbstr=0x6a0f3a8*="C:\\Boot\\zh-TW\\") returned 1 [0055.862] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-TW\\", cchLength=0xe | out: lpsz="c:\\boot\\zh-tw\\") returned 0xe [0055.862] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.862] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.862] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.862] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.862] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0055.862] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Boot\\zh-TW\\bootmgr.exe.mui", len=0x1d | out: pbstr=0x6a0f3a0*="C:\\Boot\\zh-TW\\bootmgr.exe.mui") returned 1 [0055.862] CharLowerBuffW (in: lpsz="C:\\Boot\\zh-TW\\bootmgr.exe.mui", cchLength=0x1d | out: lpsz="c:\\boot\\zh-tw\\bootmgr.exe.mui") returned 0x1d [0055.862] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0055.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.862] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.862] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0055.862] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.862] FindClose (in: hFindFile=0x5b95b0 | out: hFindFile=0x5b95b0) returned 1 [0055.862] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0055.862] SysReAllocStringLen (in: pbstr=0x6a0f930*=0x0, psz="C:\\bootmgr", len=0xa | out: pbstr=0x6a0f930*="C:\\bootmgr") returned 1 [0055.863] CharLowerBuffW (in: lpsz="C:\\bootmgr", cchLength=0xa | out: lpsz="c:\\bootmgr") returned 0xa [0055.863] SysReAllocStringLen (in: pbstr=0x6a0f8d0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f8d0*="_RESTORE FILES_.txt") returned 1 [0055.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.863] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0055.863] SysReAllocStringLen (in: pbstr=0x6a0f930*="c:\\bootmgr", psz="C:\\BOOTSECT.BAK", len=0xf | out: pbstr=0x6a0f930*="C:\\BOOTSECT.BAK") returned 1 [0055.863] CharLowerBuffW (in: lpsz="C:\\BOOTSECT.BAK", cchLength=0xf | out: lpsz="c:\\bootsect.bak") returned 0xf [0055.863] SysReAllocStringLen (in: pbstr=0x6a0f8d0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f8d0*="_RESTORE FILES_.txt") returned 1 [0055.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.863] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0055.863] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\Config.Msi\\", len=0xe | out: pbstr=0x6a0f670*="C:\\Config.Msi\\") returned 1 [0055.863] CharLowerBuffW (in: lpsz="C:\\Config.Msi\\", cchLength=0xe | out: lpsz="c:\\config.msi\\") returned 0xe [0055.863] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.863] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.863] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0055.863] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.863] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.863] FindClose (in: hFindFile=0x5b95b0 | out: hFindFile=0x5b95b0) returned 1 [0055.863] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0055.863] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0055.864] SysReAllocStringLen (in: pbstr=0x6a0f930*="c:\\bootsect.bak", psz="C:\\hiberfil.sys", len=0xf | out: pbstr=0x6a0f930*="C:\\hiberfil.sys") returned 1 [0055.864] CharLowerBuffW (in: lpsz="C:\\hiberfil.sys", cchLength=0xf | out: lpsz="c:\\hiberfil.sys") returned 0xf [0055.864] SysReAllocStringLen (in: pbstr=0x6a0f8d0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f8d0*="_RESTORE FILES_.txt") returned 1 [0055.864] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.864] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0055.864] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\MSOCache\\", len=0xc | out: pbstr=0x6a0f670*="C:\\MSOCache\\") returned 1 [0055.864] CharLowerBuffW (in: lpsz="C:\\MSOCache\\", cchLength=0xc | out: lpsz="c:\\msocache\\") returned 0xc [0055.864] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.864] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.864] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0055.864] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.864] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0055.865] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\MSOCache\\All Users\\", len=0x16 | out: pbstr=0x6a0f3a8*="C:\\MSOCache\\All Users\\") returned 1 [0055.865] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\", cchLength=0x16 | out: lpsz="c:\\msocache\\all users\\") returned 0x16 [0055.865] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.865] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.865] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0055.868] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.868] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0055.868] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\") returned 1 [0055.868] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0055.868] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.868] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.868] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0055.869] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.869] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0055.869] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 1 [0055.869] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab") returned 0x4a [0055.869] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.869] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xecdfa490, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0055.869] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0055.870] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0055.873] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xece1ee80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.msi", cAlternateFileName="")) returned 1 [0055.873] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 1 [0055.873] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi") returned 0x4b [0055.873] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.873] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.873] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0055.874] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.xml", cAlternateFileName="")) returned 1 [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 1 [0055.874] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml") returned 0x4b [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.874] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0055.874] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0055.874] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.874] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0055.874] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.874] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.874] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0018-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~2")) returned 1 [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\") returned 1 [0055.874] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0055.874] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.874] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.874] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0055.876] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe8729610, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xecdfa490, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.876] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe874f770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.msi", cAlternateFileName="POWERP~1.MSI")) returned 1 [0055.876] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", len=0x50 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 1 [0055.876] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi", cchLength=0x50 | out: lpsz="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi") returned 0x50 [0055.876] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.876] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.876] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xe8729610, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0055.877] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0055.877] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0055.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x6152d0 [0055.879] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", len=0x50 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 1 [0055.879] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", cchLength=0x50 | out: lpsz="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml") returned 0x50 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6152d0, Size=0x20) returned 0x6152f8 [0055.879] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d523500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2d523500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8b079d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x431a290, dwReserved0=0x0, dwReserved1=0x0, cFileName="PptLR.cab", cAlternateFileName="")) returned 1 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 1 [0055.879] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab") returned 0x48 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6152f8, Size=0x24) returned 0x5dc550 [0055.879] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0055.879] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0055.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0055.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0055.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x28) returned 0x5dc340 [0055.879] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0055.879] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0055.882] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0019-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9877A~1")) returned 1 [0055.882] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\") returned 1 [0055.882] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0055.891] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0055.891] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0055.891] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0056.061] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc3e6570, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc8a9170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.061] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc40b730, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x265c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.msi", cAlternateFileName="PUBLIS~1.MSI")) returned 1 [0056.061] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 1 [0056.061] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi") returned 0x4f [0056.061] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.061] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfc3e6570, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0056.061] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0056.061] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0056.063] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.xml", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0056.063] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 1 [0056.063] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml") returned 0x4f [0056.063] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.064] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.064] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0056.064] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc47e320, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x97f3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PubLR.cab", cAlternateFileName="")) returned 1 [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 1 [0056.064] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab") returned 0x48 [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.064] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.064] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0056.064] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0056.064] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.064] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.064] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0056.064] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.064] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.064] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001A-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9765F~1")) returned 1 [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\") returned 1 [0056.064] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0056.064] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0056.064] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0056.064] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0056.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee829690, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf00dbad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf00dbad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3a6f2400, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3a6f2400, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xeebe0180, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe21fcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlkLR.cab", cAlternateFileName="")) returned 1 [0056.676] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 1 [0056.676] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab") returned 0x4a [0056.676] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xee829690, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0056.676] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0056.676] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0056.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2bba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.msi", cAlternateFileName="OUTLOO~1.MSI")) returned 1 [0056.678] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab", psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 1 [0056.678] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi") returned 0x4d [0056.678] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0056.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 1 [0056.679] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml") returned 0x4d [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0056.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0056.679] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0056.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0056.679] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0056.679] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-001B-0409-1000-0000000FF1CE}-C", cAlternateFileName="{94E50~1")) returned 1 [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\") returned 1 [0056.679] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0056.679] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0056.679] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0056.679] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0056.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfe076d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0056.957] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0056.957] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0056.957] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0056.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0056.957] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfc8a9170, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0056.957] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0056.957] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0057.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2fb48f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x2fb48f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc967850, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x29c6dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordLR.cab", cAlternateFileName="")) returned 1 [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml", psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 1 [0057.240] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab") returned 0x49 [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0057.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0057.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0057.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.msi", cAlternateFileName="")) returned 1 [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab", psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 1 [0057.240] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi") returned 0x4a [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0057.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0057.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0057.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.xml", cAlternateFileName="")) returned 1 [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 1 [0057.240] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml") returned 0x4a [0057.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0057.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0057.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0057.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0057.240] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0057.241] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-002C-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92787~1")) returned 1 [0057.241] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\") returned 1 [0057.241] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0057.241] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0057.241] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0057.241] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0058.135] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf00dbad0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf58c8770, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf58c8770, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.135] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0058.135] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", len=0x48 | out: pbstr=0x6a0ee18*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\") returned 1 [0058.136] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\") returned 0x48 [0058.136] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0058.136] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0058.136] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0058.136] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01c0310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf07b3a10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf07b3a10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.136] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x219b4a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x219b4a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf07b1ad0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xaf35ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.136] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 1 [0058.136] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab") returned 0x51 [0058.136] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ec10, dwReserved1=0x771a1ecd, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0058.137] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.137] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\_restore files_.txt"), bFailIfExists=0) returned 1 [0058.139] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4db6cb00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x4db6cb00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf020c5d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0058.139] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 1 [0058.139] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi") returned 0x51 [0058.139] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0058.139] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa38b7300, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0xa38b7300, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0058.139] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 1 [0058.139] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml") returned 0x51 [0058.139] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0058.139] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.139] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0058.140] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0058.140] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", len=0x48 | out: pbstr=0x6a0ee18*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\") returned 1 [0058.140] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\") returned 0x48 [0058.140] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0058.140] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0058.140] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0058.140] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf4d53d90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf4f690d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.140] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4f690d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd02aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.140] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 1 [0058.140] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab") returned 0x51 [0058.140] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.140] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.140] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xf4d53d90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0058.140] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.140] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\_restore files_.txt"), bFailIfExists=0) returned 1 [0058.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0058.182] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e5c7f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0058.182] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 1 [0058.182] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi") returned 0x51 [0058.182] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.182] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0058.182] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0058.182] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 1 [0058.182] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml") returned 0x51 [0058.182] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.182] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0058.182] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.182] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0058.183] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0058.183] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", len=0x48 | out: pbstr=0x6a0ee18*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\") returned 1 [0058.183] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\") returned 0x48 [0058.183] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0058.183] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0058.183] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0058.183] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2bda830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf30772d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf30772d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.183] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35aa7000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x35aa7000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf3076b00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1416b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.cab", cAlternateFileName="")) returned 1 [0058.183] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 1 [0058.183] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab") returned 0x51 [0058.183] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.183] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.183] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xf2bda830, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0058.183] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0058.183] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0058.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615320 [0058.185] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2e3b660, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd8400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.msi", cAlternateFileName="")) returned 1 [0058.185] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 1 [0058.185] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi") returned 0x51 [0058.186] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615320, Size=0x20) returned 0x615348 [0058.186] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.xml", cAlternateFileName="")) returned 1 [0058.186] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", len=0x51 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 1 [0058.186] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", cchLength=0x51 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml") returned 0x51 [0058.186] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0058.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615348, Size=0x24) returned 0x5dc550 [0058.186] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.186] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0058.186] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40650500, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x40650500, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf0126df0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.msi", cAlternateFileName="")) returned 1 [0058.186] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 1 [0058.186] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi") returned 0x4b [0058.186] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0058.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0058.186] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0058.186] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0058.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615348, Size=0x24) returned 0x5dc550 [0058.200] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.xml", cAlternateFileName="")) returned 1 [0058.200] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 1 [0058.200] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml") returned 0x4b [0058.204] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0058.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x28) returned 0x5dc340 [0058.204] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0058.204] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml", psz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0058.204] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0058.204] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0058.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0058.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x2c) returned 0x61f730 [0058.204] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0058.205] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0058.205] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0043-0409-1000-0000000FF1CE}-C", cAlternateFileName="{95310~1")) returned 1 [0058.205] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\") returned 1 [0058.205] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0058.205] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0058.205] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0058.205] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc3e6570, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc3e6570, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0059.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", len=0x4e | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 1 [0059.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi", cchLength=0x4e | out: lpsz="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi") returned 0x4e [0059.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfc138cb0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0059.266] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0059.266] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.268] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", len=0x4e | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 1 [0059.268] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", cchLength=0x4e | out: lpsz="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml") returned 0x4e [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.268] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94f8, Size=0x10) returned 0x5e94b0 [0059.268] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc301560, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2cb13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32LR.cab", cAlternateFileName="")) returned 1 [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 1 [0059.268] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab") returned 0x4b [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.268] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94b0, Size=0x14) returned 0x5a5888 [0059.268] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.268] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.269] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.269] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0059.269] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.269] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.269] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0044-0409-1000-0000000FF1CE}-C", cAlternateFileName="{91454~1")) returned 1 [0059.269] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.269] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.269] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.269] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.269] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.271] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf6e34d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa13c510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.271] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf79111d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1200204, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfLR.cab", cAlternateFileName="")) returned 1 [0059.271] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 1 [0059.271] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab") returned 0x48 [0059.271] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xf6e34d70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0059.271] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0059.271] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.273] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615320 [0059.273] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e58f90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2fac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.msi", cAlternateFileName="INFOPA~1.MSI")) returned 1 [0059.273] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", len=0x4e | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 1 [0059.273] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi", cchLength=0x4e | out: lpsz="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi") returned 0x4e [0059.273] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.273] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.273] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615320, Size=0x20) returned 0x615348 [0059.273] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.xml", cAlternateFileName="INFOPA~1.XML")) returned 1 [0059.273] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", len=0x4e | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 1 [0059.273] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", cchLength=0x4e | out: lpsz="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml") returned 0x4e [0059.273] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.273] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.273] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615348, Size=0x24) returned 0x5dc550 [0059.274] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.274] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.274] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.274] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x28) returned 0x5dc340 [0059.274] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.274] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.274] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0054-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9EA85~1")) returned 1 [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.274] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.274] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.274] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.274] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x435769e0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x43bdc500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.274] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f356eb0, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f356eb0, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.274] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.274] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.274] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x435769e0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0059.275] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0059.275] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x2c) returned 0x61f730 [0059.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7fb9f9e0, ftCreationTime.dwHighDateTime=0x1cbe575, ftLastAccessTime.dwLowDateTime=0x7fb9f9e0, ftLastAccessTime.dwHighDateTime=0x1cbe575, ftLastWriteTime.dwLowDateTime=0x437179c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x30780dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioLR.cab", cAlternateFileName="")) returned 1 [0059.278] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml", psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 1 [0059.278] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab") returned 0x4a [0059.278] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f730, Size=0x30) returned 0x61f768 [0059.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x272b1e70, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x272b1e70, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x435c1d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2ab000, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.msi", cAlternateFileName="")) returned 1 [0059.278] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 1 [0059.278] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi") returned 0x4b [0059.278] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f768, Size=0x34) returned 0x5b9670 [0059.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5f0a8e20, ftCreationTime.dwHighDateTime=0x1cbe576, ftLastAccessTime.dwLowDateTime=0x5f0a8e20, ftLastAccessTime.dwHighDateTime=0x1cbe576, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.xml", cAlternateFileName="")) returned 1 [0059.279] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 1 [0059.279] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml") returned 0x4b [0059.279] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.279] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9670, Size=0x38) returned 0x5b96b0 [0059.279] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.279] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.279] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00A1-0409-1000-0000000FF1CE}-C", cAlternateFileName="{92572~1")) returned 1 [0059.279] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.279] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.279] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.279] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.279] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.281] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xf58ee8d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf6e0ec10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf6e0ec10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.281] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5914a30, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x263400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.msi", cAlternateFileName="ONENOT~1.MSI")) returned 1 [0059.281] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 1 [0059.281] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi") returned 0x4d [0059.281] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xf58ee8d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0059.281] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0059.281] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61a8a0 [0059.283] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.xml", cAlternateFileName="ONENOT~1.XML")) returned 1 [0059.283] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi", psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 1 [0059.283] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml") returned 0x4d [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a8a0, Size=0x40) returned 0x61aa50 [0059.284] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x36db9d00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x36db9d00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf5e95540, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10a5df8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnoteLR.cab", cAlternateFileName="")) returned 1 [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml", psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 1 [0059.284] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab") returned 0x4a [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa50, Size=0x44) returned 0x596c88 [0059.284] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab", psz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.284] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x48) returned 0x596cd8 [0059.284] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.284] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.284] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00B4-0409-1000-0000000FF1CE}-C", cAlternateFileName="{912E0~1")) returned 1 [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.284] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.284] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.284] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.284] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.287] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5b30b20, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa5bc90a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc90a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.287] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x308ae9f0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x308ae9f0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b55ce0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x265400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.msi", cAlternateFileName="PROJEC~1.MSI")) returned 1 [0059.287] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 1 [0059.287] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi") returned 0x4d [0059.287] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.287] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa5b30b20, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0059.287] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.287] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x669528 [0059.289] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30a2b7b0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30a2b7b0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.xml", cAlternateFileName="PROJEC~1.XML")) returned 1 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 1 [0059.290] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml") returned 0x4d [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.290] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669528, Size=0x50) returned 0x669580 [0059.290] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30306de0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x30306de0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5b7cde0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x7e1dcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjLR.cab", cAlternateFileName="")) returned 1 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 1 [0059.290] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab") returned 0x49 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.290] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669580, Size=0x54) returned 0x5a4778 [0059.290] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x309dfcc0, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0x309dfcc0, ftLastAccessTime.dwHighDateTime=0x1cbe56c, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab", psz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.290] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.290] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x58) returned 0x5a47d8 [0059.290] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.290] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.290] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-00BA-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~4")) returned 1 [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.290] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.290] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.290] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.291] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0059.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee803530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee4bb7b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x3e7e1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveLR.cab", cAlternateFileName="")) returned 1 [0059.292] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 1 [0059.292] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab") returned 0x4b [0059.292] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xee38cbf0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0059.292] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0059.292] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0059.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x5c) returned 0x5e1578 [0059.300] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee3b15e0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x264400, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.msi", cAlternateFileName="GROOVE~1.MSI")) returned 1 [0059.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab", psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 1 [0059.301] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi") returned 0x4c [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1578, Size=0x60) returned 0x5e1510 [0059.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi", psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 1 [0059.301] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml") returned 0x4c [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1510, Size=0x64) returned 0x6077d8 [0059.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec1a700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbec1a700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml", psz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0059.301] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0059.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0059.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6077d8, Size=0x68) returned 0x607848 [0059.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0059.301] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0059.301] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0115-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~1")) returned 1 [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\") returned 1 [0059.301] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0059.301] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0059.301] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0059.301] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0060.045] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8729610, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8729610, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.045] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0060.045] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", len=0x44 | out: pbstr=0x6a0ee18*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\") returned 1 [0060.046] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", cchLength=0x44 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\") returned 0x44 [0060.046] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0060.046] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0060.046] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0060.857] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8691090, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe8691090, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.857] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a35700, ftCreationTime.dwHighDateTime=0x1cac9d7, ftLastAccessTime.dwLowDateTime=0x6a35700, ftLastAccessTime.dwHighDateTime=0x1cac9d7, ftLastWriteTime.dwLowDateTime=0xe8691090, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1a588, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwintl20.dll", cAlternateFileName="")) returned 1 [0060.857] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", len=0x50 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 1 [0060.857] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll", cchLength=0x50 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll") returned 0x50 [0060.857] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0060.857] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.857] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.857] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.858] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0060.858] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 1 [0060.858] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml") returned 0x4b [0060.858] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.858] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0060.858] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0060.858] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0060.860] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa26c9d00, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xa26c9d00, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85142d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xccb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0060.860] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", len=0x47 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 1 [0060.860] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE", cchLength=0x47 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe") returned 0x47 [0060.860] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.860] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.860] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85ab8b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x80760, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwdcw20.dll", cAlternateFileName="")) returned 1 [0060.860] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 1 [0060.860] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll") returned 0x4a [0060.860] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.860] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.860] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabf60500, ftCreationTime.dwHighDateTime=0x1cac9ae, ftLastAccessTime.dwLowDateTime=0xabf60500, ftLastAccessTime.dwHighDateTime=0x1cac9ae, ftLastWriteTime.dwLowDateTime=0xe85f73a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7eda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dwtrig20.exe", cAlternateFileName="")) returned 1 [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 1 [0060.861] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe") returned 0x4b [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.861] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8d646800, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8d646800, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x741, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VC90.CRT.manifest", cAlternateFileName="MICROS~1.MAN")) returned 1 [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", len=0x5a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 1 [0060.861] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest", cchLength=0x5a | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest") returned 0x5a [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.861] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c333b00, ftCreationTime.dwHighDateTime=0x1cacc53, ftLastAccessTime.dwLowDateTime=0x8c333b00, ftLastAccessTime.dwHighDateTime=0x1cacc53, ftLastWriteTime.dwLowDateTime=0xe86b5a80, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr90.dll", cAlternateFileName="")) returned 1 [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 1 [0060.861] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll") returned 0x4a [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.861] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3ba05100, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3ba05100, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7e3b3f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd79282, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeLR.cab", cAlternateFileName="")) returned 1 [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 1 [0060.861] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab") returned 0x4b [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.861] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3cd17e00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3cd17e00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c4ba40, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x387e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.msi", cAlternateFileName="OFFICE~2.MSI")) returned 1 [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 1 [0060.861] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi") returned 0x4c [0060.861] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.861] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.861] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 1 [0060.862] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml") returned 0x4c [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 1 [0060.862] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi") returned 0x4f [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 1 [0060.862] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml") returned 0x4f [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8b16200, ftCreationTime.dwHighDateTime=0x1cac190, ftLastAccessTime.dwLowDateTime=0xc8b16200, ftLastAccessTime.dwHighDateTime=0x1cac190, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetupui.dll", cAlternateFileName="")) returned 1 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 1 [0060.862] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll") returned 0x4b [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77cbb000, ftCreationTime.dwHighDateTime=0x1cac57a, ftLastAccessTime.dwLowDateTime=0x77cbb000, ftLastAccessTime.dwHighDateTime=0x1cac57a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="pss10r.chm", cAlternateFileName="")) returned 1 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 1 [0060.862] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm") returned 0x49 [0060.862] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.862] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cab9f00, ftCreationTime.dwHighDateTime=0x1cac8ad, ftLastAccessTime.dwLowDateTime=0x7cab9f00, ftLastAccessTime.dwHighDateTime=0x1cac8ad, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.chm", cAlternateFileName="")) returned 1 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 1 [0060.863] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm") returned 0x48 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.863] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x42c75f00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x42c75f00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0060.863] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.863] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x131a1c00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x131a1c00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xe84c60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShellUI.MST", cAlternateFileName="")) returned 1 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml", psz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 1 [0060.863] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst") returned 0x4a [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0060.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0060.863] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0060.863] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0060.863] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0117-0409-1000-0000000FF1CE}-C", cAlternateFileName="{9AFC7~1")) returned 1 [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\") returned 1 [0060.863] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\") returned 0x3f [0060.863] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0060.863] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0060.863] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0061.215] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc112b50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc112b50, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.215] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0061.215] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", len=0x4c | out: pbstr=0x6a0ee18*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\") returned 1 [0061.215] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\") returned 0x4c [0061.215] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0061.215] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0061.215] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0061.251] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfa2b92d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfc0c6890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfc0c6890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.251] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3e02ab00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3e02ab00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa623330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x266a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0061.251] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", len=0x59 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 1 [0061.251] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi", cchLength=0x59 | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi") returned 0x59 [0061.251] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0061.251] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa2b92d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0061.251] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.251] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0061.253] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0061.253] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi", psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", len=0x59 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 1 [0061.253] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", cchLength=0x59 | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml") returned 0x59 [0061.253] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0061.253] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.253] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3216e900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3216e900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa64a430, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccLR.cab", cAlternateFileName="")) returned 1 [0061.253] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml", psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", len=0x55 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 1 [0061.254] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab", cchLength=0x55 | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab") returned 0x55 [0061.254] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0061.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.254] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x11e8ef00, ftCreationTime.dwHighDateTime=0x1cacdea, ftLastAccessTime.dwLowDateTime=0x11e8ef00, ftLastAccessTime.dwHighDateTime=0x1cacdea, ftLastWriteTime.dwLowDateTime=0xfc0c60c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="branding.xml", cAlternateFileName="")) returned 1 [0061.254] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab", psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", len=0x58 | out: pbstr=0x6a0ee10*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 1 [0061.254] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", cchLength=0x58 | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml") returned 0x58 [0061.254] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0061.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.254] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.254] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.254] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3f33d800, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x3f33d800, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa160f00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xd4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.msi", cAlternateFileName="ACCESS~1.MSI")) returned 1 [0061.254] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 1 [0061.254] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi") returned 0x4f [0061.254] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0061.254] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0061.254] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0061.256] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4529b900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x4529b900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.xml", cAlternateFileName="ACCESS~1.XML")) returned 1 [0061.256] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi", psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", len=0x4f | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 1 [0061.256] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", cchLength=0x4f | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml") returned 0x4f [0061.256] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.257] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x43f88c00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x43f88c00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.257] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml", psz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.257] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0061.257] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.257] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.257] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.257] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0011-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~1")) returned 1 [0061.257] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\") returned 1 [0061.257] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\") returned 0x3f [0061.257] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0061.257] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0061.257] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0061.259] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfe09ced0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x18179b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18179b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.259] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ae1a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x34ae1a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe0c2860, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0061.259] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0061.259] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi") returned 0x4d [0061.259] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.259] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfe09ced0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0061.260] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.260] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0061.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x940c2a00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x940c2a00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0061.264] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml") returned 0x4d [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf885a000, ftCreationTime.dwHighDateTime=0x1cac4d7, ftLastAccessTime.dwLowDateTime=0xf885a000, ftLastAccessTime.dwHighDateTime=0x1cac4d7, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", len=0x46 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 1 [0061.264] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe", cchLength=0x46 | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe") returned 0x46 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd900f00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbd900f00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x16854390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 1 [0061.264] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll") returned 0x49 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x147e5b00, ftCreationTime.dwHighDateTime=0x1cad01b, ftLastAccessTime.dwLowDateTime=0x147e5b00, ftLastAccessTime.dwHighDateTime=0x1cad01b, ftLastWriteTime.dwLowDateTime=0xff654fc0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0061.264] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab") returned 0x4b [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe3a02e00, ftCreationTime.dwHighDateTime=0x1cac5f7, ftLastAccessTime.dwLowDateTime=0xe3a02e00, ftLastAccessTime.dwHighDateTime=0x1cac5f7, ftLastWriteTime.dwLowDateTime=0x17e0dbf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0061.264] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 1 [0061.264] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll") returned 0x4a [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe06a9500, ftCreationTime.dwHighDateTime=0x1cac7e5, ftLastAccessTime.dwLowDateTime=0xe06a9500, ftLastAccessTime.dwHighDateTime=0x1cac7e5, ftLastWriteTime.dwLowDateTime=0x17c42c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0061.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", cchLength=0x57 | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms") returned 0x57 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb2e2000, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbb2e2000, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x1a41c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.msi", cAlternateFileName="PROPLU~1.MSI")) returned 1 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 1 [0061.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi") returned 0x4d [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.xml", cAlternateFileName="PROPLU~1.XML")) returned 1 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 1 [0061.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml") returned 0x4d [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x262b2700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x262b2700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x1ffd0c0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xa97cbdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW.cab", cAlternateFileName="")) returned 1 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 1 [0061.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab") returned 0x4a [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf14900, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbf14900, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xc96ff40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xd49ee31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPrWW2.cab", cAlternateFileName="")) returned 1 [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 1 [0061.265] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab") returned 0x4b [0061.265] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbec13c00, ftCreationTime.dwHighDateTime=0x1cac15b, ftLastAccessTime.dwLowDateTime=0xbec13c00, ftLastAccessTime.dwHighDateTime=0x1cac15b, ftLastWriteTime.dwLowDateTime=0x1682d290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 1 [0061.266] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe") returned 0x48 [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.266] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd907a00, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0xbd907a00, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe", psz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.266] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.266] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.266] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.266] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-003B-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~3")) returned 1 [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\") returned 1 [0061.266] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\") returned 0x3f [0061.266] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0061.266] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0061.266] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0061.272] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xa5cd3a40, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xa8c22f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c22f80, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.272] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87078450, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87078450, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5d1e590, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0061.272] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0061.272] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi") returned 0x4d [0061.272] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.272] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa5cd3a40, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0061.273] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0061.273] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0061.275] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87abdaa0, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x87abdaa0, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5cd2aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0061.275] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml") returned 0x4d [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.275] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe57f8e0, ftCreationTime.dwHighDateTime=0x1cbe1cb, ftLastAccessTime.dwLowDateTime=0xfe57f8e0, ftLastAccessTime.dwHighDateTime=0x1cbe1cb, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", len=0x46 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 1 [0061.275] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe", cchLength=0x46 | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe") returned 0x46 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.275] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6644b620, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x6644b620, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa81b8770, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 1 [0061.275] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll") returned 0x49 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.275] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8238e540, ftCreationTime.dwHighDateTime=0x1cb147f, ftLastAccessTime.dwLowDateTime=0x8238e540, ftLastAccessTime.dwHighDateTime=0x1cb147f, ftLastWriteTime.dwLowDateTime=0xa5ddcc70, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0061.275] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab") returned 0x4b [0061.275] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7bd91af0, ftCreationTime.dwHighDateTime=0x1cb07b2, ftLastAccessTime.dwLowDateTime=0x7bd91af0, ftLastAccessTime.dwHighDateTime=0x1cb07b2, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 1 [0061.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll") returned 0x4a [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2a2397e0, ftCreationTime.dwHighDateTime=0x1cbe19a, ftLastAccessTime.dwLowDateTime=0x2a2397e0, ftLastAccessTime.dwHighDateTime=0x1cbe19a, ftLastWriteTime.dwLowDateTime=0xa8bafbc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0061.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", cchLength=0x57 | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms") returned 0x57 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c1614f0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7c1614f0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xa4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.msi", cAlternateFileName="PRJPRO~1.MSI")) returned 1 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 1 [0061.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi") returned 0x4c [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cabec50, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7cabec50, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.xml", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 1 [0061.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", cchLength=0x4c | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml") returned 0x4c [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c87b0c0, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x6c87b0c0, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa6b67930, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x9b6ba9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjPrrWW.cab", cAlternateFileName="")) returned 1 [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 1 [0061.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab") returned 0x4b [0061.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x69dde270, ftCreationTime.dwHighDateTime=0x1cb04b2, ftLastAccessTime.dwLowDateTime=0x69dde270, ftLastAccessTime.dwHighDateTime=0x1cb04b2, ftLastWriteTime.dwLowDateTime=0xa8191670, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 1 [0061.277] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe") returned 0x48 [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.277] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ca00570, ftCreationTime.dwHighDateTime=0x1cb148c, ftLastAccessTime.dwLowDateTime=0x7ca00570, ftLastAccessTime.dwHighDateTime=0x1cb148c, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe", psz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0061.277] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0061.277] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0061.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0061.277] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0061.277] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91140000-0057-0000-1000-0000000FF1CE}-C", cAlternateFileName="{91140~2")) returned 1 [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", len=0x3f | out: pbstr=0x6a0f0e0*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\") returned 1 [0061.277] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", cchLength=0x3f | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\") returned 0x3f [0061.277] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0061.277] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0062.416] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0063.276] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x46538340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x4a6d41a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d41a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.276] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe5ed9630, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xe5ed9630, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x4655d500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1e6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.msi", cAlternateFileName="OFFICE~1.MSI")) returned 1 [0063.276] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 1 [0063.276] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi") returned 0x4d [0063.276] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0063.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0063.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x46538340, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0063.276] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0063.276] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\_RESTORE FILES_.txt" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\_restore files_.txt"), bFailIfExists=0) returned 1 [0064.669] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x16771fb0, ftCreationTime.dwHighDateTime=0x1cb12b4, ftLastAccessTime.dwLowDateTime=0x16771fb0, ftLastAccessTime.dwHighDateTime=0x1cb12b4, ftLastWriteTime.dwLowDateTime=0x46536400, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0064.669] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", len=0x4d | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 1 [0064.669] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", cchLength=0x4d | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml") returned 0x4d [0064.669] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.669] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.669] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec54b6b0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xec54b6b0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x4a687710, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="ose.exe", cAlternateFileName="")) returned 1 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", len=0x46 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 1 [0064.670] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe", cchLength=0x46 | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe") returned 0x46 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.670] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xde72fbf0, ftCreationTime.dwHighDateTime=0x1cb0d0b, ftLastAccessTime.dwLowDateTime=0xde72fbf0, ftLastAccessTime.dwHighDateTime=0x1cb0d0b, ftLastWriteTime.dwLowDateTime=0x49c902c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x709768, dwReserved0=0x0, dwReserved1=0x0, cFileName="osetup.dll", cAlternateFileName="")) returned 1 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", len=0x49 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 1 [0064.670] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll", cchLength=0x49 | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll") returned 0x49 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.670] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc9c380f0, ftCreationTime.dwHighDateTime=0x1cb12b3, ftLastAccessTime.dwLowDateTime=0xc9c380f0, ftLastAccessTime.dwHighDateTime=0x1cb12b3, ftLastWriteTime.dwLowDateTime=0x465d00f0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x228df5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWOW32WW.cab", cAlternateFileName="")) returned 1 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 1 [0064.670] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab") returned 0x4b [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.670] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7c66670, ftCreationTime.dwHighDateTime=0x1cb0ee5, ftLastAccessTime.dwLowDateTime=0xe7c66670, ftLastAccessTime.dwHighDateTime=0x1cb0ee5, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="PidGenX.dll", cAlternateFileName="")) returned 1 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", len=0x4a | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 1 [0064.670] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll", cchLength=0x4a | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll") returned 0x4a [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.670] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95261510, ftCreationTime.dwHighDateTime=0x1cb048a, ftLastAccessTime.dwLowDateTime=0x95261510, ftLastAccessTime.dwHighDateTime=0x1cb048a, ftLastWriteTime.dwLowDateTime=0x4a6ac100, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", len=0x57 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 1 [0064.670] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms", cchLength=0x57 | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms") returned 0x57 [0064.670] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.670] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb7e7af0, ftCreationTime.dwHighDateTime=0x1cb04a9, ftLastAccessTime.dwLowDateTime=0xeb7e7af0, ftLastAccessTime.dwHighDateTime=0x1cb04a9, ftLastWriteTime.dwLowDateTime=0x49c691c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x150578, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 1 [0064.671] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe") returned 0x48 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.671] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80aa51d0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80aa51d0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.xml", cAlternateFileName="")) returned 1 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 1 [0064.671] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", cchLength=0x48 | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml") returned 0x48 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.671] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749b0240, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x749b0240, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x46a46a30, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb9fa2f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.cab", cAlternateFileName="")) returned 1 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 1 [0064.671] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab") returned 0x4b [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.671] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80711960, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80711960, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468ee660, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xb80800, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.msi", cAlternateFileName="")) returned 1 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 1 [0064.671] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi") returned 0x4b [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.671] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80b17dc0, ftCreationTime.dwHighDateTime=0x1cb1486, ftLastAccessTime.dwLowDateTime=0x80b17dc0, ftLastAccessTime.dwHighDateTime=0x1cb1486, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.xml", cAlternateFileName="")) returned 1 [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi", psz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", len=0x4b | out: pbstr=0x6a0f0d8*="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 1 [0064.671] CharLowerBuffW (in: lpsz="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", cchLength=0x4b | out: lpsz="c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml") returned 0x4b [0064.671] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.672] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.672] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0064.672] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.672] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0064.672] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.672] FindClose (in: hFindFile=0x5b95b0 | out: hFindFile=0x5b95b0) returned 1 [0064.672] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x56190540, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x883c9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0064.672] SysReAllocStringLen (in: pbstr=0x6a0f930*="c:\\hiberfil.sys", psz="C:\\pagefile.sys", len=0xf | out: pbstr=0x6a0f930*="C:\\pagefile.sys") returned 1 [0064.672] CharLowerBuffW (in: lpsz="C:\\pagefile.sys", cchLength=0xf | out: lpsz="c:\\pagefile.sys") returned 0xf [0064.672] SysReAllocStringLen (in: pbstr=0x6a0f8d0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f8d0*="_RESTORE FILES_.txt") returned 1 [0064.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.672] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0064.672] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\PerfLogs\\", len=0xc | out: pbstr=0x6a0f670*="C:\\PerfLogs\\") returned 1 [0064.672] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\", cchLength=0xc | out: lpsz="c:\\perflogs\\") returned 0xc [0064.672] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.672] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.672] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0064.673] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Admin", cAlternateFileName="")) returned 1 [0064.673] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\PerfLogs\\Admin\\", len=0x12 | out: pbstr=0x6a0f3a8*="C:\\PerfLogs\\Admin\\") returned 1 [0064.673] CharLowerBuffW (in: lpsz="C:\\PerfLogs\\Admin\\", cchLength=0x12 | out: lpsz="c:\\perflogs\\admin\\") returned 0x12 [0064.673] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.673] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.673] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0064.673] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xbbba4afc, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.673] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.673] FindClose (in: hFindFile=0x5b95b0 | out: hFindFile=0x5b95b0) returned 1 [0064.673] FindNextFileW (in: hFindFile=0x5b9470, lpFindFileData=0x6a0f93c | out: lpFindFileData=0x6a0f93c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x49e2fba0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x49e2fba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0064.673] SysReAllocStringLen (in: pbstr=0x6a0f670*=0x0, psz="C:\\Program Files\\", len=0x11 | out: pbstr=0x6a0f670*="C:\\Program Files\\") returned 1 [0064.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\", cchLength=0x11 | out: lpsz="c:\\program files\\") returned 0x11 [0064.674] SysReAllocStringLen (in: pbstr=0x6a0f618*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f618*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.674] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x49e2fba0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x49e2fba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95b0 [0064.674] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x49e2fba0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x49e2fba0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.674] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x43dc80a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x43dc80a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0064.674] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Program Files\\Common Files\\", len=0x1e | out: pbstr=0x6a0f3a8*="C:\\Program Files\\Common Files\\") returned 1 [0064.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\", cchLength=0x1e | out: lpsz="c:\\program files\\common files\\") returned 0x1e [0064.674] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.674] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x43dc80a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x43dc80a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0064.674] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x43dc80a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x43dc80a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.674] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0064.674] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER\\", len=0x27 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Common Files\\DESIGNER\\") returned 1 [0064.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\designer\\") returned 0x27 [0064.674] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.674] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0064.675] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.675] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0064.675] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 1 [0064.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\designer\\msaddndr.dll") returned 0x33 [0064.675] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0064.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0064.675] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0064.675] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0064.675] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0064.675] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\", len=0x2f | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Common Files\\Microsoft Shared\\") returned 1 [0064.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\microsoft shared\\") returned 0x2f [0064.675] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.675] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0064.675] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.676] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0064.676] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", len=0x32 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\") returned 1 [0064.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\") returned 0x32 [0064.676] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0064.676] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0064.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0066.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0066.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 1 [0066.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll") returned 0x3d [0066.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1 [0066.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 1 [0066.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe") returned 0x3a [0066.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1 [0066.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 1 [0066.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe") returned 0x3e [0066.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0066.350] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0066.352] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0066.352] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\") returned 1 [0066.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\") returned 0x38 [0066.352] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0066.352] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0066.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0066.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0066.353] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\") returned 1 [0066.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\") returned 0x3d [0066.354] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0066.354] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0066.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0066.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.862] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0066.862] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 1 [0066.862] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll") returned 0x47 [0066.863] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0066.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.863] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0066.863] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.863] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1 [0066.863] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 1 [0066.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt") returned 0x44 [0066.863] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0066.863] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0066.863] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\_restore files_.txt"), bFailIfExists=0) returned 1 [0066.866] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 1 [0066.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe") returned 0x44 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.866] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.866] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x0, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 1 [0066.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest") returned 0x4d [0066.866] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.866] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.866] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 1 [0066.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp") returned 0x44 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.866] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.866] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 1 [0066.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf") returned 0x43 [0066.866] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0066.866] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0066.866] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0066.866] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0066.867] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0066.867] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", len=0x34 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\") returned 1 [0066.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\") returned 0x34 [0066.867] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0066.867] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0066.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0067.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1 [0067.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 1 [0067.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll") returned 0x3f [0067.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0067.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0067.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.683] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.684] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0067.684] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", len=0x37 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\") returned 1 [0067.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\") returned 0x37 [0067.684] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0067.684] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0067.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0067.934] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.934] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1 [0067.934] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 1 [0067.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll") returned 0x42 [0067.934] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0067.934] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0067.934] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x0, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1 [0067.934] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 1 [0067.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll") returned 0x42 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0067.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0067.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 1 [0067.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll") returned 0x43 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0067.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0067.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 1 [0067.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll") returned 0x42 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0067.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0067.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0067.935] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0067.935] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", len=0x37 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\") returned 1 [0067.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\") returned 0x37 [0067.935] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0067.935] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0067.935] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0068.044] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.044] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1 [0068.044] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 1 [0068.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg") returned 0x43 [0068.044] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeec79e70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0068.044] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.044] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.840] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1 [0068.840] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 1 [0068.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt") returned 0x43 [0068.840] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.840] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.840] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1 [0068.840] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 1 [0068.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt") returned 0x43 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.841] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x0, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 1 [0068.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt") returned 0x43 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.841] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 1 [0068.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt") returned 0x43 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.841] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 1 [0068.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt") returned 0x43 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.841] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 1 [0068.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm") returned 0x3d [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.841] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1 [0068.841] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 1 [0068.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps") returned 0x3d [0068.841] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.842] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 1 [0068.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif") returned 0x3d [0068.842] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.842] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 1 [0068.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg") returned 0x3d [0068.842] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.842] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 1 [0068.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png") returned 0x3d [0068.842] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.842] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 1 [0068.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg") returned 0x3d [0068.842] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.842] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 1 [0068.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt") returned 0x43 [0068.842] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.843] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1 [0068.843] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 1 [0068.843] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt") returned 0x40 [0068.843] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.843] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.843] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1 [0068.843] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 1 [0068.843] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt") returned 0x43 [0068.843] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.843] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.843] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.843] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.844] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0068.844] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", len=0x34 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\") returned 1 [0068.844] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\") returned 0x34 [0068.844] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.844] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.844] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0068.844] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.844] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1 [0068.844] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 1 [0068.844] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\hxds.dll") returned 0x3c [0068.844] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.844] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.844] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1 [0068.844] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\help\\hxds.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 1 [0068.844] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll") returned 0x40 [0068.844] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.844] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.845] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1 [0068.845] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 1 [0068.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll") returned 0x40 [0068.845] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.845] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.845] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0068.845] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1 [0068.845] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\") returned 1 [0068.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\") returned 0x33 [0068.845] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.845] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.845] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0068.845] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.845] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0068.845] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 1 [0068.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml") returned 0x3f [0068.845] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7545b2, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0068.846] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.846] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.853] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0068.853] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\") returned 1 [0068.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\") returned 0x39 [0068.853] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.853] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.853] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.895] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.895] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.895] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 1 [0068.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui") returned 0x48 [0068.895] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.895] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.895] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.895] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.895] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0068.895] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\") returned 1 [0068.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\") returned 0x39 [0068.895] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.895] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.896] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.896] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 1 [0068.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui") returned 0x48 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.896] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.896] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 1 [0068.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\content.xml") returned 0x3e [0068.896] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\content.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 1 [0068.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe") returned 0x46 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\") returned 1 [0068.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\") returned 0x39 [0068.896] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.897] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 1 [0068.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui") returned 0x48 [0068.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.897] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0068.897] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\") returned 1 [0068.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\") returned 0x39 [0068.897] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.897] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.897] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.898] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.898] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.898] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 1 [0068.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui") returned 0x48 [0068.898] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.898] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.898] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0068.898] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\") returned 1 [0068.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\") returned 0x39 [0068.898] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.898] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.938] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.938] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.938] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 1 [0068.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui") returned 0x48 [0068.938] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.938] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.938] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.938] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0068.938] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\") returned 1 [0068.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\") returned 0x39 [0068.938] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.938] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.938] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.939] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.939] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.939] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 1 [0068.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui") returned 0x48 [0068.939] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.939] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.939] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.939] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.939] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0068.939] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\") returned 1 [0068.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\") returned 0x39 [0068.940] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.940] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.940] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.941] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.942] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0068.942] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 1 [0068.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi") returned 0x4a [0068.942] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.942] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd77a70c, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0068.942] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.942] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.944] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0068.944] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 1 [0068.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi") returned 0x49 [0068.944] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.944] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.944] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0068.944] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 1 [0068.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi") returned 0x47 [0068.944] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.944] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.944] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 1 [0068.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi") returned 0x48 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 1 [0068.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi") returned 0x44 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 1 [0068.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi") returned 0x43 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 1 [0068.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui") returned 0x54 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 1 [0068.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui") returned 0x47 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0068.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui") returned 0x4a [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui") returned 0x55 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui") returned 0x4f [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui") returned 0x53 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi") returned 0x41 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0068.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 1 [0068.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui") returned 0x47 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 1 [0068.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui") returned 0x44 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui") returned 1 [0068.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mshwLatin.dll.mui", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui") returned 0x4a [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 1 [0068.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui") returned 0x47 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 1 [0068.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui") returned 0x4f [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1 [0068.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 1 [0068.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi") returned 0x42 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.948] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 1 [0068.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui") returned 0x47 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.948] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 1 [0068.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui") returned 0x48 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.948] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 1 [0068.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui") returned 0x47 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.948] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 1 [0068.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui") returned 0x48 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.948] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 1 [0068.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui") returned 0x47 [0068.948] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.949] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.949] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.949] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0068.949] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\") returned 1 [0068.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\") returned 0x39 [0068.949] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.949] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.949] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.949] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.949] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.949] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 1 [0068.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui") returned 0x48 [0068.949] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.949] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.949] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.949] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.950] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0068.950] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\") returned 1 [0068.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\") returned 0x39 [0068.950] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.950] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.950] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.951] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.951] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.951] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui") returned 1 [0068.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui") returned 0x48 [0068.951] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.951] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.951] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.951] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.951] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0068.951] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\") returned 1 [0068.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\") returned 0x39 [0068.951] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.952] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.952] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.952] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.952] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.952] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui") returned 1 [0068.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui") returned 0x48 [0068.952] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.952] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.952] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0068.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 1 [0068.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi") returned 0x45 [0068.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0068.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe") returned 1 [0068.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickLearningWizard.exe", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe") returned 0x4a [0068.953] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0068.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0068.953] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\") returned 1 [0068.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\") returned 0x39 [0068.953] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.953] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.953] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.953] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0068.953] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui") returned 1 [0068.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui") returned 0x48 [0068.953] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.953] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.953] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0068.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0068.954] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\") returned 1 [0068.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\") returned 0x41 [0068.954] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.954] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.954] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0068.956] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.956] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1 [0068.956] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", len=0x48 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\") returned 1 [0068.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\") returned 0x48 [0068.956] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.956] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0068.957] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.957] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0068.957] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 1 [0068.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 0x53 [0068.957] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0068.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0068.958] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0068.958] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.960] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.960] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.960] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0068.960] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 1 [0068.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 0x4b [0068.960] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.960] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.960] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0068.960] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.960] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.962] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1 [0068.962] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", len=0x48 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\") returned 1 [0068.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\") returned 0x48 [0068.962] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.962] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.962] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0068.963] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.963] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0068.963] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", len=0x4e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 1 [0068.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 0x4e [0068.963] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0068.963] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0068.963] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0068.963] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\_restore files_.txt"), bFailIfExists=0) returned 1 [0068.965] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0068.965] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 1 [0068.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 0x56 [0068.965] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0068.965] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.965] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0068.965] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 1 [0068.965] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 0x53 [0068.965] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0068.965] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.966] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0068.966] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0068.966] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0068.966] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml") returned 1 [0068.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml") returned 0x4b [0068.966] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0068.966] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0068.966] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1 [0068.966] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", len=0x46 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\") returned 1 [0068.966] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\") returned 0x46 [0068.966] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0068.966] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0068.966] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0070.032] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.032] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0070.032] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", len=0x4e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 1 [0070.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 0x4e [0070.032] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0070.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0070.032] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0070.032] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0070.032] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\_restore files_.txt"), bFailIfExists=0) returned 1 [0072.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x48) returned 0x5f7468 [0072.135] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0072.135] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", len=0x57 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 1 [0072.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml") returned 0x57 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x4c) returned 0x5f7468 [0072.136] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", len=0x54 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 1 [0072.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 0x54 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x50) returned 0x5f7468 [0072.136] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 1 [0072.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 0x51 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x54) returned 0x5f7468 [0072.136] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 1 [0072.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 0x52 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x58) returned 0x5f7468 [0072.136] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 1 [0072.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 0x52 [0072.136] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x5c) returned 0x5f7468 [0072.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 1 [0072.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 0x52 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x60) returned 0x5f7468 [0072.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 1 [0072.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 0x52 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x64) returned 0x5f7468 [0072.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", len=0x4f | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 1 [0072.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 0x4f [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x68) returned 0x5f7468 [0072.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", len=0x4f | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 1 [0072.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", cchLength=0x4f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 0x4f [0072.137] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x6c) returned 0x5f7468 [0072.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 1 [0072.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 0x55 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x70) returned 0x5f7468 [0072.138] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 1 [0072.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 0x51 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x74) returned 0x5b5d08 [0072.138] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 1 [0072.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 0x55 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x78) returned 0x5b5d08 [0072.138] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0072.138] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0072.138] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml") returned 1 [0072.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 0x49 [0072.138] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0072.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x7c) returned 0x5b5d08 [0072.139] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1 [0072.139] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", len=0x49 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\") returned 1 [0072.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\") returned 0x49 [0072.139] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0072.139] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0072.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0072.139] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.139] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1 [0072.139] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", len=0x54 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 1 [0072.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml") returned 0x54 [0072.139] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0072.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0072.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0072.140] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0072.140] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\_restore files_.txt"), bFailIfExists=0) returned 1 [0073.914] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x14) returned 0x5b5d08 [0073.914] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0073.914] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1 [0073.914] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml") returned 1 [0073.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml") returned 0x4c [0073.914] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0073.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0073.915] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x18) returned 0x5b5d08 [0073.915] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0073.915] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", len=0x49 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\") returned 1 [0073.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\") returned 0x49 [0073.915] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0073.915] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0073.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0074.358] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.358] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0074.358] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", len=0x58 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 1 [0074.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 0x58 [0074.358] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.358] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0074.359] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.359] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\_restore files_.txt"), bFailIfExists=0) returned 1 [0074.925] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x1c) returned 0x5b5d08 [0074.925] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.925] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.926] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0074.926] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 1 [0074.926] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml") returned 0x4c [0074.926] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.926] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.926] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x20) returned 0x5b5d08 [0074.926] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0074.926] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", len=0x4b | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\") returned 1 [0074.926] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\") returned 0x4b [0074.926] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.926] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.926] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0074.926] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.926] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0074.926] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", len=0x5c | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 1 [0074.927] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 0x5c [0074.927] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.927] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.927] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7a0866, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0074.927] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.927] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\_restore files_.txt"), bFailIfExists=0) returned 1 [0074.929] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x24) returned 0x5b5d08 [0074.929] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.929] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.929] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0074.929] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 1 [0074.929] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml") returned 0x4e [0074.930] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.930] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x28) returned 0x5b5d08 [0074.930] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1 [0074.930] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", len=0x49 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\") returned 1 [0074.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\") returned 0x49 [0074.930] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.930] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0074.930] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.930] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0074.930] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", len=0x58 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 1 [0074.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml") returned 0x58 [0074.930] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.930] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.930] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x800002, dwReserved1=0x8, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0074.930] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.931] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\_restore files_.txt"), bFailIfExists=0) returned 1 [0074.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x2c) returned 0x5b5d08 [0074.933] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.933] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.933] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0074.933] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 1 [0074.933] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml") returned 0x4c [0074.933] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.933] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.933] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x30) returned 0x5b5d08 [0074.933] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1 [0074.933] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", len=0x49 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\") returned 1 [0074.933] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\") returned 0x49 [0074.933] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.933] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0074.934] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.934] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0074.934] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 1 [0074.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", cchLength=0x53 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 0x53 [0074.934] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.934] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7c69c0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0074.934] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.934] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\_restore files_.txt"), bFailIfExists=0) returned 1 [0074.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x34) returned 0x5b5d08 [0074.936] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0074.936] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 1 [0074.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 0x56 [0074.936] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0074.936] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0074.936] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", len=0x54 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 1 [0074.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", cchLength=0x54 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 0x54 [0074.937] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0074.937] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.937] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.937] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0074.937] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 1 [0074.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml") returned 0x4c [0074.937] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x40) returned 0x5b5d08 [0074.937] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1 [0074.937] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", len=0x45 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\") returned 1 [0074.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\") returned 0x45 [0074.937] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.937] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.937] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0074.940] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.940] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1 [0074.941] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", len=0x50 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 1 [0074.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 0x50 [0074.941] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0074.941] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd7c69c0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0074.941] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0074.941] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\_restore files_.txt"), bFailIfExists=0) returned 1 [0074.943] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0074.943] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.943] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0074.943] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1 [0074.943] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml") returned 1 [0074.944] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml") returned 0x48 [0074.944] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.944] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.944] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0074.944] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.944] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.945] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0074.945] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\") returned 1 [0074.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\") returned 0x39 [0074.945] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.945] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.945] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui") returned 1 [0074.945] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui") returned 0x48 [0074.945] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.945] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.945] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.945] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.945] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\") returned 1 [0074.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\") returned 0x39 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.946] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.946] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui") returned 1 [0074.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui") returned 0x48 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.946] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.946] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.946] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.946] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\") returned 1 [0074.946] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\") returned 0x39 [0074.946] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.947] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.947] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.947] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui") returned 1 [0074.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui") returned 0x48 [0074.947] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.947] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.947] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.947] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0074.947] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat") returned 1 [0074.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat") returned 0x42 [0074.947] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.947] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.948] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x40) returned 0x5b5d08 [0074.948] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0074.948] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", len=0x44 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\") returned 1 [0074.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\") returned 0x44 [0074.948] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.948] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.951] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.951] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.951] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.951] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1 [0074.951] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat") returned 1 [0074.951] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat") returned 0x3f [0074.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x30) returned 0x5b5d08 [0074.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0074.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 1 [0074.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat") returned 0x3f [0074.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x34) returned 0x5b5d08 [0074.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0074.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat") returned 1 [0074.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat") returned 0x41 [0074.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x38) returned 0x5b5d08 [0074.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1 [0074.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat") returned 1 [0074.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat") returned 0x3e [0074.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x3c) returned 0x5b5d08 [0074.952] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1 [0074.952] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 1 [0074.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat") returned 0x3e [0074.952] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x40) returned 0x5b5d08 [0074.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0074.953] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 1 [0074.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat") returned 0x3f [0074.953] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x44) returned 0x5b5d08 [0074.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0074.953] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 1 [0074.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat") returned 0x3f [0074.953] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x48) returned 0x5b5d08 [0074.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0074.953] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll") returned 1 [0074.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkDiv.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll") returned 0x3d [0074.953] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0074.953] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 1 [0074.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll") returned 0x3d [0074.953] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.953] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1 [0074.953] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 1 [0074.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe") returned 0x40 [0074.954] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.954] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.954] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0074.954] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 1 [0074.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe") returned 0x4b [0074.954] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.954] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.954] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0074.954] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 1 [0074.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml") returned 0x3d [0074.954] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.954] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x4c) returned 0x5b5d08 [0074.954] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0074.954] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml") returned 1 [0074.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml") returned 0x3d [0074.954] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.954] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.954] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x50) returned 0x5b5d08 [0074.954] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0074.954] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml") returned 1 [0074.954] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml") returned 0x3d [0074.955] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.955] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x54) returned 0x5b5d08 [0074.955] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0074.955] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 1 [0074.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml") returned 0x3d [0074.955] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.955] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x58) returned 0x5b5d08 [0074.955] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0074.955] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 1 [0074.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml") returned 0x3d [0074.955] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.955] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x5c) returned 0x5b5d08 [0074.955] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0074.955] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 1 [0074.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml") returned 0x3d [0074.955] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.955] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.955] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x60) returned 0x5b5d08 [0074.955] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0074.955] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 1 [0074.955] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml") returned 0x3c [0074.955] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.956] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x64) returned 0x5b5d08 [0074.956] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 1 [0074.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml") returned 0x3d [0074.956] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.956] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x68) returned 0x5b5d08 [0074.956] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 1 [0074.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll") returned 0x45 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.956] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.956] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 1 [0074.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml") returned 0x3d [0074.956] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.956] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x6c) returned 0x5b5d08 [0074.956] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 1 [0074.956] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml") returned 0x3d [0074.956] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.956] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.956] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x70) returned 0x5b5d08 [0074.956] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0074.956] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 1 [0074.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml") returned 0x3d [0074.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x74) returned 0x5b5d08 [0074.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0074.957] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 1 [0074.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml") returned 0x3d [0074.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x78) returned 0x5b5d08 [0074.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0074.957] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 1 [0074.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml") returned 0x3d [0074.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x7c) returned 0x5b5d08 [0074.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0074.957] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 1 [0074.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml") returned 0x3d [0074.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.957] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x80) returned 0x5b5d08 [0074.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0074.957] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 1 [0074.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll") returned 0x49 [0074.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.958] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.958] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0074.958] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 1 [0074.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml") returned 0x3d [0074.958] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.958] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x84) returned 0x5b5d08 [0074.958] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0074.958] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 1 [0074.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml") returned 0x3d [0074.958] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.958] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x88) returned 0x5b5d08 [0074.958] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0074.958] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 1 [0074.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml") returned 0x3d [0074.958] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.958] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.958] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x8c) returned 0x5b5d08 [0074.958] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0074.958] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 1 [0074.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll") returned 0x40 [0074.959] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.959] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0074.959] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 1 [0074.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml") returned 0x3d [0074.959] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x90) returned 0x5b5d08 [0074.959] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0074.959] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 1 [0074.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml") returned 0x3d [0074.959] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x94) returned 0x5b5d08 [0074.959] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0074.959] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 1 [0074.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml") returned 0x3d [0074.959] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.959] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x98) returned 0x5b5d08 [0074.959] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0074.959] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 1 [0074.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml") returned 0x3d [0074.959] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x9c) returned 0x5f76f0 [0074.960] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0074.960] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 1 [0074.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml") returned 0x3d [0074.960] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.960] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xa0) returned 0x5f76f0 [0074.960] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0074.960] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 1 [0074.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml") returned 0x3d [0074.960] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.960] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xa4) returned 0x5f76f0 [0074.960] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0074.960] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 1 [0074.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml") returned 0x3d [0074.960] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.960] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.960] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xa8) returned 0x5f76f0 [0074.960] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0074.960] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\") returned 1 [0074.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\") returned 0x39 [0074.960] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.960] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5b5d08, dwReserved1=0x5ba6a0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.961] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.961] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.961] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 1 [0074.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui") returned 0x48 [0074.961] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.961] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.961] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.961] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.961] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0074.961] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\") returned 1 [0074.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\") returned 0x39 [0074.961] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.961] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.962] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.962] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.962] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 1 [0074.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui") returned 0x48 [0074.962] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.962] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.962] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.962] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.962] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1 [0074.962] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 1 [0074.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\journal.dll") returned 0x3e [0074.962] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0074.962] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.962] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0074.962] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\") returned 1 [0074.962] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\") returned 0x39 [0074.962] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.962] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0074.963] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.963] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0074.963] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui") returned 1 [0074.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui") returned 0x48 [0074.963] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0074.963] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0074.963] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0074.963] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0074.963] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0074.963] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\") returned 1 [0074.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\") returned 0x39 [0074.963] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0074.963] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0074.963] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0075.647] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.647] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0075.647] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui") returned 1 [0075.647] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui") returned 0x48 [0075.648] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0075.648] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.648] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.648] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.648] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0075.648] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\") returned 1 [0075.648] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\") returned 0x39 [0075.648] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0075.648] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0075.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0075.648] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.648] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0075.648] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 1 [0075.648] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui") returned 0x48 [0075.648] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0075.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.649] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.649] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.649] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0075.649] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\journal.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll") returned 1 [0075.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll") returned 0x3d [0075.649] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.649] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0075.649] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 1 [0075.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll") returned 0x44 [0075.649] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.649] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0075.649] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 1 [0075.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mip.exe") returned 0x3a [0075.649] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.649] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0075.649] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\mip.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 1 [0075.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll") returned 0x3c [0075.649] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.650] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0075.650] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 1 [0075.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll") returned 0x3e [0075.650] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.650] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.650] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0075.650] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 1 [0075.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll") returned 0x40 [0075.650] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0075.650] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.650] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0075.650] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\") returned 1 [0075.650] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\") returned 0x39 [0075.650] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0075.650] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0075.650] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0075.650] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.650] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 1 [0075.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui") returned 0x48 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0075.651] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.651] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.651] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.651] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\") returned 1 [0075.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\") returned 0x39 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0075.651] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0075.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0075.651] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.651] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 1 [0075.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui") returned 0x48 [0075.651] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0075.652] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0075.652] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0075.652] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0075.652] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0075.652] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\") returned 1 [0075.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\") returned 0x39 [0075.652] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0075.652] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0075.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.245] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.245] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.245] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui") returned 1 [0076.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui") returned 0x48 [0076.245] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.246] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.246] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.246] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0076.246] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\") returned 1 [0076.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\") returned 0x39 [0076.246] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.246] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.246] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.246] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.246] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 1 [0076.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui") returned 0x48 [0076.247] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.247] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.247] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.247] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0076.247] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\") returned 1 [0076.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\") returned 0x39 [0076.247] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.247] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.247] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.247] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.247] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.247] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui") returned 1 [0076.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui") returned 0x48 [0076.248] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.248] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.248] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.248] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0076.248] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\") returned 1 [0076.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\") returned 0x39 [0076.248] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.248] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.248] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.248] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.248] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui") returned 1 [0076.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui") returned 0x48 [0076.248] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.249] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.249] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0076.249] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll") returned 1 [0076.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\rtscom.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll") returned 0x3d [0076.249] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0076.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0076.249] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\") returned 1 [0076.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\") returned 0x39 [0076.249] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.249] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.957] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.957] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.957] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui") returned 1 [0076.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui") returned 0x48 [0076.957] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.957] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.957] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0076.957] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 1 [0076.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe") returned 0x45 [0076.957] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0076.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.957] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0076.957] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\") returned 1 [0076.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\") returned 0x39 [0076.958] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.958] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.958] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.958] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.958] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui") returned 1 [0076.958] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui") returned 0x48 [0076.958] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.958] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.958] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.958] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.958] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0076.959] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\") returned 1 [0076.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\") returned 0x39 [0076.959] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.959] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.959] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.959] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.959] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.959] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui") returned 1 [0076.959] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui") returned 0x48 [0076.959] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.959] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.959] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.959] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.960] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0076.960] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\") returned 1 [0076.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\") returned 0x3e [0076.960] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.960] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.960] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0076.960] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0076.960] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0076.960] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui") returned 1 [0076.960] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\tipresx.dll.mui", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\tipresx.dll.mui") returned 0x4d [0076.960] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0076.960] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0076.960] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0076.960] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0076.961] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0076.961] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\") returned 1 [0076.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\") returned 0x39 [0076.961] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0076.961] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0076.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0077.674] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.674] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.674] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui") returned 1 [0077.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui") returned 0x48 [0077.674] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0077.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.674] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.674] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0077.674] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0077.674] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll") returned 1 [0077.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabIpsps.dll", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll") returned 0x3f [0077.674] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.674] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1 [0077.674] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll") returned 1 [0077.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tabskb.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll") returned 0x3d [0077.675] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1 [0077.675] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe") returned 1 [0077.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TabTip.exe", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe") returned 0x3d [0077.675] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0077.675] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\") returned 1 [0077.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\th-th\\") returned 0x39 [0077.675] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0077.675] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0077.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0077.675] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.675] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.675] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui") returned 1 [0077.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui") returned 0x48 [0077.676] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0077.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.676] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0077.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1 [0077.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll") returned 1 [0077.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipBand.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll") returned 0x3e [0077.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0077.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tipband.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll") returned 1 [0077.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\TipRes.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll") returned 0x3d [0077.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1 [0077.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll") returned 1 [0077.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipresx.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll") returned 0x3e [0077.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1 [0077.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll") returned 1 [0077.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tipskins.dll", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll") returned 0x3f [0077.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1 [0077.677] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll") returned 1 [0077.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tiptsf.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll") returned 0x3d [0077.677] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.677] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1 [0077.677] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll") returned 1 [0077.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tpcps.dll", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll") returned 0x3c [0077.677] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0077.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.677] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0077.677] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\") returned 1 [0077.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\") returned 0x39 [0077.677] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0077.677] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0077.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0077.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.678] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui") returned 1 [0077.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui") returned 0x48 [0077.678] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0077.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.678] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.678] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0077.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0077.678] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\") returned 1 [0077.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\") returned 0x39 [0077.678] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0077.678] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0077.678] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0077.678] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0077.678] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0077.679] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui") returned 1 [0077.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui") returned 0x48 [0077.679] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0077.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0077.679] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0077.679] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0077.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0077.679] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\") returned 1 [0077.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\") returned 0x39 [0077.679] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0077.679] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0077.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0078.309] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.309] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.309] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui") returned 1 [0078.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui") returned 0x48 [0078.310] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.310] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.310] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0078.310] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0078.310] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\") returned 1 [0078.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\") returned 0x39 [0078.310] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.310] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0078.310] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.310] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0078.310] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui") returned 1 [0078.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\tipresx.dll.mui", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui") returned 0x48 [0078.311] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.311] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.311] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.311] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0078.311] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c81120, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x60c81120, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0078.311] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\_RESTORE FILES_.txt", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\_RESTORE FILES_.txt") returned 1 [0078.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\_RESTORE FILES_.txt", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\ink\\_restore files_.txt") returned 0x46 [0078.311] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0078.311] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.311] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.311] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0078.311] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0078.311] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", len=0x3f | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\") returned 1 [0078.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\") returned 0x3f [0078.311] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.311] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0078.741] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1 [0078.742] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 1 [0078.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll") returned 0x48 [0078.742] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0078.742] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.742] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0078.742] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", len=0x36 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\") returned 1 [0078.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\") returned 0x36 [0078.742] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.742] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0078.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0078.743] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\") returned 1 [0078.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\") returned 0x3c [0078.743] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.743] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.743] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0078.743] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1 [0078.743] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 1 [0078.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui") returned 0x4c [0078.743] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.743] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.743] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0078.743] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0078.743] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 1 [0078.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe") returned 0x42 [0078.743] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0078.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.743] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0078.744] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0078.744] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0078.744] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\") returned 1 [0078.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\") returned 0x38 [0078.744] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.744] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0078.744] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.744] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0078.744] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\") returned 1 [0078.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\") returned 0x3d [0078.744] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0078.744] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0078.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0078.745] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0078.745] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1 [0078.745] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 1 [0078.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll") returned 0x48 [0078.745] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.745] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.745] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1 [0078.745] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 1 [0078.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll") returned 0x49 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.746] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 1 [0078.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll") returned 0x48 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.746] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 1 [0078.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll") returned 0x48 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.746] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 1 [0078.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm") returned 0x47 [0078.746] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0078.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0078.746] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0xee282250, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0078.746] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0078.746] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.439] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 1 [0079.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll") returned 0x49 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.439] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 1 [0079.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll") returned 0x48 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.439] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 1 [0079.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll") returned 0x50 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.439] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 1 [0079.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll") returned 0x51 [0079.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a31e0, Size=0x10) returned 0x5e9528 [0079.440] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 1 [0079.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll") returned 0x49 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.440] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 1 [0079.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll") returned 0x49 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.440] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 1 [0079.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm") returned 0x47 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0079.440] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1 [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 1 [0079.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll") returned 0x4a [0079.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.440] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.440] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0079.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 1 [0079.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll") returned 0x43 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 1 [0079.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll") returned 0x42 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 1 [0079.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll") returned 0x42 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 1 [0079.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acees.dll") returned 0x41 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acees.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 1 [0079.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll") returned 0x43 [0079.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 1 [0079.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll") returned 0x43 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 1 [0079.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll") returned 0x43 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 1 [0079.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll") returned 0x44 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 1 [0079.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll") returned 0x44 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1 [0079.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 1 [0079.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll") returned 0x44 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 1 [0079.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll") returned 0x44 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 1 [0079.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll") returned 0x42 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 1 [0079.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll") returned 0x43 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 1 [0079.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll") returned 0x42 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 1 [0079.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll") returned 0x42 [0079.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 1 [0079.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll") returned 0x43 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 1 [0079.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll") returned 0x42 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 1 [0079.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll") returned 0x42 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 1 [0079.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll") returned 0x43 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1 [0079.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 1 [0079.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\csi.dll") returned 0x3f [0079.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x0, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1 [0079.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\csi.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 1 [0079.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll") returned 0x43 [0079.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1 [0079.445] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\") returned 1 [0079.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\") returned 0x41 [0079.445] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.445] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0079.445] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.445] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1 [0079.445] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 1 [0079.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf") returned 0x4b [0079.446] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0079.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xceefecc0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0079.446] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.446] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0079.448] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.448] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0079.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0079.448] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 1 [0079.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll") returned 0x42 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 1 [0079.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll") returned 0x43 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 1 [0079.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll") returned 0x43 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 1 [0079.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe") returned 0x42 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 1 [0079.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll") returned 0x42 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1 [0079.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 1 [0079.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe") returned 0x42 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 1 [0079.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\mso.dll") returned 0x3f [0079.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\mso.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 1 [0079.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe") returned 0x44 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 1 [0079.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msores.dll") returned 0x42 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msores.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 1 [0079.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll") returned 0x44 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1 [0079.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 1 [0079.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll") returned 0x42 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 1 [0079.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe") returned 0x44 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 1 [0079.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll") returned 0x44 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1 [0079.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 1 [0079.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll") returned 0x42 [0079.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.452] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1 [0079.452] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 1 [0079.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll") returned 0x44 [0079.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.452] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1 [0079.452] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 1 [0079.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab") returned 0x42 [0079.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0079.452] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0079.453] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.458] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1 [0079.458] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 1 [0079.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll") returned 0x43 [0079.458] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.458] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1 [0079.458] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 1 [0079.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe") returned 0x44 [0079.458] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.458] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1 [0079.459] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 1 [0079.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll") returned 0x43 [0079.459] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0079.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.459] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1 [0079.459] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", len=0x50 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\") returned 1 [0079.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\") returned 0x50 [0079.459] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.459] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.459] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0079.461] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.476] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1 [0079.476] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", len=0x5d | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\") returned 1 [0079.476] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\") returned 0x5d [0079.476] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.476] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0079.480] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.480] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1 [0079.480] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 1 [0079.480] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml") returned 0x6a [0079.480] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.480] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.480] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x15419830, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0079.480] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.480] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1 [0079.483] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", len=0x6d | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 1 [0079.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", cchLength=0x6d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml") returned 0x6d [0079.483] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.483] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.483] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0079.483] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0079.483] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 1 [0079.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", cchLength=0x66 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml") returned 0x66 [0079.483] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.483] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.483] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0079.483] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.483] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.483] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1 [0079.483] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", len=0x5c | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\") returned 1 [0079.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\") returned 0x5c [0079.484] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.484] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.484] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0079.484] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.484] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1 [0079.484] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", len=0x68 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 1 [0079.484] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml") returned 0x68 [0079.484] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.484] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa64b3d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0079.484] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.484] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.486] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0079.486] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0079.486] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", len=0x65 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 1 [0079.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", cchLength=0x65 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml") returned 0x65 [0079.486] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.486] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.486] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x5a6478 [0079.486] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.487] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.487] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1 [0079.487] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", len=0x5d | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\") returned 1 [0079.487] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\") returned 0x5d [0079.487] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.487] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0079.491] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.491] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0079.491] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 1 [0079.491] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml") returned 0x6a [0079.491] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.491] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd658ff0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0079.491] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.491] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0079.530] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0079.531] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 1 [0079.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", cchLength=0x66 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml") returned 0x66 [0079.531] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.531] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0079.531] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0079.531] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0079.531] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1 [0079.531] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", len=0x5f | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\") returned 1 [0079.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\") returned 0x5f [0079.531] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0079.531] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0079.531] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0079.924] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0079.924] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1 [0079.950] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", len=0x6e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 1 [0079.950] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", cchLength=0x6e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml") returned 0x6e [0079.950] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0079.950] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0079.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x112a3b30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0079.950] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0079.950] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0080.157] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.157] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 1 [0080.157] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml") returned 0x68 [0080.157] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.157] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0080.157] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.157] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.157] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1 [0080.157] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 1 [0080.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe") returned 0x5b [0080.158] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0080.158] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.158] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1 [0080.158] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", len=0x5d | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\") returned 1 [0080.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\") returned 0x5d [0080.158] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0080.158] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0080.158] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0080.435] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.435] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1 [0080.435] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", len=0x69 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 1 [0080.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL", cchLength=0x69 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll") returned 0x69 [0080.436] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.436] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.436] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1 [0080.436] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", len=0x69 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 1 [0080.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", cchLength=0x69 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml") returned 0x69 [0080.436] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.436] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e544, dwReserved1=0xee2ce510, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0080.436] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.436] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0080.671] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1 [0080.671] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", len=0x64 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 1 [0080.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", cchLength=0x64 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm") returned 0x64 [0080.671] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0080.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 1 [0080.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml") returned 0x6a [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0080.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", len=0x6d | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 1 [0080.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", cchLength=0x6d | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml") returned 0x6d [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0080.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", len=0x69 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 1 [0080.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL", cchLength=0x69 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll") returned 0x69 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 1 [0080.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll") returned 0x6a [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1 [0080.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", len=0x69 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 1 [0080.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", cchLength=0x69 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm") returned 0x69 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x5a6478 [0080.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 1 [0080.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm") returned 0x67 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a6478, Size=0x20) returned 0x615370 [0080.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 1 [0080.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm") returned 0x67 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x24) returned 0x5dc550 [0080.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", len=0x66 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 1 [0080.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", cchLength=0x66 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm") returned 0x66 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x28) returned 0x5dc340 [0080.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", len=0x66 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 1 [0080.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", cchLength=0x66 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml") returned 0x66 [0080.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x2c) returned 0x61f458 [0080.674] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0080.674] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0080.674] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1 [0080.674] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", len=0x5f | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\") returned 1 [0080.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\") returned 0x5f [0080.674] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0080.674] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0080.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0080.998] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0080.998] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0080.998] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", len=0x6e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 1 [0080.998] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", cchLength=0x6e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml") returned 0x6e [0080.998] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0080.998] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0080.998] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x19b82c30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0080.998] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0080.998] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.586] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.586] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 1 [0081.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml") returned 0x68 [0081.587] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.587] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.587] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.587] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.587] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.587] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1 [0081.587] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", len=0x5c | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\") returned 1 [0081.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\") returned 0x5c [0081.587] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.587] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.588] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.588] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1 [0081.588] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 1 [0081.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml") returned 0x6a [0081.588] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x22200730, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.588] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.589] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.594] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.594] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.594] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1 [0081.594] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", len=0x5e | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\") returned 1 [0081.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\") returned 0x5e [0081.594] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.594] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.610] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.610] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0081.610] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", len=0x6c | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 1 [0081.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", cchLength=0x6c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml") returned 0x6c [0081.610] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.610] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.610] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xc840bb0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.610] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.610] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.626] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.626] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 1 [0081.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml") returned 0x67 [0081.626] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.626] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.626] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.626] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.627] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1 [0081.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 1 [0081.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL", cchLength=0x5a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll") returned 0x5a [0081.627] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0081.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.627] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1 [0081.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 1 [0081.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll") returned 0x5c [0081.627] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0081.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.627] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1 [0081.627] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", len=0x5e | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\") returned 1 [0081.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\") returned 0x5e [0081.627] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.627] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.668] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.668] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0081.668] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", len=0x6c | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 1 [0081.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", cchLength=0x6c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml") returned 0x6c [0081.668] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x14af010, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.668] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.668] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.673] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 1 [0081.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml") returned 0x67 [0081.673] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.673] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.673] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.673] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x0, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1 [0081.673] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 1 [0081.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll") returned 0x5b [0081.673] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0081.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.673] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1 [0081.673] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", len=0x68 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 1 [0081.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms") returned 0x68 [0081.673] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0081.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0081.673] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.674] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0081.676] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1 [0081.676] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", len=0x68 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 1 [0081.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll") returned 0x68 [0081.676] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0081.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.676] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1 [0081.676] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", len=0x61 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\") returned 1 [0081.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\") returned 0x61 [0081.676] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.676] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.676] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1 [0081.677] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", len=0x72 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 1 [0081.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", cchLength=0x72 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml") returned 0x72 [0081.677] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xf5db14d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.677] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.677] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0081.681] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.681] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", len=0x6a | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 1 [0081.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", cchLength=0x6a | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml") returned 0x6a [0081.681] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615398 [0081.682] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.682] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.682] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1 [0081.682] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", len=0x58 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\") returned 1 [0081.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\") returned 0x58 [0081.682] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.682] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.721] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.721] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1 [0081.721] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", len=0x65 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 1 [0081.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", cchLength=0x65 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml") returned 0x65 [0081.721] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xbe2e8f80, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.721] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.721] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.723] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.724] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", len=0x61 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 1 [0081.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", cchLength=0x61 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml") returned 0x61 [0081.724] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.724] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.724] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.724] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1 [0081.724] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", len=0x5e | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\") returned 1 [0081.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\", cchLength=0x5e | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\") returned 0x5e [0081.724] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.724] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.724] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.782] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.782] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1 [0081.782] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", len=0x6c | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 1 [0081.782] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", cchLength=0x6c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml") returned 0x6c [0081.782] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.782] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xaf551ba0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.782] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.782] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.824] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0081.824] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 1 [0081.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml") returned 0x67 [0081.824] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.824] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.824] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.824] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.824] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.824] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1 [0081.824] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", len=0x59 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\") returned 1 [0081.824] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\") returned 0x59 [0081.824] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.824] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.886] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.886] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0081.886] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", len=0x62 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 1 [0081.887] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", cchLength=0x62 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml") returned 0x62 [0081.887] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.887] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.887] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x99177d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.887] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.887] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.889] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.889] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.890] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1 [0081.890] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", len=0x59 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\") returned 1 [0081.890] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\") returned 0x59 [0081.890] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.891] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.891] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0081.891] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0081.891] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0081.891] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", len=0x62 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 1 [0081.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", cchLength=0x62 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml") returned 0x62 [0081.892] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0081.892] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0081.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5b7fe90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0081.892] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0081.892] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\_restore files_.txt"), bFailIfExists=0) returned 1 [0081.895] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0081.895] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0081.895] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0081.895] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1 [0081.895] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", len=0x59 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\") returned 1 [0081.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\") returned 0x59 [0081.895] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0081.895] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0081.895] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0082.134] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.134] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1 [0082.134] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", len=0x62 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 1 [0082.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", cchLength=0x62 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml") returned 0x62 [0082.134] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.134] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x7941190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0082.136] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.136] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0082.138] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.138] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.138] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1 [0082.138] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", len=0x5f | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\") returned 1 [0082.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\", cchLength=0x5f | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\") returned 0x5f [0082.138] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0082.138] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0082.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0082.138] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.138] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1 [0082.139] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", len=0x6b | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 1 [0082.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", cchLength=0x6b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml") returned 0x6b [0082.139] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xab640f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0082.139] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.139] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0082.342] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.343] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", len=0x68 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 1 [0082.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml") returned 0x68 [0082.343] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0082.343] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.343] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.343] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1 [0082.343] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", len=0x59 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\") returned 1 [0082.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\") returned 0x59 [0082.343] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0082.343] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0082.343] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0082.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1 [0082.655] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", len=0x67 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 1 [0082.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", cchLength=0x67 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml") returned 0x67 [0082.656] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a95a430, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0082.656] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.656] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0082.658] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0082.658] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", len=0x62 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 1 [0082.658] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", cchLength=0x62 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml") returned 0x62 [0082.658] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.658] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0082.658] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0082.659] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0082.659] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1 [0082.659] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", len=0x60 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\") returned 1 [0082.659] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\", cchLength=0x60 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\") returned 0x60 [0082.659] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0082.659] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0082.659] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0082.916] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0082.916] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1 [0082.916] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", len=0x70 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 1 [0082.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", cchLength=0x70 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml") returned 0x70 [0082.916] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0082.916] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0082.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1ba9ab90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0082.916] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0082.917] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0083.311] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0083.311] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", len=0x69 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 1 [0083.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", cchLength=0x69 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml") returned 0x69 [0083.311] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.311] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0083.311] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.311] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.311] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0083.311] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 1 [0083.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe") returned 0x59 [0083.311] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0083.311] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.311] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1 [0083.311] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", len=0x5c | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\") returned 1 [0083.312] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\") returned 0x5c [0083.312] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0083.312] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0083.312] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0083.496] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.496] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0083.496] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", len=0x65 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 1 [0083.496] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", cchLength=0x65 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml") returned 0x65 [0083.496] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.496] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.496] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x50b66320, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0083.496] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.496] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0083.498] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1 [0083.498] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", len=0x68 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 1 [0083.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", cchLength=0x68 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml") returned 0x68 [0083.498] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.498] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.498] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0083.499] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.499] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.499] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1 [0083.499] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", len=0x57 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\") returned 1 [0083.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\", cchLength=0x57 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\") returned 0x57 [0083.499] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0083.499] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0083.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0083.499] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.499] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0083.499] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", len=0x60 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 1 [0083.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", cchLength=0x60 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml") returned 0x60 [0083.499] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.499] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x83258520, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0083.499] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.500] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\_restore files_.txt"), bFailIfExists=0) returned 1 [0083.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1 [0083.672] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", len=0x63 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 1 [0083.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", cchLength=0x63 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml") returned 0x63 [0083.672] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0083.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.672] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.672] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1 [0083.672] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", len=0x5b | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\") returned 1 [0083.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\") returned 0x5b [0083.672] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0083.672] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0083.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0083.768] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.768] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1 [0083.768] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", len=0x64 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 1 [0083.768] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", cchLength=0x64 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml") returned 0x64 [0083.768] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.769] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1e501370, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0083.769] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0083.769] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0083.771] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1 [0083.771] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", len=0x66 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 1 [0083.771] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", cchLength=0x66 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml") returned 0x66 [0083.771] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0083.771] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.771] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0083.772] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.772] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0083.772] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.772] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.772] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0083.772] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 1 [0083.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll") returned 0x42 [0083.772] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.772] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.772] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1 [0083.772] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 1 [0083.772] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll") returned 0x44 [0083.772] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.772] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.772] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1 [0083.776] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 1 [0083.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll") returned 0x43 [0083.800] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.800] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.800] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1 [0083.800] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 1 [0083.800] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll") returned 0x44 [0083.800] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.800] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.800] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1 [0083.800] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 1 [0083.800] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll") returned 0x42 [0083.800] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.800] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.800] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 1 [0083.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll") returned 0x42 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.801] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 1 [0083.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll") returned 0x44 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.801] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 1 [0083.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll") returned 0x43 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.801] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 1 [0083.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll") returned 0x41 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.801] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 1 [0083.801] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll") returned 0x44 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.801] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1 [0083.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 1 [0083.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll") returned 0x42 [0083.802] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.802] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.802] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.802] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0083.803] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0083.803] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", len=0x50 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\") returned 1 [0083.803] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\") returned 0x50 [0083.803] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0083.803] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0083.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0083.805] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0083.805] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1 [0083.805] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", len=0x59 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 1 [0083.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL", cchLength=0x59 | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll") returned 0x59 [0083.806] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.806] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1 [0083.806] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", len=0x5c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 1 [0083.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll") returned 0x5c [0083.806] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.806] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1 [0083.806] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", len=0x7a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 1 [0083.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", cchLength=0x7a | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 0x7a [0083.806] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x50e54b70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0083.806] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0083.806] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\_restore files_.txt"), bFailIfExists=0) returned 1 [0083.881] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1 [0083.881] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", len=0x5c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 1 [0083.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL", cchLength=0x5c | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll") returned 0x5c [0083.881] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.881] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1 [0083.881] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", len=0x5d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 1 [0083.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE", cchLength=0x5d | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe") returned 0x5d [0083.914] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.914] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1 [0083.914] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", len=0x5b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 1 [0083.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe") returned 0x5b [0083.914] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.914] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1 [0083.914] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", len=0x5b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 1 [0083.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll") returned 0x5b [0083.915] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.915] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.915] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1 [0083.915] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", len=0x5b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 1 [0083.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", cchLength=0x5b | out: lpsz="c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof") returned 0x5b [0083.915] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0083.915] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0083.915] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0083.915] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0083.915] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0083.915] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", len=0x35 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\") returned 1 [0083.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\") returned 0x35 [0083.915] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0083.915] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0083.915] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0084.000] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.000] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0084.000] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 1 [0084.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll") returned 0x3e [0084.041] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.041] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1 [0084.041] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 1 [0084.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex") returned 0x41 [0084.041] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x5b0da70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0084.041] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.041] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\_restore files_.txt"), bFailIfExists=0) returned 1 [0084.044] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 1 [0084.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex") returned 0x41 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0084.044] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 1 [0084.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex") returned 0x41 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0084.044] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.044] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.044] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", len=0x39 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\") returned 1 [0084.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\") returned 0x39 [0084.044] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.044] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0084.164] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.164] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0084.164] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\") returned 1 [0084.164] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\") returned 0x3e [0084.164] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.164] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0084.217] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.218] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1 [0084.218] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 1 [0084.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm") returned 0x49 [0084.218] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0084.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeee1cd90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0084.218] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.218] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0084.290] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 1 [0084.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll") returned 0x48 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0084.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.291] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 1 [0084.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll") returned 0x50 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0084.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.291] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.291] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.291] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 1 [0084.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll") returned 0x44 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.291] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 1 [0084.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll") returned 0x42 [0084.291] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.291] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 1 [0084.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll") returned 0x44 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 1 [0084.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll") returned 0x43 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 1 [0084.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll") returned 0x43 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x0, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 1 [0084.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll") returned 0x42 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 1 [0084.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll") returned 0x46 [0084.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.292] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1 [0084.293] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\") returned 1 [0084.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\") returned 0x3f [0084.293] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.293] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0084.308] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.309] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0084.309] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", len=0x44 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\") returned 1 [0084.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\") returned 0x44 [0084.309] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.309] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0084.309] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.309] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1 [0084.309] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", len=0x4d | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 1 [0084.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml") returned 0x4d [0084.309] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0084.309] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.309] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeed123f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0084.309] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0084.309] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0084.354] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1 [0084.354] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", len=0x4d | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 1 [0084.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml") returned 0x4d [0084.354] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0084.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0084.354] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1 [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", len=0x4e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 1 [0084.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat") returned 0x4e [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0084.355] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0084.355] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1 [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", len=0x4e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 1 [0084.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml") returned 0x4e [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0084.355] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0084.355] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1 [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", len=0x4c | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 1 [0084.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml") returned 0x4c [0084.355] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0084.355] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.355] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615398 [0084.355] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.355] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.355] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0084.355] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 1 [0084.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl") returned 0x49 [0084.356] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0084.356] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0084.356] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0084.356] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\_restore files_.txt"), bFailIfExists=0) returned 1 [0084.358] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x20) returned 0x615370 [0084.358] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.358] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.358] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0084.358] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 1 [0084.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll") returned 0x44 [0084.358] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.358] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.358] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1 [0084.358] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 1 [0084.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt") returned 0x44 [0084.358] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.358] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0084.359] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0084.359] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\_restore files_.txt"), bFailIfExists=0) returned 1 [0084.499] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5e94e0 [0084.499] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1 [0084.499] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 1 [0084.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll") returned 0x41 [0084.500] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.500] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.500] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1 [0084.500] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 1 [0084.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb") returned 0x42 [0084.500] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.500] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.500] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0084.500] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1 [0084.500] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 1 [0084.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe") returned 0x4c [0084.500] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.500] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.500] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.500] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.500] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0084.500] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", len=0x3d | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\") returned 1 [0084.500] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\") returned 0x3d [0084.500] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.500] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0084.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0084.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1 [0084.913] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 1 [0084.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe") returned 0x44 [0084.913] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0084.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0084.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0084.913] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0084.913] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0084.913] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", len=0x3a | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\") returned 1 [0084.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\") returned 0x3a [0084.913] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0084.913] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0084.913] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0085.477] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0085.708] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0085.708] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 1 [0085.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm") returned 0x43 [0085.708] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd85ef28, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0085.708] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0085.709] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\_restore files_.txt"), bFailIfExists=0) returned 1 [0085.711] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0085.711] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 1 [0085.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg") returned 0x43 [0085.711] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.711] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x10) returned 0x5e9528 [0085.711] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1 [0085.711] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 1 [0085.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg") returned 0x4b [0085.711] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.711] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x14) returned 0x5a5888 [0085.711] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 1 [0085.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif") returned 0x4b [0085.712] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0085.712] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 1 [0085.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif") returned 0x4a [0085.712] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615398 [0085.712] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 1 [0085.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini") returned 0x45 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x20) returned 0x615370 [0085.712] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 1 [0085.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf") returned 0x4a [0085.712] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x24) returned 0x5dc550 [0085.712] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0085.712] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 1 [0085.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm") returned 0x44 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.713] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x28) returned 0x5dc340 [0085.713] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 1 [0085.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg") returned 0x44 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.713] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x2c) returned 0x61f7a0 [0085.713] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 1 [0085.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf") returned 0x45 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.713] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x30) returned 0x61f6c0 [0085.713] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 1 [0085.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf") returned 0x45 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.713] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.713] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x34) returned 0x5b96b0 [0085.713] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1 [0085.713] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 1 [0085.713] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf") returned 0x43 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.714] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b96f0 [0085.714] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 1 [0085.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm") returned 0x4b [0085.714] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.714] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x3c) returned 0x61a468 [0085.714] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 1 [0085.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg") returned 0x4a [0085.714] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.714] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x40) returned 0x61aa08 [0085.714] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", len=0x47 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 1 [0085.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf") returned 0x47 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.714] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.714] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x44) returned 0x596c88 [0085.714] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1 [0085.714] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 1 [0085.714] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf") returned 0x49 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.715] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x48) returned 0x596cd8 [0085.715] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 1 [0085.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm") returned 0x49 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.715] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x6695d8 [0085.715] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 1 [0085.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg") returned 0x48 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.715] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6695d8, Size=0x50) returned 0x669058 [0085.715] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf") returned 1 [0085.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf") returned 0x42 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.715] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.715] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669058, Size=0x54) returned 0x5a4778 [0085.715] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg") returned 1 [0085.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg") returned 0x43 [0085.715] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x58) returned 0x5a47d8 [0085.716] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf") returned 1 [0085.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf") returned 0x4c [0085.716] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x5c) returned 0x6c56120 [0085.716] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf") returned 1 [0085.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\music.emf") returned 0x43 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x60) returned 0x6c561f0 [0085.716] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\music.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg") returned 1 [0085.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg") returned 0x46 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x64) returned 0x6f09508 [0085.716] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1 [0085.716] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm") returned 1 [0085.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm") returned 0x4c [0085.716] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x68) returned 0x6f09578 [0085.717] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg") returned 1 [0085.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg") returned 0x4b [0085.717] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x6c) returned 0x5f7468 [0085.717] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm") returned 1 [0085.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm") returned 0x45 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x70) returned 0x5f7468 [0085.717] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg") returned 1 [0085.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg") returned 0x45 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f7468, Size=0x74) returned 0x5b5d08 [0085.717] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg") returned 1 [0085.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg") returned 0x49 [0085.717] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x78) returned 0x5b5d08 [0085.718] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg") returned 1 [0085.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg") returned 0x4c [0085.718] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x7c) returned 0x5b5d08 [0085.718] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg") returned 1 [0085.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg") returned 0x49 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x80) returned 0x5b5d08 [0085.718] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm") returned 1 [0085.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm") returned 0x43 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x84) returned 0x5b5d08 [0085.718] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg") returned 1 [0085.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg") returned 0x43 [0085.718] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x88) returned 0x5b5d08 [0085.718] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg") returned 1 [0085.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg") returned 0x48 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x8c) returned 0x5b5d08 [0085.719] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf") returned 1 [0085.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf") returned 0x43 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x90) returned 0x5b5d08 [0085.719] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm") returned 1 [0085.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm") returned 0x4c [0085.719] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x94) returned 0x5b5d08 [0085.719] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1 [0085.719] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg") returned 1 [0085.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg") returned 0x4a [0085.719] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x98) returned 0x5b5d08 [0085.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", len=0x47 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf") returned 1 [0085.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf") returned 0x47 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b5d08, Size=0x9c) returned 0x6f07440 [0085.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg") returned 1 [0085.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg") returned 0x48 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f07440, Size=0xa0) returned 0x6f07440 [0085.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", len=0x47 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm") returned 1 [0085.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm") returned 0x47 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f07440, Size=0xa4) returned 0x6f07440 [0085.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg") returned 1 [0085.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg") returned 0x46 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f07440, Size=0xa8) returned 0x6f07440 [0085.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0085.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm") returned 1 [0085.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm") returned 0x43 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f07440, Size=0xac) returned 0x614a48 [0085.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg") returned 1 [0085.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg") returned 0x43 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb0) returned 0x614a48 [0085.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 1 [0085.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif") returned 0x44 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb4) returned 0x614a48 [0085.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", len=0x47 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 1 [0085.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg") returned 0x47 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xb8) returned 0x614a48 [0085.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1 [0085.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 1 [0085.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif") returned 0x42 [0085.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xbc) returned 0x614a48 [0085.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1 [0085.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 1 [0085.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf") returned 0x48 [0085.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc0) returned 0x614a48 [0085.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x0, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1 [0085.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 1 [0085.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg") returned 0x4d [0085.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc4) returned 0x614a48 [0085.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1 [0085.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 1 [0085.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif") returned 0x4c [0085.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614a48, Size=0xc8) returned 0x614a48 [0085.999] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ab3ec40, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x6ab3ec40, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0085.999] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\_RESTORE FILES_.txt", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\_RESTORE FILES_.txt") returned 1 [0085.999] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\_RESTORE FILES_.txt", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\stationery\\_restore files_.txt") returned 0x4d [0085.999] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0085.999] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0085.999] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0085.999] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0085.999] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1 [0085.999] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\") returned 1 [0085.999] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\") returned 0x38 [0085.999] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.000] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0086.000] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.000] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0086.000] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\") returned 1 [0086.000] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\") returned 0x3e [0086.000] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.000] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.000] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.000] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.000] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.000] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.001] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1 [0086.001] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 1 [0086.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll") returned 0x44 [0086.001] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0086.001] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.001] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1 [0086.001] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 1 [0086.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv") returned 0x44 [0086.001] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0086.001] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.001] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0086.001] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.001] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 1 [0086.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv") returned 0x43 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0086.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 1 [0086.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv") returned 0x43 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0086.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 1 [0086.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv") returned 0x43 [0086.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0086.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.203] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0086.203] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1 [0086.204] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\") returned 1 [0086.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\") returned 0x38 [0086.204] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.204] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.204] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0086.229] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.319] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1 [0086.319] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\") returned 1 [0086.319] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\") returned 0x41 [0086.320] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.320] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.320] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.320] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1 [0086.320] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 1 [0086.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm") returned 0x4d [0086.320] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.320] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x512f1610, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.321] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.321] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.323] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1 [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 1 [0086.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf") returned 0x4d [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.323] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 1 [0086.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif") returned 0x4c [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.323] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 1 [0086.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png") returned 0x4d [0086.323] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.324] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.324] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.324] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.324] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0086.324] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\") returned 1 [0086.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\") returned 0x3f [0086.324] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.324] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.324] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.362] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.362] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1 [0086.362] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 1 [0086.362] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm") returned 0x49 [0086.362] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.362] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5146e3d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.363] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.363] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.365] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1 [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 1 [0086.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf") returned 0x49 [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.365] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 1 [0086.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif") returned 0x4a [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.365] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 1 [0086.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png") returned 0x4b [0086.365] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.365] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.365] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1 [0086.366] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\") returned 1 [0086.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\") returned 0x3d [0086.366] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.366] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.366] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.370] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.370] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1 [0086.370] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 1 [0086.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm") returned 0x45 [0086.370] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51767f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.371] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.371] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.373] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 1 [0086.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf") returned 0x45 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.373] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.373] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.373] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 1 [0086.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif") returned 0x48 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.373] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.373] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.373] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 1 [0086.373] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png") returned 0x49 [0086.373] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.373] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.373] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.374] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.374] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.374] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0086.374] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\") returned 1 [0086.374] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\") returned 0x3f [0086.374] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.374] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.374] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.380] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.381] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1 [0086.381] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 1 [0086.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm") returned 0x49 [0086.381] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.381] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a15810, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.381] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.381] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.428] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1 [0086.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 1 [0086.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf") returned 0x49 [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.429] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 1 [0086.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif") returned 0x4a [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.429] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 1 [0086.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png") returned 0x4b [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.429] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.429] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.429] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\") returned 1 [0086.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\") returned 0x41 [0086.429] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.429] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.429] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.430] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.430] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1 [0086.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 1 [0086.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm") returned 0x4d [0086.430] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a15810, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.430] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.430] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0086.432] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1 [0086.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 1 [0086.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf") returned 0x4d [0086.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0086.433] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 1 [0086.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif") returned 0x4c [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0086.433] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 1 [0086.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png") returned 0x4d [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0086.433] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.433] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\") returned 1 [0086.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\") returned 0x41 [0086.433] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.433] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0086.894] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0086.894] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1 [0086.894] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 1 [0086.894] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm") returned 0x4d [0086.894] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.894] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a15810, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0086.894] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0086.894] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\_restore files_.txt"), bFailIfExists=0) returned 1 [0086.896] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1 [0086.896] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 1 [0086.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf") returned 0x4d [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0086.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 1 [0086.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif") returned 0x4c [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0086.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 1 [0086.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png") returned 0x4d [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0086.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0086.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0086.897] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0086.897] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0086.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\") returned 1 [0086.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\") returned 0x41 [0086.897] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0086.897] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0086.898] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0087.423] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.423] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1 [0087.424] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 1 [0087.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm") returned 0x4d [0087.424] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0087.424] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0087.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a15810, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0087.424] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0087.424] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.142] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1 [0088.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 1 [0088.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf") returned 0x4d [0088.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0088.142] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 1 [0088.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif") returned 0x4c [0088.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0088.142] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 1 [0088.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png") returned 0x4d [0088.143] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0088.143] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.143] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.143] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0088.143] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\") returned 1 [0088.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\") returned 0x3f [0088.143] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.143] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.143] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.145] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.145] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1 [0088.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 1 [0088.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm") returned 0x49 [0088.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a61ad0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.145] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.145] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0088.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1 [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 1 [0088.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf") returned 0x49 [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0088.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 1 [0088.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif") returned 0x4a [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0088.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 1 [0088.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png") returned 0x4b [0088.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0088.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.149] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.150] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1 [0088.150] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\") returned 1 [0088.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\") returned 0x3f [0088.150] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.150] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.150] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.151] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.151] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1 [0088.151] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 1 [0088.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm") returned 0x49 [0088.151] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51c2ab50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.152] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.152] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f6c0 [0088.154] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1 [0088.154] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 1 [0088.154] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf") returned 0x49 [0088.154] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.154] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x30) returned 0x61f7a0 [0088.154] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.154] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 1 [0088.154] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif") returned 0x4a [0088.154] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.154] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x34) returned 0x5b96b0 [0088.154] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.154] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 1 [0088.154] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png") returned 0x4b [0088.155] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.155] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b9730 [0088.155] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.155] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.155] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0088.155] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\") returned 1 [0088.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\") returned 0x41 [0088.155] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.155] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.219] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.219] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1 [0088.219] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 1 [0088.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm") returned 0x4d [0088.219] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51c2ab50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0088.219] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0088.219] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f6c0 [0088.221] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1 [0088.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 1 [0088.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf") returned 0x4d [0088.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x30) returned 0x61f7a0 [0088.221] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 1 [0088.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif") returned 0x4c [0088.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x34) returned 0x5b9730 [0088.222] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 1 [0088.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png") returned 0x4d [0088.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96b0 [0088.222] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.222] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.222] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0088.222] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\") returned 1 [0088.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\") returned 0x40 [0088.222] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.222] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.222] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1 [0088.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 1 [0088.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm") returned 0x4b [0088.231] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.231] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51c50cb0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.231] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.231] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1 [0088.233] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 1 [0088.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf") returned 0x4b [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0088.234] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 1 [0088.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif") returned 0x4b [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0088.234] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 1 [0088.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png") returned 0x4c [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0088.234] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.234] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.234] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0088.234] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\") returned 1 [0088.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\") returned 0x40 [0088.235] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.235] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.235] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.242] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.242] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1 [0088.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 1 [0088.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm") returned 0x4b [0088.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51cc30d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.242] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.242] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.264] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1 [0088.264] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 1 [0088.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf") returned 0x4b [0088.264] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0088.265] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.265] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 1 [0088.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif") returned 0x4b [0088.265] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0088.265] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.265] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 1 [0088.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png") returned 0x4c [0088.265] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0088.265] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.265] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.267] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0088.268] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\") returned 1 [0088.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\") returned 0x41 [0088.268] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.268] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.268] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.268] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.268] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1 [0088.268] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 1 [0088.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm") returned 0x4d [0088.268] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51cc30d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.268] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.268] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0088.271] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1 [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 1 [0088.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf") returned 0x4d [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0088.271] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 1 [0088.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif") returned 0x4c [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0088.271] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 1 [0088.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png") returned 0x4d [0088.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0088.271] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.271] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.272] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0088.272] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\") returned 1 [0088.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\") returned 0x41 [0088.272] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.272] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0088.272] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.272] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1 [0088.272] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 1 [0088.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm") returned 0x4d [0088.272] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.272] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0088.272] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0088.272] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0088.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0088.275] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1 [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 1 [0088.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf") returned 0x4d [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f6c0 [0088.275] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 1 [0088.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif") returned 0x4c [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x30) returned 0x61f7a0 [0088.275] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 1 [0088.275] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png") returned 0x4d [0088.275] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0088.275] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0088.275] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x34) returned 0x5b96b0 [0088.275] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0088.275] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0088.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1 [0088.276] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\") returned 1 [0088.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\") returned 0x3d [0088.276] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0088.276] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0088.276] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0089.873] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.873] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1 [0089.873] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 1 [0089.873] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm") returned 0x45 [0089.873] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0089.873] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0089.873] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0089.873] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0089.873] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.630] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 1 [0091.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf") returned 0x45 [0091.630] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.630] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.630] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0091.630] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 1 [0091.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif") returned 0x48 [0091.630] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.630] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.630] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0091.630] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.630] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 1 [0091.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png") returned 0x49 [0091.631] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.631] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.631] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0091.631] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.631] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.631] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0091.631] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\") returned 1 [0091.631] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\") returned 0x40 [0091.631] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.631] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.631] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0091.633] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.633] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1 [0091.633] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 1 [0091.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm") returned 0x4b [0091.633] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.633] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.633] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51e3fe90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.633] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.633] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0091.667] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1 [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 1 [0091.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf") returned 0x4b [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0091.668] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 1 [0091.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif") returned 0x4b [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0091.668] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 1 [0091.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png") returned 0x4c [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0091.668] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.668] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.668] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1 [0091.668] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\") returned 1 [0091.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\") returned 0x3d [0091.669] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.669] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0091.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1 [0091.677] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 1 [0091.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm") returned 0x45 [0091.677] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51f70990, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.677] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.677] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.679] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1 [0091.679] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 1 [0091.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf") returned 0x45 [0091.679] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0091.679] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.679] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 1 [0091.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif") returned 0x48 [0091.679] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0091.680] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.680] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 1 [0091.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png") returned 0x49 [0091.680] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.680] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0091.680] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.680] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.680] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0091.680] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\") returned 1 [0091.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\") returned 0x41 [0091.680] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.680] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0091.697] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.697] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1 [0091.698] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 1 [0091.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm") returned 0x4d [0091.698] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.698] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.698] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51fe2db0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.698] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.698] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.779] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0091.779] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1 [0091.780] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 1 [0091.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf") returned 0x4d [0091.780] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.780] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.786] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0091.786] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 1 [0091.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif") returned 0x4c [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.787] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.787] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0091.787] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 1 [0091.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png") returned 0x4d [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.787] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.787] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0091.787] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.787] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.787] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\") returned 1 [0091.787] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\") returned 0x41 [0091.787] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.787] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.787] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0091.788] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.788] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1 [0091.788] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 1 [0091.788] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm") returned 0x4d [0091.788] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.788] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.788] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.788] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0091.829] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 1 [0091.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf") returned 0x4d [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0091.830] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 1 [0091.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif") returned 0x4c [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0091.830] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 1 [0091.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png") returned 0x4d [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0091.830] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.830] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.830] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1 [0091.830] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\") returned 1 [0091.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\") returned 0x3c [0091.831] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.831] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0091.842] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.842] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1 [0091.842] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 1 [0091.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm") returned 0x43 [0091.842] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.842] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.842] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.842] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f6c0 [0091.844] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1 [0091.844] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 1 [0091.844] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf") returned 0x43 [0091.844] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.844] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.844] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x30) returned 0x61f7a0 [0091.844] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 1 [0091.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif") returned 0x47 [0091.845] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x34) returned 0x5b96b0 [0091.845] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.845] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 1 [0091.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png") returned 0x48 [0091.845] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.845] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b9730 [0091.845] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.845] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0091.847] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1 [0091.847] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\") returned 1 [0091.847] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\") returned 0x3f [0091.847] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.847] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.851] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.851] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1 [0091.851] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 1 [0091.851] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm") returned 0x49 [0091.851] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.851] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x539538d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.851] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.851] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x34) returned 0x5b96f0 [0091.878] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1 [0091.878] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 1 [0091.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf") returned 0x49 [0091.878] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.878] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x38) returned 0x5b96b0 [0091.878] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.878] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 1 [0091.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif") returned 0x4a [0091.878] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.878] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61aa08 [0091.878] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 1 [0091.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png") returned 0x4b [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.879] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x40) returned 0x61a468 [0091.879] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.879] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.879] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1 [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\") returned 1 [0091.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\") returned 0x3d [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.879] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.879] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.879] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.879] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1 [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 1 [0091.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm") returned 0x45 [0091.879] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.880] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.880] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.880] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x44) returned 0x596cd8 [0091.882] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 1 [0091.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf") returned 0x45 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x48) returned 0x596c88 [0091.882] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 1 [0091.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif") returned 0x48 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.882] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x4c) returned 0x669b00 [0091.882] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 1 [0091.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png") returned 0x49 [0091.882] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x50) returned 0x668d98 [0091.883] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.883] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.883] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0091.883] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\") returned 1 [0091.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\") returned 0x40 [0091.883] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.883] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.963] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.963] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1 [0091.963] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 1 [0091.963] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm") returned 0x4b [0091.963] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.963] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x567be5d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.963] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.963] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x44) returned 0x596cd8 [0091.968] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1 [0091.968] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 1 [0091.968] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf") returned 0x4b [0091.968] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.968] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.968] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x48) returned 0x596c88 [0091.968] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.969] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 1 [0091.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif") returned 0x4b [0091.969] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.969] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x4c) returned 0x668d98 [0091.969] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.969] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 1 [0091.969] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png") returned 0x4c [0091.969] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.969] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.969] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x668d98, Size=0x50) returned 0x669b00 [0091.970] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.970] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.970] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0091.970] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\") returned 1 [0091.970] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\") returned 0x3f [0091.970] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.970] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.970] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.986] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.986] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1 [0091.987] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 1 [0091.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm") returned 0x49 [0091.987] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.987] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x567e4730, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.987] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.987] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.989] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x4c) returned 0x669b00 [0091.989] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1 [0091.989] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 1 [0091.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf") returned 0x49 [0091.989] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.989] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.989] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x50) returned 0x668d98 [0091.989] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.989] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 1 [0091.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif") returned 0x4a [0091.990] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.990] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.990] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x668d98, Size=0x54) returned 0x5a47d8 [0091.990] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.990] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 1 [0091.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png") returned 0x4b [0091.990] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.990] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.990] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0091.990] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.990] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.990] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0091.990] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\") returned 1 [0091.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\") returned 0x3e [0091.990] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.990] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.990] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.991] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.991] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1 [0091.991] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 1 [0091.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm") returned 0x47 [0091.991] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.991] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.991] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.991] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\_restore files_.txt"), bFailIfExists=0) returned 1 [0091.993] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c561f0 [0091.993] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1 [0091.993] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 1 [0091.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf") returned 0x47 [0091.993] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.993] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.993] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x60) returned 0x6c56120 [0091.993] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0091.993] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 1 [0091.993] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif") returned 0x49 [0091.993] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.993] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.994] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x64) returned 0x6f09578 [0091.994] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0091.994] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 1 [0091.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png") returned 0x4a [0091.994] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.994] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.994] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0091.994] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0091.994] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0091.994] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0091.994] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\") returned 1 [0091.994] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\") returned 0x40 [0091.994] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0091.994] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0091.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0091.994] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0091.995] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1 [0091.995] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 1 [0091.995] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm") returned 0x4b [0091.995] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0091.995] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0091.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x59544a90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0091.995] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0091.995] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\_restore files_.txt"), bFailIfExists=0) returned 1 [0092.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x64) returned 0x6f09578 [0092.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 1 [0092.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf") returned 0x4b [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0092.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 1 [0092.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif") returned 0x4b [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x6c) returned 0x6f1aec0 [0092.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 1 [0092.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png") returned 0x4c [0092.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1aec0, Size=0x70) returned 0x6f1af38 [0092.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.043] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0092.043] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0092.044] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\") returned 1 [0092.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\") returned 0x40 [0092.044] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0092.044] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0092.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0092.129] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.129] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1 [0092.129] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 1 [0092.129] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm") returned 0x4b [0092.129] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.129] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x59c68c90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0092.129] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.129] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\_restore files_.txt"), bFailIfExists=0) returned 1 [0092.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1aec0, Size=0x70) returned 0x6f1af38 [0092.131] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 1 [0092.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf") returned 0x4b [0092.131] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.131] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1af38, Size=0x74) returned 0x5d6258 [0092.131] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0092.131] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 1 [0092.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif") returned 0x4b [0092.132] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.132] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.132] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x78) returned 0x5d62d8 [0092.132] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0092.132] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 1 [0092.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png") returned 0x4c [0092.132] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.132] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.132] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d62d8, Size=0x7c) returned 0x5f9d28 [0092.132] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.132] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0092.132] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0092.132] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\") returned 1 [0092.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\") returned 0x3e [0092.132] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0092.132] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0092.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0092.132] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.133] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1 [0092.133] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 1 [0092.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm") returned 0x47 [0092.133] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.133] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a44b570, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0092.133] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.133] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\_restore files_.txt"), bFailIfExists=0) returned 1 [0092.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9d28, Size=0x80) returned 0x5f9fd0 [0092.135] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 1 [0092.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf") returned 0x47 [0092.135] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.135] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9fd0, Size=0x84) returned 0x61b4b0 [0092.135] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0092.135] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 1 [0092.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif") returned 0x49 [0092.135] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.135] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x88) returned 0x61b540 [0092.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0092.136] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 1 [0092.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png") returned 0x4a [0092.136] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x8c) returned 0x61d550 [0092.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0092.136] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0092.136] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0092.136] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\") returned 1 [0092.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\") returned 0x40 [0092.136] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0092.136] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0092.136] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0092.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0092.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0092.137] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 1 [0092.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif") returned 0x4b [0092.137] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0092.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0092.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0092.137] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0092.137] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.165] GetProcessHeap () returned 0x580000 [0094.165] RtlAllocateHeap (HeapHandle=0x580000, Flags=0x0, Size=0xc) returned 0x5e9528 [0094.165] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1 [0094.165] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 1 [0094.165] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm") returned 0x4b [0094.165] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.165] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0094.165] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1 [0094.165] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 1 [0094.165] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf") returned 0x4b [0094.165] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.165] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.165] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0094.165] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.166] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 1 [0094.166] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png") returned 0x4c [0094.166] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.166] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.166] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0094.166] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.166] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.166] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1 [0094.166] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\") returned 1 [0094.166] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\") returned 0x3d [0094.166] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.166] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0094.167] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.167] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.167] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 1 [0094.167] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif") returned 0x48 [0094.168] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.168] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a6f8e30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.168] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.168] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0094.171] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1 [0094.171] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 1 [0094.171] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm") returned 0x45 [0094.171] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.171] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0094.171] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1 [0094.171] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 1 [0094.172] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf") returned 0x45 [0094.172] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.172] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0094.172] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.172] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 1 [0094.172] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png") returned 0x49 [0094.172] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.172] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.172] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0094.172] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.172] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.172] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0094.172] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\") returned 1 [0094.172] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\") returned 0x3f [0094.172] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.172] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0094.173] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.173] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.173] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 1 [0094.173] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif") returned 0x4a [0094.174] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.174] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a829930, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.174] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.174] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f7a0 [0094.176] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0094.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 1 [0094.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm") returned 0x49 [0094.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x30) returned 0x61f6c0 [0094.176] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1 [0094.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 1 [0094.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf") returned 0x49 [0094.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x34) returned 0x5b96f0 [0094.176] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 1 [0094.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png") returned 0x4b [0094.177] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x38) returned 0x5b96b0 [0094.177] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.177] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.177] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0094.177] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\") returned 1 [0094.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\") returned 0x40 [0094.177] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.177] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0094.177] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.177] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.177] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 1 [0094.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif") returned 0x4b [0094.178] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.178] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a84fa90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.178] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.178] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61aa08 [0094.180] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0094.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 1 [0094.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm") returned 0x4b [0094.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x40) returned 0x61a468 [0094.180] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1 [0094.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 1 [0094.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf") returned 0x4b [0094.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x44) returned 0x596cd8 [0094.180] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 1 [0094.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png") returned 0x4c [0094.181] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x48) returned 0x596c88 [0094.181] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.181] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.182] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0094.182] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\") returned 1 [0094.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\") returned 0x41 [0094.182] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.182] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0094.187] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.187] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.187] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 1 [0094.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif") returned 0x4c [0094.187] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.187] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a89bd50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0094.187] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0094.187] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x30) returned 0x61f6c0 [0094.189] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1 [0094.189] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 1 [0094.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm") returned 0x4d [0094.189] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x34) returned 0x5b9730 [0094.189] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1 [0094.189] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 1 [0094.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf") returned 0x4d [0094.189] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.190] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96f0 [0094.190] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.190] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 1 [0094.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png") returned 0x4d [0094.190] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.190] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x3c) returned 0x61aa08 [0094.190] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.190] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.190] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0094.190] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\") returned 1 [0094.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\") returned 0x3f [0094.190] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.190] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0094.191] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.191] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.191] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 1 [0094.191] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif") returned 0x4a [0094.191] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.191] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.191] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.191] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.191] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96f0, Size=0x3c) returned 0x61aa08 [0094.197] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1 [0094.197] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 1 [0094.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm") returned 0x49 [0094.197] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61aa08, Size=0x40) returned 0x61a468 [0094.197] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1 [0094.197] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 1 [0094.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf") returned 0x49 [0094.197] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61a468, Size=0x44) returned 0x596cd8 [0094.198] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.198] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 1 [0094.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png") returned 0x4b [0094.198] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x48) returned 0x596c88 [0094.198] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.198] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.198] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0094.198] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\") returned 1 [0094.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\") returned 0x40 [0094.198] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.198] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.198] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0094.242] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.242] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 1 [0094.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif") returned 0x4b [0094.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.242] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.242] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x48) returned 0x596c88 [0094.244] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1 [0094.244] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 1 [0094.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm") returned 0x4b [0094.244] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596c88, Size=0x4c) returned 0x669aa8 [0094.244] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1 [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 1 [0094.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf") returned 0x4b [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669aa8, Size=0x50) returned 0x669b00 [0094.245] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 1 [0094.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png") returned 0x4c [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x669b00, Size=0x54) returned 0x5a47d8 [0094.245] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.245] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.245] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\") returned 1 [0094.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\") returned 0x3e [0094.245] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.245] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0094.246] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0094.246] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0094.246] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 1 [0094.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif") returned 0x49 [0094.246] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.246] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0094.246] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0094.246] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\_restore files_.txt"), bFailIfExists=0) returned 1 [0094.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0094.248] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1 [0094.248] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 1 [0094.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm") returned 0x47 [0094.248] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c561f0 [0094.248] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1 [0094.248] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 1 [0094.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf") returned 0x47 [0094.248] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x60) returned 0x6c56120 [0094.248] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0094.249] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 1 [0094.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png") returned 0x4a [0094.249] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0094.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0094.249] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56120, Size=0x64) returned 0x6f09578 [0094.249] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0094.249] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0094.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0094.249] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\") returned 1 [0094.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\") returned 0x3c [0094.249] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0094.249] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0094.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0095.629] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0095.629] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0095.629] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 1 [0095.629] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif") returned 0x47 [0095.629] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0095.629] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0095.629] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a980590, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0095.629] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0095.629] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\_restore files_.txt"), bFailIfExists=0) returned 1 [0097.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0097.066] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1 [0097.066] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 1 [0097.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm") returned 0x43 [0097.066] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0097.066] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0097.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0097.066] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1 [0097.066] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 1 [0097.066] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", cchLength=0x43 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf") returned 0x43 [0097.066] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0097.066] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0097.066] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0097.066] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0097.066] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 1 [0097.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png") returned 0x48 [0097.067] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0097.067] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0097.067] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0097.067] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0097.067] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0097.067] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0097.067] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\") returned 1 [0097.067] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\") returned 0x3e [0097.067] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0097.067] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0097.067] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0098.205] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0098.205] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0098.205] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 1 [0098.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif") returned 0x49 [0098.205] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0098.205] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0098.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a980590, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0098.205] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0098.205] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\_restore files_.txt"), bFailIfExists=0) returned 1 [0098.207] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1 [0098.207] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 1 [0098.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm") returned 0x47 [0098.207] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0098.207] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0098.207] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0098.207] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1 [0098.207] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 1 [0098.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf") returned 0x47 [0098.208] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0098.208] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0098.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0098.208] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0098.208] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 1 [0098.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png") returned 0x4a [0098.208] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0098.208] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0098.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0098.208] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0098.208] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0098.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1 [0098.208] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\") returned 1 [0098.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\") returned 0x3f [0098.208] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0098.208] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0098.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0099.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 1 [0099.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif") returned 0x4a [0099.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0099.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0099.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5aad71f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0099.148] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.148] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\_restore files_.txt"), bFailIfExists=0) returned 1 [0099.150] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1 [0099.150] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 1 [0099.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm") returned 0x49 [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0099.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0099.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0099.151] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1 [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 1 [0099.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf") returned 0x49 [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0099.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0099.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0099.151] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 1 [0099.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png") returned 0x4b [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0099.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0099.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0099.151] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0099.151] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0099.151] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1 [0099.151] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\") returned 1 [0099.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\") returned 0x3f [0099.152] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0099.152] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0099.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0099.152] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0099.152] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0099.152] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 1 [0099.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif") returned 0x4a [0099.152] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0099.152] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0099.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0099.152] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0099.152] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.349] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1 [0101.349] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 1 [0101.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm") returned 0x49 [0101.349] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0101.349] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1 [0101.349] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 1 [0101.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf") returned 0x49 [0101.349] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0101.350] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.350] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 1 [0101.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png") returned 0x4b [0101.350] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0101.350] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.350] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0101.350] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\") returned 1 [0101.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\") returned 0x41 [0101.350] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.350] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0101.352] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.352] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.352] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 1 [0101.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif") returned 0x4c [0101.352] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5abe1b90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0101.353] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.353] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0101.356] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1 [0101.356] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 1 [0101.356] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm") returned 0x4d [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.357] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0101.357] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1 [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 1 [0101.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf") returned 0x4d [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.357] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0101.357] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 1 [0101.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png") returned 0x4d [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.357] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.357] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0101.357] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.357] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.357] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\") returned 1 [0101.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\") returned 0x3f [0101.357] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.357] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.358] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0101.358] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.358] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.358] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 1 [0101.358] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif") returned 0x4a [0101.358] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.358] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0101.358] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.358] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.360] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0101.360] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1 [0101.360] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 1 [0101.360] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm") returned 0x49 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.361] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0101.361] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 1 [0101.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf") returned 0x49 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.361] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f7a0 [0101.361] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 1 [0101.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png") returned 0x4b [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.361] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.361] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x30) returned 0x61f6c0 [0101.361] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.361] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.361] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\") returned 1 [0101.361] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\") returned 0x41 [0101.361] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.362] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0101.407] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.407] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.407] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 1 [0101.408] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif") returned 0x4c [0101.408] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.408] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0101.408] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.408] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0101.410] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1 [0101.410] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 1 [0101.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm") returned 0x4d [0101.410] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0101.410] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1 [0101.410] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 1 [0101.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf") returned 0x4d [0101.410] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0101.411] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.411] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 1 [0101.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png") returned 0x4d [0101.411] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0101.411] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.411] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.411] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0101.411] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 1 [0101.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf") returned 0x42 [0101.411] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0101.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0101.411] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.411] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0101.413] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1 [0101.413] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\") returned 1 [0101.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\") returned 0x3e [0101.414] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.414] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0101.442] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.442] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.442] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 1 [0101.478] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif") returned 0x49 [0101.478] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.479] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5ad387f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0101.479] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.479] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.481] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x18) returned 0x5a5888 [0101.481] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.481] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 1 [0101.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png") returned 0x4a [0101.481] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.481] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.481] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x1c) returned 0x615370 [0101.481] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1 [0101.481] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 1 [0101.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm") returned 0x47 [0101.481] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.481] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.481] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615370, Size=0x20) returned 0x615398 [0101.481] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1 [0101.481] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 1 [0101.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf") returned 0x47 [0101.482] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.482] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.482] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615398, Size=0x24) returned 0x5dc340 [0101.482] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.482] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.482] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0101.482] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", len=0x41 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\") returned 1 [0101.482] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\") returned 0x41 [0101.482] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.482] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.482] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0101.482] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.482] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0101.482] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 1 [0101.483] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif") returned 0x4c [0101.483] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.483] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a71ef90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0101.483] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0101.483] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0101.485] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x0, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1 [0101.485] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 1 [0101.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png") returned 0x4d [0101.485] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.485] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f6c0 [0101.485] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1 [0101.485] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 1 [0101.485] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm") returned 0x4d [0101.485] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.485] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.485] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f6c0, Size=0x30) returned 0x61f7d8 [0101.485] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1 [0101.485] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 1 [0101.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf") returned 0x4d [0101.486] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.486] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.486] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7d8, Size=0x34) returned 0x5b96f0 [0101.486] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.486] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.486] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.486] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0101.486] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\") returned 1 [0101.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\") returned 0x38 [0101.486] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.486] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.486] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0101.621] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.621] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1 [0101.621] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\") returned 1 [0101.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\") returned 0x3d [0101.621] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.621] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.622] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0101.653] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.653] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1 [0101.654] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 1 [0101.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its") returned 0x49 [0101.654] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x7562dd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0101.654] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.654] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f7d8 [0101.656] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.656] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1 [0101.656] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\") returned 1 [0101.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\") returned 0x3d [0101.656] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.657] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0101.669] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.669] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1 [0101.669] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 1 [0101.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its") returned 0x49 [0101.669] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.669] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x54ce0b0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0101.670] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.670] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\_restore files_.txt"), bFailIfExists=0) returned 1 [0101.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0101.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0101.672] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0101.672] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1 [0101.672] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\") returned 1 [0101.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\") returned 0x3d [0101.672] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0101.672] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0101.672] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0101.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0101.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1 [0101.672] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 1 [0101.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its") returned 0x49 [0101.673] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0101.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0101.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x7562dd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0101.673] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0101.673] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0102.309] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.309] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.309] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1 [0102.309] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\") returned 1 [0102.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\") returned 0x3d [0102.309] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0102.309] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0102.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0102.310] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.310] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1 [0102.310] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 1 [0102.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll") returned 0x49 [0102.310] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0102.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0102.310] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1 [0102.310] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 1 [0102.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its") returned 0x49 [0102.310] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0102.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0102.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x54a7f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0102.310] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.310] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\_restore files_.txt"), bFailIfExists=0) returned 1 [0102.313] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9528, Size=0x10) returned 0x5e94e0 [0102.313] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1 [0102.313] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 1 [0102.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex") returned 0x47 [0102.313] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0102.313] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0102.313] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94e0, Size=0x14) returned 0x5a58e8 [0102.313] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.313] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.313] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1 [0102.313] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\") returned 1 [0102.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\") returned 0x3d [0102.313] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0102.313] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0102.313] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0102.961] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0102.961] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1 [0102.961] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 1 [0102.961] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its") returned 0x49 [0102.961] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0102.961] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0102.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x7562dd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0102.962] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0102.962] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\_restore files_.txt"), bFailIfExists=0) returned 1 [0102.964] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0102.964] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0102.964] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1 [0102.964] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\") returned 1 [0102.964] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\") returned 0x3d [0102.964] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0102.964] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0102.965] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0103.492] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0103.492] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1 [0103.492] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 1 [0103.492] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll") returned 0x49 [0103.492] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0103.493] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0103.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1 [0103.493] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS") returned 1 [0103.493] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its") returned 0x49 [0103.493] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0103.493] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0103.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x7516b10, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0103.493] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0103.493] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\_restore files_.txt"), bFailIfExists=0) returned 1 [0104.024] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1 [0104.024] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX") returned 1 [0104.024] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex") returned 0x47 [0104.024] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0104.024] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.024] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x10) returned 0x5e92d0 [0104.024] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.024] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.024] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1 [0104.024] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 1 [0104.025] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex") returned 0x42 [0104.025] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.025] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.025] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0104.025] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.025] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\_restore files_.txt"), bFailIfExists=0) returned 1 [0104.027] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5e85f8 [0104.027] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0104.027] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 1 [0104.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex") returned 0x44 [0104.027] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.027] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.027] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e85f8, Size=0x18) returned 0x5a58e8 [0104.027] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1 [0104.027] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL") returned 1 [0104.027] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll") returned 0x44 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.028] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll") returned 0x44 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.028] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1XTOR.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll") returned 0x44 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.028] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\translat\\msb1xtor.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\WTSP61MS.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\translat\\wtsp61ms.dll") returned 0x44 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0104.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0104.028] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.028] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0104.028] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1 [0104.028] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", len=0x37 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\") returned 1 [0104.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\") returned 0x37 [0104.029] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0104.029] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0104.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0104.029] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.029] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0104.029] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\") returned 1 [0104.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\") returned 0x3d [0104.029] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0104.029] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0104.029] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0104.748] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0104.748] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.748] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0104.748] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0104.748] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0104.748] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0104.748] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\") returned 1 [0104.748] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\") returned 0x33 [0104.748] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0104.748] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0104.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0105.377] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.377] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1 [0105.377] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", len=0x38 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\") returned 1 [0105.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\") returned 0x38 [0105.377] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0105.377] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0105.377] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0105.378] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.378] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0105.378] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", len=0x3d | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\") returned 1 [0105.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\") returned 0x3d [0105.378] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0105.378] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0105.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0105.858] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0105.858] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1 [0105.858] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", len=0x45 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 1 [0105.858] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm") returned 0x45 [0105.858] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0105.858] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0105.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeedaa970, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0105.858] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0105.859] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0106.150] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1 [0106.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", len=0x46 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 1 [0106.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm") returned 0x46 [0106.150] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.150] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x10) returned 0x5e92d0 [0106.150] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1 [0106.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL") returned 1 [0106.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBE7INTL.DLL", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll") returned 0x49 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.151] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbe7intl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 1 [0106.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", cchLength=0x49 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm") returned 0x49 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5e85f8 [0106.151] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", len=0x46 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 1 [0106.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm") returned 0x46 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e85f8, Size=0x18) returned 0x5a58e8 [0106.151] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", len=0x46 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 1 [0106.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm") returned 0x46 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615078 [0106.151] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", len=0x46 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 1 [0106.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm") returned 0x46 [0106.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.152] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x20) returned 0x614d08 [0106.152] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1 [0106.152] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", len=0x46 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 1 [0106.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", cchLength=0x46 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm") returned 0x46 [0106.152] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0106.152] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.152] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614d08, Size=0x24) returned 0x5dc340 [0106.152] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.152] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0106.152] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0106.152] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 1 [0106.152] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll") returned 0x40 [0106.152] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.152] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.152] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.152] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0106.153] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.153] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.153] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1 [0106.153] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", len=0x32 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\") returned 1 [0106.153] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\") returned 0x32 [0106.154] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.154] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.154] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0106.388] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.388] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0106.388] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll") returned 1 [0106.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia100.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll") returned 0x3e [0106.388] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0106.388] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.388] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1 [0106.388] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll") returned 1 [0106.388] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\msdia90.dll", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll") returned 0x3d [0106.388] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0106.388] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.389] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.389] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.389] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1 [0106.389] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\") returned 1 [0106.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\") returned 0x33 [0106.389] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.389] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0106.389] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.389] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1 [0106.389] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll") returned 1 [0106.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\VGX.dll", cchLength=0x3a | out: lpsz="c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll") returned 0x3a [0106.389] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0106.389] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.390] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.390] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.390] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0106.390] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", len=0x3c | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\") returned 1 [0106.390] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\") returned 0x3c [0106.390] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.390] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.390] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0106.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0106.394] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", len=0x42 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\") returned 1 [0106.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\") returned 0x42 [0106.395] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.395] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0106.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1 [0106.675] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX") returned 1 [0106.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx") returned 0x4d [0106.675] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.675] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x81afcd40, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0106.676] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0106.676] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\_restore files_.txt"), bFailIfExists=0) returned 1 [0106.863] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1 [0106.863] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX") returned 1 [0106.863] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx") returned 0x4e [0106.863] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.863] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.863] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x10) returned 0x5e92d0 [0106.863] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1 [0106.863] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX") returned 1 [0106.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx") returned 0x4d [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.864] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0106.864] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1 [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX") returned 1 [0106.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx") returned 0x4c [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.864] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0106.864] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x0, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1 [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX") returned 1 [0106.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx") returned 0x4c [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.864] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615078 [0106.864] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1 [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP") returned 1 [0106.864] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp") returned 0x4a [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.864] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.864] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x20) returned 0x614d08 [0106.864] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1 [0106.864] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX") returned 1 [0106.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx") returned 0x4d [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.865] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x614d08, Size=0x24) returned 0x5dc340 [0106.865] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1 [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX") returned 1 [0106.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx") returned 0x4c [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.865] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0106.865] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1 [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX") returned 1 [0106.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx") returned 0x4d [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.865] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f420 [0106.865] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1 [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX") returned 1 [0106.865] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx") returned 0x4d [0106.865] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0106.865] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0106.865] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f420, Size=0x30) returned 0x61f6c0 [0106.865] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.865] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0106.866] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0106.866] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0106.866] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1 [0106.866] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", len=0x34 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\") returned 1 [0106.866] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\") returned 0x34 [0106.866] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.866] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0106.986] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0106.986] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0106.986] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\") returned 1 [0106.986] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\") returned 0x39 [0106.986] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0106.986] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0106.987] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0107.719] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0107.719] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0107.719] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", len=0x3e | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\") returned 1 [0107.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\") returned 0x3e [0107.719] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0107.720] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0107.720] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0108.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0108.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1 [0108.429] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 1 [0108.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll") returned 0x51 [0108.430] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0108.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0108.430] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", len=0x4e | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 1 [0108.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll", cchLength=0x4e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll") returned 0x4e [0108.430] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0108.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.430] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0108.430] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1 [0108.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 1 [0108.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", cchLength=0x4d | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config") returned 0x4d [0108.430] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0108.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0108.430] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0108.430] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\_restore files_.txt"), bFailIfExists=0) returned 1 [0108.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 1 [0108.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.exe", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe") returned 0x4a [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0108.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll") returned 1 [0108.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOLoader.dll", cchLength=0x47 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll") returned 0x47 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0108.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 1 [0108.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOMessageProvider.dll", cchLength=0x50 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll") returned 0x50 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0108.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0108.433] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0108.433] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0108.433] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll") returned 1 [0108.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee.dll", cchLength=0x3e | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll") returned 0x3e [0108.434] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0108.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.434] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1 [0108.434] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb") returned 1 [0108.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb") returned 0x41 [0108.434] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0108.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0108.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0108.434] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0108.434] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\_restore files_.txt"), bFailIfExists=0) returned 1 [0109.624] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1 [0109.624] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb") returned 1 [0109.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb") returned 0x40 [0109.624] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.624] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x10) returned 0x5e92d0 [0109.624] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.625] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.625] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1 [0109.625] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", len=0x3b | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\") returned 1 [0109.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\") returned 0x3b [0109.625] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.625] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.626] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.626] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0109.626] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", len=0x40 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\") returned 1 [0109.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\") returned 0x40 [0109.626] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.626] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0109.626] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.626] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1 [0109.626] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL") returned 1 [0109.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\MSOSVINT.DLL", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\1033\\msosvint.dll") returned 0x4c [0109.626] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0109.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.626] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.627] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.627] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1 [0109.627] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL") returned 1 [0109.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\MSOSV.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web folders\\msosv.dll") returned 0x44 [0109.627] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.627] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.627] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.627] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0109.627] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", len=0x45 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\") returned 1 [0109.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\", cchLength=0x45 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\") returned 0x45 [0109.627] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.627] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.628] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.628] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0109.628] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", len=0x48 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\") returned 1 [0109.628] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\") returned 0x48 [0109.628] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.628] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0109.629] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.629] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1 [0109.629] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", len=0x4c | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\") returned 1 [0109.629] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\", cchLength=0x4c | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\") returned 0x4c [0109.629] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.629] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.629] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0109.630] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.630] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0109.630] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", len=0x51 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\") returned 1 [0109.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\", cchLength=0x51 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\") returned 0x51 [0109.630] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.630] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.630] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0109.630] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.630] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1 [0109.630] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 1 [0109.630] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", cchLength=0x5a | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg") returned 0x5a [0109.630] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0109.630] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeedaa970, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0109.631] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0109.631] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0109.633] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0109.633] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.633] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0109.633] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", len=0x58 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL") returned 1 [0109.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL", cchLength=0x58 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll") returned 0x58 [0109.633] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0109.633] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.633] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1 [0109.633] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll", psz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL") returned 1 [0109.633] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPWEC.DLL", cchLength=0x55 | out: lpsz="c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpwec.dll") returned 0x55 [0109.633] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0109.633] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.633] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.633] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.633] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.633] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.634] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.634] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.634] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.634] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0109.634] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d9b940, ftCreationTime.dwHighDateTime=0x1d52824, ftLastAccessTime.dwLowDateTime=0x67233390, ftLastAccessTime.dwHighDateTime=0x1d4e1fe, ftLastWriteTime.dwLowDateTime=0x67233390, ftLastWriteTime.dwHighDateTime=0x1d4e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmentepainstitutional.exe", cAlternateFileName="SEGMEN~1.EXE")) returned 1 [0109.634] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Program Files\\Common Files\\segmentepainstitutional.exe", len=0x39 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\Common Files\\segmentepainstitutional.exe") returned 1 [0109.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\segmentepainstitutional.exe", cchLength=0x39 | out: lpsz="c:\\program files\\common files\\segmentepainstitutional.exe") returned 0x39 [0109.634] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0109.634] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.634] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0109.634] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Common Files\\Services\\", len=0x27 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Common Files\\Services\\") returned 1 [0109.634] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\", cchLength=0x27 | out: lpsz="c:\\program files\\common files\\services\\") returned 0x27 [0109.634] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.634] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.634] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0109.635] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.635] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0109.635] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 1 [0109.635] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\Services\\verisign.bmp", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\services\\verisign.bmp") returned 0x33 [0109.635] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0109.635] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.635] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd85ef28, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0109.635] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.635] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\services\\_restore files_.txt"), bFailIfExists=0) returned 1 [0109.637] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0109.637] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.637] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0109.637] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0109.637] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\", len=0x2c | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Common Files\\SpeechEngines\\") returned 1 [0109.637] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\speechengines\\") returned 0x2c [0109.637] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.637] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0109.638] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.638] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0109.638] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", len=0x36 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned 1 [0109.638] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\") returned 0x36 [0109.638] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.638] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.641] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.641] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0109.641] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned 1 [0109.641] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\", cchLength=0x3c | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\") returned 0x3c [0109.641] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.641] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0109.642] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.642] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.642] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", len=0x42 | out: pbstr=0x6a0e888*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned 1 [0109.642] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\") returned 0x42 [0109.642] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.642] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0109.642] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.642] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0109.642] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", len=0x4a | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned 1 [0109.642] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\", cchLength=0x4a | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\") returned 0x4a [0109.642] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.642] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.642] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0109.643] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.643] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.643] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0109.643] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0109.643] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll") returned 1 [0109.643] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSFrontendENU.dll", cchLength=0x56 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll") returned 0x56 [0109.643] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0109.643] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.643] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0109.643] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsfrontendenu.dll", psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui") returned 1 [0109.643] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\MSTTSLoc.dll.mui", cchLength=0x52 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\msttsloc.dll.mui") returned 0x52 [0109.643] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0109.643] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.643] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.643] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0109.643] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0109.643] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll") returned 1 [0109.643] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSCommon.dll", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll") returned 0x4b [0109.644] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0109.644] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.644] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0109.644] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttscommon.dll", psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll") returned 1 [0109.644] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSEngine.dll", cchLength=0x4b | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll") returned 0x4b [0109.644] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0109.644] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.644] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0109.644] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsengine.dll", psz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll") returned 1 [0109.644] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\MSTTSLoc.dll", cchLength=0x48 | out: lpsz="c:\\program files\\common files\\speechengines\\microsoft\\tts20\\msttsloc.dll") returned 0x48 [0109.644] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0109.644] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.644] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.644] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.644] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.644] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.644] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.644] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0109.644] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0109.644] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Common Files\\System\\", len=0x25 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Common Files\\System\\") returned 1 [0109.644] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\", cchLength=0x25 | out: lpsz="c:\\program files\\common files\\system\\") returned 0x25 [0109.644] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.645] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0109.647] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.647] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1 [0109.647] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\", len=0x29 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\System\\ado\\") returned 1 [0109.647] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\", cchLength=0x29 | out: lpsz="c:\\program files\\common files\\system\\ado\\") returned 0x29 [0109.647] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.647] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.648] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.649] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x0, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1 [0109.649] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 1 [0109.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\adojavas.inc") returned 0x35 [0109.649] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd85ef28, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0109.649] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.649] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\system\\ado\\_restore files_.txt"), bFailIfExists=0) returned 1 [0109.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x14) returned 0x5a5888 [0109.652] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x0, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1 [0109.652] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\adojavas.inc", psz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", len=0x33 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 1 [0109.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\system\\ado\\adovbs.inc") returned 0x33 [0109.652] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.652] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.652] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0109.652] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.652] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", len=0x2f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\System\\ado\\en-US\\") returned 1 [0109.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\", cchLength=0x2f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\") returned 0x2f [0109.652] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.652] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0109.653] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.653] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 1 [0109.653] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui", cchLength=0x3f | out: lpsz="c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui") returned 0x3f [0109.653] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0109.653] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.653] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.653] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.653] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\adovbs.inc", psz="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 1 [0109.653] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msader15.dll") returned 0x35 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.653] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.653] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msader15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 1 [0109.653] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado15.dll") returned 0x34 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.653] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.653] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1 [0109.653] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 1 [0109.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado20.tlb") returned 0x34 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x6150c8 [0109.654] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado20.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 1 [0109.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado21.tlb") returned 0x34 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6150c8, Size=0x20) returned 0x615078 [0109.654] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado21.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 1 [0109.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado25.tlb") returned 0x34 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0109.654] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado25.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 1 [0109.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado26.tlb") returned 0x34 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0109.654] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1 [0109.654] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado26.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 1 [0109.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado27.tlb") returned 0x34 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f7a0 [0109.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado27.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 1 [0109.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msado28.tlb") returned 0x34 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f7a0, Size=0x30) returned 0x61f420 [0109.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msado28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll", len=0x34 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll") returned 1 [0109.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll", cchLength=0x34 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadomd.dll") returned 0x34 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msadomd.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 1 [0109.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadomd28.tlb") returned 0x36 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f420, Size=0x34) returned 0x5b9630 [0109.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1 [0109.655] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msadomd28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll") returned 1 [0109.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msador15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msador15.dll") returned 0x35 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msador15.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", len=0x33 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll") returned 1 [0109.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadox.dll", cchLength=0x33 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadox.dll") returned 0x33 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msadox.dll", psz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb") returned 1 [0109.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadox28.tlb") returned 0x35 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x38) returned 0x5b9730 [0109.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ado\\msadox28.tlb", psz="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll") returned 1 [0109.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ado\\msadrh15.dll") returned 0x35 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.656] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.656] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\Common Files\\System\\DirectDB.dll", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Common Files\\System\\DirectDB.dll") returned 1 [0109.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\DirectDB.dll", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\directdb.dll") returned 0x31 [0109.656] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0109.657] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.657] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.657] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\System\\en-US\\", len=0x2b | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\System\\en-US\\") returned 1 [0109.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\en-us\\") returned 0x2b [0109.657] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.657] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.657] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.657] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.657] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1 [0109.657] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui") returned 1 [0109.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui", cchLength=0x3b | out: lpsz="c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui") returned 0x3b [0109.657] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.657] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.657] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0109.657] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0109.657] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1 [0109.657] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\", len=0x2b | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\System\\msadc\\") returned 1 [0109.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\", cchLength=0x2b | out: lpsz="c:\\program files\\common files\\system\\msadc\\") returned 0x2b [0109.657] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.658] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0109.660] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0109.660] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1 [0109.660] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 1 [0109.660] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\adcjavas.inc") returned 0x37 [0109.660] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.660] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.660] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd885082, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0109.660] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0109.660] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\system\\msadc\\_restore files_.txt"), bFailIfExists=0) returned 1 [0109.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x3c) returned 0x5b4020 [0109.662] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1 [0109.662] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\adcjavas.inc", psz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 1 [0109.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\adcvbs.inc") returned 0x35 [0109.662] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0109.662] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0109.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b4020, Size=0x40) returned 0x5b4140 [0109.662] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0109.662] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", len=0x31 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\") returned 1 [0109.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\") returned 0x31 [0109.662] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0109.663] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0109.663] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0110.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0110.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1 [0110.443] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui") returned 1 [0110.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui") returned 0x40 [0110.443] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui") returned 1 [0110.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcfr.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui") returned 0x40 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\msadc\\en-us\\msadcfr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui") returned 1 [0110.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui") returned 0x40 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui") returned 1 [0110.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui", cchLength=0x40 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui") returned 0x40 [0110.447] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1 [0110.448] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui") returned 1 [0110.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui") returned 0x41 [0110.448] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1 [0110.448] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui") returned 1 [0110.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui") returned 0x41 [0110.448] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0110.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.448] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0110.449] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x0, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1 [0110.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\adcvbs.inc", psz="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg") returned 1 [0110.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\handler.reg") returned 0x36 [0110.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.449] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x0, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1 [0110.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\handler.reg", psz="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg") returned 1 [0110.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\handsafe.reg") returned 0x37 [0110.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94c8, Size=0x10) returned 0x5e9510 [0110.449] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0110.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\handsafe.reg", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll") returned 1 [0110.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadce.dll") returned 0x35 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.450] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadce.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll") returned 1 [0110.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcer.dll") returned 0x36 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.450] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadcer.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll") returned 1 [0110.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcf.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcf.dll") returned 0x35 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.450] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadcf.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll") returned 1 [0110.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcfr.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcfr.dll") returned 0x36 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.450] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadcfr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll") returned 1 [0110.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadco.dll") returned 0x35 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.450] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1 [0110.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadco.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll") returned 1 [0110.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcor.dll") returned 0x36 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.451] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadcor.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll") returned 1 [0110.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadcs.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadcs.dll") returned 0x35 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.451] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadcs.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll") returned 1 [0110.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msadds.dll") returned 0x35 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.451] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msadds.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll") returned 1 [0110.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msaddsr.dll") returned 0x36 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.451] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msaddsr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll") returned 1 [0110.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaprsr.dll") returned 0x37 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.451] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1 [0110.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msdaprsr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll") returned 1 [0110.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaprst.dll") returned 0x37 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.452] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msdaprst.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll") returned 1 [0110.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdarem.dll") returned 0x36 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.452] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msdarem.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll") returned 1 [0110.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdaremr.dll") returned 0x37 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.452] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\msadc\\msdaremr.dll", psz="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll") returned 1 [0110.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\msadc\\msdfmap.dll") returned 0x36 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0110.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0110.452] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0110.452] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0110.452] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1 [0110.452] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", len=0x2c | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\System\\MSMAPI\\") returned 1 [0110.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\msmapi\\") returned 0x2c [0110.452] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0110.453] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0110.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0111.161] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.161] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0111.162] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", len=0x31 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\") returned 1 [0111.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\") returned 0x31 [0111.162] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.162] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.162] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0111.162] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.162] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1 [0111.162] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL", len=0x3d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL") returned 1 [0111.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\MSMAPI32.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\common files\\system\\msmapi\\1033\\msmapi32.dll") returned 0x3d [0111.162] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.162] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.163] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.163] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.163] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.163] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0111.163] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\", len=0x2c | out: pbstr=0x6a0ee18*="C:\\Program Files\\Common Files\\System\\Ole DB\\") returned 1 [0111.163] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\", cchLength=0x2c | out: lpsz="c:\\program files\\common files\\system\\ole db\\") returned 0x2c [0111.163] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.163] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0111.587] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.587] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0111.587] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", len=0x32 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\") returned 1 [0111.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\", cchLength=0x32 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\") returned 0x32 [0111.587] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.587] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0111.587] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.587] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1 [0111.587] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui") returned 1 [0111.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui") returned 0x42 [0111.588] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.588] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1 [0111.588] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui") returned 1 [0111.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui") returned 0x42 [0111.588] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.588] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1 [0111.588] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui") returned 1 [0111.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", cchLength=0x42 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui") returned 0x42 [0111.588] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.588] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x1eab37af, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0111.588] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.588] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.702] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1 [0111.702] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui") returned 1 [0111.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", cchLength=0x41 | out: lpsz="c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui") returned 0x41 [0111.702] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e94c8, Size=0x10) returned 0x5e9510 [0111.702] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.702] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.702] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll") returned 1 [0111.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdaosp.dll") returned 0x37 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.703] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msdaosp.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll") returned 1 [0111.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll", cchLength=0x36 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdaps.dll") returned 0x36 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.703] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msdaps.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll") returned 1 [0111.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdasql.dll") returned 0x37 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.703] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msdasql.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll") returned 1 [0111.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdasqlr.dll") returned 0x38 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.703] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msdasqlr.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll") returned 1 [0111.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msdatl3.dll") returned 0x37 [0111.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.704] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msdatl3.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll") returned 1 [0111.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\msxactps.dll") returned 0x38 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.704] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\msxactps.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 1 [0111.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledb32.dll") returned 0x37 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.704] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\oledb32.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 1 [0111.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledb32r.dll") returned 0x38 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.704] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\oledb32r.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 1 [0111.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledbjvs.inc") returned 0x38 [0111.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0111.704] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.704] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\common files\\system\\ole db\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x14) returned 0x5a5888 [0111.707] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\oledbjvs.inc", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 1 [0111.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\oledbvbs.inc") returned 0x38 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.707] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\oledbvbs.inc", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 1 [0111.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqloledb.dll") returned 0x38 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.707] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\sqloledb.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 1 [0111.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqloledb.rll") returned 0x38 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x6150c8 [0111.707] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\sqloledb.rll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 1 [0111.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll") returned 0x37 [0111.707] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.707] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 1 [0111.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", cchLength=0x37 | out: lpsz="c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll") returned 0x37 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.708] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6150c8, Size=0x20) returned 0x615078 [0111.708] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll", len=0x35 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll") returned 1 [0111.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrw.dll", cchLength=0x35 | out: lpsz="c:\\program files\\common files\\system\\ole db\\xmlrw.dll") returned 0x35 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.708] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x0, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\common files\\system\\ole db\\xmlrw.dll", psz="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll") returned 1 [0111.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\Ole DB\\xmlrwbin.dll", cchLength=0x38 | out: lpsz="c:\\program files\\common files\\system\\ole db\\xmlrwbin.dll") returned 0x38 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.708] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.708] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.708] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\common files\\system\\directdb.dll", psz="C:\\Program Files\\Common Files\\System\\wab32.dll", len=0x2e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 1 [0111.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\wab32.dll", cchLength=0x2e | out: lpsz="c:\\program files\\common files\\system\\wab32.dll") returned 0x2e [0111.708] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.708] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1 [0111.708] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\common files\\system\\wab32.dll", psz="C:\\Program Files\\Common Files\\System\\wab32res.dll", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 1 [0111.709] CharLowerBuffW (in: lpsz="C:\\Program Files\\Common Files\\System\\wab32res.dll", cchLength=0x31 | out: lpsz="c:\\program files\\common files\\system\\wab32res.dll") returned 0x31 [0111.709] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.709] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.709] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.709] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0111.711] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.711] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0111.711] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0111.712] SysReAllocStringLen (in: pbstr=0x6a0f668*=0x0, psz="C:\\Program Files\\desktop.ini", len=0x1c | out: pbstr=0x6a0f668*="C:\\Program Files\\desktop.ini") returned 1 [0111.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\desktop.ini", cchLength=0x1c | out: lpsz="c:\\program files\\desktop.ini") returned 0x1c [0111.712] SysReAllocStringLen (in: pbstr=0x6a0f608*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f608*="_RESTORE FILES_.txt") returned 1 [0111.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0f374 | out: lpFindFileData=0x6a0f374*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b95f0 [0111.712] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0111.712] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.781] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x437886e0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437886e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0111.781] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Program Files\\DVD Maker\\", len=0x1b | out: pbstr=0x6a0f3a8*="C:\\Program Files\\DVD Maker\\") returned 1 [0111.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\", cchLength=0x1b | out: lpsz="c:\\program files\\dvd maker\\") returned 0x1b [0111.781] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.781] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.781] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x437886e0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437886e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0111.781] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x437886e0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437886e0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.781] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x0, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1 [0111.781] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", len=0x31 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax") returned 1 [0111.781] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\audiodepthconverter.ax") returned 0x31 [0111.781] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.781] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0f0ac | out: lpFindFileData=0x6a0f0ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x80046d91, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9670 [0111.781] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0111.781] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.783] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.783] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\audiodepthconverter.ax", psz="C:\\Program Files\\DVD Maker\\bod_r.TTF", len=0x24 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\bod_r.TTF") returned 1 [0111.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\bod_r.TTF", cchLength=0x24 | out: lpsz="c:\\program files\\dvd maker\\bod_r.ttf") returned 0x24 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.784] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.784] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.784] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b641160, ftCreationTime.dwHighDateTime=0x1d4d09b, ftLastAccessTime.dwLowDateTime=0x42ddd550, ftLastAccessTime.dwHighDateTime=0x1d4de19, ftLastWriteTime.dwLowDateTime=0x42ddd550, ftLastWriteTime.dwHighDateTime=0x1d4de19, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="bracelet_dv.exe", cAlternateFileName="BRACEL~1.EXE")) returned 1 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\bod_r.ttf", psz="C:\\Program Files\\DVD Maker\\bracelet_dv.exe", len=0x2a | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\bracelet_dv.exe") returned 1 [0111.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\bracelet_dv.exe", cchLength=0x2a | out: lpsz="c:\\program files\\dvd maker\\bracelet_dv.exe") returned 0x2a [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.784] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.784] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\bracelet_dv.exe", psz="C:\\Program Files\\DVD Maker\\directshowtap.ax", len=0x2b | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\directshowtap.ax") returned 1 [0111.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\directshowtap.ax", cchLength=0x2b | out: lpsz="c:\\program files\\dvd maker\\directshowtap.ax") returned 0x2b [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.784] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.784] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.784] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\directshowtap.ax", psz="C:\\Program Files\\DVD Maker\\DVDMaker.exe", len=0x27 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\DVDMaker.exe") returned 1 [0111.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\DVDMaker.exe", cchLength=0x27 | out: lpsz="c:\\program files\\dvd maker\\dvdmaker.exe") returned 0x27 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.784] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.784] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0111.784] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\DVD Maker\\en-US\\", len=0x21 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\DVD Maker\\en-US\\") returned 1 [0111.784] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\", cchLength=0x21 | out: lpsz="c:\\program files\\dvd maker\\en-us\\") returned 0x21 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.785] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0111.785] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.785] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui") returned 1 [0111.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\DVDMaker.exe.mui", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui") returned 0x31 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.785] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.785] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\en-us\\dvdmaker.exe.mui", psz="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui") returned 1 [0111.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\OmdProject.dll.mui", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui") returned 0x33 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.785] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.785] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\en-us\\omdproject.dll.mui", psz="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui") returned 1 [0111.785] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\en-US\\WMM2CLIP.dll.mui", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\en-us\\wmm2clip.dll.mui") returned 0x31 [0111.785] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.786] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.786] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.786] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0111.840] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\dvdmaker.exe", psz="C:\\Program Files\\DVD Maker\\Eurosti.TTF", len=0x26 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\Eurosti.TTF") returned 1 [0111.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Eurosti.TTF", cchLength=0x26 | out: lpsz="c:\\program files\\dvd maker\\eurosti.ttf") returned 0x26 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.840] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.840] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\eurosti.ttf", psz="C:\\Program Files\\DVD Maker\\fieldswitch.ax", len=0x29 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\fieldswitch.ax") returned 1 [0111.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\fieldswitch.ax", cchLength=0x29 | out: lpsz="c:\\program files\\dvd maker\\fieldswitch.ax") returned 0x29 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.840] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.840] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.840] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\fieldswitch.ax", psz="C:\\Program Files\\DVD Maker\\offset.ax", len=0x24 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\offset.ax") returned 1 [0111.840] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\offset.ax", cchLength=0x24 | out: lpsz="c:\\program files\\dvd maker\\offset.ax") returned 0x24 [0111.840] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.840] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.840] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.840] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\offset.ax", psz="C:\\Program Files\\DVD Maker\\OmdBase.dll", len=0x26 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\OmdBase.dll") returned 1 [0111.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\OmdBase.dll", cchLength=0x26 | out: lpsz="c:\\program files\\dvd maker\\omdbase.dll") returned 0x26 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.841] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x0, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\omdbase.dll", psz="C:\\Program Files\\DVD Maker\\OmdProject.dll", len=0x29 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\OmdProject.dll") returned 1 [0111.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\OmdProject.dll", cchLength=0x29 | out: lpsz="c:\\program files\\dvd maker\\omdproject.dll") returned 0x29 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.841] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\omdproject.dll", psz="C:\\Program Files\\DVD Maker\\Pipeline.dll", len=0x27 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\Pipeline.dll") returned 1 [0111.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Pipeline.dll", cchLength=0x27 | out: lpsz="c:\\program files\\dvd maker\\pipeline.dll") returned 0x27 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.841] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\pipeline.dll", psz="C:\\Program Files\\DVD Maker\\PipeTran.dll", len=0x27 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\PipeTran.dll") returned 1 [0111.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\PipeTran.dll", cchLength=0x27 | out: lpsz="c:\\program files\\dvd maker\\pipetran.dll") returned 0x27 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.841] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1 [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\pipetran.dll", psz="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", len=0x2a | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\rtstreamsink.ax") returned 1 [0111.841] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", cchLength=0x2a | out: lpsz="c:\\program files\\dvd maker\\rtstreamsink.ax") returned 0x2a [0111.841] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.841] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.842] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1 [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\rtstreamsink.ax", psz="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", len=0x2c | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\rtstreamsource.ax") returned 1 [0111.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\rtstreamsource.ax") returned 0x2c [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0111.842] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x0, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1 [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\rtstreamsource.ax", psz="C:\\Program Files\\DVD Maker\\SecretST.TTF", len=0x27 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\SecretST.TTF") returned 1 [0111.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\SecretST.TTF", cchLength=0x27 | out: lpsz="c:\\program files\\dvd maker\\secretst.ttf") returned 0x27 [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0111.842] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.842] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0111.842] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1 [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\", len=0x22 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\DVD Maker\\Shared\\") returned 1 [0111.842] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\", cchLength=0x22 | out: lpsz="c:\\program files\\dvd maker\\shared\\") returned 0x22 [0111.842] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.842] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.842] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0111.871] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.871] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0111.871] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", len=0x2c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh") returned 1 [0111.871] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\common.fxh") returned 0x2c [0111.871] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.871] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x80046d91, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0111.872] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0111.872] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.874] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1 [0111.874] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\shared\\common.fxh", psz="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 1 [0111.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dissolveanother.png") returned 0x35 [0111.874] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.874] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.874] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x0, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1 [0111.874] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\shared\\dissolveanother.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 1 [0111.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dissolvenoise.png") returned 0x33 [0111.874] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0111.874] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.874] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.874] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1 [0111.874] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", len=0x2c | out: pbstr=0x6a0ee18*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\") returned 1 [0111.874] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\", cchLength=0x2c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\") returned 0x2c [0111.874] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.874] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.874] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0111.876] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.877] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0111.877] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 1 [0111.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png") returned 0x4e [0111.877] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.877] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.877] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f0852f1, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0111.877] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.877] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.880] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0111.880] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", len=0x54 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 1 [0111.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", cchLength=0x54 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png") returned 0x54 [0111.880] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0111.880] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0111.880] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 1 [0111.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png") returned 0x4b [0111.880] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0111.880] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0111.880] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 1 [0111.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png") returned 0x4d [0111.880] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0111.880] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0111.880] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 1 [0111.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png") returned 0x53 [0111.881] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0111.881] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0111.881] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 1 [0111.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png") returned 0x4a [0111.881] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f880 [0111.881] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0111.881] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", len=0x34 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\") returned 1 [0111.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\") returned 0x34 [0111.881] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.881] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0111.883] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.883] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0111.883] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 1 [0111.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", cchLength=0x40 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png") returned 0x40 [0111.883] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.883] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f9e8c42, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0111.891] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.891] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 1 [0111.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv") returned 0x4d [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 1 [0111.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv") returned 0x51 [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 1 [0111.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", cchLength=0x54 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv") returned 0x54 [0111.896] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 1 [0111.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv") returned 0x58 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0111.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 1 [0111.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv") returned 0x55 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0111.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv") returned 1 [0111.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv") returned 0x59 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0111.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 1 [0111.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv") returned 0x4e [0111.897] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0111.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv") returned 1 [0111.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv") returned 0x52 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0111.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 1 [0111.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv") returned 0x4f [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x30) returned 0x61f928 [0111.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 1 [0111.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv") returned 0x53 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f928, Size=0x34) returned 0x5b9730 [0111.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0111.898] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 1 [0111.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png") returned 0x4a [0111.899] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96b0 [0111.899] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0111.899] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png") returned 1 [0111.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png") returned 0x4a [0111.899] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61ab70 [0111.899] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0111.899] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png") returned 1 [0111.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png") returned 0x45 [0111.899] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0111.908] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0111.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png") returned 1 [0111.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png") returned 0x45 [0111.908] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0111.908] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0111.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png") returned 1 [0111.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png") returned 0x46 [0111.908] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0111.908] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0111.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 1 [0111.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png") returned 0x43 [0111.909] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0111.909] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.909] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.909] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0111.909] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\") returned 1 [0111.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\") returned 0x35 [0111.909] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.909] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.909] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0111.923] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0111.923] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0111.923] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned 1 [0111.923] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png") returned 0x4e [0111.923] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.923] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa12338ef, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0111.925] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0111.925] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\_restore files_.txt"), bFailIfExists=0) returned 1 [0111.929] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0111.929] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png") returned 1 [0111.929] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png") returned 0x4d [0111.929] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.929] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.929] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.930] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png") returned 1 [0111.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png") returned 0x4e [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.930] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.930] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png") returned 1 [0111.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png") returned 0x41 [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.930] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.930] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png") returned 1 [0111.930] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png") returned 0x43 [0111.930] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.930] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.930] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0111.930] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0111.934] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv") returned 1 [0111.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv") returned 0x4e [0111.934] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.934] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.934] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0111.934] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv") returned 1 [0111.934] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv") returned 0x52 [0111.934] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0111.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv") returned 1 [0111.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv") returned 0x4c [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0111.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv") returned 1 [0111.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", cchLength=0x50 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv") returned 0x50 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0111.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png") returned 1 [0111.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png") returned 0x48 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0111.935] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0111.935] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 1 [0111.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png") returned 0x48 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0111.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 1 [0111.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png") returned 0x4c [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0111.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png") returned 1 [0111.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png") returned 0x49 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0111.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png") returned 1 [0111.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png") returned 0x48 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0111.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png") returned 1 [0111.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png") returned 0x4b [0111.936] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x30) returned 0x61f848 [0111.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png") returned 1 [0111.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png") returned 0x4b [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x34) returned 0x5b9730 [0111.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png") returned 1 [0111.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png") returned 0x41 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96b0 [0111.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv") returned 1 [0111.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv") returned 0x4d [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61ab70 [0111.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv") returned 1 [0111.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv") returned 0x51 [0111.937] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.938] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ab70, Size=0x40) returned 0x61abb8 [0111.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv") returned 1 [0111.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv") returned 0x4b [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.938] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x44) returned 0x596828 [0111.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv") returned 1 [0111.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv") returned 0x4f [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.938] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0111.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv") returned 1 [0111.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv") returned 0x49 [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.938] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.938] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1ae8 [0111.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv") returned 1 [0111.938] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv") returned 0x4d [0111.938] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.939] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x50) returned 0x5e1930 [0111.939] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png") returned 1 [0111.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png") returned 0x42 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.939] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1930, Size=0x54) returned 0x5a47d8 [0111.939] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png") returned 1 [0111.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png") returned 0x47 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.939] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0111.939] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png") returned 1 [0111.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png") returned 0x45 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.939] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.939] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c563f8 [0111.939] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0111.939] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png") returned 1 [0111.939] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png") returned 0x44 [0111.940] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0111.940] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c563f8, Size=0x60) returned 0x6c56530 [0111.940] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0111.940] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0111.940] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0111.940] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp") returned 1 [0111.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", cchLength=0x3e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp") returned 0x3e [0111.940] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.940] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56530, Size=0x64) returned 0x6f09578 [0111.940] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0111.940] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 1 [0111.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png") returned 0x41 [0111.940] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.940] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0111.940] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0111.940] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 1 [0111.940] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png") returned 0x4f [0111.940] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.940] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.940] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x6c) returned 0x6f1b190 [0111.941] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png") returned 1 [0111.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png") returned 0x46 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.941] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b190, Size=0x70) returned 0x6f1b0a0 [0111.941] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 1 [0111.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png") returned 0x44 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.941] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x74) returned 0x5d6058 [0111.941] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 1 [0111.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp") returned 0x46 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.941] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x78) returned 0x5d6258 [0111.941] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0111.941] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 1 [0111.941] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png") returned 0x4b [0111.941] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.941] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.941] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x7c) returned 0x5f98e8 [0111.942] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 1 [0111.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png") returned 0x4b [0111.942] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.942] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f98e8, Size=0x80) returned 0x5f9f48 [0111.942] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 1 [0111.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png") returned 0x41 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.942] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9f48, Size=0x84) returned 0x61b4b0 [0111.942] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp") returned 1 [0111.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp") returned 0x3f [0111.942] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.942] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x88) returned 0x61b540 [0111.942] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", len=0x33 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png") returned 1 [0111.942] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png") returned 0x33 [0111.942] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.942] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.942] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x8c) returned 0x61daa8 [0111.943] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0111.943] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx") returned 1 [0111.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx") returned 0x3b [0111.943] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0111.943] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0111.943] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61daa8, Size=0x90) returned 0x61db40 [0111.943] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1 [0111.943] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\") returned 1 [0111.943] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\") returned 0x35 [0111.943] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0111.943] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0111.943] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0112.012] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.012] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.013] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned 1 [0112.013] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png") returned 0x46 [0112.013] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.013] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.013] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f43efc8, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.013] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.013] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.017] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0112.017] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png") returned 1 [0112.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png") returned 0x48 [0112.017] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.017] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png") returned 0x55 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png") returned 0x5b [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png") returned 1 [0112.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png") returned 0x56 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png") returned 0x5c [0112.018] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.019] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.019] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png") returned 1 [0112.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png") returned 0x53 [0112.019] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.019] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.019] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png") returned 0x59 [0112.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1 [0112.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.019] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.019] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1 [0112.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0112.038] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.038] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.039] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa1a3fc59, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.039] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.039] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.041] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.041] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", len=0x3d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 1 [0112.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", cchLength=0x3d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png") returned 0x3d [0112.041] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.042] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png") returned 1 [0112.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png") returned 0x44 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.042] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 1 [0112.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png") returned 0x45 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.042] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x0, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", len=0x39 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 1 [0112.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", cchLength=0x39 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png") returned 0x39 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.042] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png") returned 0x51 [0112.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.043] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png") returned 0x57 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.043] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 1 [0112.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png") returned 0x52 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.043] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png") returned 0x58 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0112.043] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 1 [0112.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png") returned 0x4f [0112.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x30) returned 0x61f848 [0112.044] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png") returned 0x55 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x34) returned 0x5b9630 [0112.044] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png") returned 1 [0112.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png") returned 0x47 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x38) returned 0x5b9730 [0112.044] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.044] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.044] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png") returned 1 [0112.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png") returned 0x43 [0112.044] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x3c) returned 0x61ab70 [0112.044] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp") returned 1 [0112.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp") returned 0x45 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ab70, Size=0x40) returned 0x61abb8 [0112.045] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png") returned 1 [0112.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png") returned 0x49 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x44) returned 0x596828 [0112.045] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png") returned 1 [0112.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", cchLength=0x40 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png") returned 0x40 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.045] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\") returned 1 [0112.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\") returned 0x35 [0112.045] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.045] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0112.069] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.069] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.069] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png") returned 1 [0112.069] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png") returned 0x46 [0112.069] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.069] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa0fd11ff, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0112.069] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.069] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.072] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.072] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png") returned 1 [0112.072] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png") returned 0x41 [0112.072] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.072] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.072] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.073] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png") returned 1 [0112.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png") returned 0x43 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.073] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.073] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.073] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x0, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png") returned 1 [0112.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png") returned 0x4b [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.073] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.073] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.073] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png") returned 0x55 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.073] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.073] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.073] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png") returned 0x5b [0112.073] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.073] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.074] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png") returned 1 [0112.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png") returned 0x56 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.074] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.074] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png") returned 0x5c [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.074] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.074] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png") returned 1 [0112.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png") returned 0x53 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.074] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.074] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0112.074] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.074] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png") returned 0x59 [0112.074] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.074] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x30) returned 0x61f848 [0112.075] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1 [0112.075] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png") returned 1 [0112.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png") returned 0x45 [0112.075] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.075] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.075] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x34) returned 0x5b9730 [0112.075] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.075] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.075] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1 [0112.075] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", len=0x3a | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\") returned 1 [0112.075] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\", cchLength=0x3a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\") returned 0x3a [0112.075] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.075] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.083] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.083] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.083] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png") returned 1 [0112.083] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png") returned 0x4b [0112.083] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.083] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa19a729d, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.083] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.083] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.085] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0112.085] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png") returned 1 [0112.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png") returned 0x4d [0112.085] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.085] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.085] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.085] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1 [0112.085] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 1 [0112.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png") returned 0x49 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.086] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.086] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png") returned 1 [0112.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png") returned 0x44 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.086] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.086] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", cchLength=0x5a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png") returned 0x5a [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.086] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.086] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.086] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", len=0x60 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.086] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", cchLength=0x60 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png") returned 0x60 [0112.086] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.086] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.090] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.090] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png") returned 0x5b [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.090] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.090] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.090] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", len=0x61 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.090] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", cchLength=0x61 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png") returned 0x61 [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.090] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.090] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.090] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.090] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png") returned 0x58 [0112.090] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.090] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.091] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.091] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.091] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", len=0x5e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.091] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", cchLength=0x5e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png") returned 0x5e [0112.091] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.091] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.091] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.091] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.091] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.091] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0112.097] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\") returned 1 [0112.097] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\") returned 0x35 [0112.097] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.097] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.097] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.099] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.099] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0112.099] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png") returned 1 [0112.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png") returned 0x4e [0112.100] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.100] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9fbd8be5, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.100] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.100] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.102] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0112.102] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 1 [0112.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png") returned 0x4d [0112.102] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.102] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.105] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0112.105] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png") returned 1 [0112.105] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png") returned 0x4e [0112.105] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.105] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.105] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.105] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1 [0112.105] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png") returned 1 [0112.105] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png") returned 0x4b [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.106] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png") returned 1 [0112.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png") returned 0x43 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.106] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png") returned 1 [0112.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png") returned 0x48 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.106] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png") returned 1 [0112.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png") returned 0x48 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.106] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0112.106] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png") returned 1 [0112.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png") returned 0x4c [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.107] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png") returned 1 [0112.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png") returned 0x49 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.107] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png") returned 1 [0112.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png") returned 0x47 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f848 [0112.107] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png") returned 1 [0112.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png") returned 0x4d [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x30) returned 0x61f880 [0112.107] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1 [0112.107] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png") returned 1 [0112.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png") returned 0x4e [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.108] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b96b0 [0112.108] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png") returned 1 [0112.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png") returned 0x51 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.108] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b9630 [0112.108] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png") returned 1 [0112.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png") returned 0x42 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.108] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x3c) returned 0x61abb8 [0112.108] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png") returned 1 [0112.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png") returned 0x51 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.108] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.108] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.108] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1 [0112.108] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png") returned 1 [0112.108] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png") returned 0x4d [0112.109] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.109] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.109] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.109] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1 [0112.109] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png") returned 1 [0112.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png") returned 0x4f [0112.109] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.109] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.109] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.109] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.109] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.109] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0112.109] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png") returned 1 [0112.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png") returned 0x4c [0112.109] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.109] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.109] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.109] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.109] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.109] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png") returned 0x4c [0112.109] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.109] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.109] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.110] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", len=0x52 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png") returned 0x52 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.110] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.110] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x54) returned 0x5a47d8 [0112.110] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png") returned 0x4d [0112.110] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.110] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.110] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0112.110] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png") returned 0x53 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.110] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.110] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c563f8 [0112.110] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.110] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.110] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png") returned 0x4a [0112.110] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.110] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.111] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c563f8, Size=0x60) returned 0x6c561f0 [0112.111] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.111] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.111] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", cchLength=0x50 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png") returned 0x50 [0112.111] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.111] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.111] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x64) returned 0x6f09578 [0112.111] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1 [0112.111] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", len=0x33 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\") returned 1 [0112.111] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\") returned 0x33 [0112.111] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.111] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.111] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.112] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.113] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.113] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned 1 [0112.113] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png") returned 0x44 [0112.113] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.113] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.113] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f465237, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.113] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.113] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.115] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0112.115] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.115] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png") returned 1 [0112.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png") returned 0x3f [0112.115] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.115] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.115] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x6c) returned 0x6f1afb0 [0112.115] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x0, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1 [0112.115] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png") returned 1 [0112.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png") returned 0x46 [0112.115] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.115] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.115] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1afb0, Size=0x70) returned 0x6f1b208 [0112.115] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.115] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.115] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png") returned 0x53 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.116] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.116] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b208, Size=0x74) returned 0x5d6058 [0112.116] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.116] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png") returned 0x59 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.116] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.116] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x78) returned 0x5d6258 [0112.116] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png") returned 1 [0112.116] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", cchLength=0x54 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png") returned 0x54 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.116] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.116] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x7c) returned 0x5f99f8 [0112.116] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.116] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", cchLength=0x5a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png") returned 0x5a [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.116] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.116] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f99f8, Size=0x80) returned 0x5fa1f0 [0112.116] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.116] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png") returned 1 [0112.116] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png") returned 0x51 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.117] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.117] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa1f0, Size=0x84) returned 0x61b4b0 [0112.117] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png") returned 0x57 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.117] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.117] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x88) returned 0x61b540 [0112.117] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png") returned 1 [0112.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", cchLength=0x3e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png") returned 0x3e [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.117] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.117] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x8c) returned 0x61daa8 [0112.117] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.117] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.117] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", len=0x38 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\") returned 1 [0112.117] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\") returned 0x38 [0112.117] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.117] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.120] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0112.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1 [0112.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png") returned 1 [0112.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png") returned 0x4e [0112.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f4fdbf3, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0112.142] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.142] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.144] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png") returned 1 [0112.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png") returned 0x4e [0112.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png") returned 1 [0112.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png") returned 0x57 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv") returned 1 [0112.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv") returned 0x46 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv") returned 1 [0112.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv") returned 0x4a [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png") returned 1 [0112.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", cchLength=0x50 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png") returned 0x50 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.146] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png") returned 1 [0112.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png") returned 0x57 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.146] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x0, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png") returned 1 [0112.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png") returned 0x47 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.146] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png") returned 1 [0112.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png") returned 0x4d [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f848 [0112.146] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1 [0112.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png") returned 1 [0112.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png") returned 0x53 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x30) returned 0x61f880 [0112.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png") returned 1 [0112.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png") returned 0x52 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b9730 [0112.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png") returned 1 [0112.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png") returned 0x57 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96b0 [0112.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x0, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png") returned 1 [0112.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png") returned 0x43 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61abb8 [0112.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1 [0112.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv") returned 1 [0112.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv") returned 0x46 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv") returned 1 [0112.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv") returned 0x4a [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png") returned 1 [0112.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png") returned 0x4b [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png") returned 1 [0112.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png") returned 0x51 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 1 [0112.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv") returned 0x46 [0112.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 1 [0112.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv") returned 0x4a [0112.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x54) returned 0x5a47d8 [0112.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv") returned 1 [0112.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv") returned 0x4d [0112.155] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.155] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61abb8 [0112.155] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 1 [0112.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv") returned 0x51 [0112.155] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.155] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.155] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 1 [0112.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv") returned 0x4d [0112.155] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.156] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv") returned 1 [0112.156] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv") returned 0x51 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.156] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 1 [0112.156] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png") returned 0x56 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.156] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 1 [0112.156] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png") returned 0x45 [0112.156] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.156] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.156] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.157] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.157] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", len=0x31 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\") returned 1 [0112.157] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\") returned 0x31 [0112.157] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.157] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0112.173] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 1 [0112.173] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv") returned 0x43 [0112.173] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.173] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa15a10e8, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.173] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.174] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.175] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0112.175] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 1 [0112.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv") returned 0x47 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv") returned 1 [0112.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv") returned 0x42 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv") returned 1 [0112.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv") returned 0x46 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png") returned 1 [0112.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png") returned 0x4e [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1 [0112.176] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png") returned 1 [0112.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png") returned 0x49 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png") returned 1 [0112.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png") returned 0x4e [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png") returned 1 [0112.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png") returned 0x49 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png") returned 1 [0112.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png") returned 0x46 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f848 [0112.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1 [0112.177] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 1 [0112.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png") returned 0x52 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x30) returned 0x61f880 [0112.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 1 [0112.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png") returned 0x4d [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b9630 [0112.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 1 [0112.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png") returned 0x46 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x38) returned 0x5b9730 [0112.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png") returned 1 [0112.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png") returned 0x49 [0112.178] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x3c) returned 0x61abb8 [0112.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png") returned 1 [0112.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png") returned 0x49 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png") returned 1 [0112.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png") returned 0x46 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png") returned 1 [0112.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png") returned 0x4e [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1 [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png") returned 1 [0112.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png") returned 0x4c [0112.179] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png") returned 1 [0112.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png") returned 0x4f [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png") returned 1 [0112.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png") returned 0x4e [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x54) returned 0x5a47d8 [0112.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png") returned 1 [0112.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png") returned 0x41 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0112.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv") returned 1 [0112.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv") returned 0x44 [0112.180] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c561f0 [0112.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0112.181] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv") returned 1 [0112.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv") returned 0x48 [0112.181] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x60) returned 0x6c563f8 [0112.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1 [0112.181] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv") returned 1 [0112.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv") returned 0x43 [0112.181] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c563f8, Size=0x64) returned 0x6f09578 [0112.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1 [0112.181] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv") returned 1 [0112.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv") returned 0x47 [0112.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0112.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1 [0112.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1 [0112.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.181] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.181] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1 [0112.182] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1 [0112.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa11287e6, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.210] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.210] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1 [0112.213] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png") returned 1 [0112.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png") returned 0x42 [0112.213] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png") returned 0x51 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png") returned 0x57 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png") returned 1 [0112.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png") returned 0x52 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png") returned 0x58 [0112.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png") returned 1 [0112.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png") returned 0x4f [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png") returned 0x55 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x0, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", len=0x39 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png") returned 1 [0112.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", cchLength=0x39 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png") returned 0x39 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f848 [0112.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x0, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png") returned 1 [0112.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png") returned 0x47 [0112.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x30) returned 0x61f880 [0112.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1 [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png") returned 1 [0112.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", cchLength=0x3e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png") returned 0x3e [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b96b0 [0112.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1 [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png") returned 1 [0112.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png") returned 0x3f [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b9630 [0112.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.216] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.216] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1 [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", len=0x37 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\") returned 1 [0112.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\", cchLength=0x37 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\") returned 0x37 [0112.216] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.216] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.223] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png") returned 1 [0112.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png") returned 0x48 [0112.223] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f38039d, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.224] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.224] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png") returned 1 [0112.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png") returned 0x49 [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png") returned 1 [0112.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png") returned 0x43 [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png") returned 1 [0112.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png") returned 0x4d [0112.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.227] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png") returned 0x57 [0112.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.228] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.228] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", len=0x5d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png") returned 0x5d [0112.228] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.229] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png") returned 1 [0112.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png") returned 0x58 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.229] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", len=0x5e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", cchLength=0x5e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png") returned 0x5e [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.229] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png") returned 1 [0112.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png") returned 0x55 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.229] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png") returned 0x5b [0112.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.230] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1 [0112.230] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png") returned 1 [0112.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png") returned 0x42 [0112.230] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.230] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1 [0112.230] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png") returned 1 [0112.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png") returned 0x42 [0112.230] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.230] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.230] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.230] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.230] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp") returned 1 [0112.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp") returned 0x4c [0112.230] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f848 [0112.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp") returned 1 [0112.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp") returned 0x49 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f848, Size=0x30) returned 0x61f880 [0112.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp") returned 1 [0112.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp") returned 0x4e [0112.231] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b9730 [0112.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp") returned 1 [0112.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp") returned 0x4f [0112.231] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b9630 [0112.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp") returned 1 [0112.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp") returned 0x49 [0112.231] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x3c) returned 0x61abb8 [0112.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.232] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp") returned 1 [0112.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp") returned 0x49 [0112.232] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.232] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp") returned 1 [0112.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp") returned 0x4b [0112.232] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.232] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp") returned 1 [0112.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp") returned 0x4d [0112.232] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.232] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp") returned 1 [0112.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp") returned 0x4e [0112.232] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1828 [0112.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.233] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp") returned 1 [0112.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp") returned 0x4a [0112.233] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1828, Size=0x50) returned 0x5e1778 [0112.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.233] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp") returned 1 [0112.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp") returned 0x4e [0112.233] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x54) returned 0x5a47d8 [0112.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1 [0112.233] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", len=0x3b | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\") returned 1 [0112.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\", cchLength=0x3b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\") returned 0x3b [0112.233] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.233] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.252] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.252] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.252] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png") returned 1 [0112.252] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png") returned 0x4c [0112.252] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.252] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa119af33, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.252] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.252] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.254] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0112.254] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png") returned 1 [0112.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png") returned 0x4e [0112.254] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.254] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1 [0112.254] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png") returned 1 [0112.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", cchLength=0x48 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png") returned 0x48 [0112.254] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.255] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x0, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1 [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png") returned 1 [0112.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png") returned 0x4a [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.255] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.255] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png") returned 0x5b [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.255] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.255] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", len=0x61 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", cchLength=0x61 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png") returned 0x61 [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.255] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.255] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png") returned 1 [0112.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png") returned 0x5c [0112.255] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.256] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.256] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.256] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", len=0x62 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", cchLength=0x62 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png") returned 0x62 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.256] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.256] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.256] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png") returned 1 [0112.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png") returned 0x59 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.256] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.256] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f880 [0112.256] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", len=0x5f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", cchLength=0x5f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png") returned 0x5f [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.256] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.256] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x30) returned 0x61f8f0 [0112.256] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1 [0112.256] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv") returned 1 [0112.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv") returned 0x49 [0112.257] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.257] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x34) returned 0x5b9630 [0112.257] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1 [0112.257] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv") returned 1 [0112.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv") returned 0x4d [0112.257] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.257] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x38) returned 0x5b96b0 [0112.257] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.257] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.257] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0112.257] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", len=0x54 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp") returned 1 [0112.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", cchLength=0x54 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp") returned 0x54 [0112.257] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.257] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x3c) returned 0x61abb8 [0112.257] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1 [0112.257] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png") returned 1 [0112.257] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png") returned 0x4d [0112.257] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.257] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.257] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.258] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0112.258] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png") returned 1 [0112.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png") returned 0x53 [0112.258] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.258] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.258] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.258] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1 [0112.258] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png") returned 1 [0112.258] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png") returned 0x4a [0112.258] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.258] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0112.262] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1 [0112.262] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", len=0x34 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\") returned 1 [0112.262] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\", cchLength=0x34 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\") returned 0x34 [0112.262] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.262] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.262] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.268] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.268] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.268] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png") returned 1 [0112.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", cchLength=0x45 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png") returned 0x45 [0112.268] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9f4d7984, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.268] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.268] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.270] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0112.270] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png") returned 1 [0112.270] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png") returned 0x47 [0112.270] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.270] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.270] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.270] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.270] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.270] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", cchLength=0x54 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png") returned 0x54 [0112.270] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.270] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.270] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.271] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png") returned 0x5a [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.271] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png") returned 1 [0112.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png") returned 0x55 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.271] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png") returned 0x5b [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.271] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.271] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png") returned 1 [0112.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png") returned 0x52 [0112.271] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.272] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", cchLength=0x58 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png") returned 0x58 [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.272] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.272] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1 [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png") returned 1 [0112.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png") returned 0x3f [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.272] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.272] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0112.272] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.272] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.272] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1 [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\") returned 1 [0112.272] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\", cchLength=0x3c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\") returned 0x3c [0112.272] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.272] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.272] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.278] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.279] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.279] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png") returned 1 [0112.279] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png") returned 0x4d [0112.279] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.279] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa1a65ec8, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.279] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.279] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.281] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1 [0112.281] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png") returned 1 [0112.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png") returned 0x4a [0112.281] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.282] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png") returned 0x5c [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.282] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", len=0x62 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", cchLength=0x62 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png") returned 0x62 [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.282] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", len=0x5d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 1 [0112.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", cchLength=0x5d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png") returned 0x5d [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.282] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.282] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", len=0x63 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", cchLength=0x63 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png") returned 0x63 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.283] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png") returned 1 [0112.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", cchLength=0x5a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png") returned 0x5a [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.283] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", len=0x60 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", cchLength=0x60 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png") returned 0x60 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.283] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x0, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png") returned 1 [0112.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png") returned 0x4c [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f458 [0112.283] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1 [0112.283] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png") returned 1 [0112.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png") returned 0x55 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f458, Size=0x30) returned 0x61f880 [0112.284] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", len=0x63 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png") returned 1 [0112.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", cchLength=0x63 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png") returned 0x63 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x34) returned 0x5b96b0 [0112.284] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", len=0x69 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png") returned 1 [0112.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", cchLength=0x69 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png") returned 0x69 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b96b0, Size=0x38) returned 0x5b9630 [0112.284] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", len=0x64 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png") returned 1 [0112.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", cchLength=0x64 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png") returned 0x64 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x3c) returned 0x61abb8 [0112.284] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.284] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", len=0x6a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png") returned 1 [0112.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", cchLength=0x6a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png") returned 0x6a [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.285] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", len=0x61 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png") returned 1 [0112.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", cchLength=0x61 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png") returned 0x61 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.285] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", len=0x67 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png") returned 1 [0112.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", cchLength=0x67 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png") returned 0x67 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.285] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png") returned 1 [0112.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png") returned 0x4f [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.285] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1 [0112.285] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png") returned 1 [0112.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png") returned 0x4d [0112.286] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.286] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.286] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1 [0112.286] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png") returned 1 [0112.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png") returned 0x51 [0112.286] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.286] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x54) returned 0x5a47d8 [0112.286] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.286] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.286] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0112.286] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", len=0x33 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\") returned 1 [0112.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\") returned 0x33 [0112.286] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.286] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.286] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.288] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.288] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1 [0112.288] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png") returned 1 [0112.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png") returned 0x47 [0112.288] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x9fdc8b88, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.288] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.288] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.296] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1 [0112.296] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png") returned 1 [0112.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png") returned 0x3f [0112.296] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.296] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0112.296] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png") returned 1 [0112.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", cchLength=0x40 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png") returned 0x40 [0112.296] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.296] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1 [0112.296] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png") returned 0x51 [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1778 [0112.297] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", cchLength=0x49 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png") returned 0x49 [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1778, Size=0x50) returned 0x5e1ae8 [0112.297] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png") returned 0x4b [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1ae8, Size=0x54) returned 0x5a47d8 [0112.297] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 1 [0112.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png") returned 0x4d [0112.297] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0112.297] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1 [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png") returned 0x4e [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c561f0 [0112.298] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1 [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", cchLength=0x4e | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png") returned 0x4e [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c561f0, Size=0x60) returned 0x6c562c0 [0112.298] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1 [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png") returned 0x4c [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c562c0, Size=0x64) returned 0x6f09578 [0112.298] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1 [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 1 [0112.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv") returned 0x4b [0112.298] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0112.298] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 1 [0112.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", cchLength=0x4f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv") returned 0x4f [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x6c) returned 0x6f1b0a0 [0112.299] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 1 [0112.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", cchLength=0x52 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv") returned 0x52 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x70) returned 0x6f1afb0 [0112.299] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 1 [0112.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv") returned 0x56 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1afb0, Size=0x74) returned 0x5d6058 [0112.299] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 1 [0112.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv") returned 0x53 [0112.299] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x78) returned 0x5d6258 [0112.300] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", cchLength=0x57 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv") returned 0x57 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x7c) returned 0x5f9f48 [0112.300] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv") returned 0x4c [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f9f48, Size=0x80) returned 0x5fa058 [0112.300] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", cchLength=0x50 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv") returned 0x50 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa058, Size=0x84) returned 0x61b4b0 [0112.300] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1 [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 1 [0112.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv") returned 0x4d [0112.300] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x88) returned 0x61b540 [0112.301] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 1 [0112.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", cchLength=0x51 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv") returned 0x51 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x8c) returned 0x61de38 [0112.301] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png") returned 1 [0112.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png") returned 0x47 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61de38, Size=0x90) returned 0x61d978 [0112.301] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.301] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.301] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\") returned 1 [0112.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\") returned 0x35 [0112.301] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.301] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.301] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0112.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.330] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png") returned 1 [0112.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png") returned 0x46 [0112.330] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa198102e, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0112.330] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.330] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1 [0112.332] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png") returned 1 [0112.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png") returned 0x47 [0112.332] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.332] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png") returned 1 [0112.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png") returned 0x41 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png") returned 1 [0112.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png") returned 0x4b [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png") returned 1 [0112.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png") returned 0x46 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png") returned 0x55 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.333] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png") returned 0x5b [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png") returned 1 [0112.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png") returned 0x56 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png") returned 0x5c [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f880 [0112.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png") returned 1 [0112.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png") returned 0x53 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x30) returned 0x61f8b8 [0112.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.334] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png") returned 0x59 [0112.335] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8b8, Size=0x34) returned 0x5b9730 [0112.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1 [0112.335] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png") returned 1 [0112.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png") returned 0x43 [0112.335] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b96b0 [0112.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.335] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.335] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1 [0112.335] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", len=0x33 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\") returned 1 [0112.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\", cchLength=0x33 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\") returned 0x33 [0112.335] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.335] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.335] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0112.343] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.343] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0112.343] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png") returned 1 [0112.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", cchLength=0x4c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png") returned 0x4c [0112.343] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa108fe2a, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.344] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.344] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png") returned 1 [0112.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", cchLength=0x4b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png") returned 0x4b [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1 [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png") returned 1 [0112.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", cchLength=0x4d | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png") returned 0x4d [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png") returned 1 [0112.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png") returned 0x46 [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0112.346] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png") returned 1 [0112.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png") returned 0x46 [0112.347] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0112.347] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png") returned 1 [0112.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", cchLength=0x4a | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png") returned 0x4a [0112.347] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1 [0112.347] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png") returned 1 [0112.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", cchLength=0x44 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png") returned 0x44 [0112.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x0, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1 [0112.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x0, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x0, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.348] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.348] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1 [0112.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0112.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0112.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa1ad8615, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0112.349] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.349] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x70) returned 0x6f1afb0 [0112.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x0, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1 [0112.351] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png") returned 1 [0112.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", cchLength=0x43 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png") returned 0x43 [0112.351] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c562c0, Size=0x64) returned 0x6f09578 [0112.355] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.355] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.355] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1 [0112.355] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", len=0x35 | out: pbstr=0x6a0eb50*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\") returned 1 [0112.355] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\", cchLength=0x35 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\") returned 0x35 [0112.355] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.355] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0112.372] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png") returned 1 [0112.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", cchLength=0x46 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png") returned 0x46 [0112.372] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.372] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xa1ad8615, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.372] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.372] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.374] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x0, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0112.374] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png") returned 1 [0112.374] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", cchLength=0x41 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png") returned 0x41 [0112.374] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.374] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.374] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e9510, Size=0x10) returned 0x5e92d0 [0112.375] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png") returned 1 [0112.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", cchLength=0x55 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png") returned 0x55 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.375] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.375] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x14) returned 0x5a5888 [0112.375] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png") returned 1 [0112.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", cchLength=0x5b | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png") returned 0x5b [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.375] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.375] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.375] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png") returned 1 [0112.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", cchLength=0x56 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png") returned 0x56 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.375] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.375] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.375] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png") returned 1 [0112.375] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", cchLength=0x5c | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png") returned 0x5c [0112.375] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.375] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.376] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png") returned 1 [0112.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", cchLength=0x53 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png") returned 0x53 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.376] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.376] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png") returned 1 [0112.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", cchLength=0x59 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png") returned 0x59 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.376] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0112.376] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png") returned 1 [0112.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png") returned 0x42 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.376] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.376] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f880 [0112.376] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png") returned 1 [0112.376] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", cchLength=0x47 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png") returned 0x47 [0112.376] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.376] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f880, Size=0x30) returned 0x61f8b8 [0112.377] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1 [0112.377] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png") returned 1 [0112.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", cchLength=0x42 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png") returned 0x42 [0112.377] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.377] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8b8, Size=0x34) returned 0x5b9630 [0112.377] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.377] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.377] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1 [0112.377] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png") returned 1 [0112.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", cchLength=0x38 | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png") returned 0x38 [0112.377] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.377] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x38) returned 0x5b9730 [0112.377] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a4bce20, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x7a4bce20, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0112.377] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png", psz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_RESTORE FILES_.txt", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_RESTORE FILES_.txt") returned 1 [0112.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\_RESTORE FILES_.txt", cchLength=0x3f | out: lpsz="c:\\program files\\dvd maker\\shared\\dvdstyles\\_restore files_.txt") returned 0x3f [0112.377] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.377] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.377] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.377] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.378] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1 [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\shared\\dissolvenoise.png", psz="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", len=0x2d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml") returned 1 [0112.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", cchLength=0x2d | out: lpsz="c:\\program files\\dvd maker\\shared\\filters.xml") returned 0x2d [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0112.378] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.378] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x3c) returned 0x61abb8 [0112.378] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1 [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\dvd maker\\shared\\filters.xml", psz="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", len=0x2b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx") returned 1 [0112.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", cchLength=0x2b | out: lpsz="c:\\program files\\dvd maker\\shared\\parity.fx") returned 0x2b [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0112.378] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.378] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0112.378] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.378] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0112.378] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x0, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1 [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\secretst.ttf", psz="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", len=0x31 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax") returned 1 [0112.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", cchLength=0x31 | out: lpsz="c:\\program files\\dvd maker\\soniccolorconverter.ax") returned 0x31 [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0112.378] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.378] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0112.378] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x0, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1 [0112.378] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\soniccolorconverter.ax", psz="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", len=0x2e | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\sonicsptransform.ax") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", cchLength=0x2e | out: lpsz="c:\\program files\\dvd maker\\sonicsptransform.ax") returned 0x2e [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0112.379] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.379] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0112.379] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1 [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f3a0*="c:\\program files\\dvd maker\\sonicsptransform.ax", psz="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll", len=0x27 | out: pbstr=0x6a0f3a0*="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\DVD Maker\\WMM2CLIP.dll", cchLength=0x27 | out: lpsz="c:\\program files\\dvd maker\\wmm2clip.dll") returned 0x27 [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0112.379] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.379] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.379] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0112.379] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Program Files\\Internet Explorer\\", len=0x23 | out: pbstr=0x6a0f3a8*="C:\\Program Files\\Internet Explorer\\") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Internet Explorer\\", cchLength=0x23 | out: lpsz="c:\\program files\\internet explorer\\") returned 0x23 [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.379] FindNextFileW (in: hFindFile=0x5b95b0, lpFindFileData=0x6a0f674 | out: lpFindFileData=0x6a0f674*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x437d49a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437d49a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\", len=0x2d | out: pbstr=0x6a0f3a8*="C:\\Program Files\\Microsoft Analysis Services\\") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\", cchLength=0x2d | out: lpsz="c:\\program files\\microsoft analysis services\\") returned 0x2d [0112.379] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.379] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x437d49a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437d49a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0112.380] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x437d49a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x437d49a0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.380] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0112.380] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", len=0x36 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned 1 [0112.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\") returned 0x36 [0112.380] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.380] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0112.380] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.380] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0112.380] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", len=0x39 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned 1 [0112.380] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\") returned 0x39 [0112.380] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.380] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.380] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0112.389] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.389] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0112.389] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", len=0x44 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned 1 [0112.389] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\") returned 0x44 [0112.389] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.389] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.394] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.394] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0112.394] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 1 [0112.394] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl") returned 0x4c [0112.394] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.394] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5146e3d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0112.395] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.395] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.397] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 1 [0112.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl") returned 0x4c [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x10) returned 0x5e92e8 [0112.397] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 1 [0112.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl") returned 0x50 [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x14) returned 0x5a5888 [0112.397] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 1 [0112.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl") returned 0x4d [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.397] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0112.397] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 1 [0112.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl") returned 0x4f [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0112.398] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 1 [0112.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl") returned 0x4d [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0112.398] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 1 [0112.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl") returned 0x4d [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0112.398] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0112.398] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 1 [0112.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl") returned 0x4e [0112.477] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0112.477] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.477] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0112.477] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0112.477] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.477] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0112.477] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll") returned 1 [0112.477] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll") returned 0x46 [0112.477] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.477] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.477] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0112.477] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll") returned 1 [0112.477] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll") returned 0x45 [0112.477] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.477] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.478] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll") returned 1 [0112.478] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll") returned 0x46 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.478] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.478] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll") returned 1 [0112.478] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolui100.dll", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\msolui100.dll") returned 0x46 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0112.478] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.478] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", len=0x43 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned 1 [0112.478] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\") returned 0x43 [0112.478] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.478] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.478] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0112.478] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.478] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0112.479] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", len=0x48 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned 1 [0112.479] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\") returned 0x48 [0112.479] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.479] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.479] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0112.648] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0112.649] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0112.649] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 1 [0112.649] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll") returned 0x53 [0112.649] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0112.649] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa1d4a90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0112.649] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0112.649] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0112.651] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll", psz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 1 [0112.651] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll") returned 0x55 [0112.651] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0112.651] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.651] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x10) returned 0x5e92e8 [0112.652] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0112.652] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0112.652] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0112.652] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0112.652] SysReAllocStringLen (in: pbstr=0x6a0f3a0*=0x0, psz="C:\\Program Files\\Microsoft Analysis Services\\robin_person.exe", len=0x3d | out: pbstr=0x6a0f3a0*="C:\\Program Files\\Microsoft Analysis Services\\robin_person.exe") returned 1 [0112.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Analysis Services\\robin_person.exe", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft analysis services\\robin_person.exe") returned 0x3d [0112.652] SysReAllocStringLen (in: pbstr=0x6a0f340*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f340*="_RESTORE FILES_.txt") returned 1 [0112.652] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0112.652] FindClose (in: hFindFile=0x5b95f0 | out: hFindFile=0x5b95f0) returned 1 [0112.652] SysReAllocStringLen (in: pbstr=0x6a0f3a8*=0x0, psz="C:\\Program Files\\Microsoft Office\\", len=0x22 | out: pbstr=0x6a0f3a8*="C:\\Program Files\\Microsoft Office\\") returned 1 [0112.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\", cchLength=0x22 | out: lpsz="c:\\program files\\microsoft office\\") returned 0x22 [0112.652] SysReAllocStringLen (in: pbstr=0x6a0f350*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f350*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.652] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.652] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x512f1610, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b95f0 [0112.652] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\", len=0x2a | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned 1 [0112.652] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\", cchLength=0x2a | out: lpsz="c:\\program files\\microsoft office\\clipart\\") returned 0x2a [0112.653] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.653] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.653] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0112.867] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned 1 [0112.867] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\") returned 0x33 [0112.867] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0112.867] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0112.867] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0113.085] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 1 [0113.085] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif") returned 0x3f [0113.085] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.085] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.085] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x512f1610, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0113.086] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0113.086] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\_restore files_.txt"), bFailIfExists=0) returned 1 [0113.291] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0113.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 1 [0113.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif") returned 0x3f [0113.291] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92d0, Size=0x10) returned 0x5e92e8 [0113.291] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0113.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 1 [0113.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif") returned 0x3f [0113.291] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e92e8, Size=0x14) returned 0x5a5888 [0113.291] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0113.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 1 [0113.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif") returned 0x3f [0113.291] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.291] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a5888, Size=0x18) returned 0x5a58e8 [0113.291] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0113.291] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 1 [0113.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif") returned 0x3f [0113.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a58e8, Size=0x1c) returned 0x615190 [0113.292] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0113.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 1 [0113.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif") returned 0x3f [0113.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615190, Size=0x20) returned 0x615078 [0113.292] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0113.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 1 [0113.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif") returned 0x3f [0113.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x615078, Size=0x24) returned 0x5dc340 [0113.292] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0113.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 1 [0113.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif") returned 0x3f [0113.292] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc340, Size=0x28) returned 0x5dc550 [0113.292] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0113.292] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 1 [0113.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif") returned 0x3f [0113.293] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5dc550, Size=0x2c) returned 0x61f8f0 [0113.293] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0113.293] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 1 [0113.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif") returned 0x3f [0113.293] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f8f0, Size=0x30) returned 0x61f810 [0113.293] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0113.293] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 1 [0113.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif") returned 0x3f [0113.293] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61f810, Size=0x34) returned 0x5b9730 [0113.293] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0113.293] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 1 [0113.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif") returned 0x3f [0113.293] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9730, Size=0x38) returned 0x5b9630 [0113.293] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0113.294] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 1 [0113.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif") returned 0x3f [0113.294] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b9630, Size=0x3c) returned 0x61abb8 [0113.294] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0113.294] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 1 [0113.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif") returned 0x3f [0113.294] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61abb8, Size=0x40) returned 0x61ac00 [0113.294] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0113.294] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 1 [0113.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif") returned 0x3f [0113.294] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ac00, Size=0x44) returned 0x596828 [0113.294] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0113.294] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 1 [0113.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif") returned 0x3f [0113.294] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596828, Size=0x48) returned 0x596cd8 [0113.295] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0113.295] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 1 [0113.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif") returned 0x3f [0113.295] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x596cd8, Size=0x4c) returned 0x5e1b40 [0113.295] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0113.295] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 1 [0113.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif") returned 0x3f [0113.295] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1b40, Size=0x50) returned 0x5e1cf8 [0113.295] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0113.295] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 1 [0113.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif") returned 0x3f [0113.295] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5e1cf8, Size=0x54) returned 0x5a47d8 [0113.295] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0113.295] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 1 [0113.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif") returned 0x3f [0113.295] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a47d8, Size=0x58) returned 0x5a4778 [0113.296] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0113.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 1 [0113.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif") returned 0x3f [0113.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5a4778, Size=0x5c) returned 0x6c56460 [0113.296] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0113.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 1 [0113.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif") returned 0x3f [0113.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56460, Size=0x60) returned 0x6c56328 [0113.296] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0113.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 1 [0113.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif") returned 0x3f [0113.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6c56328, Size=0x64) returned 0x6f09578 [0113.296] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0113.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 1 [0113.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif") returned 0x3f [0113.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09578, Size=0x68) returned 0x6f09508 [0113.297] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0113.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 1 [0113.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif") returned 0x3f [0113.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f09508, Size=0x6c) returned 0x6f1b0a0 [0113.297] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0113.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 1 [0113.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif") returned 0x3f [0113.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1b0a0, Size=0x70) returned 0x6f1afb0 [0113.297] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0113.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 1 [0113.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif") returned 0x3f [0113.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f1afb0, Size=0x74) returned 0x5d6058 [0113.297] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1 [0113.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 1 [0113.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif") returned 0x3f [0113.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6058, Size=0x78) returned 0x5d6258 [0113.298] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1 [0113.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 1 [0113.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif") returned 0x3f [0113.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5d6258, Size=0x7c) returned 0x5f99f8 [0113.298] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1 [0113.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 1 [0113.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif") returned 0x3f [0113.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f99f8, Size=0x80) returned 0x5fa1f0 [0113.298] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1 [0113.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 1 [0113.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif") returned 0x3f [0113.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5fa1f0, Size=0x84) returned 0x61b4b0 [0113.298] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1 [0113.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 1 [0113.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif") returned 0x3f [0113.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b4b0, Size=0x88) returned 0x61b540 [0113.299] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1 [0113.299] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 1 [0113.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif") returned 0x3f [0113.299] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61b540, Size=0x8c) returned 0x61ed10 [0113.299] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1 [0113.299] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 1 [0113.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif") returned 0x3f [0113.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61ed10, Size=0x90) returned 0x61eda8 [0113.300] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1 [0113.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 1 [0113.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf") returned 0x3f [0113.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61eda8, Size=0x94) returned 0x60c7d8 [0113.300] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1 [0113.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 1 [0113.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf") returned 0x3f [0113.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x60c7d8, Size=0x98) returned 0x60c878 [0113.300] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1 [0113.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 1 [0113.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf") returned 0x3f [0113.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x60c878, Size=0x9c) returned 0x601c70 [0113.300] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1 [0113.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 1 [0113.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf") returned 0x3f [0113.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x601c70, Size=0xa0) returned 0x6019d0 [0113.301] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1 [0113.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 1 [0113.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf") returned 0x3f [0113.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6019d0, Size=0xa4) returned 0x61fc20 [0113.301] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1 [0113.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 1 [0113.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf") returned 0x3f [0113.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61fc20, Size=0xa8) returned 0x61fcd0 [0113.301] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1 [0113.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 1 [0113.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf") returned 0x3f [0113.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x61fcd0, Size=0xac) returned 0x5b20e0 [0113.301] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1 [0113.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 1 [0113.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf") returned 0x3f [0113.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b20e0, Size=0xb0) returned 0x5b2f40 [0113.302] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1 [0113.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 1 [0113.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf") returned 0x3f [0113.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b2f40, Size=0xb4) returned 0x5b57f8 [0113.302] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1 [0113.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 1 [0113.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf") returned 0x3f [0113.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b57f8, Size=0xb8) returned 0x5b57f8 [0113.302] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1 [0113.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 1 [0113.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf") returned 0x3f [0113.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b57f8, Size=0xbc) returned 0x5b57f8 [0113.302] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1 [0113.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 1 [0113.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf") returned 0x3f [0113.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b57f8, Size=0xc0) returned 0x5b57f8 [0113.303] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1 [0113.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 1 [0113.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf") returned 0x3f [0113.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5b57f8, Size=0xc4) returned 0x5f76f0 [0113.303] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1 [0113.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 1 [0113.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf") returned 0x3f [0113.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xc8) returned 0x5f76f0 [0113.303] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1 [0113.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 1 [0113.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf") returned 0x3f [0113.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5f76f0, Size=0xcc) returned 0x5ba6a0 [0113.304] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1 [0113.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 1 [0113.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf") returned 0x3f [0113.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ba6a0, Size=0xd0) returned 0x5ba6a0 [0113.304] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1 [0113.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 1 [0113.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf") returned 0x3f [0113.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5ba6a0, Size=0xd4) returned 0x5bcf08 [0113.304] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1 [0113.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 1 [0113.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf") returned 0x3f [0113.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xd8) returned 0x5bcf08 [0113.304] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1 [0113.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 1 [0113.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf") returned 0x3f [0113.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xdc) returned 0x5bcf08 [0113.305] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1 [0113.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 1 [0113.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf") returned 0x3f [0113.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe0) returned 0x5bcf08 [0113.305] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1 [0113.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 1 [0113.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf") returned 0x3f [0113.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe4) returned 0x5bcf08 [0113.305] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1 [0113.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 1 [0113.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf") returned 0x3f [0113.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xe8) returned 0x5bcf08 [0113.305] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1 [0113.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 1 [0113.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf") returned 0x3f [0113.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xec) returned 0x5bcf08 [0113.306] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1 [0113.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 1 [0113.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf") returned 0x3f [0113.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xf0) returned 0x5bcf08 [0113.306] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1 [0113.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 1 [0113.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf") returned 0x3f [0113.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xf4) returned 0x5bcf08 [0113.306] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1 [0113.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 1 [0113.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf") returned 0x3f [0113.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xf8) returned 0x5bcf08 [0113.306] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1 [0113.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 1 [0113.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf") returned 0x3f [0113.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0xfc) returned 0x5bcf08 [0113.307] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1 [0113.307] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 1 [0113.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf") returned 0x3f [0113.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x100) returned 0x5bcf08 [0113.307] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1 [0113.307] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 1 [0113.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf") returned 0x3f [0113.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x104) returned 0x5bcf08 [0113.307] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1 [0113.307] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 1 [0113.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf") returned 0x3f [0113.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x108) returned 0x5bcf08 [0113.307] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1 [0113.308] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 1 [0113.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf") returned 0x3f [0113.308] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x5bcf08, Size=0x10c) returned 0x6f0ceb8 [0113.308] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1 [0113.308] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 1 [0113.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf") returned 0x3f [0113.308] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x110) returned 0x6f0ceb8 [0113.308] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1 [0113.308] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 1 [0113.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf") returned 0x3f [0113.308] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x114) returned 0x6f0ceb8 [0113.308] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1 [0113.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 1 [0113.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf") returned 0x3f [0113.343] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x68) returned 0x6f0ceb8 [0113.343] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1 [0113.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 1 [0113.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf") returned 0x3f [0113.343] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x6c) returned 0x6f0ceb8 [0113.343] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1 [0113.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 1 [0113.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf") returned 0x3f [0113.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x70) returned 0x6f0ceb8 [0113.344] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1 [0113.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 1 [0113.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf") returned 0x3f [0113.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x74) returned 0x6f0ceb8 [0113.344] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1 [0113.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 1 [0113.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf") returned 0x3f [0113.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x78) returned 0x6f0ceb8 [0113.344] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1 [0113.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 1 [0113.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf") returned 0x3f [0113.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x7c) returned 0x6f0ceb8 [0113.344] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1 [0113.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 1 [0113.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf") returned 0x3f [0113.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x80) returned 0x6f0ceb8 [0113.345] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1 [0113.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 1 [0113.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf") returned 0x3f [0113.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x84) returned 0x6f0ceb8 [0113.345] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1 [0113.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 1 [0113.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid") returned 0x3e [0113.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x88) returned 0x6f0ceb8 [0113.345] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1 [0113.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 1 [0113.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf") returned 0x3f [0113.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x8c) returned 0x6f0ceb8 [0113.345] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1 [0113.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 1 [0113.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf") returned 0x3f [0113.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x90) returned 0x6f0ceb8 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1 [0113.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 1 [0113.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf") returned 0x3f [0113.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0113.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0113.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x94) returned 0x6f0ceb8 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1 [0113.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 1 [0113.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf") returned 0x3f [0113.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f0ceb8, Size=0x98) returned 0x6f0ceb8 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1 [0113.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1 [0113.347] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1 [0113.360] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1 [0113.385] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1 [0113.386] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1 [0113.387] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1 [0113.387] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1 [0113.387] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1 [0113.387] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1 [0113.393] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1 [0113.394] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1 [0113.408] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1 [0113.437] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1 [0113.438] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1 [0113.832] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1 [0113.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1 [0113.834] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1 [0113.835] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1 [0113.865] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1 [0113.866] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1 [0113.866] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1 [0113.866] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x0, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1 [0119.185] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0119.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0119.932] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0119.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x56406370, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0119.945] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0119.945] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\_restore files_.txt"), bFailIfExists=0) returned 1 [0120.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1770) returned 0x6d06ca8 [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned 1 [0120.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif") returned 0x4c [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.136] GetProcessHeap () returned 0x580000 [0120.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1774) returned 0x6d06ca8 [0120.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned 1 [0120.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif") returned 0x4c [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.136] GetProcessHeap () returned 0x580000 [0120.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1778) returned 0x6d06ca8 [0120.136] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned 1 [0120.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif") returned 0x4c [0120.136] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.136] GetProcessHeap () returned 0x580000 [0120.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x177c) returned 0x6d06ca8 [0120.137] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned 1 [0120.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif") returned 0x4c [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.137] GetProcessHeap () returned 0x580000 [0120.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1780) returned 0x6d06ca8 [0120.137] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned 1 [0120.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif") returned 0x4c [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.137] GetProcessHeap () returned 0x580000 [0120.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1784) returned 0x6d06ca8 [0120.137] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned 1 [0120.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif") returned 0x4c [0120.137] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.137] GetProcessHeap () returned 0x580000 [0120.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1788) returned 0x6d06ca8 [0120.138] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned 1 [0120.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif") returned 0x4c [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.138] GetProcessHeap () returned 0x580000 [0120.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x178c) returned 0x6d06ca8 [0120.138] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned 1 [0120.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif") returned 0x4c [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.138] GetProcessHeap () returned 0x580000 [0120.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1790) returned 0x6d06ca8 [0120.138] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned 1 [0120.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif") returned 0x4c [0120.138] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.138] GetProcessHeap () returned 0x580000 [0120.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1794) returned 0x6d06ca8 [0120.139] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned 1 [0120.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif") returned 0x4c [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.139] GetProcessHeap () returned 0x580000 [0120.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1798) returned 0x6d06ca8 [0120.139] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned 1 [0120.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif") returned 0x4c [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.139] GetProcessHeap () returned 0x580000 [0120.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x179c) returned 0x6d06ca8 [0120.139] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned 1 [0120.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif") returned 0x4c [0120.139] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.139] GetProcessHeap () returned 0x580000 [0120.139] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a0) returned 0x6d06ca8 [0120.139] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned 1 [0120.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif") returned 0x4c [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.140] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.140] GetProcessHeap () returned 0x580000 [0120.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a4) returned 0x6d06ca8 [0120.140] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned 1 [0120.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif") returned 0x4c [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.140] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.140] GetProcessHeap () returned 0x580000 [0120.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a8) returned 0x6d06ca8 [0120.140] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned 1 [0120.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif") returned 0x4c [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.140] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.140] GetProcessHeap () returned 0x580000 [0120.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ac) returned 0x6d06ca8 [0120.140] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0120.140] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned 1 [0120.140] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif") returned 0x4c [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.141] GetProcessHeap () returned 0x580000 [0120.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b0) returned 0x6d06ca8 [0120.141] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned 1 [0120.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif") returned 0x4c [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.141] GetProcessHeap () returned 0x580000 [0120.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b4) returned 0x6d06ca8 [0120.141] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned 1 [0120.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif") returned 0x4c [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.141] GetProcessHeap () returned 0x580000 [0120.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b8) returned 0x6d06ca8 [0120.141] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned 1 [0120.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif") returned 0x4c [0120.141] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.142] GetProcessHeap () returned 0x580000 [0120.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17bc) returned 0x6d06ca8 [0120.142] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned 1 [0120.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif") returned 0x4c [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.142] GetProcessHeap () returned 0x580000 [0120.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c0) returned 0x6d06ca8 [0120.142] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned 1 [0120.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif") returned 0x4c [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.142] GetProcessHeap () returned 0x580000 [0120.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c4) returned 0x6d06ca8 [0120.142] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned 1 [0120.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif") returned 0x4c [0120.142] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.143] GetProcessHeap () returned 0x580000 [0120.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c8) returned 0x6d06ca8 [0120.143] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned 1 [0120.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif") returned 0x4c [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.143] GetProcessHeap () returned 0x580000 [0120.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17cc) returned 0x6d06ca8 [0120.143] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned 1 [0120.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif") returned 0x4c [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.143] GetProcessHeap () returned 0x580000 [0120.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d0) returned 0x6d06ca8 [0120.143] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned 1 [0120.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif") returned 0x4c [0120.143] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.143] GetProcessHeap () returned 0x580000 [0120.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d4) returned 0x6d06ca8 [0120.144] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned 1 [0120.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif") returned 0x4c [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.144] GetProcessHeap () returned 0x580000 [0120.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d8) returned 0x6d06ca8 [0120.144] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned 1 [0120.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif") returned 0x4c [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.144] GetProcessHeap () returned 0x580000 [0120.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17dc) returned 0x6d06ca8 [0120.144] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned 1 [0120.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif") returned 0x4c [0120.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.144] GetProcessHeap () returned 0x580000 [0120.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e0) returned 0x6d06ca8 [0120.145] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned 1 [0120.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif") returned 0x4c [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.145] GetProcessHeap () returned 0x580000 [0120.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e4) returned 0x6d06ca8 [0120.145] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned 1 [0120.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif") returned 0x4c [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.145] GetProcessHeap () returned 0x580000 [0120.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e8) returned 0x6d06ca8 [0120.145] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned 1 [0120.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif") returned 0x4c [0120.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.145] GetProcessHeap () returned 0x580000 [0120.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ec) returned 0x6d06ca8 [0120.145] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned 1 [0120.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif") returned 0x4c [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.146] GetProcessHeap () returned 0x580000 [0120.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f0) returned 0x6d06ca8 [0120.146] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned 1 [0120.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif") returned 0x4c [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.146] GetProcessHeap () returned 0x580000 [0120.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f4) returned 0x6d06ca8 [0120.146] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f1a7500, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x7f1a7500, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif", psz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\_RESTORE FILES_.txt", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\_RESTORE FILES_.txt") returned 1 [0120.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\_RESTORE FILES_.txt", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\_restore files_.txt") returned 0x53 [0120.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0120.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.146] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0120.146] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0120.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0120.147] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.147] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0120.147] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0120.147] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0120.147] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", len=0x35 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned 1 [0120.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\") returned 0x35 [0120.147] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0120.147] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0120.147] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0120.162] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.178] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0120.178] SysReAllocStringLen (in: pbstr=0x6a0f0d8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned 1 [0120.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx") returned 0x43 [0120.178] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.179] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0120.179] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.179] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0120.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1754) returned 0x6d06ca8 [0120.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0120.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned 1 [0120.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\angles.thmx") returned 0x40 [0120.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1758) returned 0x6d06ca8 [0120.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0120.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\angles.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned 1 [0120.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\apex.thmx") returned 0x3e [0120.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x175c) returned 0x6d06ca8 [0120.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0120.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\apex.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", len=0x44 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned 1 [0120.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx") returned 0x44 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1760) returned 0x6d06ca8 [0120.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned 1 [0120.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\aspect.thmx") returned 0x40 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1764) returned 0x6d06ca8 [0120.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\aspect.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned 1 [0120.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\austin.thmx") returned 0x40 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1768) returned 0x6d06ca8 [0120.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\austin.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned 1 [0120.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\black tie.thmx") returned 0x43 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x176c) returned 0x6d06ca8 [0120.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0120.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\black tie.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned 1 [0120.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\civic.thmx") returned 0x3f [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1770) returned 0x6d06ca8 [0120.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\civic.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned 1 [0120.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\clarity.thmx") returned 0x41 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1774) returned 0x6d06ca8 [0120.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\clarity.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned 1 [0120.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\composite.thmx") returned 0x43 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1778) returned 0x6d06ca8 [0120.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\composite.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned 1 [0120.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\concourse.thmx") returned 0x43 [0120.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x177c) returned 0x6d06ca8 [0120.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\concourse.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned 1 [0120.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\couture.thmx") returned 0x41 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1780) returned 0x6d06ca8 [0120.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\couture.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned 1 [0120.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\elemental.thmx") returned 0x43 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1784) returned 0x6d06ca8 [0120.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\elemental.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned 1 [0120.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\equity.thmx") returned 0x40 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1788) returned 0x6d06ca8 [0120.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\equity.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned 1 [0120.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\essential.thmx") returned 0x43 [0120.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x178c) returned 0x6d06ca8 [0120.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\essential.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned 1 [0120.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\executive.thmx") returned 0x43 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1790) returned 0x6d06ca8 [0120.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\executive.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned 1 [0120.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\flow.thmx") returned 0x3e [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1794) returned 0x6d06ca8 [0120.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\flow.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned 1 [0120.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\foundry.thmx") returned 0x41 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1798) returned 0x6d06ca8 [0120.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\foundry.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned 1 [0120.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\grid.thmx") returned 0x3e [0120.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x179c) returned 0x6d06ca8 [0120.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\grid.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned 1 [0120.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx") returned 0x43 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a0) returned 0x6d06ca8 [0120.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned 1 [0120.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\horizon.thmx") returned 0x41 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a4) returned 0x6d06ca8 [0120.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\horizon.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned 1 [0120.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\median.thmx") returned 0x40 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17a8) returned 0x6d06ca8 [0120.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\median.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned 1 [0120.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\metro.thmx") returned 0x3f [0120.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ac) returned 0x6d06ca8 [0120.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\metro.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned 1 [0120.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\module.thmx") returned 0x40 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b0) returned 0x6d06ca8 [0120.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\module.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx", len=0x43 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned 1 [0120.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx") returned 0x43 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b4) returned 0x6d06ca8 [0120.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned 1 [0120.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\opulent.thmx") returned 0x41 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17b8) returned 0x6d06ca8 [0120.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\opulent.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned 1 [0120.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\oriel.thmx") returned 0x3f [0120.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17bc) returned 0x6d06ca8 [0120.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\oriel.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned 1 [0120.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\origin.thmx") returned 0x40 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c0) returned 0x6d06ca8 [0120.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\origin.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned 1 [0120.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\paper.thmx") returned 0x3f [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c4) returned 0x6d06ca8 [0120.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\paper.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx", len=0x45 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned 1 [0120.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\perspective.thmx") returned 0x45 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17c8) returned 0x6d06ca8 [0120.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0120.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\perspective.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned 1 [0120.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx") returned 0x41 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17cc) returned 0x6d06ca8 [0120.304] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", len=0x44 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned 1 [0120.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx") returned 0x44 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d0) returned 0x6d06ca8 [0120.304] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned 1 [0120.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\solstice.thmx") returned 0x42 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d4) returned 0x6d06ca8 [0120.304] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\solstice.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned 1 [0120.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\technic.thmx") returned 0x41 [0120.304] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d8) returned 0x6d06ca8 [0120.304] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0120.305] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\technic.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned 1 [0120.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\thatch.thmx") returned 0x40 [0120.305] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0120.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17dc) returned 0x6d06ca8 [0120.305] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0120.305] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", len=0x42 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\") returned 1 [0120.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\") returned 0x42 [0120.305] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0120.305] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0120.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0120.433] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0120.438] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0120.438] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml") returned 1 [0120.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml") returned 0x4f [0120.438] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51c9cf70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0120.438] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0120.438] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\_restore files_.txt"), bFailIfExists=0) returned 1 [0120.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d0) returned 0x6d06ca8 [0120.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0120.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml") returned 1 [0120.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml") returned 0x4c [0120.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d4) returned 0x6d06ca8 [0120.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0120.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml") returned 1 [0120.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml") returned 0x4a [0120.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17d8) returned 0x6d06ca8 [0120.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0120.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml") returned 1 [0120.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml") returned 0x50 [0120.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17dc) returned 0x6d06ca8 [0120.441] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0120.441] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml") returned 1 [0120.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml") returned 0x4c [0120.441] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e0) returned 0x6d06ca8 [0120.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0120.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml") returned 1 [0120.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml") returned 0x4c [0120.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e4) returned 0x6d06ca8 [0120.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0120.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml") returned 1 [0120.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml") returned 0x4f [0120.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17e8) returned 0x6d06ca8 [0120.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0120.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml") returned 1 [0120.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml") returned 0x4b [0120.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17ec) returned 0x6d06ca8 [0120.442] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0120.442] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml") returned 1 [0120.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml") returned 0x4d [0120.442] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f0) returned 0x6d06ca8 [0120.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0120.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml") returned 1 [0120.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml") returned 0x4f [0120.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f4) returned 0x6d06ca8 [0120.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0120.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml") returned 1 [0120.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml") returned 0x4f [0120.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17f8) returned 0x6d06ca8 [0120.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0120.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml") returned 1 [0120.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml") returned 0x4d [0120.443] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x17fc) returned 0x6d06ca8 [0120.443] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0120.443] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml") returned 1 [0120.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml") returned 0x4f [0120.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1800) returned 0x6d06ca8 [0120.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0120.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml") returned 1 [0120.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml") returned 0x4c [0120.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1804) returned 0x6d06ca8 [0120.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0120.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml") returned 1 [0120.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml") returned 0x4f [0120.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1808) returned 0x6d06ca8 [0120.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0120.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml") returned 1 [0120.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml") returned 0x4f [0120.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x180c) returned 0x6d06ca8 [0120.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0120.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml") returned 1 [0120.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml") returned 0x4a [0120.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1810) returned 0x6d06ca8 [0120.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0120.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml") returned 1 [0120.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml") returned 0x4d [0120.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1814) returned 0x6d06ca8 [0120.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1 [0120.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml") returned 1 [0120.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml") returned 0x4f [0120.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1818) returned 0x6d06ca8 [0120.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0120.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml") returned 1 [0120.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml") returned 0x4a [0120.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x181c) returned 0x6d06ca8 [0120.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0120.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml") returned 1 [0120.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml") returned 0x4f [0120.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1820) returned 0x6d06ca8 [0120.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0120.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml") returned 1 [0120.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml") returned 0x4d [0120.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1824) returned 0x6d06ca8 [0120.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0120.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml") returned 1 [0120.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml") returned 0x4c [0120.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1828) returned 0x6d06ca8 [0120.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0120.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml") returned 1 [0120.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml") returned 0x4b [0120.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x182c) returned 0x6d06ca8 [0120.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0120.447] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml") returned 1 [0120.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml") returned 0x4c [0120.447] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1830) returned 0x6d06ca8 [0120.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0120.447] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml") returned 1 [0120.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml") returned 0x4f [0120.447] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1834) returned 0x6d06ca8 [0120.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0120.447] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml") returned 1 [0120.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml") returned 0x4d [0120.447] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1838) returned 0x6d06ca8 [0120.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0120.447] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml") returned 1 [0120.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml") returned 0x4b [0120.447] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x183c) returned 0x6d06ca8 [0120.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0120.448] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml") returned 1 [0120.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml") returned 0x4c [0120.448] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1840) returned 0x6d06ca8 [0120.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0120.448] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml") returned 1 [0120.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml") returned 0x4b [0120.448] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1844) returned 0x6d06ca8 [0120.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0120.448] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml") returned 1 [0120.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml") returned 0x51 [0120.448] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.448] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1848) returned 0x6d06ca8 [0120.448] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0120.448] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml") returned 1 [0120.448] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml") returned 0x4d [0120.448] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.448] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x184c) returned 0x6d06ca8 [0120.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0120.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml") returned 1 [0120.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml") returned 0x50 [0120.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1850) returned 0x6d06ca8 [0120.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0120.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml") returned 1 [0120.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml") returned 0x4e [0120.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1854) returned 0x6d06ca8 [0120.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0120.449] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml") returned 1 [0120.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml") returned 0x4d [0120.449] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.449] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x1858) returned 0x6d06ca8 [0120.449] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0120.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml") returned 1 [0120.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml") returned 0x4c [0120.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d06ca8, Size=0x185c) returned 0x6e00ac0 [0120.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0120.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml") returned 1 [0120.450] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml") returned 0x4a [0120.450] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.450] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.450] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1860) returned 0x6e00ac0 [0120.450] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0120.450] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml") returned 1 [0120.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml") returned 0x4b [0120.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1864) returned 0x6e00ac0 [0120.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0120.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml") returned 1 [0120.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml") returned 0x4b [0120.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1868) returned 0x6e00ac0 [0120.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0120.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml") returned 1 [0120.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml") returned 0x4e [0120.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x186c) returned 0x6e00ac0 [0120.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f66a100, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x7f66a100, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0120.451] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\_RESTORE FILES_.txt", len=0x55 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\_RESTORE FILES_.txt") returned 1 [0120.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\_RESTORE FILES_.txt", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme colors\\_restore files_.txt") returned 0x55 [0120.451] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0120.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0120.451] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0120.451] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0120.452] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0120.452] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", len=0x43 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\") returned 1 [0120.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\") returned 0x43 [0120.452] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0120.452] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0120.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0120.918] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0121.603] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1 [0121.603] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 1 [0121.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx") returned 0x51 [0121.604] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0121.604] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0121.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0121.604] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0121.604] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\_restore files_.txt"), bFailIfExists=0) returned 1 [0122.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1830) returned 0x6e00ac0 [0122.239] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1 [0122.239] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 1 [0122.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx") returned 0x4e [0122.239] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1834) returned 0x6e00ac0 [0122.239] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1 [0122.240] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 1 [0122.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx") returned 0x4c [0122.240] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1838) returned 0x6e00ac0 [0122.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1 [0122.240] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", len=0x52 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 1 [0122.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx") returned 0x52 [0122.240] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x183c) returned 0x6e00ac0 [0122.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1 [0122.240] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 1 [0122.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx") returned 0x4e [0122.240] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1840) returned 0x6e00ac0 [0122.240] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1 [0122.240] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 1 [0122.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx") returned 0x4e [0122.240] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1844) returned 0x6e00ac0 [0122.241] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 1 [0122.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx") returned 0x51 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1848) returned 0x6e00ac0 [0122.241] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 1 [0122.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx") returned 0x4d [0122.241] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x184c) returned 0x6e00ac0 [0122.241] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 1 [0122.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx") returned 0x4f [0122.241] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1850) returned 0x6e00ac0 [0122.241] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 1 [0122.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx") returned 0x51 [0122.241] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1854) returned 0x6e00ac0 [0122.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 1 [0122.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx") returned 0x51 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1858) returned 0x6e00ac0 [0122.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 1 [0122.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx") returned 0x4f [0122.242] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x185c) returned 0x6e00ac0 [0122.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 1 [0122.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx") returned 0x51 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1860) returned 0x6e00ac0 [0122.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1 [0122.242] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 1 [0122.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx") returned 0x4e [0122.243] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1864) returned 0x6e00ac0 [0122.243] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1 [0122.243] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 1 [0122.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx") returned 0x51 [0122.243] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1868) returned 0x6e00ac0 [0122.243] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1 [0122.243] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 1 [0122.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx") returned 0x51 [0122.243] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x186c) returned 0x6e00ac0 [0122.243] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1 [0122.243] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 1 [0122.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx") returned 0x4c [0122.243] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1870) returned 0x6e00ac0 [0122.243] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1 [0122.244] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 1 [0122.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx") returned 0x4f [0122.244] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1874) returned 0x6e00ac0 [0122.244] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1 [0122.244] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 1 [0122.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx") returned 0x4c [0122.244] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1878) returned 0x6e00ac0 [0122.244] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1 [0122.244] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 1 [0122.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx") returned 0x51 [0122.244] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x187c) returned 0x6e00ac0 [0122.244] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1 [0122.244] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 1 [0122.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx") returned 0x4f [0122.244] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1880) returned 0x6e00ac0 [0122.245] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1 [0122.245] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 1 [0122.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx") returned 0x4e [0122.245] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1884) returned 0x6e00ac0 [0122.245] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1 [0122.245] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 1 [0122.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx") returned 0x4d [0122.245] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1888) returned 0x6e00ac0 [0122.245] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1 [0122.245] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 1 [0122.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx") returned 0x4e [0122.245] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x188c) returned 0x6e00ac0 [0122.245] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1 [0122.245] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 1 [0122.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx") returned 0x51 [0122.245] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1890) returned 0x6e00ac0 [0122.246] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1 [0122.246] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 1 [0122.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx") returned 0x4f [0122.246] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1894) returned 0x6e00ac0 [0122.246] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1 [0122.246] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 1 [0122.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx") returned 0x4d [0122.246] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1898) returned 0x6e00ac0 [0122.246] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1 [0122.246] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 1 [0122.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx") returned 0x4e [0122.246] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x189c) returned 0x6e00ac0 [0122.246] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1 [0122.246] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 1 [0122.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx") returned 0x4d [0122.246] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18a0) returned 0x6e00ac0 [0122.247] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 1 [0122.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx") returned 0x53 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18a4) returned 0x6e00ac0 [0122.247] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 1 [0122.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx") returned 0x4f [0122.247] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18a8) returned 0x6e00ac0 [0122.247] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", len=0x52 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 1 [0122.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx") returned 0x52 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18ac) returned 0x6e00ac0 [0122.247] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1 [0122.247] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 1 [0122.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx") returned 0x50 [0122.248] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18b0) returned 0x6e00ac0 [0122.248] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1 [0122.248] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 1 [0122.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx") returned 0x4f [0122.248] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18b4) returned 0x6e00ac0 [0122.248] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1 [0122.248] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 1 [0122.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx") returned 0x4e [0122.248] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18b8) returned 0x6e00ac0 [0122.248] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1 [0122.248] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 1 [0122.248] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx") returned 0x4c [0122.248] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.248] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.248] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18bc) returned 0x6e00ac0 [0122.248] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 1 [0122.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx") returned 0x4d [0122.249] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.249] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c0) returned 0x6e00ac0 [0122.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 1 [0122.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx") returned 0x4d [0122.249] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.249] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c4) returned 0x6e00ac0 [0122.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 1 [0122.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx") returned 0x50 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.249] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c8) returned 0x6e00ac0 [0122.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80419f80, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x80419f80, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\_RESTORE FILES_.txt", len=0x56 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\_RESTORE FILES_.txt") returned 1 [0122.249] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\_RESTORE FILES_.txt", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme effects\\_restore files_.txt") returned 0x56 [0122.249] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.249] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.249] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.250] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0122.250] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0122.250] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", len=0x41 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\") returned 1 [0122.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\") returned 0x41 [0122.250] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0122.250] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0122.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0122.253] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.293] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1 [0122.293] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml") returned 1 [0122.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml") returned 0x4e [0122.293] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528a9ed0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0122.293] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.293] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\_restore files_.txt"), bFailIfExists=0) returned 1 [0122.295] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c0) returned 0x6e00ac0 [0122.295] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1 [0122.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml") returned 1 [0122.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml") returned 0x4b [0122.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c4) returned 0x6e00ac0 [0122.296] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1 [0122.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml") returned 1 [0122.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml") returned 0x49 [0122.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18c8) returned 0x6e00ac0 [0122.296] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1 [0122.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml") returned 1 [0122.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml") returned 0x4f [0122.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18cc) returned 0x6e00ac0 [0122.296] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1 [0122.296] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml") returned 1 [0122.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml") returned 0x4b [0122.296] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18d0) returned 0x6e00ac0 [0122.297] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1 [0122.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml") returned 1 [0122.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml") returned 0x4b [0122.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18d4) returned 0x6e00ac0 [0122.297] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1 [0122.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml") returned 1 [0122.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml") returned 0x4e [0122.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18d8) returned 0x6e00ac0 [0122.297] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1 [0122.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml") returned 1 [0122.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml") returned 0x4a [0122.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.297] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18dc) returned 0x6e00ac0 [0122.297] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1 [0122.297] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml") returned 1 [0122.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml") returned 0x4c [0122.297] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18e0) returned 0x6e00ac0 [0122.298] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1 [0122.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml") returned 1 [0122.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml") returned 0x4e [0122.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18e4) returned 0x6e00ac0 [0122.298] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1 [0122.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml") returned 1 [0122.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml") returned 0x4e [0122.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18e8) returned 0x6e00ac0 [0122.298] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1 [0122.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml") returned 1 [0122.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml") returned 0x4c [0122.298] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.298] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18ec) returned 0x6e00ac0 [0122.298] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1 [0122.298] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml") returned 1 [0122.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml") returned 0x4e [0122.299] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18f0) returned 0x6e00ac0 [0122.299] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1 [0122.299] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml") returned 1 [0122.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml") returned 0x4b [0122.299] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18f4) returned 0x6e00ac0 [0122.299] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1 [0122.299] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml") returned 1 [0122.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml") returned 0x4e [0122.299] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18f8) returned 0x6e00ac0 [0122.299] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1 [0122.299] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml") returned 1 [0122.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml") returned 0x4e [0122.299] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.299] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x18fc) returned 0x6e00ac0 [0122.299] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml") returned 1 [0122.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml") returned 0x49 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1900) returned 0x6e00ac0 [0122.300] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml") returned 1 [0122.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml") returned 0x4c [0122.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1904) returned 0x6e00ac0 [0122.300] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml") returned 1 [0122.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml") returned 0x49 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x1908) returned 0x6e00ac0 [0122.300] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1 [0122.300] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml") returned 1 [0122.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml") returned 0x4e [0122.300] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e00ac0, Size=0x190c) returned 0x6f42f08 [0122.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1 [0122.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml") returned 1 [0122.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml") returned 0x4c [0122.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1910) returned 0x6f42f08 [0122.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1 [0122.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml") returned 1 [0122.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml") returned 0x4b [0122.301] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1914) returned 0x6f42f08 [0122.301] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1 [0122.301] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml") returned 1 [0122.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml") returned 0x4a [0122.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1918) returned 0x6f42f08 [0122.302] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1 [0122.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml") returned 1 [0122.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml") returned 0x4b [0122.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x191c) returned 0x6f42f08 [0122.302] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1 [0122.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml") returned 1 [0122.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml") returned 0x4e [0122.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1920) returned 0x6f42f08 [0122.302] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0122.302] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml") returned 1 [0122.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml") returned 0x4d [0122.302] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.302] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1924) returned 0x6f42f08 [0122.302] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", len=0x55 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml") returned 1 [0122.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml") returned 0x55 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1928) returned 0x6f42f08 [0122.303] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml") returned 1 [0122.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml") returned 0x53 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x192c) returned 0x6f42f08 [0122.303] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml") returned 1 [0122.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml") returned 0x4c [0122.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1930) returned 0x6f42f08 [0122.303] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1 [0122.303] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml") returned 1 [0122.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml") returned 0x4a [0122.303] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.303] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1934) returned 0x6f42f08 [0122.304] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1 [0122.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml") returned 1 [0122.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml") returned 0x4b [0122.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1938) returned 0x6f42f08 [0122.304] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1 [0122.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml") returned 1 [0122.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml") returned 0x4a [0122.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x193c) returned 0x6f42f08 [0122.304] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1 [0122.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml") returned 1 [0122.304] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml") returned 0x50 [0122.304] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.304] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.304] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1940) returned 0x6f42f08 [0122.304] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1 [0122.304] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml") returned 1 [0122.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml") returned 0x4c [0122.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1944) returned 0x6f42f08 [0122.305] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1 [0122.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml") returned 1 [0122.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml") returned 0x4f [0122.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1948) returned 0x6f42f08 [0122.305] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1 [0122.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml") returned 1 [0122.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml") returned 0x4d [0122.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x194c) returned 0x6f42f08 [0122.305] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1 [0122.305] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml") returned 1 [0122.305] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml") returned 0x4c [0122.305] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.305] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.305] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1950) returned 0x6f42f08 [0122.305] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1 [0122.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml") returned 1 [0122.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml") returned 0x4b [0122.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1954) returned 0x6f42f08 [0122.306] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1 [0122.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml") returned 1 [0122.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml") returned 0x49 [0122.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1958) returned 0x6f42f08 [0122.306] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1 [0122.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml") returned 1 [0122.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml") returned 0x4a [0122.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.306] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x195c) returned 0x6f42f08 [0122.306] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1 [0122.306] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml") returned 1 [0122.306] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml") returned 0x4a [0122.306] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.306] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1960) returned 0x6f42f08 [0122.307] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1 [0122.307] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml") returned 1 [0122.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml") returned 0x4d [0122.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0122.307] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8081e4a0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x8081e4a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0122.307] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\_RESTORE FILES_.txt", len=0x54 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\_RESTORE FILES_.txt") returned 1 [0122.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\_RESTORE FILES_.txt", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\theme fonts\\_restore files_.txt") returned 0x54 [0122.307] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.307] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.307] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0122.307] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0122.307] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\thatch.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned 1 [0122.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\trek.thmx") returned 0x3e [0122.307] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0122.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.307] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1968) returned 0x6f42f08 [0122.307] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0122.307] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\trek.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned 1 [0122.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\urban.thmx") returned 0x3f [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0122.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x196c) returned 0x6f42f08 [0122.308] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\urban.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned 1 [0122.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\verve.thmx") returned 0x3f [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0122.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1970) returned 0x6f42f08 [0122.308] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\verve.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned 1 [0122.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\waveform.thmx") returned 0x42 [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0122.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.308] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1974) returned 0x6f42f08 [0122.308] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f3e29a0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x7f3e29a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\document themes 14\\waveform.thmx", psz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\_RESTORE FILES_.txt", len=0x48 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Document Themes 14\\_RESTORE FILES_.txt") returned 1 [0122.308] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Document Themes 14\\_RESTORE FILES_.txt", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\document themes 14\\_restore files_.txt") returned 0x48 [0122.308] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0122.308] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.308] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.308] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0122.309] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0122.309] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\", len=0x28 | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned 1 [0122.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\", cchLength=0x28 | out: lpsz="c:\\program files\\microsoft office\\media\\") returned 0x28 [0122.309] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0122.309] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0122.309] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0122.309] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.309] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0122.309] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned 1 [0122.309] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\") returned 0x31 [0122.309] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0122.310] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0122.310] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0122.352] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0122.353] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned 1 [0122.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\1033\\") returned 0x36 [0122.354] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0122.354] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0122.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0122.354] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0122.354] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0122.354] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 1 [0122.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml") returned 0x42 [0122.354] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0122.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeec79e70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0122.354] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0122.354] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0122.356] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1968) returned 0x6f42f08 [0122.356] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0122.356] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.356] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0122.357] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 1 [0122.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll") returned 0x3d [0122.357] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.357] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.357] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0122.357] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 1 [0122.357] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw") returned 0x3d [0122.357] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0122.357] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0122.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0122.357] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0122.357] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\_restore files_.txt"), bFailIfExists=0) returned 1 [0125.319] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1878) returned 0x6f42f08 [0125.319] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0125.320] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned 1 [0125.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav") returned 0x3d [0125.320] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.320] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x187c) returned 0x6f42f08 [0125.320] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0125.320] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned 1 [0125.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf") returned 0x3d [0125.320] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.320] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1880) returned 0x6f42f08 [0125.320] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0125.320] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned 1 [0125.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf") returned 0x3d [0125.320] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.320] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.320] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1884) returned 0x6f42f08 [0125.320] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0125.320] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned 1 [0125.320] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf") returned 0x3d [0125.320] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.320] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1888) returned 0x6f42f08 [0125.321] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0125.321] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned 1 [0125.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf") returned 0x3d [0125.321] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.321] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x188c) returned 0x6f42f08 [0125.321] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0125.321] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned 1 [0125.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf") returned 0x3d [0125.321] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.321] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1890) returned 0x6f42f08 [0125.321] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0125.321] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned 1 [0125.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf") returned 0x3d [0125.321] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.321] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.321] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1894) returned 0x6f42f08 [0125.321] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0125.321] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned 1 [0125.321] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf") returned 0x3d [0125.321] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.321] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1898) returned 0x6f42f08 [0125.322] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0125.322] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned 1 [0125.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf") returned 0x3d [0125.322] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.322] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x189c) returned 0x6f42f08 [0125.322] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0125.322] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned 1 [0125.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf") returned 0x3d [0125.322] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.322] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a0) returned 0x6f42f08 [0125.322] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0125.322] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned 1 [0125.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf") returned 0x3d [0125.322] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.322] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.322] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a4) returned 0x6f42f08 [0125.322] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0125.322] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned 1 [0125.322] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf") returned 0x3d [0125.322] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.322] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18a8) returned 0x6f42f08 [0125.323] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0125.323] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned 1 [0125.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf") returned 0x3d [0125.323] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ac) returned 0x6f42f08 [0125.323] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0125.323] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned 1 [0125.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf") returned 0x3d [0125.323] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b0) returned 0x6f42f08 [0125.323] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0125.323] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned 1 [0125.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf") returned 0x3d [0125.323] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.323] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b4) returned 0x6f42f08 [0125.323] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0125.323] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned 1 [0125.323] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf") returned 0x3d [0125.323] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.323] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18b8) returned 0x6f42f08 [0125.324] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0125.324] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned 1 [0125.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf") returned 0x3d [0125.324] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.324] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18bc) returned 0x6f42f08 [0125.324] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0125.324] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned 1 [0125.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf") returned 0x3d [0125.324] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.324] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c0) returned 0x6f42f08 [0125.324] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0125.324] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned 1 [0125.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf") returned 0x3d [0125.324] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.324] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c4) returned 0x6f42f08 [0125.324] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0125.324] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned 1 [0125.324] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf") returned 0x3d [0125.324] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.324] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18c8) returned 0x6f42f08 [0125.325] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0125.325] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned 1 [0125.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf") returned 0x3d [0125.325] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18cc) returned 0x6f42f08 [0125.325] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0125.325] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned 1 [0125.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf") returned 0x3d [0125.325] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d0) returned 0x6f42f08 [0125.325] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0125.325] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned 1 [0125.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf") returned 0x3d [0125.325] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d4) returned 0x6f42f08 [0125.325] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0125.325] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned 1 [0125.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf") returned 0x3d [0125.325] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18d8) returned 0x6f42f08 [0125.326] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0125.326] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned 1 [0125.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf") returned 0x3d [0125.326] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18dc) returned 0x6f42f08 [0125.326] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0125.326] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned 1 [0125.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf") returned 0x3d [0125.326] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e0) returned 0x6f42f08 [0125.326] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0125.326] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned 1 [0125.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf") returned 0x3d [0125.326] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e4) returned 0x6f42f08 [0125.326] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0125.326] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned 1 [0125.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf") returned 0x3d [0125.326] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18e8) returned 0x6f42f08 [0125.327] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0125.327] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned 1 [0125.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf") returned 0x3d [0125.327] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ec) returned 0x6f42f08 [0125.327] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0125.327] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned 1 [0125.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf") returned 0x3d [0125.327] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f0) returned 0x6f42f08 [0125.327] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0125.329] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned 1 [0125.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf") returned 0x3d [0125.329] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18ec) returned 0x6f42f08 [0125.329] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0125.329] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned 1 [0125.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf") returned 0x3d [0125.329] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f0) returned 0x6f42f08 [0125.329] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0125.329] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned 1 [0125.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf") returned 0x3d [0125.329] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f4) returned 0x6f42f08 [0125.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0125.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned 1 [0125.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf") returned 0x3d [0125.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18f8) returned 0x6f42f08 [0125.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0125.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned 1 [0125.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf") returned 0x3d [0125.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x18fc) returned 0x6f42f08 [0125.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0125.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned 1 [0125.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf") returned 0x3d [0125.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1900) returned 0x6f42f08 [0125.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0125.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned 1 [0125.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf") returned 0x3d [0125.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1904) returned 0x6f42f08 [0125.331] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0125.331] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned 1 [0125.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf") returned 0x3d [0125.331] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1900) returned 0x6f42f08 [0125.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0125.332] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned 1 [0125.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf") returned 0x3d [0125.332] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1904) returned 0x6f42f08 [0125.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0125.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned 1 [0125.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav") returned 0x3d [0125.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1908) returned 0x6f42f08 [0125.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0125.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned 1 [0125.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf") returned 0x3d [0125.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x190c) returned 0x6f42f08 [0125.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0125.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned 1 [0125.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf") returned 0x3d [0125.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1910) returned 0x6f42f08 [0125.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0125.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned 1 [0125.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf") returned 0x3d [0125.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1914) returned 0x6f42f08 [0125.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0125.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned 1 [0125.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf") returned 0x3d [0125.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1918) returned 0x6f42f08 [0125.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0125.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned 1 [0125.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf") returned 0x3d [0125.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x191c) returned 0x6f42f08 [0125.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0125.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned 1 [0125.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf") returned 0x3d [0125.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1920) returned 0x6f42f08 [0125.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0125.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned 1 [0125.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf") returned 0x3d [0125.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1924) returned 0x6f42f08 [0125.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0125.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned 1 [0125.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf") returned 0x3d [0125.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1928) returned 0x6f42f08 [0125.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0125.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned 1 [0125.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf") returned 0x3d [0125.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x192c) returned 0x6f42f08 [0125.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0125.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned 1 [0125.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf") returned 0x3d [0125.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1930) returned 0x6f42f08 [0125.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0125.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned 1 [0125.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf") returned 0x3d [0125.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1934) returned 0x6f42f08 [0125.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0125.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned 1 [0125.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf") returned 0x3d [0125.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1938) returned 0x6f42f08 [0125.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0125.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned 1 [0125.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf") returned 0x3d [0125.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x193c) returned 0x6f42f08 [0125.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0125.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned 1 [0125.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf") returned 0x3d [0125.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1940) returned 0x6f42f08 [0125.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0125.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned 1 [0125.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf") returned 0x3d [0125.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1944) returned 0x6f42f08 [0125.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0125.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned 1 [0125.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf") returned 0x3d [0125.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1948) returned 0x6f42f08 [0125.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0125.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned 1 [0125.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf") returned 0x3d [0125.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x194c) returned 0x6f42f08 [0125.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0125.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned 1 [0125.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf") returned 0x3d [0125.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1950) returned 0x6f42f08 [0125.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0125.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned 1 [0125.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf") returned 0x3d [0125.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1954) returned 0x6f42f08 [0125.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0125.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned 1 [0125.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf") returned 0x3d [0125.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1958) returned 0x6f42f08 [0125.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0125.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned 1 [0125.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif") returned 0x3d [0125.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x195c) returned 0x6f42f08 [0125.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0125.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned 1 [0125.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf") returned 0x3d [0125.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1960) returned 0x6f42f08 [0125.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0125.339] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned 1 [0125.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf") returned 0x3d [0125.339] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.339] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0125.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0125.339] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned 1 [0125.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf") returned 0x3d [0125.339] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.339] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1968) returned 0x6f42f08 [0125.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0125.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned 1 [0125.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf") returned 0x3d [0125.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1940) returned 0x6f42f08 [0125.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0125.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned 1 [0125.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf") returned 0x3d [0125.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1944) returned 0x6f42f08 [0125.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0125.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned 1 [0125.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf") returned 0x3d [0125.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1948) returned 0x6f42f08 [0125.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0125.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned 1 [0125.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf") returned 0x3d [0125.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x194c) returned 0x6f42f08 [0125.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0125.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned 1 [0125.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf") returned 0x3d [0125.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1950) returned 0x6f42f08 [0125.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0125.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned 1 [0125.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf") returned 0x3d [0125.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1954) returned 0x6f42f08 [0125.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0125.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned 1 [0125.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf") returned 0x3d [0125.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1958) returned 0x6f42f08 [0125.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0125.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned 1 [0125.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif") returned 0x3d [0125.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x195c) returned 0x6f42f08 [0125.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0125.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned 1 [0125.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg") returned 0x3d [0125.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1960) returned 0x6f42f08 [0125.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0125.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned 1 [0125.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf") returned 0x3d [0125.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1964) returned 0x6f42f08 [0125.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0125.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned 1 [0125.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf") returned 0x3d [0125.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1968) returned 0x6f42f08 [0125.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0125.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned 1 [0125.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf") returned 0x3d [0125.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x196c) returned 0x6f42f08 [0125.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0125.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned 1 [0125.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf") returned 0x3d [0125.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1970) returned 0x6f42f08 [0125.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0125.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned 1 [0125.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf") returned 0x3d [0125.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1974) returned 0x6f42f08 [0125.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0125.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned 1 [0125.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf") returned 0x3d [0125.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1978) returned 0x6f42f08 [0125.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0125.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned 1 [0125.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf") returned 0x3d [0125.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x197c) returned 0x6f42f08 [0125.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0125.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned 1 [0125.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf") returned 0x3d [0125.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1980) returned 0x6f42f08 [0125.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0125.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned 1 [0125.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf") returned 0x3d [0125.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1984) returned 0x6f42f08 [0125.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0125.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned 1 [0125.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf") returned 0x3d [0125.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1988) returned 0x6f42f08 [0125.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0125.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned 1 [0125.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf") returned 0x3d [0125.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x198c) returned 0x6f42f08 [0125.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0125.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned 1 [0125.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf") returned 0x3d [0125.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1990) returned 0x6f42f08 [0125.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0125.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned 1 [0125.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf") returned 0x3d [0125.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1994) returned 0x6f42f08 [0125.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0125.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned 1 [0125.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf") returned 0x3d [0125.352] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x1998) returned 0x6f42f08 [0125.352] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0125.352] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned 1 [0125.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf") returned 0x3d [0125.352] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x199c) returned 0x6f42f08 [0125.352] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0125.352] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned 1 [0125.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf") returned 0x3d [0125.352] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19a0) returned 0x6f42f08 [0125.352] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0125.352] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned 1 [0125.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf") returned 0x3d [0125.352] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.352] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19a4) returned 0x6f42f08 [0125.352] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0125.352] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned 1 [0125.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf") returned 0x3d [0125.353] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.353] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19a8) returned 0x6f42f08 [0125.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0125.353] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned 1 [0125.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf") returned 0x3d [0125.353] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.353] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19ac) returned 0x6f42f08 [0125.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0125.353] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned 1 [0125.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf") returned 0x3d [0125.353] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.353] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b0) returned 0x6f42f08 [0125.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0125.353] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned 1 [0125.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif") returned 0x3d [0125.353] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.353] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.353] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b4) returned 0x6f42f08 [0125.353] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0125.353] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned 1 [0125.353] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf") returned 0x3d [0125.354] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b8) returned 0x6f42f08 [0125.354] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0125.354] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned 1 [0125.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf") returned 0x3d [0125.354] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19bc) returned 0x6f42f08 [0125.354] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0125.354] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned 1 [0125.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf") returned 0x3d [0125.354] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c0) returned 0x6f42f08 [0125.354] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0125.354] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned 1 [0125.354] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf") returned 0x3d [0125.354] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.354] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.354] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c4) returned 0x6f42f08 [0125.354] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0125.363] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned 1 [0125.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf") returned 0x3d [0125.363] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.363] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b4) returned 0x6f42f08 [0125.363] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0125.363] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned 1 [0125.363] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf") returned 0x3d [0125.363] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.363] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.363] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19b8) returned 0x6f42f08 [0125.364] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0125.364] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned 1 [0125.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf") returned 0x3d [0125.364] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.364] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19bc) returned 0x6f42f08 [0125.364] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0125.364] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned 1 [0125.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf") returned 0x3d [0125.364] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.364] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c0) returned 0x6f42f08 [0125.364] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0125.364] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned 1 [0125.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf") returned 0x3d [0125.364] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.364] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.364] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c4) returned 0x6f42f08 [0125.364] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0125.364] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned 1 [0125.364] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf") returned 0x3d [0125.364] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.364] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19c8) returned 0x6f42f08 [0125.365] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0125.365] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned 1 [0125.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf") returned 0x3d [0125.365] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f42f08, Size=0x19cc) returned 0x667250 [0125.365] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0125.365] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned 1 [0125.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif") returned 0x3d [0125.365] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d0) returned 0x667250 [0125.365] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0125.365] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned 1 [0125.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf") returned 0x3d [0125.365] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.365] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d4) returned 0x667250 [0125.365] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0125.365] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned 1 [0125.365] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf") returned 0x3d [0125.365] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d8) returned 0x667250 [0125.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0125.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned 1 [0125.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf") returned 0x3d [0125.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19dc) returned 0x667250 [0125.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0125.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned 1 [0125.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf") returned 0x3d [0125.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e0) returned 0x667250 [0125.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0125.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned 1 [0125.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf") returned 0x3d [0125.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e4) returned 0x667250 [0125.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0125.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned 1 [0125.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf") returned 0x3d [0125.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.367] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e8) returned 0x667250 [0125.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0125.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned 1 [0125.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg") returned 0x3d [0125.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.367] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19ec) returned 0x667250 [0125.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0125.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned 1 [0125.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg") returned 0x3d [0125.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.367] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f0) returned 0x667250 [0125.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0125.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned 1 [0125.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf") returned 0x3d [0125.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f4) returned 0x667250 [0125.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0125.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned 1 [0125.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf") returned 0x3d [0125.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f8) returned 0x667250 [0125.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0125.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned 1 [0125.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf") returned 0x3d [0125.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19fc) returned 0x667250 [0125.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0125.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned 1 [0125.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg") returned 0x3d [0125.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a00) returned 0x667250 [0125.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0125.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned 1 [0125.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf") returned 0x3d [0125.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a04) returned 0x667250 [0125.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0125.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned 1 [0125.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf") returned 0x3d [0125.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a08) returned 0x667250 [0125.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0125.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned 1 [0125.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf") returned 0x3d [0125.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a0c) returned 0x667250 [0125.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0125.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned 1 [0125.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf") returned 0x3d [0125.370] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a10) returned 0x667250 [0125.370] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07200, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x80d07200, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0125.370] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\_RESTORE FILES_.txt", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\_RESTORE FILES_.txt") returned 1 [0125.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\_RESTORE FILES_.txt", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\media\\cagcat10\\_restore files_.txt") returned 0x44 [0125.370] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0125.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0125.370] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0126.414] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0127.384] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0127.384] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned 1 [0127.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\") returned 0x31 [0127.384] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0127.384] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0127.384] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0127.384] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.384] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0127.384] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned 1 [0127.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\1033\\") returned 0x36 [0127.384] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0127.384] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0127.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0127.385] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0127.385] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0127.385] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 1 [0127.385] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml") returned 0x42 [0127.385] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0127.385] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0127.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeef015d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0127.385] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0127.385] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0127.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c4) returned 0x667250 [0127.818] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0127.818] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0127.818] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0127.818] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", len=0x3a | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned 1 [0127.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\") returned 0x3a [0127.818] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0127.818] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0127.818] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0128.203] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.204] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0128.204] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 1 [0128.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll") returned 0x46 [0128.204] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.204] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0128.204] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned 1 [0128.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf") returned 0x46 [0128.204] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x51767f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0128.204] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.204] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\_restore files_.txt"), bFailIfExists=0) returned 1 [0128.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b0) returned 0x667250 [0128.209] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned 1 [0128.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf") returned 0x46 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b4) returned 0x667250 [0128.209] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned 1 [0128.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf") returned 0x46 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19b8) returned 0x667250 [0128.209] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned 1 [0128.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf") returned 0x46 [0128.209] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19bc) returned 0x667250 [0128.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned 1 [0128.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf") returned 0x46 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c0) returned 0x667250 [0128.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned 1 [0128.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf") returned 0x46 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c4) returned 0x667250 [0128.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned 1 [0128.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf") returned 0x46 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19c8) returned 0x667250 [0128.210] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned 1 [0128.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf") returned 0x46 [0128.210] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19cc) returned 0x667250 [0128.211] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned 1 [0128.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf") returned 0x46 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d0) returned 0x667250 [0128.211] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned 1 [0128.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf") returned 0x46 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d4) returned 0x667250 [0128.211] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned 1 [0128.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf") returned 0x46 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19d8) returned 0x667250 [0128.211] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned 1 [0128.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf") returned 0x46 [0128.211] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19dc) returned 0x667250 [0128.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned 1 [0128.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf") returned 0x46 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e0) returned 0x667250 [0128.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned 1 [0128.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf") returned 0x46 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e4) returned 0x667250 [0128.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned 1 [0128.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf") returned 0x46 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19e8) returned 0x667250 [0128.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned 1 [0128.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf") returned 0x46 [0128.212] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19ec) returned 0x667250 [0128.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned 1 [0128.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf") returned 0x46 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f0) returned 0x667250 [0128.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned 1 [0128.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf") returned 0x46 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f4) returned 0x667250 [0128.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned 1 [0128.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf") returned 0x46 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19f8) returned 0x667250 [0128.213] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned 1 [0128.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf") returned 0x46 [0128.213] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x19fc) returned 0x667250 [0128.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned 1 [0128.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf") returned 0x46 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a00) returned 0x667250 [0128.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned 1 [0128.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf") returned 0x46 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a04) returned 0x667250 [0128.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned 1 [0128.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf") returned 0x46 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a08) returned 0x667250 [0128.214] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned 1 [0128.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf") returned 0x46 [0128.214] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a0c) returned 0x667250 [0128.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned 1 [0128.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf") returned 0x46 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a10) returned 0x667250 [0128.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned 1 [0128.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf") returned 0x46 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a14) returned 0x667250 [0128.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18209_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF") returned 1 [0128.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf") returned 0x46 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a18) returned 0x667250 [0128.215] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18210_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF") returned 1 [0128.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf") returned 0x46 [0128.215] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a1c) returned 0x667250 [0128.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18211_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF") returned 1 [0128.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf") returned 0x46 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a20) returned 0x667250 [0128.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18212_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF") returned 1 [0128.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18213_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf") returned 0x46 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a24) returned 0x667250 [0128.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18213_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF") returned 1 [0128.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18214_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf") returned 0x46 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a28) returned 0x667250 [0128.216] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b613000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2b613000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18215_.WMF", cAlternateFileName="")) returned 1 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18214_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF") returned 1 [0128.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18215_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf") returned 0x46 [0128.216] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.217] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a2c) returned 0x667250 [0128.217] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cab3c00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cab3c00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x726, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18216_.WMF", cAlternateFileName="")) returned 1 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18215_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF") returned 1 [0128.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf") returned 0x46 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.217] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a30) returned 0x667250 [0128.217] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded1d00, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ded1d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1552, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18217_.WMF", cAlternateFileName="")) returned 1 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF") returned 1 [0128.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf") returned 0x46 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.217] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a34) returned 0x667250 [0128.217] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fcec000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8fcec000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x1212, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18218_.WMF", cAlternateFileName="")) returned 1 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF") returned 1 [0128.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf") returned 0x46 [0128.217] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.217] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a38) returned 0x667250 [0128.217] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f247600, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f247600, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x1136, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18219_.WMF", cAlternateFileName="")) returned 1 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF") returned 1 [0128.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf") returned 0x46 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a3c) returned 0x667250 [0128.218] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aadf500, ftCreationTime.dwHighDateTime=0x1bddca5, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2aadf500, ftLastWriteTime.dwHighDateTime=0x1bddca5, nFileSizeHigh=0x0, nFileSizeLow=0x213c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18220_.WMF", cAlternateFileName="")) returned 1 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF") returned 1 [0128.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf") returned 0x46 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a40) returned 0x667250 [0128.218] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0346a00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0346a00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x72c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18221_.WMF", cAlternateFileName="")) returned 1 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF") returned 1 [0128.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf") returned 0x46 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a44) returned 0x667250 [0128.218] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5a99400, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5a99400, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18222_.WMF", cAlternateFileName="")) returned 1 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF") returned 1 [0128.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf") returned 0x46 [0128.218] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a48) returned 0x667250 [0128.218] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee4c100, ftCreationTime.dwHighDateTime=0x1bddb92, ftLastAccessTime.dwLowDateTime=0xbcc25d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ee4c100, ftLastWriteTime.dwHighDateTime=0x1bddb92, nFileSizeHigh=0x0, nFileSizeLow=0xc5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18223_.WMF", cAlternateFileName="")) returned 1 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF") returned 1 [0128.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf") returned 0x46 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a4c) returned 0x667250 [0128.219] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9730600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa9730600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x680, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18224_.WMF", cAlternateFileName="")) returned 1 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF") returned 1 [0128.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf") returned 0x46 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a50) returned 0x667250 [0128.219] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2357bf00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2357bf00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18225_.WMF", cAlternateFileName="")) returned 1 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF") returned 1 [0128.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf") returned 0x46 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a54) returned 0x667250 [0128.219] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d10e600, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d10e600, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x7b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18226_.WMF", cAlternateFileName="")) returned 1 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF") returned 1 [0128.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf") returned 0x46 [0128.219] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a58) returned 0x667250 [0128.219] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e4fd00, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83e4fd00, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18227_.WMF", cAlternateFileName="")) returned 1 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF") returned 1 [0128.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf") returned 0x46 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a5c) returned 0x667250 [0128.220] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb337000, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb337000, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x884, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18228_.WMF", cAlternateFileName="")) returned 1 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF") returned 1 [0128.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf") returned 0x46 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a60) returned 0x667250 [0128.220] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3405b200, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3405b200, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18229_.WMF", cAlternateFileName="")) returned 1 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF") returned 1 [0128.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf") returned 0x46 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a64) returned 0x667250 [0128.220] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef2cd000, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcc4be80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xef2cd000, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0x724, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18230_.WMF", cAlternateFileName="")) returned 1 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF") returned 1 [0128.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf") returned 0x46 [0128.220] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a68) returned 0x667250 [0128.220] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa3500, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcfa3500, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x67c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18231_.WMF", cAlternateFileName="")) returned 1 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF") returned 1 [0128.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf") returned 0x46 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a6c) returned 0x667250 [0128.221] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4763d200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4763d200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18232_.WMF", cAlternateFileName="")) returned 1 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF") returned 1 [0128.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf") returned 0x46 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a70) returned 0x667250 [0128.221] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76a200, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5a76a200, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18233_.WMF", cAlternateFileName="")) returned 1 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF") returned 1 [0128.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf") returned 0x46 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a74) returned 0x667250 [0128.221] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eba9f00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6eba9f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x754, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18234_.WMF", cAlternateFileName="")) returned 1 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF") returned 1 [0128.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf") returned 0x46 [0128.221] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a78) returned 0x667250 [0128.222] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a25aa00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a25aa00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18235_.WMF", cAlternateFileName="")) returned 1 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF") returned 1 [0128.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf") returned 0x46 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x667250, Size=0x1a7c) returned 0x6d0e508 [0128.222] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f9ad400, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc71fe0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9f9ad400, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x6d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18236_.WMF", cAlternateFileName="")) returned 1 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF") returned 1 [0128.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf") returned 0x46 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a80) returned 0x6d0e508 [0128.222] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29966d00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29966d00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x5fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18237_.WMF", cAlternateFileName="")) returned 1 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF") returned 1 [0128.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf") returned 0x46 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a84) returned 0x6d0e508 [0128.222] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb50ffe00, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb50ffe00, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18238_.WMF", cAlternateFileName="")) returned 1 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF") returned 1 [0128.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18238_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf") returned 0x46 [0128.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a88) returned 0x6d0e508 [0128.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9086900, ftCreationTime.dwHighDateTime=0x1bddcaa, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd9086900, ftLastWriteTime.dwHighDateTime=0x1bddcaa, nFileSizeHigh=0x0, nFileSizeLow=0x93c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18239_.WMF", cAlternateFileName="")) returned 1 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18238_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF") returned 1 [0128.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18239_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf") returned 0x46 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a8c) returned 0x6d0e508 [0128.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2305400, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa2305400, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18241_.WMF", cAlternateFileName="")) returned 1 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18239_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF") returned 1 [0128.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18241_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf") returned 0x46 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a90) returned 0x6d0e508 [0128.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a42b600, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a42b600, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18242_.WMF", cAlternateFileName="")) returned 1 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18241_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF") returned 1 [0128.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18242_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf") returned 0x46 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a94) returned 0x6d0e508 [0128.223] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fb7e000, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fb7e000, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18243_.WMF", cAlternateFileName="")) returned 1 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18242_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF") returned 1 [0128.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf") returned 0x46 [0128.223] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a98) returned 0x6d0e508 [0128.224] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d151300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbcc98140, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d151300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18244_.WMF", cAlternateFileName="")) returned 1 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF") returned 1 [0128.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf") returned 0x46 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1a9c) returned 0x6d0e508 [0128.224] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3027e300, ftCreationTime.dwHighDateTime=0x1bdcf22, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3027e300, ftLastWriteTime.dwHighDateTime=0x1bdcf22, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18245_.WMF", cAlternateFileName="")) returned 1 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF") returned 1 [0128.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf") returned 0x46 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1aa0) returned 0x6d0e508 [0128.224] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc4feb00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc4feb00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18246_.WMF", cAlternateFileName="")) returned 1 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF") returned 1 [0128.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf") returned 0x46 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1aa4) returned 0x6d0e508 [0128.224] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba237c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xba237c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18247_.WMF", cAlternateFileName="")) returned 1 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF") returned 1 [0128.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf") returned 0x46 [0128.224] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1aa8) returned 0x6d0e508 [0128.225] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd364c00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcd364c00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18248_.WMF", cAlternateFileName="")) returned 1 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF") returned 1 [0128.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf") returned 0x46 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1aac) returned 0x6d0e508 [0128.225] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b2f4300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b2f4300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x8a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18249_.WMF", cAlternateFileName="")) returned 1 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF") returned 1 [0128.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf") returned 0x46 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ab0) returned 0x6d0e508 [0128.225] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ef00, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbccbe2a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ef00, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x142e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18250_.WMF", cAlternateFileName="")) returned 1 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF") returned 1 [0128.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf") returned 0x46 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ab4) returned 0x6d0e508 [0128.225] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc86500, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xefc86500, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18251_.WMF", cAlternateFileName="")) returned 1 [0128.225] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF") returned 1 [0128.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18251_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf") returned 0x46 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ab8) returned 0x6d0e508 [0128.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8ec2300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe8ec2300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x756, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18252_.WMF", cAlternateFileName="")) returned 1 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18251_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF") returned 1 [0128.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18252_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf") returned 0x46 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1abc) returned 0x6d0e508 [0128.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb803b00, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb803b00, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x6ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18253_.WMF", cAlternateFileName="")) returned 1 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18252_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF") returned 1 [0128.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18253_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf") returned 0x46 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ac0) returned 0x6d0e508 [0128.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bca4100, ftCreationTime.dwHighDateTime=0x1bddcab, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1bca4100, ftLastWriteTime.dwHighDateTime=0x1bddcab, nFileSizeHigh=0x0, nFileSizeLow=0x796, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18254_.WMF", cAlternateFileName="")) returned 1 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18253_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF") returned 1 [0128.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18254_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf") returned 0x46 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ac4) returned 0x6d0e508 [0128.226] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55feb900, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x55feb900, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18255_.WMF", cAlternateFileName="")) returned 1 [0128.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18254_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF") returned 1 [0128.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18255_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf") returned 0x46 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ac8) returned 0x6d0e508 [0128.227] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a21700, ftCreationTime.dwHighDateTime=0x1bdcf1c, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7a21700, ftLastWriteTime.dwHighDateTime=0x1bdcf1c, nFileSizeHigh=0x0, nFileSizeLow=0x8ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18256_.WMF", cAlternateFileName="")) returned 1 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18255_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF") returned 1 [0128.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18256_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf") returned 0x46 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1acc) returned 0x6d0e508 [0128.227] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd83b2900, ftCreationTime.dwHighDateTime=0x1bdfe4b, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd83b2900, ftLastWriteTime.dwHighDateTime=0x1bdfe4b, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18257_.WMF", cAlternateFileName="")) returned 1 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18256_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF") returned 1 [0128.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18257_.WMF", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf") returned 0x46 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ad0) returned 0x6d0e508 [0128.227] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84080dc0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x84080dc0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18257_.wmf", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\_RESTORE FILES_.txt", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\_RESTORE FILES_.txt") returned 1 [0128.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\_RESTORE FILES_.txt", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\autoshap\\_restore files_.txt") returned 0x4d [0128.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.227] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0128.227] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0128.227] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0128.228] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned 1 [0128.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\") returned 0x39 [0128.228] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0128.228] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0128.228] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0128.230] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0128.231] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0128.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned 1 [0128.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif") returned 0x45 [0128.231] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.231] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5178e0b0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0128.231] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0128.231] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\_restore files_.txt"), bFailIfExists=0) returned 1 [0128.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ad4) returned 0x6d0e508 [0128.234] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0128.234] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned 1 [0128.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif") returned 0x45 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1ad8) returned 0x6d0e508 [0128.235] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned 1 [0128.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif") returned 0x45 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6d0e508, Size=0x1adc) returned 0x6e063d0 [0128.235] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned 1 [0128.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif") returned 0x45 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ae0) returned 0x6e063d0 [0128.235] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned 1 [0128.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif") returned 0x45 [0128.235] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ae4) returned 0x6e063d0 [0128.235] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned 1 [0128.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif") returned 0x45 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.236] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ae8) returned 0x6e063d0 [0128.236] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned 1 [0128.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif") returned 0x45 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.236] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1aec) returned 0x6e063d0 [0128.236] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned 1 [0128.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif") returned 0x45 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.236] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1af0) returned 0x6e063d0 [0128.236] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned 1 [0128.236] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif") returned 0x45 [0128.236] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.236] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.236] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1af4) returned 0x6e063d0 [0128.236] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned 1 [0128.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif") returned 0x45 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.237] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1af8) returned 0x6e063d0 [0128.237] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned 1 [0128.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif") returned 0x45 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.237] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1afc) returned 0x6e063d0 [0128.237] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned 1 [0128.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif") returned 0x45 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.237] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b00) returned 0x6e063d0 [0128.237] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned 1 [0128.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif") returned 0x45 [0128.237] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.237] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.237] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b04) returned 0x6e063d0 [0128.237] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned 1 [0128.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif") returned 0x45 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b08) returned 0x6e063d0 [0128.238] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned 1 [0128.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif") returned 0x45 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b0c) returned 0x6e063d0 [0128.238] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned 1 [0128.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif") returned 0x45 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b10) returned 0x6e063d0 [0128.238] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned 1 [0128.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif") returned 0x45 [0128.238] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b14) returned 0x6e063d0 [0128.238] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned 1 [0128.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif") returned 0x45 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b18) returned 0x6e063d0 [0128.239] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned 1 [0128.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif") returned 0x45 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b1c) returned 0x6e063d0 [0128.239] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned 1 [0128.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif") returned 0x45 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b20) returned 0x6e063d0 [0128.239] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned 1 [0128.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif") returned 0x45 [0128.239] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b24) returned 0x6e063d0 [0128.239] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned 1 [0128.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif") returned 0x45 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b28) returned 0x6e063d0 [0128.240] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned 1 [0128.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif") returned 0x45 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b2c) returned 0x6e063d0 [0128.240] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned 1 [0128.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif") returned 0x45 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b30) returned 0x6e063d0 [0128.240] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned 1 [0128.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif") returned 0x45 [0128.240] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b34) returned 0x6e063d0 [0128.240] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned 1 [0128.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif") returned 0x45 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b38) returned 0x6e063d0 [0128.241] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned 1 [0128.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif") returned 0x45 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b3c) returned 0x6e063d0 [0128.241] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned 1 [0128.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif") returned 0x45 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b40) returned 0x6e063d0 [0128.241] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned 1 [0128.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif") returned 0x45 [0128.241] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b44) returned 0x6e063d0 [0128.242] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned 1 [0128.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif") returned 0x45 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b48) returned 0x6e063d0 [0128.242] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned 1 [0128.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif") returned 0x45 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b4c) returned 0x6e063d0 [0128.242] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned 1 [0128.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif") returned 0x45 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b50) returned 0x6e063d0 [0128.242] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned 1 [0128.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif") returned 0x45 [0128.242] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b54) returned 0x6e063d0 [0128.243] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8115e400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8115e400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14583_.GIF", cAlternateFileName="")) returned 1 [0128.547] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF") returned 1 [0128.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14583_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif") returned 0x45 [0128.547] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b50) returned 0x6e063d0 [0128.547] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14654_.GIF", cAlternateFileName="")) returned 1 [0128.547] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14583_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF") returned 1 [0128.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14654_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif") returned 0x45 [0128.547] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b54) returned 0x6e063d0 [0128.547] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4a53e00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb4a53e00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14655_.GIF", cAlternateFileName="")) returned 1 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14654_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF") returned 1 [0128.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14655_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif") returned 0x45 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b58) returned 0x6e063d0 [0128.548] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5d66b00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb5d66b00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14656_.GIF", cAlternateFileName="")) returned 1 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14655_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF") returned 1 [0128.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14656_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif") returned 0x45 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b5c) returned 0x6e063d0 [0128.548] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14691_.GIF", cAlternateFileName="")) returned 1 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14656_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF") returned 1 [0128.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14691_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif") returned 0x45 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b60) returned 0x6e063d0 [0128.548] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14692_.GIF", cAlternateFileName="")) returned 1 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14691_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF") returned 1 [0128.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14692_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif") returned 0x45 [0128.548] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b64) returned 0x6e063d0 [0128.549] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14693_.GIF", cAlternateFileName="")) returned 1 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14692_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF") returned 1 [0128.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14693_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif") returned 0x45 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b68) returned 0x6e063d0 [0128.549] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14752_.GIF", cAlternateFileName="")) returned 1 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14693_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF") returned 1 [0128.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14752_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif") returned 0x45 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b6c) returned 0x6e063d0 [0128.549] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14753_.GIF", cAlternateFileName="")) returned 1 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14752_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF") returned 1 [0128.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14753_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif") returned 0x45 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b70) returned 0x6e063d0 [0128.549] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecac8100, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecac8100, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14754_.GIF", cAlternateFileName="")) returned 1 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14753_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF") returned 1 [0128.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14754_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif") returned 0x45 [0128.549] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b74) returned 0x6e063d0 [0128.550] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fd2f700, ftCreationTime.dwHighDateTime=0x1bd4f43, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fd2f700, ftLastWriteTime.dwHighDateTime=0x1bd4f43, nFileSizeHigh=0x0, nFileSizeLow=0x44, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14755_.GIF", cAlternateFileName="")) returned 1 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14754_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF") returned 1 [0128.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14755_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif") returned 0x45 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b78) returned 0x6e063d0 [0128.550] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14756_.GIF", cAlternateFileName="")) returned 1 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14755_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF") returned 1 [0128.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14756_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif") returned 0x45 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b7c) returned 0x6e063d0 [0128.550] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedddae00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xedddae00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14757_.GIF", cAlternateFileName="")) returned 1 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14756_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF") returned 1 [0128.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14757_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif") returned 0x45 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b80) returned 0x6e063d0 [0128.550] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14790_.GIF", cAlternateFileName="")) returned 1 [0128.550] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14757_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF") returned 1 [0128.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14790_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif") returned 0x45 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b84) returned 0x6e063d0 [0128.551] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14791_.GIF", cAlternateFileName="")) returned 1 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14790_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF") returned 1 [0128.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14791_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif") returned 0x45 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b88) returned 0x6e063d0 [0128.551] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfafa9d00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfafa9d00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14792_.GIF", cAlternateFileName="")) returned 1 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14791_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF") returned 1 [0128.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14792_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif") returned 0x45 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b8c) returned 0x6e063d0 [0128.551] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14793_.GIF", cAlternateFileName="")) returned 1 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14792_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF") returned 1 [0128.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14793_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif") returned 0x45 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b90) returned 0x6e063d0 [0128.551] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14794_.GIF", cAlternateFileName="")) returned 1 [0128.551] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14793_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF") returned 1 [0128.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14794_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif") returned 0x45 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.552] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b94) returned 0x6e063d0 [0128.552] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2bca00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc2bca00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14795_.GIF", cAlternateFileName="")) returned 1 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14794_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF") returned 1 [0128.552] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14795_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif") returned 0x45 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.552] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b98) returned 0x6e063d0 [0128.552] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14828_.GIF", cAlternateFileName="")) returned 1 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14795_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF") returned 1 [0128.552] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14828_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif") returned 0x45 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.552] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1b9c) returned 0x6e063d0 [0128.552] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948b900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948b900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14829_.GIF", cAlternateFileName="")) returned 1 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14828_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF") returned 1 [0128.552] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14829_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif") returned 0x45 [0128.552] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.552] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.552] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ba0) returned 0x6e063d0 [0128.552] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14830_.GIF", cAlternateFileName="")) returned 1 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14829_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF") returned 1 [0128.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14830_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif") returned 0x45 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ba4) returned 0x6e063d0 [0128.553] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14831_.GIF", cAlternateFileName="")) returned 1 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14830_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF") returned 1 [0128.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14831_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif") returned 0x45 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1ba8) returned 0x6e063d0 [0128.553] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14832_.GIF", cAlternateFileName="")) returned 1 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14831_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF") returned 1 [0128.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14832_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif") returned 0x45 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bac) returned 0x6e063d0 [0128.553] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79e600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa79e600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14833_.GIF", cAlternateFileName="")) returned 1 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14832_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF") returned 1 [0128.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14833_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif") returned 0x45 [0128.553] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bb0) returned 0x6e063d0 [0128.554] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1796d500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1796d500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14866_.GIF", cAlternateFileName="")) returned 1 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14833_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF") returned 1 [0128.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14866_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif") returned 0x45 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bb4) returned 0x6e063d0 [0128.554] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14867_.GIF", cAlternateFileName="")) returned 1 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14866_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF") returned 1 [0128.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14867_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif") returned 0x45 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bb8) returned 0x6e063d0 [0128.554] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14868_.GIF", cAlternateFileName="")) returned 1 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14867_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF") returned 1 [0128.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14868_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif") returned 0x45 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bbc) returned 0x6e063d0 [0128.554] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18c80200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x18c80200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14869_.GIF", cAlternateFileName="")) returned 1 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14868_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF") returned 1 [0128.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14869_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif") returned 0x45 [0128.554] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bc0) returned 0x6e063d0 [0128.555] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14870_.GIF", cAlternateFileName="")) returned 1 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14869_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF") returned 1 [0128.555] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14870_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif") returned 0x45 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.555] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bc4) returned 0x6e063d0 [0128.555] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19f92f00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19f92f00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14871_.GIF", cAlternateFileName="")) returned 1 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14870_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF") returned 1 [0128.555] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14871_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif") returned 0x45 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.555] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bc8) returned 0x6e063d0 [0128.555] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3a5000, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c3a5000, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14980_.GIF", cAlternateFileName="")) returned 1 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14871_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF") returned 1 [0128.555] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14980_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif") returned 0x45 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.555] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bcc) returned 0x6e063d0 [0128.555] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d6b7d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d6b7d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14981_.GIF", cAlternateFileName="")) returned 1 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14980_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF") returned 1 [0128.555] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14981_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif") returned 0x45 [0128.555] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.555] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd0) returned 0x6e063d0 [0128.556] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56d8700, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc56d8700, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14982_.GIF", cAlternateFileName="")) returned 1 [0128.556] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14981_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF") returned 1 [0128.556] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14982_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif") returned 0x45 [0128.556] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.556] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.556] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd4) returned 0x6e063d0 [0128.556] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43c5a00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc43c5a00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14983_.GIF", cAlternateFileName="")) returned 1 [0128.654] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14982_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF") returned 1 [0128.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14983_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif") returned 0x45 [0128.654] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.654] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd0) returned 0x6e063d0 [0128.655] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc30b2d00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc30b2d00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14984_.GIF", cAlternateFileName="")) returned 1 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14983_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF") returned 1 [0128.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14984_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif") returned 0x45 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd4) returned 0x6e063d0 [0128.655] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1da0000, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1da0000, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x40, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14985_.GIF", cAlternateFileName="")) returned 1 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14984_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF") returned 1 [0128.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14985_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif") returned 0x45 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bd8) returned 0x6e063d0 [0128.655] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57254000, ftCreationTime.dwHighDateTime=0x1bd5ec1, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57254000, ftLastWriteTime.dwHighDateTime=0x1bd5ec1, nFileSizeHigh=0x0, nFileSizeLow=0x40f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15018_.GIF", cAlternateFileName="")) returned 1 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14985_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF") returned 1 [0128.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15018_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif") returned 0x45 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bdc) returned 0x6e063d0 [0128.655] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb99900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bb99900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15019_.GIF", cAlternateFileName="")) returned 1 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15018_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF") returned 1 [0128.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15019_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif") returned 0x45 [0128.655] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1be0) returned 0x6e063d0 [0128.656] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83dcdc00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83dcdc00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15020_.GIF", cAlternateFileName="")) returned 1 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15019_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF") returned 1 [0128.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15020_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif") returned 0x45 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1be4) returned 0x6e063d0 [0128.656] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82abaf00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82abaf00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15021_.GIF", cAlternateFileName="")) returned 1 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15020_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF") returned 1 [0128.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15021_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif") returned 0x45 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1be8) returned 0x6e063d0 [0128.656] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x817a8200, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x817a8200, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15022_.GIF", cAlternateFileName="")) returned 1 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15021_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF") returned 1 [0128.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15022_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif") returned 0x45 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bec) returned 0x6e063d0 [0128.656] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80495500, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80495500, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15023_.GIF", cAlternateFileName="")) returned 1 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15022_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF") returned 1 [0128.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15023_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif") returned 0x45 [0128.656] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bf0) returned 0x6e063d0 [0128.657] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15056_.GIF", cAlternateFileName="")) returned 1 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15023_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF") returned 1 [0128.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15056_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif") returned 0x45 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.657] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bf4) returned 0x6e063d0 [0128.657] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95f37700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95f37700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15057_.GIF", cAlternateFileName="")) returned 1 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15056_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF") returned 1 [0128.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15057_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif") returned 0x45 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.657] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bf8) returned 0x6e063d0 [0128.657] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9724a400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9724a400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15058_.GIF", cAlternateFileName="")) returned 1 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15057_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF") returned 1 [0128.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15058_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif") returned 0x45 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.657] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.657] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1bfc) returned 0x6e063d0 [0128.657] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x319bbb00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x319bbb00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0xaa, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15059_.GIF", cAlternateFileName="")) returned 1 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15058_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF") returned 1 [0128.657] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15059_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif") returned 0x45 [0128.657] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.658] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c00) returned 0x6e063d0 [0128.658] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306a8e00, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x306a8e00, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15060_.GIF", cAlternateFileName="")) returned 1 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15059_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF") returned 1 [0128.658] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15060_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif") returned 0x45 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.658] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c04) returned 0x6e063d0 [0128.658] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f396100, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2f396100, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15061_.GIF", cAlternateFileName="")) returned 1 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15060_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF") returned 1 [0128.658] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15061_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif") returned 0x45 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.658] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c08) returned 0x6e063d0 [0128.658] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfac9e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbfac9e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15132_.GIF", cAlternateFileName="")) returned 1 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15061_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF") returned 1 [0128.658] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15132_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif") returned 0x45 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.658] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.658] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c0c) returned 0x6e063d0 [0128.658] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15133_.GIF", cAlternateFileName="")) returned 1 [0128.658] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15132_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF") returned 1 [0128.658] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif") returned 0x45 [0128.659] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.659] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c10) returned 0x6e063d0 [0128.659] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15134_.GIF", cAlternateFileName="")) returned 1 [0128.659] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF") returned 1 [0128.659] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif") returned 0x45 [0128.659] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.659] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.659] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6e063d0, Size=0x1c14) returned 0x6f3bea8 [0128.659] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ddcb00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc0ddcb00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15135_.GIF", cAlternateFileName="")) returned 1 [0128.659] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF") returned 1 [0128.659] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif") returned 0x45 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.660] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c18) returned 0x6f3bea8 [0128.660] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc20ef800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc20ef800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15136_.GIF", cAlternateFileName="")) returned 1 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF") returned 1 [0128.660] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif") returned 0x45 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.660] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c1c) returned 0x6f3bea8 [0128.660] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15168_.GIF", cAlternateFileName="")) returned 1 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF") returned 1 [0128.660] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif") returned 0x45 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.660] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c20) returned 0x6f3bea8 [0128.660] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfaba00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdfaba00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15169_.GIF", cAlternateFileName="")) returned 1 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF") returned 1 [0128.660] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif") returned 0x45 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.660] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.660] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c24) returned 0x6f3bea8 [0128.660] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15170_.GIF", cAlternateFileName="")) returned 1 [0128.660] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF") returned 1 [0128.660] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif") returned 0x45 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.661] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c28) returned 0x6f3bea8 [0128.661] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a06a900, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a06a900, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15171_.GIF", cAlternateFileName="")) returned 1 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF") returned 1 [0128.661] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif") returned 0x45 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.661] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c2c) returned 0x6f3bea8 [0128.661] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf2be700, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcf2be700, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15172_.GIF", cAlternateFileName="")) returned 1 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF") returned 1 [0128.661] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15172_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif") returned 0x45 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.661] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c30) returned 0x6f3bea8 [0128.661] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a44f00, ftCreationTime.dwHighDateTime=0x1bd4f40, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x77a44f00, ftLastWriteTime.dwHighDateTime=0x1bd4f40, nFileSizeHigh=0x0, nFileSizeLow=0x8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15173_.GIF", cAlternateFileName="")) returned 1 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15172_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF") returned 1 [0128.661] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15173_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif") returned 0x45 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.661] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.661] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c34) returned 0x6f3bea8 [0128.661] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb476800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb476800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15272_.GIF", cAlternateFileName="")) returned 1 [0128.661] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15173_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF") returned 1 [0128.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15272_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif") returned 0x45 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.662] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c38) returned 0x6f3bea8 [0128.662] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc789500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfc789500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15273_.GIF", cAlternateFileName="")) returned 1 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15272_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF") returned 1 [0128.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15273_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif") returned 0x45 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.662] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c3c) returned 0x6f3bea8 [0128.662] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc998a500, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc998a500, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15274_.GIF", cAlternateFileName="")) returned 1 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15273_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF") returned 1 [0128.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15274_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif") returned 0x45 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.662] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c40) returned 0x6f3bea8 [0128.662] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7364b00, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc7364b00, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15275_.GIF", cAlternateFileName="")) returned 1 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15274_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF") returned 1 [0128.662] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15275_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif") returned 0x45 [0128.662] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.662] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c44) returned 0x6f3bea8 [0128.662] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3a2c400, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc3a2c400, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15276_.GIF", cAlternateFileName="")) returned 1 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15275_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF") returned 1 [0128.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15276_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif") returned 0x45 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c48) returned 0x6f3bea8 [0128.663] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2719700, ftCreationTime.dwHighDateTime=0x1bd4f3f, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2719700, ftLastWriteTime.dwHighDateTime=0x1bd4f3f, nFileSizeHigh=0x0, nFileSizeLow=0x3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15277_.GIF", cAlternateFileName="")) returned 1 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15276_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF") returned 1 [0128.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15277_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif") returned 0x45 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c4c) returned 0x6f3bea8 [0128.663] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42390f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42390f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21294_.GIF", cAlternateFileName="")) returned 1 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15277_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF") returned 1 [0128.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21294_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif") returned 0x45 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c50) returned 0x6f3bea8 [0128.663] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436a3c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x436a3c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21295_.GIF", cAlternateFileName="")) returned 1 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21294_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF") returned 1 [0128.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21295_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif") returned 0x45 [0128.663] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c54) returned 0x6f3bea8 [0128.663] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45cc9600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x45cc9600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21296_.GIF", cAlternateFileName="")) returned 1 [0128.826] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21295_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF") returned 1 [0128.826] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21296_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif") returned 0x45 [0128.826] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.826] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.826] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c54) returned 0x6f3bea8 [0128.826] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x449b6900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x449b6900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21297_.GIF", cAlternateFileName="")) returned 1 [0128.826] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21296_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF") returned 1 [0128.826] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21297_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif") returned 0x45 [0128.826] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.827] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c58) returned 0x6f3bea8 [0128.827] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a914a00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a914a00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21298_.GIF", cAlternateFileName="")) returned 1 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21297_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF") returned 1 [0128.827] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21298_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif") returned 0x45 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.827] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c5c) returned 0x6f3bea8 [0128.827] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49601d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd0a560, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49601d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21299_.GIF", cAlternateFileName="")) returned 1 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21298_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF") returned 1 [0128.827] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21299_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif") returned 0x45 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.827] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c60) returned 0x6f3bea8 [0128.827] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x482ef000, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x482ef000, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21300_.GIF", cAlternateFileName="")) returned 1 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21299_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF") returned 1 [0128.827] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21300_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif") returned 0x45 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.827] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.827] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c64) returned 0x6f3bea8 [0128.827] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51b85800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51b85800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21301_.GIF", cAlternateFileName="")) returned 1 [0128.827] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21300_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF") returned 1 [0128.827] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21301_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif") returned 0x45 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.828] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c68) returned 0x6f3bea8 [0128.828] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50872b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50872b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21302_.GIF", cAlternateFileName="")) returned 1 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21301_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF") returned 1 [0128.828] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21302_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif") returned 0x45 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.828] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c6c) returned 0x6f3bea8 [0128.828] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4cf3a400, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4cf3a400, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21304_.GIF", cAlternateFileName="")) returned 1 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21302_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF") returned 1 [0128.828] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21304_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif") returned 0x45 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.828] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c70) returned 0x6f3bea8 [0128.828] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bc27700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bc27700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21306_.GIF", cAlternateFileName="")) returned 1 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21304_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF") returned 1 [0128.828] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21306_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif") returned 0x45 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.828] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.828] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c74) returned 0x6f3bea8 [0128.828] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4107e200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4107e200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21308_.GIF", cAlternateFileName="")) returned 1 [0128.828] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21306_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF") returned 1 [0128.828] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21308_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif") returned 0x45 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.829] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c78) returned 0x6f3bea8 [0128.829] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ea58800, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ea58800, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21310_.GIF", cAlternateFileName="")) returned 1 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21308_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF") returned 1 [0128.829] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21310_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif") returned 0x45 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.829] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c7c) returned 0x6f3bea8 [0128.829] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c432e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c432e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21312_.GIF", cAlternateFileName="")) returned 1 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21310_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF") returned 1 [0128.829] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21312_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif") returned 0x45 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.829] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c80) returned 0x6f3bea8 [0128.829] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38afa700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x38afa700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x45, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21314_.GIF", cAlternateFileName="")) returned 1 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21312_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF") returned 1 [0128.829] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21314_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif") returned 0x45 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.829] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.829] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c84) returned 0x6f3bea8 [0128.829] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33eaf300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33eaf300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x113, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21316_.GIF", cAlternateFileName="")) returned 1 [0128.829] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21314_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF") returned 1 [0128.829] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21316_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif") returned 0x45 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c88) returned 0x6f3bea8 [0128.830] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cc3e500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2cc3e500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21327_.GIF", cAlternateFileName="")) returned 1 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21316_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF") returned 1 [0128.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21327_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif") returned 0x45 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c8c) returned 0x6f3bea8 [0128.830] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29305e00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29305e00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21329_.GIF", cAlternateFileName="")) returned 1 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21327_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF") returned 1 [0128.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21329_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif") returned 0x45 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c90) returned 0x6f3bea8 [0128.830] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x259cd700, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x259cd700, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21331_.GIF", cAlternateFileName="")) returned 1 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21329_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF") returned 1 [0128.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21331_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif") returned 0x45 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.830] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.830] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c94) returned 0x6f3bea8 [0128.830] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20d82300, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x20d82300, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21333_.GIF", cAlternateFileName="")) returned 1 [0128.830] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21331_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF") returned 1 [0128.830] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21333_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif") returned 0x45 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.831] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c98) returned 0x6f3bea8 [0128.831] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d449c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1d449c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x3cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21335_.GIF", cAlternateFileName="")) returned 1 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21333_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF") returned 1 [0128.831] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21335_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif") returned 0x45 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.831] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1c9c) returned 0x6f3bea8 [0128.831] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c136f00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c136f00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21337_.GIF", cAlternateFileName="")) returned 1 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21335_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF") returned 1 [0128.831] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21337_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif") returned 0x45 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.831] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ca0) returned 0x6f3bea8 [0128.831] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b11500, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x19b11500, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21339_.GIF", cAlternateFileName="")) returned 1 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21337_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF") returned 1 [0128.831] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21339_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif") returned 0x45 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.831] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ca4) returned 0x6f3bea8 [0128.831] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21342_.GIF", cAlternateFileName="")) returned 1 [0128.831] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21339_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF") returned 1 [0128.831] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21342_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif") returned 0x45 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ca8) returned 0x6f3bea8 [0128.832] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d01a600, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d01a600, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21343_.GIF", cAlternateFileName="")) returned 1 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21342_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF") returned 1 [0128.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21343_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif") returned 0x45 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cac) returned 0x6f3bea8 [0128.832] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e32d300, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8e32d300, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21344_.GIF", cAlternateFileName="")) returned 1 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21343_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF") returned 1 [0128.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif") returned 0x45 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cb0) returned 0x6f3bea8 [0128.832] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21364_.GIF", cAlternateFileName="")) returned 1 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF") returned 1 [0128.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif") returned 0x45 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cb4) returned 0x6f3bea8 [0128.832] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21365_.GIF", cAlternateFileName="")) returned 1 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF") returned 1 [0128.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif") returned 0x45 [0128.832] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.833] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cb8) returned 0x6f3bea8 [0128.833] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52007200, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x52007200, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21366_.GIF", cAlternateFileName="")) returned 1 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF") returned 1 [0128.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif") returned 0x45 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.833] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cbc) returned 0x6f3bea8 [0128.833] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d68800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x88d68800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21375_.GIF", cAlternateFileName="")) returned 1 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF") returned 1 [0128.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21375_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif") returned 0x45 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.833] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cc0) returned 0x6f3bea8 [0128.833] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21376_.GIF", cAlternateFileName="")) returned 1 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21375_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF") returned 1 [0128.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21376_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif") returned 0x45 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.833] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.833] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cc4) returned 0x6f3bea8 [0128.833] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a07b500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8a07b500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21377_.GIF", cAlternateFileName="")) returned 1 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21376_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF") returned 1 [0128.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21377_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif") returned 0x45 [0128.833] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.834] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.834] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cc8) returned 0x6f3bea8 [0128.834] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb28faf00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb28faf00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21398_.GIF", cAlternateFileName="")) returned 1 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21377_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF") returned 1 [0128.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21398_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif") returned 0x45 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.834] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.834] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ccc) returned 0x6f3bea8 [0128.834] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21399_.GIF", cAlternateFileName="")) returned 1 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21398_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF") returned 1 [0128.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21399_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif") returned 0x45 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.834] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.834] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cd0) returned 0x6f3bea8 [0128.834] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3c0dc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb3c0dc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21400_.GIF", cAlternateFileName="")) returned 1 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21399_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF") returned 1 [0128.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21400_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif") returned 0x45 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.834] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.834] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cd4) returned 0x6f3bea8 [0128.834] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21421_.GIF", cAlternateFileName="")) returned 1 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21400_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF") returned 1 [0128.834] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21421_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif") returned 0x45 [0128.834] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.835] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0128.835] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cd8) returned 0x6f3bea8 [0128.835] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6b100, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6b100, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21422_.GIF", cAlternateFileName="")) returned 1 [0128.967] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21421_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF") returned 1 [0128.967] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21422_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif") returned 0x45 [0128.967] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0128.967] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.438] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cdc) returned 0x6f3bea8 [0129.438] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf7de00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf7de00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21423_.GIF", cAlternateFileName="")) returned 1 [0129.438] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21422_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF") returned 1 [0129.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21423_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif") returned 0x45 [0129.438] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.438] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ce0) returned 0x6f3bea8 [0129.438] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21433_.GIF", cAlternateFileName="")) returned 1 [0129.438] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21423_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF") returned 1 [0129.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21433_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif") returned 0x45 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ce4) returned 0x6f3bea8 [0129.439] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c65a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91c65a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21434_.GIF", cAlternateFileName="")) returned 1 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21433_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF") returned 1 [0129.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21434_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif") returned 0x45 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1ce8) returned 0x6f3bea8 [0129.439] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f78700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x92f78700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21435_.GIF", cAlternateFileName="")) returned 1 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21434_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF") returned 1 [0129.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21435_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif") returned 0x45 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cec) returned 0x6f3bea8 [0129.439] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5593f900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5593f900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21480_.GIF", cAlternateFileName="")) returned 1 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21435_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF") returned 1 [0129.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21480_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif") returned 0x45 [0129.439] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cf0) returned 0x6f3bea8 [0129.439] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21481_.GIF", cAlternateFileName="")) returned 1 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21480_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF") returned 1 [0129.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21481_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif") returned 0x45 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cf4) returned 0x6f3bea8 [0129.440] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56c52600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56c52600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21482_.GIF", cAlternateFileName="")) returned 1 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21481_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF") returned 1 [0129.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21482_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif") returned 0x45 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cf8) returned 0x6f3bea8 [0129.440] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ffd9600, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8ffd9600, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21503_.GIF", cAlternateFileName="")) returned 1 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21482_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF") returned 1 [0129.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21503_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif") returned 0x45 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1cfc) returned 0x6f3bea8 [0129.440] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21504_.GIF", cAlternateFileName="")) returned 1 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21503_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF") returned 1 [0129.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21504_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif") returned 0x45 [0129.440] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d00) returned 0x6f3bea8 [0129.441] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912ec300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x912ec300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21505_.GIF", cAlternateFileName="")) returned 1 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21504_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF") returned 1 [0129.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21505_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif") returned 0x45 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d04) returned 0x6f3bea8 [0129.441] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b6bd00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9b6bd00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21518_.GIF", cAlternateFileName="")) returned 1 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21505_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF") returned 1 [0129.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21518_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif") returned 0x45 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d08) returned 0x6f3bea8 [0129.441] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21519_.GIF", cAlternateFileName="")) returned 1 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21518_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF") returned 1 [0129.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21519_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif") returned 0x45 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d0c) returned 0x6f3bea8 [0129.441] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbae7ea00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbae7ea00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21520_.GIF", cAlternateFileName="")) returned 1 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21519_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF") returned 1 [0129.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21520_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif") returned 0x45 [0129.441] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.441] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d10) returned 0x6f3bea8 [0129.442] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21533_.GIF", cAlternateFileName="")) returned 1 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21520_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF") returned 1 [0129.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21533_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif") returned 0x45 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d14) returned 0x6f3bea8 [0129.442] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21534_.GIF", cAlternateFileName="")) returned 1 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21533_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF") returned 1 [0129.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21534_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif") returned 0x45 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d18) returned 0x6f3bea8 [0129.442] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8b6500, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8b6500, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x12b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21535_.GIF", cAlternateFileName="")) returned 1 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21534_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF") returned 1 [0129.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21535_.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif") returned 0x45 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.442] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d1c) returned 0x6f3bea8 [0129.442] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS.DLL", cAlternateFileName="")) returned 1 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21535_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 1 [0129.442] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll") returned 0x44 [0129.442] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.442] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.443] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2f35a00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc2f35a00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115834.GIF", cAlternateFileName="")) returned 1 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF") returned 1 [0129.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115834.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif") returned 0x45 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d20) returned 0x6f3bea8 [0129.443] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4248700, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc4248700, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115835.GIF", cAlternateFileName="")) returned 1 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115834.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF") returned 1 [0129.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115835.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif") returned 0x45 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d24) returned 0x6f3bea8 [0129.443] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc555b400, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc555b400, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115836.GIF", cAlternateFileName="")) returned 1 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115835.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF") returned 1 [0129.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115836.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif") returned 0x45 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.443] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d28) returned 0x6f3bea8 [0129.443] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x497bb300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x497bb300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115839.GIF", cAlternateFileName="")) returned 1 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115836.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF") returned 1 [0129.443] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115839.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif") returned 0x45 [0129.443] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.443] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d2c) returned 0x6f3bea8 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115840.GIF", cAlternateFileName="")) returned 1 [0129.444] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115839.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF") returned 1 [0129.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115840.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115840.gif") returned 0x45 [0129.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d30) returned 0x6f3bea8 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115841.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115842.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aace000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4aace000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115843.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bde0d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4bde0d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115844.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115863.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115864.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57c9cf00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x57c9cf00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115865.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115866.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115867.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58fafc00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58fafc00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115868.GIF", cAlternateFileName="")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x840a6f20, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x840a6f20, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0129.444] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.445] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0129.445] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0129.447] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.448] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0129.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5178e0b0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0129.448] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.448] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\_restore files_.txt"), bFailIfExists=0) returned 1 [0129.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f3bea8, Size=0x1d5c) returned 0x6f14048 [0129.451] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0129.451] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned 1 [0129.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif") returned 0x43 [0129.451] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d60) returned 0x6f14048 [0129.451] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0129.451] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned 1 [0129.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif") returned 0x43 [0129.451] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.451] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d64) returned 0x6f14048 [0129.451] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0129.451] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned 1 [0129.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif") returned 0x43 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d68) returned 0x6f14048 [0129.452] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned 1 [0129.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif") returned 0x43 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d6c) returned 0x6f14048 [0129.452] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned 1 [0129.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif") returned 0x43 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d70) returned 0x6f14048 [0129.452] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned 1 [0129.452] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif") returned 0x43 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.452] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.452] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d74) returned 0x6f14048 [0129.452] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0129.452] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned 1 [0129.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif") returned 0x43 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.453] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d78) returned 0x6f14048 [0129.453] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned 1 [0129.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif") returned 0x43 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.453] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d7c) returned 0x6f14048 [0129.453] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned 1 [0129.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif") returned 0x43 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.453] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d80) returned 0x6f14048 [0129.453] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned 1 [0129.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif") returned 0x43 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.453] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d84) returned 0x6f14048 [0129.453] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0129.453] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned 1 [0129.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif") returned 0x43 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d88) returned 0x6f14048 [0129.454] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned 1 [0129.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif") returned 0x43 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d8c) returned 0x6f14048 [0129.454] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned 1 [0129.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif") returned 0x43 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d90) returned 0x6f14048 [0129.454] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned 1 [0129.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif") returned 0x43 [0129.454] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d94) returned 0x6f14048 [0129.454] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned 1 [0129.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif") returned 0x43 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.455] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d98) returned 0x6f14048 [0129.455] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned 1 [0129.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif") returned 0x43 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.455] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d9c) returned 0x6f14048 [0129.455] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned 1 [0129.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif") returned 0x43 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.455] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da0) returned 0x6f14048 [0129.455] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned 1 [0129.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif") returned 0x43 [0129.455] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.455] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.455] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da4) returned 0x6f14048 [0129.456] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned 1 [0129.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif") returned 0x43 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.456] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.456] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da8) returned 0x6f14048 [0129.456] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned 1 [0129.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif") returned 0x43 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.456] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.456] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dac) returned 0x6f14048 [0129.456] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned 1 [0129.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif") returned 0x43 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.456] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.456] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db0) returned 0x6f14048 [0129.456] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned 1 [0129.456] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif") returned 0x43 [0129.456] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.456] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.456] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db4) returned 0x6f14048 [0129.457] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned 1 [0129.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif") returned 0x43 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.457] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db8) returned 0x6f14048 [0129.457] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14997_.GIF", cAlternateFileName="")) returned 1 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14996_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF") returned 1 [0129.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14997_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif") returned 0x43 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.457] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dbc) returned 0x6f14048 [0129.457] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca82e00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15034_.GIF", cAlternateFileName="")) returned 1 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd14997_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF") returned 1 [0129.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15034_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif") returned 0x43 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.457] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.457] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc0) returned 0x6f14048 [0129.457] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81af7a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcaa8f60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81af7a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x16e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15035_.GIF", cAlternateFileName="")) returned 1 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15034_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF") returned 1 [0129.457] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15035_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif") returned 0x43 [0129.457] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc4) returned 0x6f14048 [0129.458] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9be95800, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9be95800, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15072_.GIF", cAlternateFileName="")) returned 1 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15035_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF") returned 1 [0129.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15072_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif") returned 0x43 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc8) returned 0x6f14048 [0129.458] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a8500, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcacf0c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9d1a8500, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15073_.GIF", cAlternateFileName="")) returned 1 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15072_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF") returned 1 [0129.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15073_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif") returned 0x43 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dcc) returned 0x6f14048 [0129.458] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15155_.GIF", cAlternateFileName="")) returned 1 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15073_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF") returned 1 [0129.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15155_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif") returned 0x43 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.458] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.458] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd0) returned 0x6f14048 [0129.458] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab3c1d00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcaf5220, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xab3c1d00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15156_.GIF", cAlternateFileName="")) returned 1 [0129.458] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15155_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF") returned 1 [0129.458] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15156_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif") returned 0x43 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd4) returned 0x6f14048 [0129.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15184_.GIF", cAlternateFileName="")) returned 1 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15156_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF") returned 1 [0129.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15184_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif") returned 0x43 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd8) returned 0x6f14048 [0129.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f09b00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcb1b380, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3f09b00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15185_.GIF", cAlternateFileName="")) returned 1 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15184_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF") returned 1 [0129.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15185_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif") returned 0x43 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0129.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6d4a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac6d4a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15301_.GIF", cAlternateFileName="")) returned 1 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15185_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF") returned 1 [0129.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15301_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif") returned 0x43 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0129.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7332a00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7332a00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD15302_.GIF", cAlternateFileName="")) returned 1 [0129.459] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15301_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF") returned 1 [0129.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD15302_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif") returned 0x43 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0129.460] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e24d100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4e24d100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21303_.GIF", cAlternateFileName="")) returned 1 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd15302_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF") returned 1 [0129.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21303_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif") returned 0x43 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0129.460] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0150b00, ftCreationTime.dwHighDateTime=0x1bd4f54, ftLastAccessTime.dwLowDateTime=0xbcd306c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0150b00, ftLastWriteTime.dwHighDateTime=0x1bd4f54, nFileSizeHigh=0x0, nFileSizeLow=0x616, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21305_.GIF", cAlternateFileName="")) returned 1 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21303_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF") returned 1 [0129.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21305_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif") returned 0x43 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0129.460] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf17ca00, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf17ca00, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21307_.GIF", cAlternateFileName="")) returned 1 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21305_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF") returned 1 [0129.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21307_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif") returned 0x43 [0129.460] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0129.460] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56009300, ftCreationTime.dwHighDateTime=0x1bd4f53, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56009300, ftLastWriteTime.dwHighDateTime=0x1bd4f53, nFileSizeHigh=0x0, nFileSizeLow=0xd1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21309_.GIF", cAlternateFileName="")) returned 1 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21307_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF") returned 1 [0129.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21309_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif") returned 0x43 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0129.461] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d745b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd56820, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3d745b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x901, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21311_.GIF", cAlternateFileName="")) returned 1 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21309_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF") returned 1 [0129.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21311_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif") returned 0x43 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0129.461] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b120100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3b120100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1a15, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21313_.GIF", cAlternateFileName="")) returned 1 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21311_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF") returned 1 [0129.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21313_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif") returned 0x43 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0129.461] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x364d4d00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x364d4d00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21315_.GIF", cAlternateFileName="")) returned 1 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21313_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF") returned 1 [0129.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21315_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif") returned 0x43 [0129.461] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0129.461] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb568300, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbb568300, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21318_.GIF", cAlternateFileName="")) returned 1 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21315_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF") returned 1 [0129.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21318_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif") returned 0x43 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0129.462] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7128600, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7128600, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x193, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21319_.GIF", cAlternateFileName="")) returned 1 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21318_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF") returned 1 [0129.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21319_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif") returned 0x43 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0129.462] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97933d00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97933d00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x664, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21320_.GIF", cAlternateFileName="")) returned 1 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21319_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF") returned 1 [0129.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21320_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif") returned 0x43 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0129.462] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b19a00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcd7c980, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85b19a00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x9c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21321_.GIF", cAlternateFileName="")) returned 1 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21320_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF") returned 1 [0129.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21321_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif") returned 0x43 [0129.462] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0129.463] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5c3b00, ftCreationTime.dwHighDateTime=0x1bd4f57, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f5c3b00, ftLastWriteTime.dwHighDateTime=0x1bd4f57, nFileSizeHigh=0x0, nFileSizeLow=0x4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21322_.GIF", cAlternateFileName="")) returned 1 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21321_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF") returned 1 [0129.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21322_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif") returned 0x43 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0129.463] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b9c600, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32b9c600, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21323_.GIF", cAlternateFileName="")) returned 1 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21322_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF") returned 1 [0129.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21323_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif") returned 0x43 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0129.463] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30576c00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x30576c00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21324_.GIF", cAlternateFileName="")) returned 1 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21323_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF") returned 1 [0129.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif") returned 0x43 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0129.463] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2df51200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2df51200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x5e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21325_.GIF", cAlternateFileName="")) returned 1 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF") returned 1 [0129.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif") returned 0x43 [0129.463] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0129.464] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dae8400, ftCreationTime.dwHighDateTime=0x1bd4f56, ftLastAccessTime.dwLowDateTime=0xbcda2ae0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dae8400, ftLastWriteTime.dwHighDateTime=0x1bd4f56, nFileSizeHigh=0x0, nFileSizeLow=0x6f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21326_.GIF", cAlternateFileName="")) returned 1 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF") returned 1 [0129.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif") returned 0x43 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0129.464] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a618b00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2a618b00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21328_.GIF", cAlternateFileName="")) returned 1 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF") returned 1 [0129.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif") returned 0x43 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0129.464] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ff3100, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x27ff3100, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21330_.GIF", cAlternateFileName="")) returned 1 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF") returned 1 [0129.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif") returned 0x43 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0129.464] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x246baa00, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdc8c40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x246baa00, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x1f91, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21332_.GIF", cAlternateFileName="")) returned 1 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF") returned 1 [0129.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif") returned 0x43 [0129.464] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0129.465] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e75c900, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1e75c900, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x888, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21334_.GIF", cAlternateFileName="")) returned 1 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF") returned 1 [0129.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif") returned 0x43 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0129.465] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4465be00, ftCreationTime.dwHighDateTime=0x1bd4f48, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4465be00, ftLastWriteTime.dwHighDateTime=0x1bd4f48, nFileSizeHigh=0x0, nFileSizeLow=0xaeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21336_.GIF", cAlternateFileName="")) returned 1 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF") returned 1 [0129.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif") returned 0x43 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0129.465] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae24200, ftCreationTime.dwHighDateTime=0x1bd4d50, ftLastAccessTime.dwLowDateTime=0xbcdeeda0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ae24200, ftLastWriteTime.dwHighDateTime=0x1bd4d50, nFileSizeHigh=0x0, nFileSizeLow=0x344, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21338_.GIF", cAlternateFileName="")) returned 1 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF") returned 1 [0129.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif") returned 0x43 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0129.465] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a537400, ftCreationTime.dwHighDateTime=0x1bd4f41, ftLastAccessTime.dwLowDateTime=0xbce14f00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7a537400, ftLastWriteTime.dwHighDateTime=0x1bd4f41, nFileSizeHigh=0x0, nFileSizeLow=0x96, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21340_.GIF", cAlternateFileName="")) returned 1 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF") returned 1 [0129.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif") returned 0x43 [0129.465] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0129.466] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7a89600, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa7a89600, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21348_.GIF", cAlternateFileName="")) returned 1 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF") returned 1 [0129.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif") returned 0x43 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0129.466] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5462cc00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce3b060, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5462cc00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x8e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21370_.GIF", cAlternateFileName="")) returned 1 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF") returned 1 [0129.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif") returned 0x43 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0129.466] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b3c00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce611c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8d9b3c00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21390_.GIF", cAlternateFileName="")) returned 1 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF") returned 1 [0129.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif") returned 0x43 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0129.466] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7546300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7546300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21413_.GIF", cAlternateFileName="")) returned 1 [0129.466] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF") returned 1 [0129.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif") returned 0x43 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0129.467] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd290b00, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbce87320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd290b00, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x770, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21427_.GIF", cAlternateFileName="")) returned 1 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF") returned 1 [0129.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif") returned 0x43 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0129.467] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97bc3b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbcead480, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97bc3b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21448_.GIF", cAlternateFileName="")) returned 1 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF") returned 1 [0129.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21448_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif") returned 0x43 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0129.467] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b89da00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbced35e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5b89da00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21495_.GIF", cAlternateFileName="")) returned 1 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21448_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF") returned 1 [0129.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21495_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif") returned 0x43 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0129.467] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93911d00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x93911d00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21512_.GIF", cAlternateFileName="")) returned 1 [0129.467] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21495_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF") returned 1 [0129.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21512_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif") returned 0x43 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0129.468] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd4a4400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbcef9740, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4a4400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x24e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21527_.GIF", cAlternateFileName="")) returned 1 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21512_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF") returned 1 [0129.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21527_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif") returned 0x43 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0129.468] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15814600, ftCreationTime.dwHighDateTime=0x1bd8f93, ftLastAccessTime.dwLowDateTime=0xbcf1f8a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15814600, ftLastWriteTime.dwHighDateTime=0x1bd8f93, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD21548_.GIF", cAlternateFileName="")) returned 1 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21527_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF") returned 1 [0129.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21548_.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif") returned 0x43 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0129.468] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115855.GIF", cAlternateFileName="")) returned 1 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\bd21548_.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF") returned 1 [0129.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115855.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif") returned 0x43 [0129.468] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0129.468] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51d3ee00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd408600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51d3ee00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115856.GIF", cAlternateFileName="")) returned 1 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115855.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF") returned 1 [0129.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115856.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif") returned 0x43 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0129.469] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115875.GIF", cAlternateFileName="")) returned 1 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115856.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF") returned 1 [0129.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115875.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif") returned 0x43 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.469] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60220a00, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x60220a00, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0115876.GIF", cAlternateFileName="")) returned 1 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115875.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF") returned 1 [0129.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\J0115876.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif") returned 0x43 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0129.469] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES.DLL", cAlternateFileName="")) returned 1 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\j0115876.gif", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 1 [0129.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll") returned 0x40 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.469] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c41a60, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x84c41a60, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0129.469] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\_RESTORE FILES_.txt", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\_RESTORE FILES_.txt") returned 1 [0129.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\_RESTORE FILES_.txt", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\lines\\_restore files_.txt") returned 0x4a [0129.470] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.470] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.470] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.470] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0129.470] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 1 [0129.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\office10.dll") returned 0x3d [0129.470] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.470] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0129.470] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\media\\office14\\office10.dll", psz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 1 [0129.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\media\\office14\\office10.mmw") returned 0x3d [0129.470] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0129.470] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.470] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0129.490] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0129.490] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.490] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0129.490] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.490] FindClose (in: hFindFile=0x5b9670 | out: hFindFile=0x5b9670) returned 1 [0129.491] FindNextFileW (in: hFindFile=0x5b95f0, lpFindFileData=0x6a0f3ac | out: lpFindFileData=0x6a0f3ac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0129.491] SysReAllocStringLen (in: pbstr=0x6a0f0e0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\", len=0x2b | out: pbstr=0x6a0f0e0*="C:\\Program Files\\Microsoft Office\\Office14\\") returned 1 [0129.491] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\", cchLength=0x2b | out: lpsz="c:\\program files\\microsoft office\\office14\\") returned 0x2b [0129.491] SysReAllocStringLen (in: pbstr=0x6a0f088*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0f088*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0129.491] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0129.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*.*", lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9670 [0129.491] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.576] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0129.576] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", len=0x30 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned 1 [0129.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\", cchLength=0x30 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\") returned 0x30 [0129.576] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0129.576] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0129.576] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0129.580] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0129.581] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 1 [0129.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll") returned 0x3c [0129.581] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0129.582] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 1 [0129.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\access12.acc") returned 0x3c [0129.582] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.582] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0xee2ce510, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0129.582] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.582] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0129.585] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0129.585] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0129.585] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\access12.acc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 1 [0129.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\accolki.dll") returned 0x3b [0129.585] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.585] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.585] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0129.585] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\accolki.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 1 [0129.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll") returned 0x3c [0129.585] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.585] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.585] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0129.585] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 1 [0129.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp") returned 0x3b [0129.585] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.585] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.585] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0129.585] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0129.585] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 1 [0129.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll") returned 0x3b [0129.586] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.586] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.586] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 1 [0129.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\aec.vsl") returned 0x37 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.586] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.586] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0129.586] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\aec.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 1 [0129.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl") returned 0x3c [0129.586] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.586] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.586] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0129.586] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 1 [0129.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\asset.vrd") returned 0x39 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.586] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.586] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0129.586] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0129.586] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\asset.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM") returned 1 [0129.586] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\basic.htm") returned 0x39 [0129.587] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.587] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.587] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.587] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0129.587] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\basic.htm", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 1 [0129.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll") returned 0x41 [0129.587] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.587] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.587] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0129.587] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 1 [0129.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll") returned 0x3b [0129.587] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.587] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.587] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0129.587] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned 1 [0129.587] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bibliography\\") returned 0x3d [0129.587] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0129.587] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0129.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0129.593] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.593] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0129.594] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML") returned 1 [0129.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bibliography\\bibform.xml") returned 0x48 [0129.594] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.594] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1e1bb530, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0129.594] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.594] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bibliography\\_restore files_.txt"), bFailIfExists=0) returned 1 [0129.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.596] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.596] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.596] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0129.596] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 1 [0129.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl") returned 0x3a [0129.596] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0129.596] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0129.596] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS") returned 1 [0129.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\bw.css") returned 0x36 [0129.596] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0129.597] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0129.597] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\bw.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 1 [0129.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd") returned 0x3c [0129.597] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.597] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0129.597] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0129.597] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 1 [0129.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\certintl.dll") returned 0x3c [0129.597] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.597] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0129.597] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\certintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 1 [0129.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll") returned 0x3c [0129.597] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.597] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0129.597] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 1 [0129.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll") returned 0x3b [0129.597] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.597] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0129.597] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS") returned 1 [0129.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\coffee.css") returned 0x3a [0129.598] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0129.598] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0129.598] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\coffee.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn") returned 1 [0129.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn") returned 0x4a [0129.598] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0129.598] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0129.598] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn") returned 1 [0129.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn") returned 0x4a [0129.598] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0129.598] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0129.598] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 1 [0129.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll") returned 0x45 [0129.598] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.598] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0129.598] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML") returned 1 [0129.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml") returned 0x3c [0129.599] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.599] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.599] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0129.599] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0129.599] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned 1 [0129.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\") returned 0x3d [0129.599] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0129.599] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0129.599] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0129.642] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0129.642] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa887a200, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa887a200, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="+Connect to New Data Source.odc", cAlternateFileName="_CONNE~1.ODC")) returned 1 [0129.642] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", len=0x5c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc") returned 1 [0129.642] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc") returned 0x5c [0129.642] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.642] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xeecec290, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0129.642] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0129.642] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\_restore files_.txt"), bFailIfExists=0) returned 1 [0129.644] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0129.645] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6254800, ftCreationTime.dwHighDateTime=0x1c026ae, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa6254800, ftLastWriteTime.dwHighDateTime=0x1c026ae, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="+NewSQLServerConnection.odc", cAlternateFileName="_NEWSQ~1.ODC")) returned 1 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc") returned 1 [0129.645] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc") returned 0x58 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.645] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0129.645] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5811c800, ftCreationTime.dwHighDateTime=0x1bff783, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5811c800, ftLastWriteTime.dwHighDateTime=0x1bff783, nFileSizeHigh=0x0, nFileSizeLow=0x46, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKTOP.INI", cAlternateFileName="")) returned 1 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI") returned 1 [0129.645] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\DESKTOP.INI", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini") returned 0x48 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.645] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0129.645] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x952b9800, ftCreationTime.dwHighDateTime=0x1bff81f, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x952b9800, ftLastWriteTime.dwHighDateTime=0x1bff81f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDER.ICO", cAlternateFileName="")) returned 1 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\desktop.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 1 [0129.645] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico") returned 0x47 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0129.645] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.645] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0129.645] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0129.645] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0129.645] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0129.645] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 1 [0129.646] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl") returned 0x3a [0129.646] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.646] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0129.646] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0129.646] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned 1 [0129.646] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb") returned 0x3c [0129.646] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.646] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0129.646] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0129.646] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 1 [0129.646] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl") returned 0x39 [0129.646] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.646] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0129.646] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0129.646] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned 1 [0129.646] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\default.css") returned 0x3b [0129.646] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.646] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.646] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0129.646] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0129.646] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\default.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 1 [0129.647] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\discussion.gta") returned 0x3e [0129.647] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.647] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0129.647] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0129.647] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\discussion.gta", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 1 [0129.647] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta") returned 0x40 [0129.647] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.647] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.647] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0129.647] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0129.647] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 1 [0129.647] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll") returned 0x3a [0129.647] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.647] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.647] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD", cAlternateFileName="")) returned 1 [0129.702] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 1 [0129.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd") returned 0x3c [0129.702] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0129.702] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0129.702] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 1 [0129.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl") returned 0x3c [0129.702] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0129.703] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL", cAlternateFileName="")) returned 1 [0129.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 1 [0129.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl") returned 0x3a [0129.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0129.703] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDPRES.DLL", cAlternateFileName="")) returned 1 [0129.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 1 [0129.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll") returned 0x3c [0129.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.703] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0129.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned 1 [0129.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn") returned 0x4b [0129.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e9c) returned 0x6f14048 [0129.703] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0129.703] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned 1 [0129.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn") returned 0x4d [0129.703] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.704] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea0) returned 0x6f14048 [0129.704] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 1 [0129.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll") returned 0x3c [0129.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.704] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITRES.DLL", cAlternateFileName="")) returned 1 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 1 [0129.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\editres.dll") returned 0x3b [0129.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.704] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\editres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 1 [0129.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll") returned 0x44 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.704] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 1 [0129.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll") returned 0x3c [0129.704] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0129.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0129.704] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0129.704] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 1 [0129.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll") returned 0x44 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0129.705] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.CSS", cAlternateFileName="")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbba2a00, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbba2a00, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x7fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VRD", cAlternateFileName="")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50950fe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4e570, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.VSL", cAlternateFileName="")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d63000, ftCreationTime.dwHighDateTime=0x1bbd3c6, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74d63000, ftLastWriteTime.dwHighDateTime=0x1bbd3c6, nFileSizeHigh=0x0, nFileSizeLow=0x2da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="GR8GALRY.GRA", cAlternateFileName="")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61152c00, ftCreationTime.dwHighDateTime=0x1c6e5fa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61152c00, ftLastWriteTime.dwHighDateTime=0x1c6e5fa, nFileSizeHigh=0x0, nFileSizeLow=0x94f26, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.HXS", cAlternateFileName="")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXC", cAlternateFileName="GRAPH_~1.HXC")) returned 1 [0129.706] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_COL.HXT", cAlternateFileName="GRAPH_~1.HXT")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_F_COL.HXK", cAlternateFileName="GRAPH_~1.HXK")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27344a00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x27344a00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH_K_COL.HXK", cAlternateFileName="GRAPH_~2.HXK")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x32d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL", cAlternateFileName="")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.IDX_DLL", cAlternateFileName="GRINTL~1.IDX")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cc82600, ftCreationTime.dwHighDateTime=0x1cac1e2, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3cc82600, ftLastWriteTime.dwHighDateTime=0x1cac1e2, nFileSizeHigh=0x0, nFileSizeLow=0x18780, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.IDX_DLL", cAlternateFileName="GRINTL~2.IDX")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRLEX.DLL", cAlternateFileName="")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd9dd600, ftCreationTime.dwHighDateTime=0x1cacb3e, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdd9dd600, ftLastWriteTime.dwHighDateTime=0x1cacb3e, nFileSizeHigh=0x0, nFileSizeLow=0xbb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove Starter Template.xsn", cAlternateFileName="GROOVE~1.XSN")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x22c410, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.HXS", cAlternateFileName="")) returned 1 [0131.493] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~1")) returned 1 [0131.494] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0133.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd443cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0133.459] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0133.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd3f79f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0133.459] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0133.459] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.369] GetProcessHeap () returned 0x580000 [0135.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0135.369] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5373f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc5373f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0135.369] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif") returned 1 [0135.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif") returned 0x4a [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0135.370] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif") returned 1 [0135.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Country.gif", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif") returned 0x4b [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0135.370] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_country.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif") returned 1 [0135.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif") returned 0x4a [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0135.370] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd41db50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif") returned 1 [0135.370] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif") returned 0x4c [0135.370] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.370] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.371] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif") returned 1 [0135.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif") returned 0x4a [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.371] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.371] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif") returned 1 [0135.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif") returned 0x4f [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.371] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.371] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif") returned 1 [0135.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_OliveGreen.gif", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif") returned 0x4e [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.371] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.371] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.371] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0135.371] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_olivegreen.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif") returned 1 [0135.371] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Premium.gif", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif") returned 0x4b [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.372] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.372] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_premium.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif") returned 1 [0135.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_SlateBlue.gif", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif") returned 0x4d [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.372] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.372] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_slateblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif") returned 1 [0135.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_TexturedBlue.gif", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif") returned 0x50 [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.372] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.372] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6686c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd443cb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc6686c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_texturedblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif") returned 1 [0135.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_VelvetRose.gif", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_velvetrose.gif") returned 0x4e [0135.372] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0135.372] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.372] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0135.372] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0135.372] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", len=0x49 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\") returned 1 [0135.372] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\") returned 0x49 [0135.373] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.373] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.373] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0135.384] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd3f79f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.481] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0135.481] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css") returned 1 [0135.481] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Adobe.css", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css") returned 0x52 [0135.481] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.481] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd3f79f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0135.481] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.481] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.612] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0135.612] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\") returned 1 [0135.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\") returned 0x53 [0135.612] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.612] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0135.612] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4b60d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.612] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0135.612] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x5e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0135.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif") returned 0x5e [0135.612] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd4b60d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0135.613] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.613] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.616] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0135.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif") returned 0x5d [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.616] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.616] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.616] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\adobe.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css") returned 1 [0135.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana.css", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css") returned 0x56 [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.616] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", len=0x52 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\") returned 1 [0135.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\") returned 0x52 [0135.616] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.616] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0135.718] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd48ff70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6cb410, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.718] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0135.718] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0135.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif") returned 0x5c [0135.718] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.718] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd48ff70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0135.718] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.718] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0135.720] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0135.720] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0135.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif") returned 0x5c [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0135.721] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0135.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif") returned 0x5d [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0135.721] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0135.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif") returned 0x5c [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.721] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.721] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.721] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8cac600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8cac600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css") returned 1 [0135.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue.css", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css") returned 0x55 [0135.721] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.722] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd3f79f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beige.css", cAlternateFileName="")) returned 1 [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css") returned 1 [0135.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Beige.css", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css") returned 0x52 [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.722] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay", cAlternateFileName="")) returned 1 [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", len=0x50 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\") returned 1 [0135.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\") returned 0x50 [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.722] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.722] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0135.722] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4b60d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd4dc230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.722] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0135.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_OFF.GIF", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif") returned 0x5b [0135.722] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd4b60d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0135.723] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.723] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.725] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0135.725] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0135.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay\\TAB_ON.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay\\tab_on.gif") returned 0x5a [0135.725] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.725] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.725] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.725] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0135.725] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\beige.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css") returned 1 [0135.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Biscay.css", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css") returned 0x53 [0135.725] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.725] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0135.725] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", len=0x56 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\") returned 1 [0135.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\") returned 0x56 [0135.726] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.726] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.726] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0135.814] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd4dc230, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd502390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.814] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4dc230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0135.814] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0135.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\background.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif") returned 0x64 [0135.814] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.814] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd4dc230, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0135.815] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.815] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.831] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0135.831] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0135.831] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned 1 [0135.831] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\BUTTON.GIF", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif") returned 0x60 [0135.831] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0135.832] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned 1 [0135.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif") returned 0x61 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.832] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned 1 [0135.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange\\TAB_ON.GIF", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange\\tab_on.gif") returned 0x60 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.832] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.832] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.832] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\biscay.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", len=0x59 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css") returned 1 [0135.832] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightOrange.css", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css") returned 0x59 [0135.832] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.832] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.832] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.833] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0135.833] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", len=0x56 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\") returned 1 [0135.833] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\") returned 0x56 [0135.833] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.833] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.833] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0135.850] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd502390, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0135.850] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd502390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0135.850] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0135.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\HEADER.GIF", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif") returned 0x60 [0135.850] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.850] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd502390, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0135.851] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0135.851] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\_restore files_.txt"), bFailIfExists=0) returned 1 [0135.853] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0135.853] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0135.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif") returned 0x61 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.853] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.853] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0135.853] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0135.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow\\TAB_ON.GIF", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow\\tab_on.gif") returned 0x60 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0135.853] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.853] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0135.853] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0135.853] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0135.853] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9fbf300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc9fbf300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd03, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightorange.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", len=0x59 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css") returned 1 [0135.853] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BrightYellow.css", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css") returned 0x59 [0135.853] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.853] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.854] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0135.854] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0135.854] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\brightyellow.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css") returned 1 [0135.854] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Casual.css", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css") returned 0x53 [0135.854] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0135.854] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0135.854] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0135.854] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert", cAlternateFileName="")) returned 1 [0135.854] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", len=0x50 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\") returned 1 [0135.854] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\") returned 0x50 [0135.854] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0135.854] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0135.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0138.533] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.533] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0138.533] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0138.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif") returned 0x5a [0138.534] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.534] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd5284f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0138.534] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.534] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\_restore files_.txt"), bFailIfExists=0) returned 1 [0138.654] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0138.654] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0138.654] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0138.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif") returned 0x5b [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0138.655] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0138.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif") returned 0x5a [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0138.655] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0138.655] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\casual.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css") returned 1 [0138.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert.css", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css") returned 0x53 [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.655] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.655] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0138.655] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.css", cAlternateFileName="DISCUS~1.CSS")) returned 1 [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", len=0x57 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css") returned 1 [0138.655] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Discussion.css", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css") returned 0x57 [0138.655] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0138.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x71e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0138.656] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\discussion.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css") returned 1 [0138.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Earthy.css", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css") returned 0x53 [0138.656] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.656] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.656] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0138.656] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0138.656] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\") returned 1 [0138.656] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\") returned 0x53 [0138.656] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0138.656] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0138.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0138.659] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.659] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0138.659] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0138.659] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif") returned 0x5d [0138.659] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.659] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.660] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd5284f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0138.660] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.660] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\_restore files_.txt"), bFailIfExists=0) returned 1 [0138.662] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0138.662] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0138.662] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x5e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0138.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif") returned 0x5e [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0138.663] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0138.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif") returned 0x5d [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0138.663] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0138.663] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0138.663] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb2d2000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb2d2000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbea, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\earthy.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css") returned 1 [0138.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck.css", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css") returned 0x56 [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.663] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.663] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0138.663] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0138.663] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css") returned 1 [0138.663] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GreenTea.css", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css") returned 0x55 [0138.664] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.664] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0138.664] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0138.664] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\greentea.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", len=0x58 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css") returned 1 [0138.664] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\LightSpirit.css", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css") returned 0x58 [0138.664] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0138.664] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.664] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0138.664] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime", cAlternateFileName="")) returned 1 [0138.664] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", len=0x4e | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\") returned 1 [0138.664] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\") returned 0x4e [0138.664] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0138.664] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0138.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0138.679] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5284f0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0138.679] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0138.680] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0138.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif") returned 0x59 [0138.680] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0138.680] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0138.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd5284f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0138.680] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0138.680] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\_restore files_.txt"), bFailIfExists=0) returned 1 [0139.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0139.880] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5284f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0139.880] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x58 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0139.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif") returned 0x58 [0139.880] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0139.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.880] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0139.881] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0139.881] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.881] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lightspirit.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css") returned 1 [0139.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime.css", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css") returned 0x51 [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0139.881] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x715, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", len=0x53 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css") returned 1 [0139.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Maroon.css", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css") returned 0x53 [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0139.881] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", len=0x4f | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\") returned 1 [0139.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\") returned 0x4f [0139.881] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0139.881] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0139.881] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0139.882] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd5284f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.882] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0139.882] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0139.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif") returned 0x59 [0139.883] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0139.883] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd5284f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0139.883] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.883] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\_restore files_.txt"), bFailIfExists=0) returned 1 [0139.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0139.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0139.898] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0139.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif") returned 0x5a [0139.898] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0139.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0139.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0139.898] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0139.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif") returned 0x59 [0139.898] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0139.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0139.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0139.898] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0139.898] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5e4d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd632e90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc5e4d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0139.898] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\maroon.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css") returned 1 [0139.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css") returned 0x52 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0139.899] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74f, dwReserved0=0x0, dwReserved1=0x0, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", len=0x57 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css") returned 1 [0139.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css") returned 0x57 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0139.899] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x705, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", len=0x54 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css") returned 1 [0139.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css") returned 0x54 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0139.899] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF") returned 1 [0139.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif") returned 0x55 [0139.899] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0139.899] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79023600, ftCreationTime.dwHighDateTime=0x1ca2b70, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79023600, ftLastWriteTime.dwHighDateTime=0x1ca2b70, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", len=0x5b | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif") returned 1 [0139.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif") returned 0x5b [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0139.900] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", len=0x57 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif") returned 1 [0139.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif") returned 0x57 [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0139.900] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dfe600, ftCreationTime.dwHighDateTime=0x1ca2b73, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x60dfe600, ftLastWriteTime.dwHighDateTime=0x1ca2b73, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", len=0x5b | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif") returned 1 [0139.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif") returned 0x5b [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0139.900] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", len=0x5a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif") returned 1 [0139.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif") returned 0x5a [0139.900] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0139.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0139.901] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate", cAlternateFileName="")) returned 1 [0139.901] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", len=0x4f | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\") returned 1 [0139.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\") returned 0x4f [0139.901] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0139.901] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0139.901] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0139.956] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.957] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0139.957] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0139.957] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_OFF.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif") returned 0x5a [0139.957] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0139.957] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0139.957] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd54e650, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0139.957] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0139.957] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.133] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0140.133] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0140.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate\\TAB_ON.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate\\tab_on.gif") returned 0x59 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.133] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.133] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0140.133] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.133] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.133] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css") returned 1 [0140.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Slate.css", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css") returned 0x52 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.133] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.133] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0140.133] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slate.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css") returned 1 [0140.133] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SlateBlue.css", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css") returned 0x56 [0140.133] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.133] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.133] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.133] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0140.134] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", len=0x52 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\") returned 1 [0140.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\") returned 0x52 [0140.134] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0140.134] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0140.134] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0140.134] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.134] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0140.134] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0140.134] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\background.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif") returned 0x60 [0140.134] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.134] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd54e650, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0140.134] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.134] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0140.137] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned 1 [0140.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif") returned 0x5d [0140.137] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0140.137] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned 1 [0140.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue\\TAB_ON.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue\\tab_on.gif") returned 0x5c [0140.137] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.137] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.137] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.137] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd8f7a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcd8f7a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0140.137] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\slateblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", len=0x55 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css") returned 1 [0140.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SoftBlue.css", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css") returned 0x55 [0140.138] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0140.138] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions", cAlternateFileName="SOLUTI~1")) returned 1 [0140.138] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\") returned 1 [0140.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\") returned 0x53 [0140.138] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0140.138] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0140.138] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0140.145] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd67f150, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd6a52b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.145] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrow.png", cAlternateFileName="")) returned 1 [0140.145] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png") returned 1 [0140.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\arrow.png", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png") returned 0x5c [0140.145] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd67f150, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0140.145] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.145] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x931, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document.gif", cAlternateFileName="")) returned 1 [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\arrow.png", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif") returned 1 [0140.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Document.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif") returned 0x5f [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x832, dwReserved0=0x0, dwReserved1=0x0, cFileName="Generic.gif", cAlternateFileName="")) returned 1 [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\document.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", len=0x5e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif") returned 1 [0140.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Generic.gif", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif") returned 0x5e [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gradient.png", cAlternateFileName="")) returned 1 [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\generic.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png") returned 1 [0140.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\gradient.png", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png") returned 0x5f [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.148] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x0, dwReserved1=0x0, cFileName="Main.gif", cAlternateFileName="")) returned 1 [0140.148] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\gradient.png", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif") returned 1 [0140.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Main.gif", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif") returned 0x5b [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0140.149] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x96a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Person.gif", cAlternateFileName="")) returned 1 [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\main.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif") returned 1 [0140.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Person.gif", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif") returned 0x5d [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0140.149] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x68e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Response.gif", cAlternateFileName="")) returned 1 [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\person.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif") returned 1 [0140.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions\\Response.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions\\response.gif") returned 0x5f [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0140.149] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.149] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions.css", cAlternateFileName="SOLUTI~1.CSS")) returned 1 [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\softblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", len=0x56 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css") returned 1 [0140.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions.css", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css") returned 0x56 [0140.149] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.150] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0140.150] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Doc.css", cAlternateFileName="SOLUTI~2.CSS")) returned 1 [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", len=0x5a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css") returned 1 [0140.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Doc.css", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css") returned 0x5a [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.150] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0140.150] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec0a700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcec0a700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Generic.css", cAlternateFileName="SOLUTI~3.CSS")) returned 1 [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_doc.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", len=0x5e | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css") returned 1 [0140.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Generic.css", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css") returned 0x5e [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.150] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0140.150] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Person.css", cAlternateFileName="SOLUTI~4.CSS")) returned 1 [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_generic.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", len=0x5d | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css") returned 1 [0140.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Person.css", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css") returned 0x5d [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.150] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.150] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0140.150] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solutions_Response.css", cAlternateFileName="SOB0ED~1.CSS")) returned 1 [0140.150] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_person.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", len=0x5f | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css") returned 1 [0140.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Solutions_Response.css", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css") returned 0x5f [0140.151] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.151] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0140.151] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0140.151] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", len=0x55 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\") returned 1 [0140.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\") returned 0x55 [0140.151] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0140.151] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0140.151] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0140.151] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.151] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0140.151] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0140.151] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\BUTTON.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif") returned 0x5f [0140.151] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.151] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd54e650, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0140.152] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.152] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0140.154] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0140.154] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0140.154] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif") returned 0x60 [0140.154] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.154] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0140.154] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0140.154] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0140.154] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen\\TAB_ON.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen\\tab_on.gif") returned 0x5f [0140.154] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.154] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.154] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0140.154] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.154] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.154] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\solutions_response.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", len=0x58 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css") returned 1 [0140.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\SpringGreen.css", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css") returned 0x58 [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.155] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0140.155] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\springgreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", len=0x50 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css") returned 1 [0140.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts.css", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css") returned 0x50 [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.155] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.155] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0140.155] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", len=0x4e | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\") returned 1 [0140.155] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\") returned 0x4e [0140.155] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0140.155] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0140.155] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0140.161] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd54e650, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.161] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0140.161] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif") returned 1 [0140.161] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\background.gif", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif") returned 0x5c [0140.161] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.161] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd54e650, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0140.161] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.162] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.409] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0140.409] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", len=0x58 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF") returned 1 [0140.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\HEADER.GIF", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif") returned 0x58 [0140.414] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.414] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0140.414] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF") returned 1 [0140.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_OFF.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif") returned 0x59 [0140.414] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.414] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", len=0x58 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF") returned 1 [0140.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\STS2\\TAB_ON.GIF", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2\\tab_on.gif") returned 0x58 [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.415] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.415] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.415] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.415] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcff1d400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcff1d400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css") returned 1 [0140.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Sts2.css", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css") returned 0x51 [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.415] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0140.415] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl", cAlternateFileName="")) returned 1 [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", len=0x4f | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\") returned 1 [0140.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\") returned 0x4f [0140.415] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0140.415] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0140.415] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0140.432] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd54e650, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd5747b0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.432] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd54e650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0140.432] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif") returned 1 [0140.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\background.gif", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif") returned 0x5d [0140.432] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfd54e650, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0140.432] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0140.432] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\_restore files_.txt"), bFailIfExists=0) returned 1 [0140.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d84) returned 0x6f14048 [0140.675] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF") returned 1 [0140.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\HEADER.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif") returned 0x59 [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d88) returned 0x6f14048 [0140.675] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned 1 [0140.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_OFF.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif") returned 0x5a [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d8c) returned 0x6f14048 [0140.675] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd5747b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF") returned 1 [0140.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl\\TAB_ON.GIF", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl\\tab_on.gif") returned 0x59 [0140.675] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0140.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d90) returned 0x6f14048 [0140.675] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.675] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0140.675] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6a52b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\sts2.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", len=0x52 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css") returned 1 [0140.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Swirl.css", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css") returned 0x52 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d94) returned 0x6f14048 [0140.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\swirl.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", len=0x51 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css") returned 1 [0140.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Teal.css", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css") returned 0x51 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d98) returned 0x6f14048 [0140.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x727, dwReserved0=0x0, dwReserved1=0x0, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\teal.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", len=0x59 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css") returned 1 [0140.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\TexturedBlue.css", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css") returned 0x59 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1d9c) returned 0x6f14048 [0140.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1230100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd6cb410, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd1230100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x732, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\texturedblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", len=0x57 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css") returned 1 [0140.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\VelvetRose.css", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css") returned 0x57 [0140.676] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da0) returned 0x6f14048 [0140.676] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88693560, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x88693560, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0140.677] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\velvetrose.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\_RESTORE FILES_.txt", len=0x5c | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\_RESTORE FILES_.txt") returned 1 [0140.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\_RESTORE FILES_.txt", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\_restore files_.txt") returned 0x5c [0140.677] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0140.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.677] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.677] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0140.678] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0140.678] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0140.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x863360, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0140.678] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\groove.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 1 [0140.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll") returned 0x46 [0140.678] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXC", cAlternateFileName="GROOVE~1.HXC")) returned 1 [0140.678] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 1 [0140.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc") returned 0x3e [0140.678] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da4) returned 0x6f14048 [0140.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_COL.HXT", cAlternateFileName="GROOVE~1.HXT")) returned 1 [0140.678] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 1 [0140.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt") returned 0x3e [0140.678] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1da8) returned 0x6f14048 [0140.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_F_COL.HXK", cAlternateFileName="GROOVE~1.HXK")) returned 1 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 1 [0140.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk") returned 0x40 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dac) returned 0x6f14048 [0140.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5e7b500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0xfd59a910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd5e7b500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE_K_COL.HXK", cAlternateFileName="GROOVE~2.HXK")) returned 1 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 1 [0140.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk") returned 0x40 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db0) returned 0x6f14048 [0140.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50977140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.VSL", cAlternateFileName="")) returned 1 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 1 [0140.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl") returned 0x38 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db4) returned 0x6f14048 [0140.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x77f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDIFF.VRD", cAlternateFileName="")) returned 1 [0140.679] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 1 [0140.679] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd") returned 0x3c [0140.679] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.679] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.679] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1db8) returned 0x6f14048 [0140.679] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ede00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x5099d2a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7ede00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x51d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVACDUCT.VRD", cAlternateFileName="")) returned 1 [0140.680] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 1 [0140.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd") returned 0x3c [0140.680] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.680] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dbc) returned 0x6f14048 [0140.680] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x75790, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFINTL.DLL", cAlternateFileName="")) returned 1 [0140.680] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 1 [0140.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infintl.dll") returned 0x3b [0140.680] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.680] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.680] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x174d06, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.HXS", cAlternateFileName="")) returned 1 [0140.680] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 1 [0140.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs") returned 0x3c [0140.680] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.680] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc0) returned 0x6f14048 [0140.680] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98679500, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98679500, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x697e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR.HXS", cAlternateFileName="INFOPA~1.HXS")) returned 1 [0140.680] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 1 [0140.680] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs") returned 0x42 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc4) returned 0x6f14048 [0140.681] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXC", cAlternateFileName="INFOPA~2.HXC")) returned 1 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 1 [0140.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc") returned 0x46 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dc8) returned 0x6f14048 [0140.681] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_COL.HXT", cAlternateFileName="INFOPA~2.HXT")) returned 1 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 1 [0140.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt") returned 0x46 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dcc) returned 0x6f14048 [0140.681] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_F_COL.HXK", cAlternateFileName="INFOPA~3.HXK")) returned 1 [0140.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 1 [0140.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk") returned 0x48 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd0) returned 0x6f14048 [0140.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcc29600, ftCreationTime.dwHighDateTime=0x1c59321, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcc29600, ftLastWriteTime.dwHighDateTime=0x1c59321, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATHEDITOR_K_COL.HXK", cAlternateFileName="INFOPA~4.HXK")) returned 1 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 1 [0140.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk") returned 0x48 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd4) returned 0x6f14048 [0140.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXC", cAlternateFileName="INFOPA~1.HXC")) returned 1 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 1 [0140.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc") returned 0x40 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd8) returned 0x6f14048 [0140.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_COL.HXT", cAlternateFileName="INFOPA~1.HXT")) returned 1 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 1 [0140.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt") returned 0x40 [0140.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0140.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_F_COL.HXK", cAlternateFileName="INFOPA~1.HXK")) returned 1 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 1 [0140.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk") returned 0x42 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0140.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8c8500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x11257870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f8c8500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH_K_COL.HXK", cAlternateFileName="INFOPA~2.HXK")) returned 1 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 1 [0140.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk") returned 0x42 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x108a400, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x108a400, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="INSTLIST.VRD", cAlternateFileName="")) returned 1 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 1 [0140.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd") returned 0x3c [0140.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37deba00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x509c3400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37deba00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVENTRY.VRD", cAlternateFileName="")) returned 1 [0140.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 1 [0140.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd") returned 0x3c [0140.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3491f00, ftCreationTime.dwHighDateTime=0x1ca0f52, ftLastAccessTime.dwLowDateTime=0xc7a8630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3491f00, ftLastWriteTime.dwHighDateTime=0x1ca0f52, nFileSizeHigh=0x0, nFileSizeLow=0x2bc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Invite or Link.one", cAlternateFileName="INVITE~1.ONE")) returned 1 [0140.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one") returned 1 [0140.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Invite or Link.one", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\invite or link.one") returned 0x42 [0140.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0140.687] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x1127d9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x22a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDSINTL.DLL", cAlternateFileName="")) returned 1 [0140.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\invite or link.one", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 1 [0140.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll") returned 0x3c [0140.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.687] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xd7b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDINTL.DLL", cAlternateFileName="")) returned 1 [0140.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 1 [0140.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll") returned 0x3c [0140.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.688] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLKINTL.DLL", cAlternateFileName="IPOLKI~1.DLL")) returned 1 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 1 [0140.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll") returned 0x3d [0140.688] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.688] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.688] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd5e6bd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x3cebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issue Tracking.gta", cAlternateFileName="ISSUET~1.GTA")) returned 1 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 1 [0140.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta") returned 0x42 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.688] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.688] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0140.688] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x509e9560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="JADE.CSS", cAlternateFileName="")) returned 1 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS") returned 1 [0140.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\JADE.CSS", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\jade.css") returned 0x38 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.688] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.688] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0140.688] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafe69b00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50a35820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xafe69b00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9980, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.VSL", cAlternateFileName="")) returned 1 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\jade.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 1 [0140.688] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl") returned 0x38 [0140.688] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.688] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.688] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0140.689] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x112970, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL", cAlternateFileName="")) returned 1 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 1 [0140.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mapir.dll") returned 0x39 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.689] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.689] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.IDX_DLL", cAlternateFileName="MAPIRD~1.IDX")) returned 1 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mapir.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 1 [0140.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll") returned 0x41 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.689] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.689] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 1 [0140.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll") returned 0x3e [0140.689] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.689] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.689] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x100fb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MERES.DLL", cAlternateFileName="")) returned 1 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 1 [0140.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\meres.dll") returned 0x39 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.689] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.689] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6cf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.DLL", cAlternateFileName="")) returned 1 [0140.689] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\meres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 1 [0140.689] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll") returned 0x3b [0140.689] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.690] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x9b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.IDX_DLL", cAlternateFileName="MOR6IN~1.IDX")) returned 1 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 1 [0140.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll") returned 0x44 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0140.690] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b00b00, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b00b00, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x58c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOVE.VRD", cAlternateFileName="")) returned 1 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 1 [0140.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\move.vrd") returned 0x38 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0140.690] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50aa7c40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x3178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXRES.DLL", cAlternateFileName="")) returned 1 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\move.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 1 [0140.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll") returned 0x3a [0140.690] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.690] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0xa3f874, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV.HXS", cAlternateFileName="MSACCE~1.HXS")) returned 1 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 1 [0140.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs") returned 0x40 [0140.690] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0140.691] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXC", cAlternateFileName="MSACCE~1.HXC")) returned 1 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 1 [0140.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc") returned 0x44 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.691] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0140.691] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_COL.HXT", cAlternateFileName="MSACCE~1.HXT")) returned 1 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 1 [0140.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt") returned 0x44 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.691] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0140.691] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_F_COL.HXK", cAlternateFileName="MSACCE~1.HXK")) returned 1 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 1 [0140.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk") returned 0x46 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.691] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0140.691] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37e4c000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153cd570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37e4c000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.DEV_K_COL.HXK", cAlternateFileName="MSACCE~2.HXK")) returned 1 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 1 [0140.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk") returned 0x46 [0140.691] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.691] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.692] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0140.692] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x3b2c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.HXS", cAlternateFileName="")) returned 1 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 1 [0140.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs") returned 0x3c [0140.692] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.692] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.692] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0140.692] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXC", cAlternateFileName="MSACCE~2.HXC")) returned 1 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 1 [0140.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc") returned 0x40 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.692] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.692] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0140.692] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_COL.HXT", cAlternateFileName="MSACCE~2.HXT")) returned 1 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 1 [0140.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt") returned 0x40 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.692] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.692] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0140.692] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_F_COL.HXK", cAlternateFileName="MSACCE~3.HXK")) returned 1 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 1 [0140.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk") returned 0x42 [0140.692] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.692] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.693] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0140.693] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33200c00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x153f36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33200c00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS_K_COL.HXK", cAlternateFileName="MSACCE~4.HXK")) returned 1 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 1 [0140.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk") returned 0x42 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.693] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.693] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0140.693] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x127f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAIN.DLL", cAlternateFileName="")) returned 1 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 1 [0140.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msain.dll") returned 0x39 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.693] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.693] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x589e0a00, ftCreationTime.dwHighDateTime=0x1c99224, ftLastAccessTime.dwLowDateTime=0x980ce30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x589e0a00, ftLastWriteTime.dwHighDateTime=0x1c99224, nFileSizeHigh=0x0, nFileSizeLow=0x9382, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msain.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 1 [0140.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mso.acl") returned 0x37 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.693] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.693] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0140.693] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe15bf200, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe15bf200, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x69560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.HXS", cAlternateFileName="")) returned 1 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mso.acl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 1 [0140.693] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs") returned 0x39 [0140.693] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.693] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.694] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0140.694] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXC", cAlternateFileName="MSOUC_~1.HXC")) returned 1 [0140.694] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 1 [0140.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc") returned 0x3d [0140.694] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.694] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.694] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0140.694] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_COL.HXT", cAlternateFileName="MSOUC_~1.HXT")) returned 1 [0140.694] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 1 [0140.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt") returned 0x3d [0140.694] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.694] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.694] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0140.694] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_F_COL.HXK", cAlternateFileName="MSOUC_~1.HXK")) returned 1 [0140.694] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 1 [0140.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk") returned 0x3f [0140.694] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.694] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.694] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0140.694] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c107b00, ftCreationTime.dwHighDateTime=0x1ca77cf, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c107b00, ftLastWriteTime.dwHighDateTime=0x1ca77cf, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC_K_COL.HXK", cAlternateFileName="MSOUC_~2.HXK")) returned 1 [0140.694] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 1 [0140.694] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk") returned 0x3f [0140.694] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.694] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0140.695] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0140.695] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x487dc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV.HXS", cAlternateFileName="MSPUBD~1.HXS")) returned 1 [0140.701] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 1 [0140.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs") returned 0x3d [0140.701] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0140.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.527] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dd8) returned 0x6f14048 [0141.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXC", cAlternateFileName="MSPUBD~1.HXC")) returned 1 [0141.527] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 1 [0141.527] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc") returned 0x41 [0141.527] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.527] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.527] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ddc) returned 0x6f14048 [0141.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_COL.HXT", cAlternateFileName="MSPUBD~1.HXT")) returned 1 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 1 [0141.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt") returned 0x41 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.528] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.528] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de0) returned 0x6f14048 [0141.528] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_F_COL.HXK", cAlternateFileName="MSPUBD~1.HXK")) returned 1 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 1 [0141.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk") returned 0x43 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.528] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.528] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de4) returned 0x6f14048 [0141.528] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ddaa100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba74a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ddaa100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.DEV_K_COL.HXK", cAlternateFileName="MSPUBD~2.HXK")) returned 1 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 1 [0141.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk") returned 0x43 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.528] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.528] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1de8) returned 0x6f14048 [0141.528] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1cc936, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.HXS", cAlternateFileName="")) returned 1 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 1 [0141.528] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs") returned 0x39 [0141.528] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.528] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.529] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dec) returned 0x6f14048 [0141.529] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe30400, ftCreationTime.dwHighDateTime=0x1c2a1b4, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fe30400, ftLastWriteTime.dwHighDateTime=0x1c2a1b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ef8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.OPG", cAlternateFileName="")) returned 1 [0141.529] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 1 [0141.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub.opg") returned 0x39 [0141.529] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.529] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.529] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df0) returned 0x6f14048 [0141.529] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXC", cAlternateFileName="MSPUB_~1.HXC")) returned 1 [0141.529] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub.opg", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 1 [0141.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc") returned 0x3d [0141.529] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.529] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.529] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df4) returned 0x6f14048 [0141.529] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_COL.HXT", cAlternateFileName="MSPUB_~1.HXT")) returned 1 [0141.529] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 1 [0141.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt") returned 0x3d [0141.529] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.529] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.529] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1df8) returned 0x6f14048 [0141.529] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_F_COL.HXK", cAlternateFileName="MSPUB_~1.HXK")) returned 1 [0141.529] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 1 [0141.529] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk") returned 0x3f [0141.530] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.530] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1dfc) returned 0x6f14048 [0141.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b784700, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b784700, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB_K_COL.HXK", cAlternateFileName="MSPUB_~2.HXK")) returned 1 [0141.530] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 1 [0141.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk") returned 0x3f [0141.530] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.530] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e00) returned 0x6f14048 [0141.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8527700, ftCreationTime.dwHighDateTime=0x1c33a9f, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd8527700, ftLastWriteTime.dwHighDateTime=0x1c33a9f, nFileSizeHigh=0x0, nFileSizeLow=0x7d682, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.CHM", cAlternateFileName="")) returned 1 [0141.530] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM") returned 1 [0141.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSQRY32.CHM", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm") returned 0x3b [0141.530] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.530] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e04) returned 0x6f14048 [0141.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x15d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTINTL.DLL", cAlternateFileName="")) returned 1 [0141.530] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\msqry32.chm", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 1 [0141.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll") returned 0x3b [0141.530] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e84c00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x88e84c00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x5f254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.HXS", cAlternateFileName="")) returned 1 [0141.531] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 1 [0141.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs") returned 0x3a [0141.531] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.531] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e08) returned 0x6f14048 [0141.531] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXC", cAlternateFileName="MSTORE~1.HXC")) returned 1 [0141.531] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 1 [0141.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc") returned 0x3e [0141.531] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.531] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e0c) returned 0x6f14048 [0141.531] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_COL.HXT", cAlternateFileName="MSTORE~1.HXT")) returned 1 [0141.531] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 1 [0141.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt") returned 0x3e [0141.531] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.531] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e10) returned 0x6f14048 [0141.531] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_F_COL.HXK", cAlternateFileName="MSTORE~1.HXK")) returned 1 [0141.531] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 1 [0141.531] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk") returned 0x40 [0141.531] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.531] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e14) returned 0x6f14048 [0141.532] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x416e2800, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x416e2800, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE_K_COL.HXK", cAlternateFileName="MSTORE~2.HXK")) returned 1 [0141.532] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 1 [0141.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk") returned 0x40 [0141.532] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.532] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e18) returned 0x6f14048 [0141.532] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK.CSS", cAlternateFileName="")) returned 1 [0141.532] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS") returned 1 [0141.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK.CSS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\network.css") returned 0x3b [0141.532] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.532] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e1c) returned 0x6f14048 [0141.532] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK1.VRD", cAlternateFileName="")) returned 1 [0141.532] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\network.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 1 [0141.532] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\network1.vrd") returned 0x3c [0141.532] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.532] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.532] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e20) returned 0x6f14048 [0141.532] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x866, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK2.VRD", cAlternateFileName="")) returned 1 [0141.533] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\network1.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 1 [0141.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\network2.vrd") returned 0x3c [0141.533] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.533] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e24) returned 0x6f14048 [0141.533] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4126500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4126500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0xcae, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETWORK3.VRD", cAlternateFileName="")) returned 1 [0141.533] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\network2.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 1 [0141.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\network3.vrd") returned 0x3c [0141.533] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.533] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e28) returned 0x6f14048 [0141.533] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeaeefd00, ftCreationTime.dwHighDateTime=0x1c2c076, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeaeefd00, ftLastWriteTime.dwHighDateTime=0x1c2c076, nFileSizeHigh=0x0, nFileSizeLow=0x468, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCCMPVRD.XML", cAlternateFileName="")) returned 1 [0141.533] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\network3.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML") returned 1 [0141.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCCMPVRD.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml") returned 0x3c [0141.533] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.533] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.533] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e2c) returned 0x6f14048 [0141.533] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b675400, ftCreationTime.dwHighDateTime=0x1c2c0e2, ftLastAccessTime.dwLowDateTime=0x50acdda0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4b675400, ftLastWriteTime.dwHighDateTime=0x1c2c0e2, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCMODVRD.XML", cAlternateFileName="")) returned 1 [0141.533] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\occmpvrd.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML") returned 1 [0141.533] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OCMODVRD.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml") returned 0x3c [0141.533] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.533] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.534] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e30) returned 0x6f14048 [0141.534] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde567d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xde567d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x81380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWCI.DLL", cAlternateFileName="")) returned 1 [0141.534] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ocmodvrd.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 1 [0141.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\offowci.dll") returned 0x3b [0141.534] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.534] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.534] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6fd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.HXS", cAlternateFileName="")) returned 1 [0141.534] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\offowci.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 1 [0141.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ois.hxs") returned 0x37 [0141.534] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.534] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.534] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e34) returned 0x6f14048 [0141.534] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISINTL.DLL", cAlternateFileName="")) returned 1 [0141.534] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ois.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 1 [0141.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll") returned 0x3b [0141.534] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.534] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.534] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXC", cAlternateFileName="")) returned 1 [0141.534] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 1 [0141.534] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc") returned 0x3b [0141.534] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.534] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e38) returned 0x6f14048 [0141.535] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_COL.HXT", cAlternateFileName="")) returned 1 [0141.535] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 1 [0141.535] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt") returned 0x3b [0141.535] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.535] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e3c) returned 0x6f14048 [0141.535] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_F_COL.HXK", cAlternateFileName="OIS_F_~1.HXK")) returned 1 [0141.535] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 1 [0141.535] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk") returned 0x3d [0141.535] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.535] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e40) returned 0x6f14048 [0141.535] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4501af00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4501af00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS_K_COL.HXK", cAlternateFileName="OIS_K_~1.HXK")) returned 1 [0141.535] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 1 [0141.535] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk") returned 0x3d [0141.535] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.535] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.535] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e44) returned 0x6f14048 [0141.535] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8de21e00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8de21e00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x62180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL", cAlternateFileName="")) returned 1 [0141.535] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 1 [0141.535] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll") returned 0x3b [0141.536] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.536] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.536] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70618400, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70618400, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.IDX_DLL", cAlternateFileName="OMSINT~1.IDX")) returned 1 [0141.536] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 1 [0141.536] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll") returned 0x43 [0141.536] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.536] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.536] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xdf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONELEV.EXE", cAlternateFileName="")) returned 1 [0141.541] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 1 [0141.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onelev.exe") returned 0x3a [0141.541] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.541] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7bd300, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c7bd300, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x1ab7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.HXS", cAlternateFileName="")) returned 1 [0141.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onelev.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 1 [0141.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs") returned 0x3b [0141.542] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.542] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e48) returned 0x6f14048 [0141.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabfa4f00, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabfa4f00, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x25e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteSyncPCIntl.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0141.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 1 [0141.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll") returned 0x45 [0141.542] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xc7ce790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXC", cAlternateFileName="ONENOT~1.HXC")) returned 1 [0141.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 1 [0141.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc") returned 0x3f [0141.542] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.542] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e4c) returned 0x6f14048 [0141.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_COL.HXT", cAlternateFileName="ONENOT~1.HXT")) returned 1 [0141.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 1 [0141.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt") returned 0x3f [0141.543] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.543] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.543] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0141.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_F_COL.HXK", cAlternateFileName="ONENOT~1.HXK")) returned 1 [0141.543] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 1 [0141.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk") returned 0x41 [0141.543] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.543] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.543] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0141.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48953600, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48953600, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE_K_COL.HXK", cAlternateFileName="ONENOT~2.HXK")) returned 1 [0141.543] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 1 [0141.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk") returned 0x41 [0141.543] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.543] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.543] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0141.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb96d3b00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb96d3b00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x148d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONGuide.onepkg", cAlternateFileName="ONGUID~1.ONE")) returned 1 [0141.543] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg") returned 1 [0141.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONGuide.onepkg", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg") returned 0x3e [0141.543] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.543] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.543] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0141.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x341f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL", cAlternateFileName="")) returned 1 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onguide.onepkg", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 1 [0141.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onintl.dll") returned 0x3a [0141.544] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.544] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.544] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc7f48f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.IDX_DLL", cAlternateFileName="ONINTL~1.IDX")) returned 1 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 1 [0141.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll") returned 0x42 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.544] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.544] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3266200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0xc81aa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3266200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.IDX_DLL", cAlternateFileName="ONINTL~2.IDX")) returned 1 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 1 [0141.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll") returned 0x43 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.544] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.544] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0141.544] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50af3f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCH.VRD", cAlternateFileName="")) returned 1 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 1 [0141.544] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd") returned 0x39 [0141.544] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.544] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.544] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0141.545] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.VSL", cAlternateFileName="")) returned 1 [0141.545] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 1 [0141.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl") returned 0x3c [0141.545] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.545] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0141.545] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5439200, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5439200, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGPOS.VRD", cAlternateFileName="")) returned 1 [0141.545] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 1 [0141.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd") returned 0x3a [0141.545] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.545] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0141.545] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b1a060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x105b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.VSL", cAlternateFileName="")) returned 1 [0141.545] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 1 [0141.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl") returned 0x3a [0141.545] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.545] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0141.545] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4790, dwReserved0=0x0, dwReserved1=0x0, cFileName="ospintl.dll", cAlternateFileName="")) returned 1 [0141.545] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 1 [0141.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll") returned 0x3b [0141.545] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.546] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8c4100, ftCreationTime.dwHighDateTime=0x1c67eda, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed8c4100, ftLastWriteTime.dwHighDateTime=0x1c67eda, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTFORM.DAT", cAlternateFileName="")) returned 1 [0141.546] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT") returned 1 [0141.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTFORM.DAT", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outform.dat") returned 0x3b [0141.546] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0141.546] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fc5400, ftCreationTime.dwHighDateTime=0x1ca0f51, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fc5400, ftLastWriteTime.dwHighDateTime=0x1ca0f51, nFileSizeHigh=0x0, nFileSizeLow=0x970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLBAR.INF", cAlternateFileName="")) returned 1 [0141.546] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outform.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 1 [0141.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf") returned 0x3b [0141.546] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0141.546] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x13f0930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x644d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL", cAlternateFileName="")) returned 1 [0141.546] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 1 [0141.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll") returned 0x3c [0141.546] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.546] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x1d380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.IDX_DLL", cAlternateFileName="OUTLLI~1.IDX")) returned 1 [0141.546] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 1 [0141.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll") returned 0x44 [0141.546] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.547] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x1416a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x46f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.IDX_DLL", cAlternateFileName="OUTLLI~2.IDX")) returned 1 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 1 [0141.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll") returned 0x45 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0141.547] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa80e2700, ftCreationTime.dwHighDateTime=0x1ca8f17, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa80e2700, ftLastWriteTime.dwHighDateTime=0x1ca8f17, nFileSizeHigh=0x0, nFileSizeLow=0x6aa3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV.HXS", cAlternateFileName="OUTLOO~1.HXS")) returned 1 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 1 [0141.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs") returned 0x3f [0141.547] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0141.547] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXC", cAlternateFileName="OUTLOO~1.HXC")) returned 1 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 1 [0141.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc") returned 0x43 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.547] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0141.547] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_COL.HXT", cAlternateFileName="OUTLOO~1.HXT")) returned 1 [0141.547] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 1 [0141.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt") returned 0x43 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0141.548] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_F_COL.HXK", cAlternateFileName="OUTLOO~1.HXK")) returned 1 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 1 [0141.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk") returned 0x45 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0141.548] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fbc4400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1462d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4fbc4400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.DEV_K_COL.HXK", cAlternateFileName="OUTLOO~2.HXK")) returned 1 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 1 [0141.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk") returned 0x45 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0141.548] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3475b500, ftCreationTime.dwHighDateTime=0x1ca95bc, ftLastAccessTime.dwLowDateTime=0x1488eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3475b500, ftLastWriteTime.dwHighDateTime=0x1ca95bc, nFileSizeHigh=0x0, nFileSizeLow=0x13a57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HOL", cAlternateFileName="")) returned 1 [0141.548] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 1 [0141.548] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.hol") returned 0x3b [0141.548] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.548] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.548] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0141.548] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ede2d00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ede2d00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c67, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.HXS", cAlternateFileName="")) returned 1 [0141.549] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.hol", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 1 [0141.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs") returned 0x3b [0141.549] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0141.549] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXC", cAlternateFileName="OUTLOO~2.HXC")) returned 1 [0141.549] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 1 [0141.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc") returned 0x3f [0141.549] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e9c) returned 0x6f14048 [0141.549] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_COL.HXT", cAlternateFileName="OUTLOO~2.HXT")) returned 1 [0141.549] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 1 [0141.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt") returned 0x3f [0141.549] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.549] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea0) returned 0x6f14048 [0141.549] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_F_COL.HXK", cAlternateFileName="OUTLOO~3.HXK")) returned 1 [0141.549] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 1 [0141.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk") returned 0x41 [0141.549] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea4) returned 0x6f14048 [0141.550] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c28bd00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c28bd00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK_K_COL.HXK", cAlternateFileName="OUTLOO~4.HXK")) returned 1 [0141.550] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 1 [0141.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk") returned 0x41 [0141.550] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea8) returned 0x6f14048 [0141.550] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.H", cAlternateFileName="")) returned 1 [0141.553] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H") returned 1 [0141.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlperf.h") returned 0x3a [0141.553] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eac) returned 0x6f14048 [0141.553] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0xa87, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPERF.INI", cAlternateFileName="")) returned 1 [0141.553] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlperf.h", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI") returned 1 [0141.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini") returned 0x3c [0141.553] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.553] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.553] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb0) returned 0x6f14048 [0141.553] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1f760, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL", cAlternateFileName="")) returned 1 [0141.553] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 1 [0141.553] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll") returned 0x3b [0141.553] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.554] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x2b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.IDX_DLL", cAlternateFileName="OUTLWV~1.IDX")) returned 1 [0141.554] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 1 [0141.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll") returned 0x43 [0141.554] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.554] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSPORT.CSS", cAlternateFileName="")) returned 1 [0141.554] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS") returned 1 [0141.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASSPORT.CSS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\passport.css") returned 0x3c [0141.554] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0141.554] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASTEL.CSS", cAlternateFileName="")) returned 1 [0141.554] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\passport.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS") returned 1 [0141.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PASTEL.CSS", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pastel.css") returned 0x3a [0141.554] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.554] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.554] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0141.554] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50b8c480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.VSL", cAlternateFileName="")) returned 1 [0141.554] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pastel.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL", len=0x36 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 1 [0141.554] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pe.vsl") returned 0x36 [0141.555] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.555] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.555] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0141.555] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cd5800, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50bfe8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5cd5800, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PIPELINE.VRD", cAlternateFileName="")) returned 1 [0141.555] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pe.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 1 [0141.561] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd") returned 0x3c [0141.574] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.574] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0141.574] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xdf0d2c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x33a380, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTL.DLL", cAlternateFileName="")) returned 1 [0141.574] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 1 [0141.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll") returned 0x3a [0141.574] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.574] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJINTLC.DLL", cAlternateFileName="")) returned 1 [0141.574] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 1 [0141.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll") returned 0x3b [0141.574] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.575] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c24a00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMENURES.DLL", cAlternateFileName="")) returned 1 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 1 [0141.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll") returned 0x3c [0141.575] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.575] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4cf264, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV.HXS", cAlternateFileName="POWERP~1.HXS")) returned 1 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 1 [0141.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs") returned 0x40 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0141.575] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXC", cAlternateFileName="POWERP~1.HXC")) returned 1 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 1 [0141.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc") returned 0x44 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0141.575] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_COL.HXT", cAlternateFileName="POWERP~1.HXT")) returned 1 [0141.575] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 1 [0141.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt") returned 0x44 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec4) returned 0x6f14048 [0141.576] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_F_COL.HXK", cAlternateFileName="POWERP~1.HXK")) returned 1 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 1 [0141.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk") returned 0x46 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec8) returned 0x6f14048 [0141.576] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e35200, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5dfd790, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x56e35200, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.DEV_K_COL.HXK", cAlternateFileName="POWERP~2.HXK")) returned 1 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 1 [0141.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk") returned 0x46 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ecc) returned 0x6f14048 [0141.576] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x68013d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.HXS", cAlternateFileName="")) returned 1 [0141.576] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 1 [0141.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs") returned 0x3c [0141.576] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed0) returned 0x6f14048 [0141.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXC", cAlternateFileName="POWERP~2.HXC")) returned 1 [0141.577] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 1 [0141.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc") returned 0x40 [0141.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed4) returned 0x6f14048 [0141.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_COL.HXT", cAlternateFileName="POWERP~2.HXT")) returned 1 [0141.577] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 1 [0141.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt") returned 0x40 [0141.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed8) returned 0x6f14048 [0141.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_F_COL.HXK", cAlternateFileName="POWERP~3.HXK")) returned 1 [0141.579] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 1 [0141.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk") returned 0x42 [0141.579] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1edc) returned 0x6f14048 [0141.580] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x534fcb00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x534fcb00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT_K_COL.HXK", cAlternateFileName="POWERP~4.HXK")) returned 1 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 1 [0141.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk") returned 0x42 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee0) returned 0x6f14048 [0141.580] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x139968, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL", cAlternateFileName="")) returned 1 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 1 [0141.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll") returned 0x3a [0141.580] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.580] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e49a50, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x9580, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.IDX_DLL", cAlternateFileName="PPINTL~1.IDX")) returned 1 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 1 [0141.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll") returned 0x42 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.580] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45e38b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0xf5e6fbb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45e38b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x22180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.IDX_DLL", cAlternateFileName="PPINTL~2.IDX")) returned 1 [0141.580] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 1 [0141.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll") returned 0x43 [0141.581] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee4) returned 0x6f14048 [0141.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50c4ab60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRIMARY.CSS", cAlternateFileName="")) returned 1 [0141.581] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS") returned 1 [0141.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PRIMARY.CSS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\primary.css") returned 0x3b [0141.581] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee8) returned 0x6f14048 [0141.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x21788, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSL", cAlternateFileName="")) returned 1 [0141.581] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\primary.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 1 [0141.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl") returned 0x3b [0141.581] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eec) returned 0x6f14048 [0141.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e830b00, ftCreationTime.dwHighDateTime=0x1ca4730, ftLastAccessTime.dwLowDateTime=0x50c70cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e830b00, ftLastWriteTime.dwHighDateTime=0x1ca4730, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.VSS", cAlternateFileName="")) returned 1 [0141.581] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS") returned 1 [0141.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss") returned 0x3b [0141.581] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.581] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0141.581] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4722d700, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4722d700, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.DOC", cAlternateFileName="")) returned 1 [0141.582] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\proprpt.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC") returned 1 [0141.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.DOC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc") returned 0x3c [0141.582] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0141.582] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.PPT", cAlternateFileName="")) returned 1 [0141.582] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottpln.doc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT") returned 1 [0141.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.PPT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt") returned 0x3c [0141.582] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0141.582] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51dd6c00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x51dd6c00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLN.XLS", cAlternateFileName="")) returned 1 [0141.582] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottpln.ppt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS") returned 1 [0141.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLN.XLS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls") returned 0x3c [0141.582] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0141.582] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45f1aa00, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45f1aa00, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x4e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.DOC", cAlternateFileName="")) returned 1 [0141.582] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottpln.xls", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC") returned 1 [0141.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.DOC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc") returned 0x3c [0141.582] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0141.583] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9744d100, ftCreationTime.dwHighDateTime=0x1c7e3af, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9744d100, ftLastWriteTime.dwHighDateTime=0x1c7e3af, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.PPT", cAlternateFileName="")) returned 1 [0141.583] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottplv.doc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT") returned 1 [0141.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.PPT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt") returned 0x3c [0141.583] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0141.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f04) returned 0x6f14048 [0141.583] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d18b800, ftCreationTime.dwHighDateTime=0x1c4bfe8, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d18b800, ftLastWriteTime.dwHighDateTime=0x1c4bfe8, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROTTPLV.XLS", cAlternateFileName="")) returned 1 [0141.588] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottplv.ppt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS") returned 1 [0141.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROTTPLV.XLS", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls") returned 0x3c [0141.589] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0141.589] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e50) returned 0x6f14048 [0146.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e7da00, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99e7da00, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0x4f777, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHKEY.DAT", cAlternateFileName="")) returned 1 [0146.444] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\prottplv.xls", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT") returned 1 [0146.444] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHKEY.DAT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat") returned 0x3c [0146.444] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.444] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.444] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e54) returned 0x6f14048 [0146.444] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0x1f3978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLEX.DAT", cAlternateFileName="")) returned 1 [0146.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\psrchkey.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT") returned 1 [0146.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat") returned 0x3c [0146.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0146.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xcd64, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHLTS.DAT", cAlternateFileName="")) returned 1 [0146.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT") returned 1 [0146.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLTS.DAT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat") returned 0x3c [0146.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0146.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33033d00, ftCreationTime.dwHighDateTime=0x1c56d62, ftLastAccessTime.dwLowDateTime=0xc866d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33033d00, ftLastWriteTime.dwHighDateTime=0x1c56d62, nFileSizeHigh=0x0, nFileSizeLow=0xd18, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHPHN.DAT", cAlternateFileName="")) returned 1 [0146.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\psrchlts.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT") returned 1 [0146.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHPHN.DAT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat") returned 0x3c [0146.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.445] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0146.445] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b190700, ftCreationTime.dwHighDateTime=0x1c5c981, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b190700, ftLastWriteTime.dwHighDateTime=0x1c5c981, nFileSizeHigh=0x0, nFileSizeLow=0xa03a47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSRCHSRN.DAT", cAlternateFileName="")) returned 1 [0146.445] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\psrchphn.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT") returned 1 [0146.445] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat") returned 0x3c [0146.445] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.445] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0146.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x6a8b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL", cAlternateFileName="")) returned 1 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 1 [0146.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll") returned 0x3c [0146.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x10980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.IDX_DLL", cAlternateFileName="PUB6IN~1.IDX")) returned 1 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 1 [0146.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll") returned 0x44 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7146200, ftCreationTime.dwHighDateTime=0x1cab7cc, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7146200, ftLastWriteTime.dwHighDateTime=0x1cab7cc, nFileSizeHigh=0x0, nFileSizeLow=0x41b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.IDX_DLL", cAlternateFileName="PUB6IN~2.IDX")) returned 1 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 1 [0146.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll") returned 0x45 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.446] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.446] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0146.446] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf925f00, ftCreationTime.dwHighDateTime=0x1c92dac, ftLastAccessTime.dwLowDateTime=0x1bbcb690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf925f00, ftLastWriteTime.dwHighDateTime=0x1c92dac, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCOLOR.SCM", cAlternateFileName="")) returned 1 [0146.446] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 1 [0146.446] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm") returned 0x3c [0146.446] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0146.447] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.447] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0146.447] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBFTSCM", cAlternateFileName="")) returned 1 [0146.447] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\") returned 1 [0146.447] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\") returned 0x39 [0146.447] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0146.447] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0146.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0146.492] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba28770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.493] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c22e700, ftCreationTime.dwHighDateTime=0x1ca6669, ftLastAccessTime.dwLowDateTime=0x1ba28770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c22e700, ftLastWriteTime.dwHighDateTime=0x1ca6669, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FONTSCHM.INI", cAlternateFileName="")) returned 1 [0146.493] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI") returned 1 [0146.493] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini") returned 0x45 [0146.493] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.493] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1ba28770, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0146.493] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.493] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\_restore files_.txt"), bFailIfExists=0) returned 1 [0146.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e58) returned 0x6f14048 [0146.612] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47994900, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47994900, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1eea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME01.CSS", cAlternateFileName="")) returned 1 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS") returned 1 [0146.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME01.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css") returned 0x45 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e5c) returned 0x6f14048 [0146.612] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b96a700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b96a700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fbbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME02.CSS", cAlternateFileName="")) returned 1 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme01.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS") returned 1 [0146.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME02.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css") returned 0x45 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e60) returned 0x6f14048 [0146.612] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a657a00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a657a00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f024, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME03.CSS", cAlternateFileName="")) returned 1 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme02.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS") returned 1 [0146.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME03.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css") returned 0x45 [0146.612] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e64) returned 0x6f14048 [0146.612] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29344d00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29344d00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME04.CSS", cAlternateFileName="")) returned 1 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme03.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS") returned 1 [0146.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME04.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css") returned 0x45 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e68) returned 0x6f14048 [0146.613] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1edba, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME05.CSS", cAlternateFileName="")) returned 1 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme04.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS") returned 1 [0146.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME05.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css") returned 0x45 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e6c) returned 0x6f14048 [0146.613] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28032000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28032000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f2da, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME06.CSS", cAlternateFileName="")) returned 1 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme05.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS") returned 1 [0146.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME06.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css") returned 0x45 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e70) returned 0x6f14048 [0146.613] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26d1f300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26d1f300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ff56, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME07.CSS", cAlternateFileName="")) returned 1 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme06.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS") returned 1 [0146.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME07.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css") returned 0x45 [0146.613] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e74) returned 0x6f14048 [0146.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f998, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME08.CSS", cAlternateFileName="")) returned 1 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme07.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS") returned 1 [0146.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME08.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css") returned 0x45 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e78) returned 0x6f14048 [0146.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a0c600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a0c600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20444, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME09.CSS", cAlternateFileName="")) returned 1 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme08.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS") returned 1 [0146.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME09.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css") returned 0x45 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e7c) returned 0x6f14048 [0146.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x233e6c00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x233e6c00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x2072a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME10.CSS", cAlternateFileName="")) returned 1 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme09.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS") returned 1 [0146.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME10.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css") returned 0x45 [0146.614] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e80) returned 0x6f14048 [0146.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x220d3f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x220d3f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20030, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME11.CSS", cAlternateFileName="")) returned 1 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme10.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS") returned 1 [0146.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME11.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css") returned 0x45 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e84) returned 0x6f14048 [0146.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20dc1200, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20dc1200, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e09a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME12.CSS", cAlternateFileName="")) returned 1 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme11.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS") returned 1 [0146.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME12.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css") returned 0x45 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e88) returned 0x6f14048 [0146.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ec9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME13.CSS", cAlternateFileName="")) returned 1 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme12.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS") returned 1 [0146.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME13.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css") returned 0x45 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e8c) returned 0x6f14048 [0146.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1faae500, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1faae500, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME14.CSS", cAlternateFileName="")) returned 1 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme13.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS") returned 1 [0146.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME14.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css") returned 0x45 [0146.615] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e90) returned 0x6f14048 [0146.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e79b800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e79b800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e094, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME15.CSS", cAlternateFileName="")) returned 1 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme14.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS") returned 1 [0146.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME15.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css") returned 0x45 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e94) returned 0x6f14048 [0146.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d488b00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d488b00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f822, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME16.CSS", cAlternateFileName="")) returned 1 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme15.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS") returned 1 [0146.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME16.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css") returned 0x45 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e98) returned 0x6f14048 [0146.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c175e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c175e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eada, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME17.CSS", cAlternateFileName="")) returned 1 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme16.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS") returned 1 [0146.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME17.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css") returned 0x45 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1e9c) returned 0x6f14048 [0146.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ae63100, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ae63100, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x20438, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME18.CSS", cAlternateFileName="")) returned 1 [0146.616] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme17.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS") returned 1 [0146.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME18.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css") returned 0x45 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea0) returned 0x6f14048 [0146.617] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19b50400, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b50400, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME19.CSS", cAlternateFileName="")) returned 1 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme18.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS") returned 1 [0146.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME19.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css") returned 0x45 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea4) returned 0x6f14048 [0146.617] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1883d700, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1883d700, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f6f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME20.CSS", cAlternateFileName="")) returned 1 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme19.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS") returned 1 [0146.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME20.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css") returned 0x45 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ea8) returned 0x6f14048 [0146.617] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1752aa00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1752aa00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eae6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME21.CSS", cAlternateFileName="")) returned 1 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme20.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS") returned 1 [0146.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME21.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css") returned 0x45 [0146.617] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eac) returned 0x6f14048 [0146.618] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f05000, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f05000, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME22.CSS", cAlternateFileName="")) returned 1 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme21.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS") returned 1 [0146.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME22.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css") returned 0x45 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb0) returned 0x6f14048 [0146.618] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13bf2300, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13bf2300, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1f5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME23.CSS", cAlternateFileName="")) returned 1 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme22.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS") returned 1 [0146.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME23.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css") returned 0x45 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb4) returned 0x6f14048 [0146.618] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128df600, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x128df600, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1ee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME24.CSS", cAlternateFileName="")) returned 1 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme23.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS") returned 1 [0146.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME24.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css") returned 0x45 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0146.618] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1fcee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME25.CSS", cAlternateFileName="")) returned 1 [0146.618] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme24.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS") returned 1 [0146.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css") returned 0x45 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.619] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.619] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0146.619] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x115cc900, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc17950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x115cc900, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d1b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME26.CSS", cAlternateFileName="")) returned 1 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS") returned 1 [0146.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css") returned 0x45 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.619] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.619] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0146.619] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e088, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME27.CSS", cAlternateFileName="")) returned 1 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS") returned 1 [0146.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css") returned 0x45 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.619] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.619] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec4) returned 0x6f14048 [0146.619] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefa6f00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefa6f00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d754, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME28.CSS", cAlternateFileName="")) returned 1 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS") returned 1 [0146.619] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css") returned 0x45 [0146.619] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.619] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.619] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec8) returned 0x6f14048 [0146.620] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb66e800, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb66e800, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME29.CSS", cAlternateFileName="")) returned 1 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS") returned 1 [0146.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME29.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css") returned 0x45 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.620] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ecc) returned 0x6f14048 [0146.620] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35bb00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa35bb00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1d522, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME30.CSS", cAlternateFileName="")) returned 1 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme29.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS") returned 1 [0146.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME30.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css") returned 0x45 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.620] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed0) returned 0x6f14048 [0146.620] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff7b2600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff7b2600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d652, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME31.CSS", cAlternateFileName="")) returned 1 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme30.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS") returned 1 [0146.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME31.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css") returned 0x45 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.620] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.620] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed4) returned 0x6f14048 [0146.620] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fda00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43fda00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1eb20, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME32.CSS", cAlternateFileName="")) returned 1 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme31.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS") returned 1 [0146.620] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME32.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css") returned 0x45 [0146.620] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.621] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.621] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed8) returned 0x6f14048 [0146.621] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8755100, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8755100, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1dcb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME33.CSS", cAlternateFileName="")) returned 1 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme32.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS") returned 1 [0146.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME33.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css") returned 0x45 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.621] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.621] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1edc) returned 0x6f14048 [0146.621] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eebe900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9eebe900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d124, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME34.CSS", cAlternateFileName="")) returned 1 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme33.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS") returned 1 [0146.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME34.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css") returned 0x45 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.621] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.621] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee0) returned 0x6f14048 [0146.621] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ce4c100, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ce4c100, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x202f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME35.CSS", cAlternateFileName="")) returned 1 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme34.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS") returned 1 [0146.621] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME35.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css") returned 0x45 [0146.621] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.621] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.621] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee4) returned 0x6f14048 [0146.621] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94315400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94315400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e12c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME36.CSS", cAlternateFileName="")) returned 1 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme35.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS") returned 1 [0146.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME36.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css") returned 0x45 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.622] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee8) returned 0x6f14048 [0146.622] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad35f00, ftCreationTime.dwHighDateTime=0x1c69a52, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad35f00, ftLastWriteTime.dwHighDateTime=0x1c69a52, nFileSizeHigh=0x0, nFileSizeLow=0x205bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME37.CSS", cAlternateFileName="")) returned 1 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme36.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS") returned 1 [0146.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME37.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css") returned 0x45 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.622] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eec) returned 0x6f14048 [0146.622] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8380de00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8380de00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f07c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME38.CSS", cAlternateFileName="")) returned 1 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme37.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS") returned 1 [0146.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME38.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css") returned 0x45 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.622] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.622] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0146.622] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532c200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7532c200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME39.CSS", cAlternateFileName="")) returned 1 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme38.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS") returned 1 [0146.622] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME39.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css") returned 0x45 [0146.622] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.623] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.623] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0146.623] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cda8700, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc3dab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cda8700, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1eb4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME40.CSS", cAlternateFileName="")) returned 1 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme39.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS") returned 1 [0146.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME40.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css") returned 0x45 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.623] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.623] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0146.623] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621ff200, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x621ff200, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME41.CSS", cAlternateFileName="")) returned 1 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme40.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS") returned 1 [0146.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME41.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css") returned 0x45 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.623] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.623] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0146.623] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56343000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56343000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1d920, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME42.CSS", cAlternateFileName="")) returned 1 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme41.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS") returned 1 [0146.623] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME42.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css") returned 0x45 [0146.623] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.623] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.623] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0146.623] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47e61400, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47e61400, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e714, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME43.CSS", cAlternateFileName="")) returned 1 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme42.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS") returned 1 [0146.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME43.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css") returned 0x45 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.624] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f04) returned 0x6f14048 [0146.624] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37359e00, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37359e00, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1ecfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME44.CSS", cAlternateFileName="")) returned 1 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme43.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS") returned 1 [0146.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME44.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css") returned 0x45 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.624] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f08) returned 0x6f14048 [0146.624] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7b0900, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7b0900, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME45.CSS", cAlternateFileName="")) returned 1 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme44.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS") returned 1 [0146.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME45.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css") returned 0x45 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.624] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.624] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f0c) returned 0x6f14048 [0146.624] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cfbc000, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cfbc000, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1fdb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME46.CSS", cAlternateFileName="")) returned 1 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme45.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS") returned 1 [0146.624] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME46.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css") returned 0x45 [0146.624] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.624] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f10) returned 0x6f14048 [0146.625] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a38500, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a38500, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME47.CSS", cAlternateFileName="")) returned 1 [0146.625] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme46.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS") returned 1 [0146.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME47.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css") returned 0x45 [0146.625] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.625] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0146.625] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7869600, ftCreationTime.dwHighDateTime=0x1ca1578, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7869600, ftLastWriteTime.dwHighDateTime=0x1ca1578, nFileSizeHigh=0x0, nFileSizeLow=0x1f984, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME48.CSS", cAlternateFileName="")) returned 1 [0146.625] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme47.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS") returned 1 [0146.625] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css") returned 0x45 [0146.625] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.625] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.625] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0146.625] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa69a700, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa69a700, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1da6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME49.CSS", cAlternateFileName="")) returned 1 [0146.625] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS") returned 1 [0146.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css") returned 0x45 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.626] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0146.626] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e03f00, ftCreationTime.dwHighDateTime=0x1ca1577, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0e03f00, ftLastWriteTime.dwHighDateTime=0x1ca1577, nFileSizeHigh=0x0, nFileSizeLow=0x1f018, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME50.CSS", cAlternateFileName="")) returned 1 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS") returned 1 [0146.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css") returned 0x45 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.626] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0146.626] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1922be00, ftCreationTime.dwHighDateTime=0x1c69a7b, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1922be00, ftLastWriteTime.dwHighDateTime=0x1c69a7b, nFileSizeHigh=0x0, nFileSizeLow=0x1df68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME51.CSS", cAlternateFileName="")) returned 1 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS") returned 1 [0146.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css") returned 0x45 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.626] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0146.626] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ce8a00, ftCreationTime.dwHighDateTime=0x1c69651, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1ce8a00, ftLastWriteTime.dwHighDateTime=0x1c69651, nFileSizeHigh=0x0, nFileSizeLow=0x1e254, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME52.CSS", cAlternateFileName="")) returned 1 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS") returned 1 [0146.626] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css") returned 0x45 [0146.626] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.626] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0146.627] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74d95100, ftCreationTime.dwHighDateTime=0x1c69a53, ftLastAccessTime.dwLowDateTime=0x1bc63c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74d95100, ftLastWriteTime.dwHighDateTime=0x1c69a53, nFileSizeHigh=0x0, nFileSizeLow=0x1e6a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME53.CSS", cAlternateFileName="")) returned 1 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS") returned 1 [0146.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css") returned 0x45 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0146.627] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c1eb00, ftCreationTime.dwHighDateTime=0x1c69597, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67c1eb00, ftLastWriteTime.dwHighDateTime=0x1c69597, nFileSizeHigh=0x0, nFileSizeLow=0x1f064, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME54.CSS", cAlternateFileName="")) returned 1 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS") returned 1 [0146.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css") returned 0x45 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0146.627] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f2a2e00, ftCreationTime.dwHighDateTime=0x1ca1579, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f2a2e00, ftLastWriteTime.dwHighDateTime=0x1ca1579, nFileSizeHigh=0x0, nFileSizeLow=0x1e114, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHEME55.CSS", cAlternateFileName="")) returned 1 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS") returned 1 [0146.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css") returned 0x45 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.627] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.627] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0146.627] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f00e440, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x8f00e440, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0146.627] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\_RESTORE FILES_.txt", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\_RESTORE FILES_.txt") returned 1 [0146.627] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\_RESTORE FILES_.txt", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\_restore files_.txt") returned 0x4c [0146.628] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.628] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.628] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0146.628] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0146.628] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0146.628] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\") returned 1 [0146.628] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\") returned 0x39 [0146.628] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0146.628] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0146.628] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0146.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bde09d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.770] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x182b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAPERS.INI", cAlternateFileName="")) returned 1 [0146.770] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI") returned 1 [0146.770] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PAPERS.INI", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini") returned 0x43 [0146.770] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.770] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1ba9ab90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0146.770] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0146.770] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\_restore files_.txt"), bFailIfExists=0) returned 1 [0146.814] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0146.814] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3bb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR10F.GIF", cAlternateFileName="")) returned 1 [0146.814] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\papers.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF") returned 1 [0146.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR10F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif") returned 0x44 [0146.814] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.814] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.814] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0146.814] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x142f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR11F.GIF", cAlternateFileName="")) returned 1 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir10f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF") returned 1 [0146.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR11F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif") returned 0x44 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.815] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0146.815] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR12F.GIF", cAlternateFileName="")) returned 1 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir11f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF") returned 1 [0146.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR12F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif") returned 0x44 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.815] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0146.815] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x430d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR13F.GIF", cAlternateFileName="")) returned 1 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir12f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF") returned 1 [0146.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR13F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif") returned 0x44 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.815] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0146.815] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5cb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR14F.GIF", cAlternateFileName="")) returned 1 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir13f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF") returned 1 [0146.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR14F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif") returned 0x44 [0146.815] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.816] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0146.816] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR15F.GIF", cAlternateFileName="")) returned 1 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir14f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF") returned 1 [0146.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR15F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif") returned 0x44 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.816] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0146.816] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x399f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR16F.GIF", cAlternateFileName="")) returned 1 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir15f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF") returned 1 [0146.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR16F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif") returned 0x44 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.816] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0146.816] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR17F.GIF", cAlternateFileName="")) returned 1 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir16f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF") returned 1 [0146.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR17F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif") returned 0x44 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.816] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0146.816] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR18F.GIF", cAlternateFileName="")) returned 1 [0146.816] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir17f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF") returned 1 [0146.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR18F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif") returned 0x44 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0146.817] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR19F.GIF", cAlternateFileName="")) returned 1 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir18f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF") returned 1 [0146.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR19F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif") returned 0x44 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0146.817] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd98, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR1B.GIF", cAlternateFileName="")) returned 1 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir19f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF") returned 1 [0146.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif") returned 0x43 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0146.817] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR1F.GIF", cAlternateFileName="")) returned 1 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF") returned 1 [0146.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif") returned 0x43 [0146.817] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0146.818] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bac0cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3408, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR20F.GIF", cAlternateFileName="")) returned 1 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF") returned 1 [0146.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR20F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif") returned 0x44 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.818] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0146.818] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR21F.GIF", cAlternateFileName="")) returned 1 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir20f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF") returned 1 [0146.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR21F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif") returned 0x44 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.818] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0146.818] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR22F.GIF", cAlternateFileName="")) returned 1 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir21f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF") returned 1 [0146.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR22F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif") returned 0x44 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.818] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.818] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0146.818] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x313b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR23F.GIF", cAlternateFileName="")) returned 1 [0146.818] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir22f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF") returned 1 [0146.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR23F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif") returned 0x44 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.819] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0146.819] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR24F.GIF", cAlternateFileName="")) returned 1 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir23f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF") returned 1 [0146.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR24F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif") returned 0x44 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.819] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0146.819] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd51e200, ftCreationTime.dwHighDateTime=0x1bdb5da, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd51e200, ftLastWriteTime.dwHighDateTime=0x1bdb5da, nFileSizeHigh=0x0, nFileSizeLow=0x3187, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR25F.GIF", cAlternateFileName="")) returned 1 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir24f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF") returned 1 [0146.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR25F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif") returned 0x44 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.819] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0146.819] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1985, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR26F.GIF", cAlternateFileName="")) returned 1 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir25f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF") returned 1 [0146.819] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR26F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif") returned 0x44 [0146.819] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.819] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.819] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0146.819] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR27F.GIF", cAlternateFileName="")) returned 1 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir26f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF") returned 1 [0146.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR27F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif") returned 0x44 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.820] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0146.820] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x684, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR28B.GIF", cAlternateFileName="")) returned 1 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir27f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF") returned 1 [0146.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif") returned 0x44 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.820] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0146.820] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1786, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR28F.GIF", cAlternateFileName="")) returned 1 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF") returned 1 [0146.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR28F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif") returned 0x44 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.820] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.820] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0146.820] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR29B.GIF", cAlternateFileName="")) returned 1 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir28f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF") returned 1 [0146.820] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif") returned 0x44 [0146.820] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.820] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0146.821] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x59bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR29F.GIF", cAlternateFileName="")) returned 1 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF") returned 1 [0146.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR29F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif") returned 0x44 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.821] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0146.821] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3567a000, ftCreationTime.dwHighDateTime=0x1bdb36e, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3567a000, ftLastWriteTime.dwHighDateTime=0x1bdb36e, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR2B.GIF", cAlternateFileName="")) returned 1 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir29f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF") returned 1 [0146.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif") returned 0x43 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.821] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0146.821] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf73, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR2F.GIF", cAlternateFileName="")) returned 1 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF") returned 1 [0146.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR2F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif") returned 0x43 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.821] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0146.821] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR30B.GIF", cAlternateFileName="")) returned 1 [0146.821] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir2f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF") returned 1 [0146.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif") returned 0x44 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.822] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0146.822] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR30F.GIF", cAlternateFileName="")) returned 1 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF") returned 1 [0146.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif") returned 0x44 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.822] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0146.822] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bae6e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR31B.GIF", cAlternateFileName="")) returned 1 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF") returned 1 [0146.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif") returned 0x44 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.822] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0146.822] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x52da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR31F.GIF", cAlternateFileName="")) returned 1 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF") returned 1 [0146.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif") returned 0x44 [0146.822] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.822] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0146.823] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xf47, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR32B.GIF", cAlternateFileName="")) returned 1 [0146.823] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF") returned 1 [0146.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif") returned 0x44 [0146.823] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.823] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0146.823] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x910b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR32F.GIF", cAlternateFileName="")) returned 1 [0146.823] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF") returned 1 [0146.823] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif") returned 0x44 [0146.823] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0146.823] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0146.823] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa8) returned 0x6f14048 [0146.823] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1631, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR33B.GIF", cAlternateFileName="")) returned 1 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF") returned 1 [0148.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif") returned 0x44 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0148.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d13, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR33F.GIF", cAlternateFileName="")) returned 1 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF") returned 1 [0148.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR33F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif") returned 0x44 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0148.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR34B.GIF", cAlternateFileName="")) returned 1 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir33f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF") returned 1 [0148.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif") returned 0x44 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0148.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x95dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR34F.GIF", cAlternateFileName="")) returned 1 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF") returned 1 [0148.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR34F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif") returned 0x44 [0148.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0148.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x11ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR35B.GIF", cAlternateFileName="")) returned 1 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir34f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF") returned 1 [0148.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif") returned 0x44 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0148.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR35F.GIF", cAlternateFileName="")) returned 1 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF") returned 1 [0148.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR35F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif") returned 0x44 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0148.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x23e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR36B.GIF", cAlternateFileName="")) returned 1 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir35f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF") returned 1 [0148.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif") returned 0x44 [0148.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0148.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8fd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR36F.GIF", cAlternateFileName="")) returned 1 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF") returned 1 [0148.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR36F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif") returned 0x44 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0148.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd4a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR37F.GIF", cAlternateFileName="")) returned 1 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir36f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF") returned 1 [0148.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR37F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif") returned 0x44 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0148.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb0cfb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb819, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR38F.GIF", cAlternateFileName="")) returned 1 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir37f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF") returned 1 [0148.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR38F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif") returned 0x44 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0148.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xaf65, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR39F.GIF", cAlternateFileName="")) returned 1 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir38f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF") returned 1 [0148.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR39F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif") returned 0x44 [0148.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0148.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR3B.GIF", cAlternateFileName="")) returned 1 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir39f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF") returned 1 [0148.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif") returned 0x43 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0148.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4647, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR3F.GIF", cAlternateFileName="")) returned 1 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF") returned 1 [0148.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR3F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif") returned 0x43 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0148.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10f19, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR40F.GIF", cAlternateFileName="")) returned 1 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir3f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF") returned 1 [0148.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR40F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif") returned 0x44 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0148.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7d5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR41F.GIF", cAlternateFileName="")) returned 1 [0148.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir40f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF") returned 1 [0148.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR41F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif") returned 0x44 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0148.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdf73, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR42F.GIF", cAlternateFileName="")) returned 1 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir41f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF") returned 1 [0148.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR42F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif") returned 0x44 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0148.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR43B.GIF", cAlternateFileName="")) returned 1 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir42f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF") returned 1 [0148.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif") returned 0x44 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0148.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR43F.GIF", cAlternateFileName="")) returned 1 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF") returned 1 [0148.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR43F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif") returned 0x44 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0148.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3606, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR44B.GIF", cAlternateFileName="")) returned 1 [0148.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir43f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF") returned 1 [0148.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif") returned 0x44 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0148.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3026, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR44F.GIF", cAlternateFileName="")) returned 1 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF") returned 1 [0148.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR44F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif") returned 0x44 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0148.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2019, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR45B.GIF", cAlternateFileName="")) returned 1 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir44f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF") returned 1 [0148.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif") returned 0x44 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0148.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ee9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR45F.GIF", cAlternateFileName="")) returned 1 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF") returned 1 [0148.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR45F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif") returned 0x44 [0148.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0148.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb33110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1349, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR46B.GIF", cAlternateFileName="")) returned 1 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir45f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF") returned 1 [0148.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif") returned 0x44 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0148.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1377, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR46F.GIF", cAlternateFileName="")) returned 1 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF") returned 1 [0148.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR46F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif") returned 0x44 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0148.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x80d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR47B.GIF", cAlternateFileName="")) returned 1 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir46f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF") returned 1 [0148.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif") returned 0x44 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0148.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR47F.GIF", cAlternateFileName="")) returned 1 [0148.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF") returned 1 [0148.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR47F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif") returned 0x44 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0148.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2b53, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR48B.GIF", cAlternateFileName="")) returned 1 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir47f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF") returned 1 [0148.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif") returned 0x44 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0148.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x178c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR48F.GIF", cAlternateFileName="")) returned 1 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF") returned 1 [0148.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif") returned 0x44 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0148.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4a66, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR49B.GIF", cAlternateFileName="")) returned 1 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF") returned 1 [0148.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif") returned 0x44 [0148.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0148.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR49F.GIF", cAlternateFileName="")) returned 1 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF") returned 1 [0148.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif") returned 0x44 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0148.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a01, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR4B.GIF", cAlternateFileName="")) returned 1 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF") returned 1 [0148.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif") returned 0x43 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0148.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x76cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR4F.GIF", cAlternateFileName="")) returned 1 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF") returned 1 [0148.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif") returned 0x43 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0148.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1001, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR50B.GIF", cAlternateFileName="")) returned 1 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF") returned 1 [0148.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif") returned 0x44 [0148.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0148.725] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR50F.GIF", cAlternateFileName="")) returned 1 [0148.725] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF") returned 1 [0148.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif") returned 0x44 [0148.725] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0148.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0148.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0148.725] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4217, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR51B.GIF", cAlternateFileName="")) returned 1 [0150.400] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF") returned 1 [0150.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif") returned 0x44 [0150.401] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.401] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.710] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0150.710] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR51F.GIF", cAlternateFileName="")) returned 1 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF") returned 1 [0150.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif") returned 0x44 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.711] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0150.711] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4c88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5B.GIF", cAlternateFileName="")) returned 1 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF") returned 1 [0150.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif") returned 0x43 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.711] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0150.711] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb59270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xce72, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR5F.GIF", cAlternateFileName="")) returned 1 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF") returned 1 [0150.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif") returned 0x43 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.711] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.711] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0150.711] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x24dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR6B.GIF", cAlternateFileName="")) returned 1 [0150.711] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF") returned 1 [0150.711] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif") returned 0x43 [0150.712] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0150.712] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR6F.GIF", cAlternateFileName="")) returned 1 [0150.712] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF") returned 1 [0150.712] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif") returned 0x43 [0150.712] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.712] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.712] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0150.715] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6054, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR7B.GIF", cAlternateFileName="")) returned 1 [0150.715] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF") returned 1 [0150.715] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif") returned 0x43 [0150.715] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.715] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0150.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x70bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR7F.GIF", cAlternateFileName="")) returned 1 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF") returned 1 [0150.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif") returned 0x43 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0150.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR8B.GIF", cAlternateFileName="")) returned 1 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF") returned 1 [0150.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif") returned 0x43 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0150.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2204, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR8F.GIF", cAlternateFileName="")) returned 1 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF") returned 1 [0150.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif") returned 0x43 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.716] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.716] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0150.716] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x445d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR9B.GIF", cAlternateFileName="")) returned 1 [0150.716] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF") returned 1 [0150.716] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif") returned 0x43 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0150.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bb7f3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5aec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIR9F.GIF", cAlternateFileName="")) returned 1 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF") returned 1 [0150.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif") returned 0x43 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa8) returned 0x6f14048 [0150.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x189e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPAPERS.INI", cAlternateFileName="")) returned 1 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI") returned 1 [0150.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini") returned 0x44 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.717] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fac) returned 0x6f14048 [0150.717] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR00.GIF", cAlternateFileName="")) returned 1 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF") returned 1 [0150.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif") returned 0x44 [0150.717] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb0) returned 0x6f14048 [0150.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR10F.GIF", cAlternateFileName="")) returned 1 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF") returned 1 [0150.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR10F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif") returned 0x45 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb4) returned 0x6f14048 [0150.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1706, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR11F.GIF", cAlternateFileName="")) returned 1 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir10f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF") returned 1 [0150.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR11F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif") returned 0x45 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb8) returned 0x6f14048 [0150.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x6499, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR12F.GIF", cAlternateFileName="")) returned 1 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir11f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF") returned 1 [0150.718] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR12F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif") returned 0x45 [0150.718] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.718] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.718] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fbc) returned 0x6f14048 [0150.718] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR13F.GIF", cAlternateFileName="")) returned 1 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir12f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF") returned 1 [0150.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR13F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif") returned 0x45 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc0) returned 0x6f14048 [0150.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x645b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR14F.GIF", cAlternateFileName="")) returned 1 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir13f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF") returned 1 [0150.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR14F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif") returned 0x45 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc4) returned 0x6f14048 [0150.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x452b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR15F.GIF", cAlternateFileName="")) returned 1 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir14f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF") returned 1 [0150.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR15F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif") returned 0x45 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.719] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc8) returned 0x6f14048 [0150.719] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR16F.GIF", cAlternateFileName="")) returned 1 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir15f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF") returned 1 [0150.719] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR16F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif") returned 0x45 [0150.719] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.719] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fcc) returned 0x6f14048 [0150.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x34cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR17F.GIF", cAlternateFileName="")) returned 1 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir16f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF") returned 1 [0150.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR17F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif") returned 0x45 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd0) returned 0x6f14048 [0150.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4be9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR18F.GIF", cAlternateFileName="")) returned 1 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir17f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF") returned 1 [0150.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR18F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif") returned 0x45 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd4) returned 0x6f14048 [0150.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc11, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR19F.GIF", cAlternateFileName="")) returned 1 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir18f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF") returned 1 [0150.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR19F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif") returned 0x45 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd8) returned 0x6f14048 [0150.720] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR1B.GIF", cAlternateFileName="")) returned 1 [0150.720] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir19f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF") returned 1 [0150.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif") returned 0x44 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fdc) returned 0x6f14048 [0150.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b75, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR1F.GIF", cAlternateFileName="")) returned 1 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF") returned 1 [0150.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif") returned 0x44 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe0) returned 0x6f14048 [0150.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xc85, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR20F.GIF", cAlternateFileName="")) returned 1 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF") returned 1 [0150.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR20F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif") returned 0x45 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe4) returned 0x6f14048 [0150.721] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcafed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x42ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR21F.GIF", cAlternateFileName="")) returned 1 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir20f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF") returned 1 [0150.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR21F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif") returned 0x45 [0150.721] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe8) returned 0x6f14048 [0150.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1983, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR22F.GIF", cAlternateFileName="")) returned 1 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir21f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF") returned 1 [0150.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR22F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif") returned 0x45 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fec) returned 0x6f14048 [0150.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bcd6030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2a71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR23F.GIF", cAlternateFileName="")) returned 1 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir22f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF") returned 1 [0150.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR23F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif") returned 0x45 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff0) returned 0x6f14048 [0150.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR24F.GIF", cAlternateFileName="")) returned 1 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir23f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF") returned 1 [0150.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR24F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif") returned 0x45 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff4) returned 0x6f14048 [0150.722] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x326c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR25F.GIF", cAlternateFileName="")) returned 1 [0150.722] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir24f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF") returned 1 [0150.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR25F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif") returned 0x45 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0150.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2072, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR26F.GIF", cAlternateFileName="")) returned 1 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir25f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF") returned 1 [0150.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR26F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif") returned 0x45 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0150.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR27F.GIF", cAlternateFileName="")) returned 1 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir26f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF") returned 1 [0150.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR27F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif") returned 0x45 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0150.723] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR28F.GIF", cAlternateFileName="")) returned 1 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir27f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF") returned 1 [0150.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif") returned 0x45 [0150.723] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0150.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR29F.GIF", cAlternateFileName="")) returned 1 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF") returned 1 [0150.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif") returned 0x45 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0150.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20a5ff00, ftCreationTime.dwHighDateTime=0x1bdb3a4, ftLastAccessTime.dwLowDateTime=0x1bd222f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20a5ff00, ftLastWriteTime.dwHighDateTime=0x1bdb3a4, nFileSizeHigh=0x0, nFileSizeLow=0xc49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR2B.GIF", cAlternateFileName="")) returned 1 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF") returned 1 [0150.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif") returned 0x44 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0150.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x154f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR2F.GIF", cAlternateFileName="")) returned 1 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF") returned 1 [0150.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif") returned 0x44 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0150.724] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x905a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR30F.GIF", cAlternateFileName="")) returned 1 [0150.724] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF") returned 1 [0150.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif") returned 0x45 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0150.725] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3b6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR31F.GIF", cAlternateFileName="")) returned 1 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF") returned 1 [0150.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif") returned 0x45 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0150.725] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9eb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR32F.GIF", cAlternateFileName="")) returned 1 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF") returned 1 [0150.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif") returned 0x45 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0150.725] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5a34, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR33F.GIF", cAlternateFileName="")) returned 1 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF") returned 1 [0150.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif") returned 0x45 [0150.725] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0150.726] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa9f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR34F.GIF", cAlternateFileName="")) returned 1 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF") returned 1 [0150.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif") returned 0x45 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0150.726] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4660, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR35F.GIF", cAlternateFileName="")) returned 1 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF") returned 1 [0150.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif") returned 0x45 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0150.726] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd48450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x875e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR36F.GIF", cAlternateFileName="")) returned 1 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF") returned 1 [0150.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif") returned 0x45 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0150.726] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xd1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR37F.GIF", cAlternateFileName="")) returned 1 [0150.726] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF") returned 1 [0150.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif") returned 0x45 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0150.727] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xcbc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR38F.GIF", cAlternateFileName="")) returned 1 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF") returned 1 [0150.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR38F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif") returned 0x45 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0150.727] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdc9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR39F.GIF", cAlternateFileName="")) returned 1 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir38f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF") returned 1 [0150.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR39F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif") returned 0x45 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0150.727] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3a1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR3B.GIF", cAlternateFileName="")) returned 1 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir39f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF") returned 1 [0150.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif") returned 0x44 [0150.727] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0150.728] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x58e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR3F.GIF", cAlternateFileName="")) returned 1 [0150.728] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF") returned 1 [0150.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR3F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif") returned 0x44 [0150.728] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.728] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0150.728] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x112a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR40F.GIF", cAlternateFileName="")) returned 1 [0150.728] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir3f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF") returned 1 [0150.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR40F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif") returned 0x45 [0150.728] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.728] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0150.729] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR41F.GIF", cAlternateFileName="")) returned 1 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir40f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF") returned 1 [0150.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR41F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif") returned 0x45 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0150.729] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe591, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR42F.GIF", cAlternateFileName="")) returned 1 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir41f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF") returned 1 [0150.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR42F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif") returned 0x45 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0150.729] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x98a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR43B.GIF", cAlternateFileName="")) returned 1 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir42f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF") returned 1 [0150.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif") returned 0x45 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0150.729] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd6e5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x997, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR43F.GIF", cAlternateFileName="")) returned 1 [0150.729] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF") returned 1 [0150.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR43F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif") returned 0x45 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0150.730] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b06, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR44B.GIF", cAlternateFileName="")) returned 1 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir43f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF") returned 1 [0150.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif") returned 0x45 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0150.730] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a76, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR44F.GIF", cAlternateFileName="")) returned 1 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF") returned 1 [0150.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR44F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif") returned 0x45 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x205c) returned 0x6f14048 [0150.730] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR45B.GIF", cAlternateFileName="")) returned 1 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir44f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF") returned 1 [0150.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif") returned 0x45 [0150.730] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2060) returned 0x6f14048 [0150.731] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR45F.GIF", cAlternateFileName="")) returned 1 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF") returned 1 [0150.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif") returned 0x45 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2064) returned 0x6f14048 [0150.731] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1304, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR46B.GIF", cAlternateFileName="")) returned 1 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF") returned 1 [0150.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif") returned 0x45 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0150.731] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x141c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR46F.GIF", cAlternateFileName="")) returned 1 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF") returned 1 [0150.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif") returned 0x45 [0150.731] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x206c) returned 0x6f14048 [0150.731] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x7517, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR47B.GIF", cAlternateFileName="")) returned 1 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF") returned 1 [0150.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif") returned 0x45 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2070) returned 0x6f14048 [0150.732] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x539e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR47F.GIF", cAlternateFileName="")) returned 1 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF") returned 1 [0150.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif") returned 0x45 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2074) returned 0x6f14048 [0150.732] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x67f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR48B.GIF", cAlternateFileName="")) returned 1 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF") returned 1 [0150.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif") returned 0x45 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2078) returned 0x6f14048 [0150.732] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR48F.GIF", cAlternateFileName="")) returned 1 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF") returned 1 [0150.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif") returned 0x45 [0150.732] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x207c) returned 0x6f14048 [0150.733] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR49B.GIF", cAlternateFileName="")) returned 1 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF") returned 1 [0150.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif") returned 0x45 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2080) returned 0x6f14048 [0150.733] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b99, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR49F.GIF", cAlternateFileName="")) returned 1 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF") returned 1 [0150.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif") returned 0x45 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2084) returned 0x6f14048 [0150.733] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bd94710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR4B.GIF", cAlternateFileName="")) returned 1 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF") returned 1 [0150.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif") returned 0x44 [0150.733] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2088) returned 0x6f14048 [0150.733] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8edb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR4F.GIF", cAlternateFileName="")) returned 1 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF") returned 1 [0150.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif") returned 0x44 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x208c) returned 0x6f14048 [0150.734] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x10a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR50B.GIF", cAlternateFileName="")) returned 1 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF") returned 1 [0150.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif") returned 0x45 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2090) returned 0x6f14048 [0150.734] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x117f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR50F.GIF", cAlternateFileName="")) returned 1 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF") returned 1 [0150.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif") returned 0x45 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2094) returned 0x6f14048 [0150.734] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2395, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR51B.GIF", cAlternateFileName="")) returned 1 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF") returned 1 [0150.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif") returned 0x45 [0150.734] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2098) returned 0x6f14048 [0150.735] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1179, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR51F.GIF", cAlternateFileName="")) returned 1 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF") returned 1 [0150.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif") returned 0x45 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x209c) returned 0x6f14048 [0150.735] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x592b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5B.GIF", cAlternateFileName="")) returned 1 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF") returned 1 [0150.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif") returned 0x44 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a0) returned 0x6f14048 [0150.735] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xdb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR5F.GIF", cAlternateFileName="")) returned 1 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF") returned 1 [0150.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR5F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif") returned 0x44 [0150.735] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.735] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a4) returned 0x6f14048 [0150.735] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2ade, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6B.GIF", cAlternateFileName="")) returned 1 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir5f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF") returned 1 [0150.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif") returned 0x44 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.736] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a8) returned 0x6f14048 [0150.736] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x41e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR6F.GIF", cAlternateFileName="")) returned 1 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF") returned 1 [0150.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR6F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif") returned 0x44 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.736] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ac) returned 0x6f14048 [0150.736] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5559, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7B.GIF", cAlternateFileName="")) returned 1 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir6f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF") returned 1 [0150.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif") returned 0x44 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.736] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b0) returned 0x6f14048 [0150.736] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bdba870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x5fdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR7F.GIF", cAlternateFileName="")) returned 1 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF") returned 1 [0150.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR7F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif") returned 0x44 [0150.736] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b4) returned 0x6f14048 [0150.737] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1038, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8B.GIF", cAlternateFileName="")) returned 1 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir7f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF") returned 1 [0150.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif") returned 0x44 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0150.737] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR8F.GIF", cAlternateFileName="")) returned 1 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF") returned 1 [0150.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR8F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif") returned 0x44 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0150.737] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3e39, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9B.GIF", cAlternateFileName="")) returned 1 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir8f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF") returned 1 [0150.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9B.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif") returned 0x44 [0150.737] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0150.737] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x1bde09d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x46ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZPDIR9F.GIF", cAlternateFileName="")) returned 1 [0150.738] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9b.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF") returned 1 [0150.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR9F.GIF", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif") returned 0x44 [0150.738] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.738] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0150.738] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f1fd620, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x8f1fd620, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0150.738] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir9f.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\_RESTORE FILES_.txt", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\_RESTORE FILES_.txt") returned 1 [0150.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\_RESTORE FILES_.txt", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\_restore files_.txt") returned 0x4c [0150.738] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.738] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.738] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0150.738] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc87ce900, ftCreationTime.dwHighDateTime=0x1ca9b87, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc87ce900, ftLastWriteTime.dwHighDateTime=0x1ca9b87, nFileSizeHigh=0x0, nFileSizeLow=0x29d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0150.738] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 1 [0150.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll") returned 0x3c [0150.738] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.738] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9324cb00, ftCreationTime.dwHighDateTime=0x1ca9b88, ftLastAccessTime.dwLowDateTime=0x1bbf17f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9324cb00, ftLastWriteTime.dwHighDateTime=0x1ca9b88, nFileSizeHigh=0x0, nFileSizeLow=0x2a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.IDX_DLL", cAlternateFileName="PUBWZI~1.IDX")) returned 1 [0150.738] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 1 [0150.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll") returned 0x45 [0150.739] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.739] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.739] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0150.739] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x14760, dwReserved0=0x0, dwReserved1=0x0, cFileName="QRYINT32.DLL", cAlternateFileName="")) returned 1 [0150.739] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 1 [0150.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll") returned 0x3c [0150.739] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.739] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.739] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuickStyles", cAlternateFileName="QUICKS~1")) returned 1 [0150.739] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\") returned 1 [0150.739] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\") returned 0x3c [0150.739] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0150.739] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0150.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0150.777] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e5274d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.777] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95af5900, ftCreationTime.dwHighDateTime=0x1c7e846, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95af5900, ftLastWriteTime.dwHighDateTime=0x1c7e846, nFileSizeHigh=0x0, nFileSizeLow=0x2387, dwReserved0=0x0, dwReserved1=0x0, cFileName="Classic.dotx", cAlternateFileName="CLASSI~1.DOT")) returned 1 [0150.777] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx") returned 1 [0150.777] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx") returned 0x48 [0150.777] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.777] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.777] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1e3382f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0150.777] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0150.777] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0150.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0150.905] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x23e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default.dotx", cAlternateFileName="DEFAUL~1.DOT")) returned 1 [0150.905] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx") returned 1 [0150.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx") returned 0x48 [0150.905] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.905] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0150.905] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultBlackAndWhite.dotx", cAlternateFileName="DEFAUL~2.DOT")) returned 1 [0150.905] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx") returned 1 [0150.905] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\DefaultBlackAndWhite.dotx", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx") returned 0x55 [0150.905] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.905] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.905] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0150.906] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2169, dwReserved0=0x0, dwReserved1=0x0, cFileName="Distinctive.dotx", cAlternateFileName="DISTIN~1.DOT")) returned 1 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\defaultblackandwhite.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx") returned 1 [0150.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Distinctive.dotx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx") returned 0x4c [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.906] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0150.906] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x222a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elegant.dotx", cAlternateFileName="ELEGAN~1.DOT")) returned 1 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\distinctive.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx") returned 1 [0150.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Elegant.dotx", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx") returned 0x48 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.906] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0150.906] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x221b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy.dotx", cAlternateFileName="FANCY~1.DOT")) returned 1 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\elegant.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx") returned 1 [0150.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Fancy.dotx", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx") returned 0x46 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.906] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.906] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0150.906] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x0, dwReserved1=0x0, cFileName="Formal.dotx", cAlternateFileName="FORMAL~1.DOT")) returned 1 [0150.906] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\fancy.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx") returned 1 [0150.906] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Formal.dotx", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx") returned 0x47 [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.907] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0150.907] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e48ef50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x210c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manuscript.dotx", cAlternateFileName="MANUSC~1.DOT")) returned 1 [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\formal.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx") returned 1 [0150.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Manuscript.dotx", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx") returned 0x4b [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.907] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0150.907] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e4b50b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modern.dotx", cAlternateFileName="MODERN~1.DOT")) returned 1 [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\manuscript.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx") returned 1 [0150.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Modern.dotx", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx") returned 0x47 [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.907] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0150.907] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e4db210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x8ce63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.dotx", cAlternateFileName="NEWSPR~1.DOT")) returned 1 [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\modern.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx") returned 1 [0150.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Newsprint.dotx", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx") returned 0x4a [0150.907] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0150.908] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5adf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.dotx", cAlternateFileName="PERSPE~1.DOT")) returned 1 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\newsprint.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx") returned 1 [0150.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Perspective.dotx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx") returned 0x4c [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0150.908] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x20f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple.dotx", cAlternateFileName="SIMPLE~1.DOT")) returned 1 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\perspective.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx") returned 1 [0150.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Simple.dotx", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx") returned 0x47 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0150.908] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2744700, ftCreationTime.dwHighDateTime=0x1ca568e, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2744700, ftLastWriteTime.dwHighDateTime=0x1ca568e, nFileSizeHigh=0x0, nFileSizeLow=0x5d3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.dotx", cAlternateFileName="THATCH~1.DOT")) returned 1 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\simple.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx") returned 1 [0150.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Thatch.dotx", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx") returned 0x47 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0150.908] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc418100, ftCreationTime.dwHighDateTime=0x1c6ea86, ftLastAccessTime.dwLowDateTime=0x1e5274d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc418100, ftLastWriteTime.dwHighDateTime=0x1c6ea86, nFileSizeHigh=0x0, nFileSizeLow=0x21f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Traditional.dotx", cAlternateFileName="TRADIT~1.DOT")) returned 1 [0150.908] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\thatch.dotx", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx") returned 1 [0150.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Traditional.dotx", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\traditional.dotx") returned 0x4c [0150.909] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0150.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0150.909] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0150.909] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0150.909] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x39aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0150.909] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn") returned 1 [0150.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Init.xsn", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn") returned 0x46 [0150.909] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0150.909] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63ed7300, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63ed7300, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x482d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReviewRouting_Review.xsn", cAlternateFileName="REVIEW~2.XSN")) returned 1 [0150.909] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_init.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", len=0x48 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn") returned 1 [0150.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ReviewRouting_Review.xsn", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn") returned 0x48 [0150.909] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.909] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0150.909] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROSE.CSS", cAlternateFileName="")) returned 1 [0150.909] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\reviewrouting_review.xsn", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS") returned 1 [0150.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ROSE.CSS", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\rose.css") returned 0x38 [0150.910] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0150.910] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1d3a600, ftCreationTime.dwHighDateTime=0x1be1dd7, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1d3a600, ftLastWriteTime.dwHighDateTime=0x1be1dd7, nFileSizeHigh=0x0, nFileSizeLow=0xc06d, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPLBRF35.CHM", cAlternateFileName="")) returned 1 [0150.910] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\rose.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM") returned 1 [0150.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\RPLBRF35.CHM", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm") returned 0x3c [0150.910] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0150.910] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50d55500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xbd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.VSL", cAlternateFileName="")) returned 1 [0150.910] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\rplbrf35.chm", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 1 [0150.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl") returned 0x3c [0150.910] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0150.910] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9271b400, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9271b400, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x61204, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.HXS", cAlternateFileName="")) returned 1 [0150.910] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 1 [0150.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs") returned 0x3b [0150.910] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.910] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0150.911] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXC", cAlternateFileName="SETLAN~1.HXC")) returned 1 [0150.911] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 1 [0150.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc") returned 0x3f [0150.911] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.911] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x210c) returned 0x6f14048 [0150.911] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_COL.HXT", cAlternateFileName="SETLAN~1.HXT")) returned 1 [0150.911] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 1 [0150.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt") returned 0x3f [0150.911] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.911] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2110) returned 0x6f14048 [0150.911] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_F_COL.HXK", cAlternateFileName="SETLAN~1.HXK")) returned 1 [0150.911] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 1 [0150.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk") returned 0x41 [0150.911] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.911] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2114) returned 0x6f14048 [0150.911] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a76d900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5a76d900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG_K_COL.HXK", cAlternateFileName="SETLAN~2.HXK")) returned 1 [0150.911] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 1 [0150.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk") returned 0x41 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.912] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2118) returned 0x6f14048 [0150.912] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL", cAlternateFileName="")) returned 1 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 1 [0150.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\sgres.dll") returned 0x39 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.912] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba4cc00, ftCreationTime.dwHighDateTime=0x1cab7e0, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ba4cc00, ftLastWriteTime.dwHighDateTime=0x1cab7e0, nFileSizeHigh=0x0, nFileSizeLow=0x2d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.IDX_DLL", cAlternateFileName="SGRESD~1.IDX")) returned 1 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\sgres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 1 [0150.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll") returned 0x41 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.912] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.VSL", cAlternateFileName="")) returned 1 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 1 [0150.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl") returned 0x3b [0150.912] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.912] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x211c) returned 0x6f14048 [0150.912] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY.CSS", cAlternateFileName="")) returned 1 [0150.912] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS") returned 1 [0150.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SKY.CSS", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\sky.css") returned 0x37 [0150.913] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.913] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2120) returned 0x6f14048 [0150.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2380, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLINTL.DLL", cAlternateFileName="")) returned 1 [0150.913] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\sky.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 1 [0150.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\slintl.dll") returned 0x3a [0150.913] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.VSL", cAlternateFileName="")) returned 1 [0150.913] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\slintl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 1 [0150.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl") returned 0x3c [0150.913] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.913] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2124) returned 0x6f14048 [0150.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x4e5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALCONNECTORRES.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0150.913] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 1 [0150.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll") returned 0x46 [0150.913] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.913] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffe2700, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x50deda80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xffe2700, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x644, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACE.VRD", cAlternateFileName="")) returned 1 [0150.935] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 1 [0150.935] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\space.vrd") returned 0x39 [0150.935] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.935] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.935] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2124) returned 0x6f14048 [0150.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPRING.CSS", cAlternateFileName="")) returned 1 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\space.vrd", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS") returned 1 [0150.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPRING.CSS", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\spring.css") returned 0x3a [0150.936] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2128) returned 0x6f14048 [0150.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e13be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPS.CSS", cAlternateFileName="")) returned 1 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\spring.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", len=0x37 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS") returned 1 [0150.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPS.CSS", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\sps.css") returned 0x37 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x212c) returned 0x6f14048 [0150.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STEEL.CSS", cAlternateFileName="")) returned 1 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\sps.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS") returned 1 [0150.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STEEL.CSS", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\steel.css") returned 0x39 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.936] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.936] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2130) returned 0x6f14048 [0150.936] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33021f00, ftCreationTime.dwHighDateTime=0x1ca6570, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x33021f00, ftLastWriteTime.dwHighDateTime=0x1ca6570, nFileSizeHigh=0x0, nFileSizeLow=0x69d1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.CHM", cAlternateFileName="")) returned 1 [0150.936] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\steel.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM") returned 1 [0150.936] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLIST.CHM", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\stslist.chm") returned 0x3b [0150.937] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0150.937] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0150.937] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2134) returned 0x6f14048 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6069a300, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6069a300, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0x15990, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLISTI.DLL", cAlternateFileName="")) returned 1 [0150.937] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\1033\\stslist.chm", psz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 1 [0150.937] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll") returned 0x3c [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNNY.CSS", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUNSET.CSS", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50e5fea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TERRCOTT.CSS", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50e86000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x44b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.VSL", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50ed22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x5fd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.VSL", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f896e00, ftCreationTime.dwHighDateTime=0x1cab8a9, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f896e00, ftLastWriteTime.dwHighDateTime=0x1cab8a9, nFileSizeHigh=0x0, nFileSizeLow=0xef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookStrings.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x960df00, ftCreationTime.dwHighDateTime=0x1c56bc5, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x960df00, ftLastWriteTime.dwHighDateTime=0x1c56bc5, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="VALVE.VRD", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ceb0900, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ceb0900, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9190, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL", cAlternateFileName="")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b68e400, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7b68e400, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.IDX_DLL", cAlternateFileName="VISBRR~1.IDX")) returned 1 [0150.937] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.VSL", cAlternateFileName="")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xb9378, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL", cAlternateFileName="")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bb60400, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bb60400, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x3a980, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.IDX_DLL", cAlternateFileName="VISINT~1.IDX")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3a6b500, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe3a6b500, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.CSS", cAlternateFileName="")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x588a20, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV.HXS", cAlternateFileName="VISIOD~1.HXS")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXC", cAlternateFileName="VISIOD~1.HXC")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_COL.HXT", cAlternateFileName="VISIOD~1.HXT")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_F_COL.HXK", cAlternateFileName="VISIOD~1.HXK")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62cf1400, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x50fdcc60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x62cf1400, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.DEV_K_COL.HXK", cAlternateFileName="VISIOD~2.HXK")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96053b00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96053b00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x2b532a, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.HXS", cAlternateFileName="")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e34500, ftCreationTime.dwHighDateTime=0x1ca90f4, ftLastAccessTime.dwLowDateTime=0x51002dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4e34500, ftLastWriteTime.dwHighDateTime=0x1ca90f4, nFileSizeHigh=0x0, nFileSizeLow=0xd6cc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET.HXS", cAlternateFileName="VISIOS~1.HXS")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x2a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXC", cAlternateFileName="VISIOS~1.HXC")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51028f20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_COL.HXT", cAlternateFileName="VISIOS~1.HXT")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x51ca82a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_F_COL.HXK", cAlternateFileName="VISIOS~1.HXK")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa53f300, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaa53f300, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.SHAPESHEET_K_COL.HXK", cAlternateFileName="VISIOS~2.HXK")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXC", cAlternateFileName="VISIO_~1.HXC")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_COL.HXT", cAlternateFileName="VISIO_~1.HXT")) returned 1 [0150.938] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_F_COL.HXK", cAlternateFileName="VISIO_~1.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3b8d00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f3b8d00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_K_COL.HXK", cAlternateFileName="VISIO_~2.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe62b3700, ftCreationTime.dwHighDateTime=0x1ca5009, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe62b3700, ftLastWriteTime.dwHighDateTime=0x1ca5009, nFileSizeHigh=0x0, nFileSizeLow=0x22e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM.HXS", cAlternateFileName="VISIO_~1.HXS")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65709000, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x5203a3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x65709000, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXC", cAlternateFileName="VISIO_~2.HXC")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5be72800, ftCreationTime.dwHighDateTime=0x1ca53a7, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5be72800, ftLastWriteTime.dwHighDateTime=0x1ca53a7, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_COL.HXT", cAlternateFileName="VISIO_~2.HXT")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_F_COL.HXK", cAlternateFileName="VISIO_~3.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa724d200, ftCreationTime.dwHighDateTime=0x1ca5059, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa724d200, ftLastWriteTime.dwHighDateTime=0x1ca5059, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_PRM_K_COL.HXK", cAlternateFileName="VISIO_~4.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94d40e00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x94d40e00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x26745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD.HXS", cAlternateFileName="VISIO_~2.HXS")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXC", cAlternateFileName="VISIO_~3.HXC")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_COL.HXT", cAlternateFileName="VISIO_~3.HXT")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_F_COL.HXK", cAlternateFileName="VIB8A9~1.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb770e200, ftCreationTime.dwHighDateTime=0x1c5aeb1, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb770e200, ftLastWriteTime.dwHighDateTime=0x1c5aeb1, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO_STD_K_COL.HXK", cAlternateFileName="VI5545~1.HXK")) returned 1 [0153.527] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52060500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.VSL", cAlternateFileName="")) returned 1 [0153.528] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52086660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.VSL", cAlternateFileName="")) returned 1 [0153.528] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vsdir", cAlternateFileName="")) returned 1 [0153.528] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0153.528] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50f6a840, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.528] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b19600, ftCreationTime.dwHighDateTime=0x1c304b9, ftLastAccessTime.dwLowDateTime=0x50f6a840, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x58b19600, ftLastWriteTime.dwHighDateTime=0x1c304b9, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visfilem.vsdir", cAlternateFileName="VISFIL~1.VSD")) returned 1 [0153.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x504da6a0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0153.529] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0153.529] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\_restore files_.txt"), bFailIfExists=0) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.539] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xa3380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDALLLNK.VRD", cAlternateFileName="")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd43d9b00, ftCreationTime.dwHighDateTime=0x1c2a020, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd43d9b00, ftLastWriteTime.dwHighDateTime=0x1c2a020, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDCMPVRD.XML", cAlternateFileName="")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15f40800, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x520ac7c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x15f40800, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x722, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDERRLNK.VRD", cAlternateFileName="")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900f5a00, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x900f5a00, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x4b425a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV.HXS", cAlternateFileName="WINPRO~1.HXS")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXC", cAlternateFileName="WINPRO~1.HXC")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_COL.HXT", cAlternateFileName="WINPRO~1.HXT")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_F_COL.HXK", cAlternateFileName="WINPRO~1.HXK")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711d3000, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5c3fc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x711d3000, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.DEV_K_COL.HXK", cAlternateFileName="WINPRO~2.HXK")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91408700, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91408700, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x168406, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.HXS", cAlternateFileName="")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXC", cAlternateFileName="WINPRO~2.HXC")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_COL.HXT", cAlternateFileName="WINPRO~2.HXT")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_F_COL.HXK", cAlternateFileName="WINPRO~3.HXK")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d89a900, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xaf5ea120, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6d89a900, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ_K_COL.HXK", cAlternateFileName="WINPRO~4.HXK")) returned 1 [0153.539] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17253500, ftCreationTime.dwHighDateTime=0x1c55531, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17253500, ftLastWriteTime.dwHighDateTime=0x1c55531, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINSCHD.VRD", cAlternateFileName="")) returned 1 [0153.540] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97366800, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97366800, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x718092, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV.HXS", cAlternateFileName="WINWOR~1.HXS")) returned 1 [0153.540] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x28b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXC", cAlternateFileName="WINWOR~1.HXC")) returned 1 [0153.540] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_COL.HXT", cAlternateFileName="WINWOR~1.HXT")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_F_COL.HXK", cAlternateFileName="WINWOR~1.HXK")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3a1f00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5998f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3a1f00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.DEV_K_COL.HXK", cAlternateFileName="WINWOR~2.HXK")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe02ac500, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0x1e5bfa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe02ac500, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x4ff5e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.HXS", cAlternateFileName="")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c67200, ftCreationTime.dwHighDateTime=0x1c9ff32, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c67200, ftLastWriteTime.dwHighDateTime=0x1c9ff32, nFileSizeHigh=0x0, nFileSizeLow=0x277, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXC", cAlternateFileName="WINWOR~2.HXC")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_COL.HXT", cAlternateFileName="WINWOR~2.HXT")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_F_COL.HXK", cAlternateFileName="WINWOR~3.HXK")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79756b00, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79756b00, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD_K_COL.HXK", cAlternateFileName="WINWOR~4.HXK")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x521b7160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa560, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.VSL", cAlternateFileName="")) returned 1 [0153.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x225ee90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8a5d00, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2212bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8a5d00, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x1a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.IDX_DLL", cAlternateFileName="WWINTL~1.IDX")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea593000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x2284ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea593000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0x96180, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.IDX_DLL", cAlternateFileName="WWINTL~2.IDX")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57a100, ftCreationTime.dwHighDateTime=0x1cac466, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4c57a100, ftLastWriteTime.dwHighDateTime=0x1cac466, nFileSizeHigh=0x0, nFileSizeLow=0x4188, dwReserved0=0x0, dwReserved1=0x0, cFileName="wxpr.dll", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fff8a00, ftCreationTime.dwHighDateTime=0x1bdff9a, ftLastAccessTime.dwLowDateTime=0x1548bc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fff8a00, ftLastWriteTime.dwHighDateTime=0x1bdff9a, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WZCNFLCT.CHM", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="XFUNC.VSL", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x3283, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Complete.xsn", cAlternateFileName="XLATE_~1.XSN")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xlate_Init.xsn", cAlternateFileName="XLATE_~2.XSN")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dd9100, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x44dd9100, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x240d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427b3700, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ebbe70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x427b3700, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x18380, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.IDX_DLL", cAlternateFileName="XLINTL~1.IDX")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x414a0a00, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x414a0a00, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x5db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.IDX_DLL", cAlternateFileName="XLINTL~2.IDX")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0xf5ee1fd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLLEX.DLL", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae096500, ftCreationTime.dwHighDateTime=0x1c30d4d, ftLastAccessTime.dwLowDateTime=0xfa6bd7f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xae096500, ftLastWriteTime.dwHighDateTime=0x1c30d4d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLMACRO.CHM", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc255d100, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa6e3950, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc255d100, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.IDX_DLL", cAlternateFileName="XLSLIC~1.IDX")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf94f400, ftCreationTime.dwHighDateTime=0x1c556ae, ftLastAccessTime.dwLowDateTime=0x112efdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf94f400, ftLastWriteTime.dwHighDateTime=0x1c556ae, nFileSizeHigh=0x0, nFileSizeLow=0x349922, dwReserved0=0x0, dwReserved1=0x0, cFileName="XMLSDK5.CHM", cAlternateFileName="")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d986c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x84d986c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0153.543] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.543] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.601] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0153.601] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0153.654] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.654] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0153.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x779e270, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0153.655] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.655] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\_restore files_.txt"), bFailIfExists=0) returned 1 [0153.658] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.658] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.658] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0153.658] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0153.664] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.664] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0153.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a4f390, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0153.664] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.664] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\_restore files_.txt"), bFailIfExists=0) returned 1 [0153.668] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.668] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.668] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0153.668] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0153.669] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0153.669] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0153.669] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0153.709] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.709] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0153.709] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x50e7acd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0153.709] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0153.709] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\_restore files_.txt"), bFailIfExists=0) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL", cAlternateFileName="")) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0153.742] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0153.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0153.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0154.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.530] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0154.530] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 1 [0154.530] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu") returned 0x41 [0154.530] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.530] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51174850, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0154.531] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0154.531] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\_restore files_.txt"), bFailIfExists=0) returned 1 [0154.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0154.541] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea37bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZLIB.ACCDE", cAlternateFileName="ACWZLI~1.ACC")) returned 1 [0154.541] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE") returned 1 [0154.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde") returned 0x3f [0154.541] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.541] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0154.541] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x8f8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZMAIN.ACCDE", cAlternateFileName="ACWZMA~1.ACC")) returned 1 [0154.541] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE") returned 1 [0154.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde") returned 0x40 [0154.541] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.541] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0154.541] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5eaa9fd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xb39000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZTOOL.ACCDE", cAlternateFileName="ACWZTO~1.ACC")) returned 1 [0154.541] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE") returned 1 [0154.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde") returned 0x40 [0154.541] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.541] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0154.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x348000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZUSR12.ACCDU", cAlternateFileName="ACWZUS~1.ACC")) returned 1 [0154.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 1 [0154.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu") returned 0x41 [0154.542] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.542] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0154.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4106500, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4106500, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0xbf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTILITY.ACCDA", cAlternateFileName="UTILIT~1.ACC")) returned 1 [0154.542] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA") returned 1 [0154.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\UTILITY.ACCDA", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz\\utility.accda") returned 0x3f [0154.542] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0154.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.542] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0154.542] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0154.542] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0154.542] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0154.542] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\accvdt.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 1 [0154.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\accwiz.dll") returned 0x35 [0154.542] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0154.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.542] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0154.543] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\accwiz.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 1 [0154.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\acedao.dll") returned 0x35 [0154.543] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0154.543] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0154.543] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0154.543] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", len=0x32 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned 1 [0154.543] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\") returned 0x32 [0154.543] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0154.543] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0154.543] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0155.039] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.039] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0155.039] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 1 [0155.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\accolk.dll") returned 0x3c [0155.039] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.039] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0155.039] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\accolk.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 1 [0155.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll") returned 0x3e [0155.039] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.039] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0155.039] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 1 [0155.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll") returned 0x45 [0155.039] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.040] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.040] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0155.040] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 1 [0155.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf") returned 0x3c [0155.040] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.040] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.040] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0xfff68b70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0155.040] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.040] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0155.736] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0155.736] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 1 [0155.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\msosec.dll") returned 0x3c [0155.736] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.736] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.736] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0155.736] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\msosec.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned 1 [0155.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\msosec.xml") returned 0x3c [0155.736] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.736] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.736] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0155.736] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0155.736] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\msosec.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 1 [0155.736] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf") returned 0x3b [0155.737] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0155.737] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0155.737] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", len=0x42 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 1 [0155.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll") returned 0x42 [0155.737] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.737] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0155.737] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 1 [0155.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\outex.ecf") returned 0x3b [0155.737] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0155.737] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0155.737] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\outex.ecf", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 1 [0155.737] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf") returned 0x3c [0155.737] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.737] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.737] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0155.737] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0155.738] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 1 [0155.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll") returned 0x3d [0155.738] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.738] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0155.738] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 1 [0155.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf") returned 0x3e [0155.738] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.738] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0155.738] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0155.738] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 1 [0155.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll") returned 0x44 [0155.738] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.738] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.738] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.738] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.738] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0155.738] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\acedao.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned 1 [0155.738] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\advcmp.dic") returned 0x35 [0155.739] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.739] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.739] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0ede4 | out: lpFindFileData=0x6a0ede4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ed9c, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9630 [0155.739] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.739] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.741] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0155.741] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0155.741] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\advcmp.dic", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned 1 [0155.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\advtel.dic") returned 0x35 [0155.741] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.741] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.742] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0155.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\advtel.dic", psz="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned 1 [0155.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\advzip.dic") returned 0x35 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.742] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.742] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0155.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\advzip.dic", psz="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 1 [0155.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\aec.dll") returned 0x32 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.742] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\aec.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 1 [0155.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\aecutils.dll") returned 0x37 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.742] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.742] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0155.742] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\aecutils.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 1 [0155.742] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\asciieng.lng") returned 0x37 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.743] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0155.743] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\asciieng.lng", psz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 1 [0155.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\audiosearchlts.dll") returned 0x3d [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.743] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\audiosearchlts.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 1 [0155.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\audiosearchmain.dll") returned 0x3e [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.743] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\audiosearchmain.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 1 [0155.743] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll") returned 0x40 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.743] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.743] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0155.743] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 1 [0155.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\authzax.dll") returned 0x36 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.744] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.744] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\authzax.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", len=0x39 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 1 [0155.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsautogen.dll") returned 0x39 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.744] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.744] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsautogen.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 1 [0155.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll") returned 0x3c [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.744] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.744] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 1 [0155.744] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man") returned 0x40 [0155.744] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.744] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.744] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0155.744] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 1 [0155.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsevents.man") returned 0x38 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.745] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.745] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0155.745] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsevents.man", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 1 [0155.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcslaunch.dll") returned 0x38 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.745] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.745] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcslaunch.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 1 [0155.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsproxy.dll") returned 0x37 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.745] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.745] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsproxy.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", len=0x39 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 1 [0155.745] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsruntime.dll") returned 0x39 [0155.745] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.745] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.745] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsruntime.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 1 [0155.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll") returned 0x3b [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.746] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 1 [0155.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcsstr32.dll") returned 0x37 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.746] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcsstr32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 1 [0155.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\bcssync.exe") returned 0x36 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.746] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bcssync.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned 1 [0155.746] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd") returned 0x3a [0155.746] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.746] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0155.747] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0155.747] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned 1 [0155.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd") returned 0x42 [0155.747] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.747] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.747] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0155.747] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0155.747] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", len=0x38 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned 1 [0155.747] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\") returned 0x38 [0155.747] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0155.747] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0155.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0155.799] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.799] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0155.799] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned 1 [0155.799] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl") returned 0x49 [0155.799] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.799] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51422110, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0155.799] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.799] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.801] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0155.801] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0155.801] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned 1 [0155.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl") returned 0x46 [0155.802] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.802] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.802] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0155.802] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0155.802] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", len=0x3d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned 1 [0155.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\") returned 0x3d [0155.802] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0155.802] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0155.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0155.802] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.802] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0155.802] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned 1 [0155.802] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl") returned 0x47 [0155.802] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.803] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51767f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0155.803] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0155.803] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.805] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0155.805] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0155.805] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned 1 [0155.805] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl") returned 0x44 [0155.805] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.805] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.805] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0155.805] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0155.805] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned 1 [0155.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl") returned 0x46 [0155.806] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.806] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0155.806] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0155.806] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL") returned 1 [0155.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl") returned 0x45 [0155.806] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.806] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0155.806] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.806] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.806] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0155.806] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned 1 [0155.806] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\") returned 0x3e [0155.806] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0155.806] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0155.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0155.845] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.845] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0155.845] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned 1 [0155.845] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl") returned 0x45 [0155.845] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.845] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51422110, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0155.845] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0155.845] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.847] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0155.847] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24a63000, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24a63000, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x5282c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL") returned 1 [0155.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl") returned 0x49 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.848] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0155.848] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25ddce00, ftCreationTime.dwHighDateTime=0x1c93006, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25ddce00, ftLastWriteTime.dwHighDateTime=0x1c93006, nFileSizeHigh=0x0, nFileSizeLow=0x40188, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL") returned 1 [0155.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl") returned 0x44 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.848] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0155.848] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe44d2300, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe44d2300, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3cd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL") returned 1 [0155.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl") returned 0x4a [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.848] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.848] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0155.848] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x828cb900, ftCreationTime.dwHighDateTime=0x1c93005, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x828cb900, ftLastWriteTime.dwHighDateTime=0x1c93005, nFileSizeHigh=0x0, nFileSizeLow=0x3b9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0155.848] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL") returned 1 [0155.848] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl") returned 0x4b [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.849] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.849] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0155.849] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbd7dc00, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbd7dc00, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x4033d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL") returned 1 [0155.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl") returned 0x48 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.849] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.849] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0155.849] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a982900, ftCreationTime.dwHighDateTime=0x1c93004, ftLastAccessTime.dwLowDateTime=0x56263450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a982900, ftLastWriteTime.dwHighDateTime=0x1c93004, nFileSizeHigh=0x0, nFileSizeLow=0x3ee6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL") returned 1 [0155.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl") returned 0x50 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.849] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.849] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0155.849] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2f9800, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e2f9800, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x49051, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLA.XSL", cAlternateFileName="")) returned 1 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL") returned 1 [0155.849] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl") returned 0x45 [0155.849] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.849] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.849] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0155.850] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb63100, ftCreationTime.dwHighDateTime=0x1c6da3c, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2fb63100, ftLastWriteTime.dwHighDateTime=0x1c6da3c, nFileSizeHigh=0x0, nFileSizeLow=0x3bd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0155.850] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL") returned 1 [0155.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl") returned 0x48 [0155.850] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.850] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.850] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0155.850] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3556a600, ftCreationTime.dwHighDateTime=0x1ca5c5f, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3556a600, ftLastWriteTime.dwHighDateTime=0x1ca5c5f, nFileSizeHigh=0x0, nFileSizeLow=0x52a0d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0155.850] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL") returned 1 [0155.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl") returned 0x4a [0155.850] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0155.850] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.850] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0155.850] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.850] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.850] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.850] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.850] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0155.850] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned 1 [0155.850] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\") returned 0x33 [0155.851] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0155.851] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0155.851] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0155.892] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.892] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0155.892] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 1 [0155.892] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr") returned 0x3d [0155.892] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.892] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x58b4ce70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0155.892] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0155.892] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\_restore files_.txt"), bFailIfExists=0) returned 1 [0155.895] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0155.895] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0155.895] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 1 [0155.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr") returned 0x3e [0155.895] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.895] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0155.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0155.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 1 [0155.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr") returned 0x3e [0155.896] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0155.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0155.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 1 [0155.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr") returned 0x3e [0155.896] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0155.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0155.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 1 [0155.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr") returned 0x3e [0155.896] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0155.896] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0155.896] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 1 [0155.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr") returned 0x3e [0155.897] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0155.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0155.897] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 1 [0155.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr") returned 0x3e [0155.897] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0155.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0155.897] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 1 [0155.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr") returned 0x3d [0155.897] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0155.897] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0155.897] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 1 [0155.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr") returned 0x3d [0155.897] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0155.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0155.898] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 1 [0155.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr") returned 0x3d [0155.898] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0155.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0155.898] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 1 [0155.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr") returned 0x3d [0155.898] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0155.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0155.898] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 1 [0155.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr") returned 0x3d [0155.898] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0155.898] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0155.898] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 1 [0155.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr") returned 0x3d [0155.899] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0155.899] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0155.899] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 1 [0155.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr") returned 0x3d [0155.899] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0155.899] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0155.899] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 1 [0155.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr") returned 0x3d [0155.899] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0155.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0155.899] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0155.899] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0155.899] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0155.899] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 1 [0155.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\brtview.dll") returned 0x36 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.900] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\brtview.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 1 [0155.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\bstorm.dll") returned 0x35 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.900] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\bstorm.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 1 [0155.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\cdlmso.dll") returned 0x35 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.900] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\cdlmso.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 1 [0155.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\cgmimp32.hlp") returned 0x37 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0155.900] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0155.900] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\cgmimp32.hlp", psz="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 1 [0155.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\charsettable.chr") returned 0x3b [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2228) returned 0x6f14048 [0155.901] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\charsettable.chr", psz="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 1 [0155.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\clview.exe") returned 0x35 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.901] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\clview.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 1 [0155.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\cmax20.dll") returned 0x35 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.901] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\cmax20.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 1 [0155.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\cnfnot32.exe") returned 0x37 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.901] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\cnfnot32.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 1 [0155.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\codeedit.dll") returned 0x37 [0155.901] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.902] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0155.902] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\codeedit.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 1 [0155.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\contab32.dll") returned 0x37 [0155.902] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.902] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0155.902] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\contab32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 1 [0155.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\contactpicker.dll") returned 0x3c [0155.902] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0155.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0155.902] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0155.902] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned 1 [0155.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\") returned 0x33 [0155.902] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0155.902] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0155.902] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0160.790] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.790] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0160.790] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", len=0x38 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned 1 [0160.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\") returned 0x38 [0160.790] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0160.790] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0160.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0162.974] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.974] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3R.SAM", cAlternateFileName="")) returned 1 [0162.974] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 1 [0162.975] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam") returned 0x41 [0162.975] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0162.975] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0162.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xbe7ef0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0162.975] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0162.975] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0166.185] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0166.185] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMR.FAE", cAlternateFileName="")) returned 1 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 1 [0166.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae") returned 0x42 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0166.186] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x9180, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOCALDV.DLL", cAlternateFileName="")) returned 1 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL") returned 1 [0166.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\LOCALDV.DLL", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll") returned 0x43 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.186] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBCR.SAM", cAlternateFileName="")) returned 1 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\localdv.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 1 [0166.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam") returned 0x41 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.186] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.186] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0166.186] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x35b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADDR.FAE", cAlternateFileName="")) returned 1 [0166.186] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 1 [0166.186] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae") returned 0x42 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.187] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0166.187] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0xf79ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPTR.FAE", cAlternateFileName="")) returned 1 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 1 [0166.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae") returned 0x43 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.187] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0166.187] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x1332250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNLR.FAE", cAlternateFileName="")) returned 1 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 1 [0166.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae") returned 0x43 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.187] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0166.187] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x27b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAILR.FAE", cAlternateFileName="")) returned 1 [0166.187] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 1 [0166.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae") returned 0x43 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0166.188] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x25b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTER.FAE", cAlternateFileName="")) returned 1 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 1 [0166.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae") returned 0x43 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0166.188] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLR.SAM", cAlternateFileName="")) returned 1 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 1 [0166.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam") returned 0x3f [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0166.188] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASKR.FAE", cAlternateFileName="")) returned 1 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 1 [0166.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae") returned 0x43 [0166.188] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0166.189] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x31a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97R.SAM", cAlternateFileName="")) returned 1 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 1 [0166.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam") returned 0x42 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0166.189] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x2b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PABR.SAM", cAlternateFileName="")) returned 1 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 1 [0166.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam") returned 0x40 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0166.189] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x3590, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMRR.DLL", cAlternateFileName="")) returned 1 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 1 [0166.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll") returned 0x44 [0166.189] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.189] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0166.189] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0166.190] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 1 [0166.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\act3.sam") returned 0x3b [0166.190] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.190] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0166.190] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0166.190] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\_restore files_.txt"), bFailIfExists=0) returned 1 [0166.193] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0166.193] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0166.193] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\act3.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 1 [0166.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae") returned 0x3f [0166.193] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.193] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.193] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0166.193] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0166.193] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 1 [0166.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae") returned 0x3f [0166.193] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.193] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.193] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0166.193] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0166.193] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 1 [0166.193] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\desksam.sam") returned 0x3e [0166.193] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.193] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.193] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0166.193] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0166.194] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\desksam.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 1 [0166.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\odbc.sam") returned 0x3b [0166.194] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.194] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0166.194] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0166.194] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\odbc.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 1 [0166.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\ol.sam") returned 0x39 [0166.194] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.194] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0166.194] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0166.194] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\ol.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 1 [0166.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\oladd.fae") returned 0x3c [0166.194] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.194] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0166.194] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0166.194] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\oladd.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 1 [0166.194] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\olappt.fae") returned 0x3d [0166.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0166.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0166.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\olappt.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 1 [0166.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae") returned 0x3d [0166.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0166.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0166.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 1 [0166.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\olmail.fae") returned 0x3d [0166.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0166.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0166.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\olmail.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 1 [0166.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\olnote.fae") returned 0x3d [0166.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0166.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0166.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\olnote.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 1 [0166.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\oltask.fae") returned 0x3d [0166.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0166.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0166.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\oltask.fae", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 1 [0166.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\org97.sam") returned 0x3c [0166.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0166.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0166.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\org97.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 1 [0166.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\pab.sam") returned 0x3a [0166.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0166.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x18568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RM.DLL", cAlternateFileName="")) returned 1 [0166.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\pab.sam", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 1 [0166.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\rm.dll") returned 0x39 [0166.197] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.197] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 1 [0166.197] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\convert\\rm.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 1 [0166.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll") returned 0x3f [0166.197] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0166.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.197] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0166.197] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0166.197] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0166.197] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\contactpicker.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 1 [0166.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\css7data0009.dll") returned 0x3b [0166.197] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.197] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0166.197] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\css7data0009.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 1 [0166.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\css7data000a.dll") returned 0x3b [0166.197] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.198] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\css7data000a.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 1 [0166.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\css7data000c.dll") returned 0x3b [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.198] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\css7data000c.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 1 [0166.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\custom.propdesc") returned 0x3a [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0166.198] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\custom.propdesc", psz="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 1 [0166.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\datagath.dll") returned 0x37 [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.198] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0166.198] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\datagath.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 1 [0166.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\dbengr.dll") returned 0x35 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.199] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dbengr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 1 [0166.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\dbghelp.dll") returned 0x36 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.199] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dbghelp.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 1 [0166.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\dbshare.dll") returned 0x36 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.199] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dbshare.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 1 [0166.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\dbwiz.dll") returned 0x34 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.199] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0166.199] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dbwiz.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 1 [0166.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\dgrmlnch.dll") returned 0x37 [0166.200] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.200] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.200] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0166.200] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dgrmlnch.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL") returned 1 [0166.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DLGSETP.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\dlgsetp.dll") returned 0x36 [0166.200] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.200] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.200] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0166.200] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", len=0x3a | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned 1 [0166.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\document parts\\") returned 0x3a [0166.200] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0166.200] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0166.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0166.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0166.208] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\") returned 1 [0166.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\document parts\\1033\\") returned 0x3f [0166.208] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0166.208] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0166.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0166.209] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.209] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1 [0166.209] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", len=0x42 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\") returned 1 [0166.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\") returned 0x42 [0166.209] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0166.209] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0166.209] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0166.209] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.209] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3845b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0166.209] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", len=0x5f | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 1 [0166.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx") returned 0x5f [0166.209] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0166.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x1e3382f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0166.210] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0166.210] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\_restore files_.txt"), bFailIfExists=0) returned 1 [0166.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0166.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0166.212] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.212] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0166.212] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0166.212] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0166.212] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0166.212] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0166.212] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dlgsetp.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL") returned 1 [0166.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\drilldwn.dll") returned 0x37 [0166.212] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.213] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\drilldwn.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL") returned 1 [0166.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DWGCNV.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\dwgcnv.dll") returned 0x35 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.213] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dwgcnv.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL") returned 1 [0166.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\dwgdp.dll") returned 0x34 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.213] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\dwgdp.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE") returned 1 [0166.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EDITOR.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\editor.exe") returned 0x35 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.213] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\editor.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL") returned 1 [0166.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EDITORS.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\editors.dll") returned 0x36 [0166.213] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.213] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\editors.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL") returned 1 [0166.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ELEMENTS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\elements.dll") returned 0x37 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.214] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\elements.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL") returned 1 [0166.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ELEMUTIL.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\elemutil.dll") returned 0x37 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.214] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\elemutil.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL") returned 1 [0166.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EMABLT32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\emablt32.dll") returned 0x37 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.214] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\emablt32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL") returned 1 [0166.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\emsmdb32.dll") returned 0x37 [0166.214] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.215] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\emsmdb32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 1 [0166.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\engdic.dat") returned 0x35 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0166.215] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\engdic.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 1 [0166.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\engidx.dat") returned 0x35 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0166.215] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\engidx.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 1 [0166.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\english.lng") returned 0x36 [0166.215] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0166.215] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\english.lng", psz="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 1 [0166.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\entitydatahandler.dll") returned 0x40 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.216] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\entitydatahandler.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 1 [0166.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\entitypicker.dll") returned 0x3b [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.216] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\entitypicker.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 1 [0166.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\envelope.dll") returned 0x37 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.216] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\envelope.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 1 [0166.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\erximp.add") returned 0x35 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.216] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.216] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0166.216] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0166.216] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\erximp.add", psz="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 1 [0166.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\excel.exe") returned 0x34 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.217] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\excel.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 1 [0166.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\excel.exe.manifest") returned 0x3d [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.217] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\excel.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 1 [0166.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\excelcnv.exe") returned 0x37 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.217] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\excelcnv.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 1 [0166.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll") returned 0x3a [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.217] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.217] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0166.217] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 1 [0166.217] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\exlirm.xml") returned 0x35 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0166.218] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\exlirm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 1 [0166.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\exlirmv.xml") returned 0x36 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0166.218] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\exlirmv.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 1 [0166.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\exsec32.dll") returned 0x36 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.218] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\exsec32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 1 [0166.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\extract.dll") returned 0x36 [0166.218] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.218] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.219] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\extract.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 1 [0166.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\facility.dll") returned 0x37 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.219] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\facility.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 1 [0166.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\form.dll") returned 0x33 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0166.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.219] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\") returned 1 [0166.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\") returned 0x31 [0166.219] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0166.219] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0166.219] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0166.220] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.220] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0166.220] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\") returned 1 [0166.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\") returned 0x36 [0166.220] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0166.220] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0166.220] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0166.222] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.222] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75974300, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75974300, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITL.ICO", cAlternateFileName="")) returned 1 [0166.222] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 1 [0166.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico") returned 0x42 [0166.222] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xccc730, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0166.223] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0166.223] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0166.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0166.226] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITS.ICO", cAlternateFileName="")) returned 1 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 1 [0166.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico") returned 0x42 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0166.226] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIVITY.CFG", cAlternateFileName="")) returned 1 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 1 [0166.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg") returned 0x42 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0166.226] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xcf2890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPT.CFG", cAlternateFileName="")) returned 1 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 1 [0166.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg") returned 0x3e [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0166.226] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTL.ICO", cAlternateFileName="")) returned 1 [0166.226] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 1 [0166.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico") returned 0x3f [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0166.227] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPTS.ICO", cAlternateFileName="")) returned 1 [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 1 [0166.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico") returned 0x3f [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0166.227] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.CFG", cAlternateFileName="")) returned 1 [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 1 [0166.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg") returned 0x40 [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0166.227] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec8ed400, ftCreationTime.dwHighDateTime=0x1c68837, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec8ed400, ftLastWriteTime.dwHighDateTime=0x1c68837, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT.ICO", cAlternateFileName="")) returned 1 [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 1 [0166.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico") returned 0x40 [0166.227] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0166.228] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd189f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFRES.CFG", cAlternateFileName="")) returned 1 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 1 [0166.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg") returned 0x40 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0166.228] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONFLICT.ICO", cAlternateFileName="")) returned 1 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 1 [0166.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico") returned 0x42 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0166.228] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44dc4200, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44dc4200, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.CFG", cAlternateFileName="")) returned 1 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 1 [0166.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg") returned 0x41 [0166.228] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2228) returned 0x6f14048 [0166.229] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTL.ICO", cAlternateFileName="")) returned 1 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 1 [0166.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico") returned 0x42 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x222c) returned 0x6f14048 [0166.229] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xd3eb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTS.ICO", cAlternateFileName="")) returned 1 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 1 [0166.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico") returned 0x42 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2230) returned 0x6f14048 [0166.229] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLIST.CFG", cAlternateFileName="")) returned 1 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 1 [0166.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg") returned 0x42 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2234) returned 0x6f14048 [0166.229] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTL.ICO", cAlternateFileName="")) returned 1 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 1 [0166.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico") returned 0x42 [0166.229] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2238) returned 0x6f14048 [0166.230] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DISTLSTS.ICO", cAlternateFileName="")) returned 1 [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 1 [0166.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico") returned 0x42 [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x223c) returned 0x6f14048 [0166.230] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOC.CFG", cAlternateFileName="")) returned 1 [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", len=0x3d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 1 [0166.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg") returned 0x3d [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2240) returned 0x6f14048 [0166.230] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCL.ICO", cAlternateFileName="")) returned 1 [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 1 [0166.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico") returned 0x3e [0166.230] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2244) returned 0x6f14048 [0166.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOCS.ICO", cAlternateFileName="")) returned 1 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 1 [0166.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico") returned 0x3e [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2248) returned 0x6f14048 [0166.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x473e9c00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x473e9c00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x346, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEM.CFG", cAlternateFileName="")) returned 1 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 1 [0166.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg") returned 0x40 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x224c) returned 0x6f14048 [0166.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEML.ICO", cAlternateFileName="")) returned 1 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 1 [0166.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico") returned 0x41 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2250) returned 0x6f14048 [0166.231] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXITEMS.ICO", cAlternateFileName="")) returned 1 [0166.231] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 1 [0166.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico") returned 0x41 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2254) returned 0x6f14048 [0166.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb999900, ftCreationTime.dwHighDateTime=0x1c451be, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb999900, ftLastWriteTime.dwHighDateTime=0x1c451be, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMAIL.CFG", cAlternateFileName="")) returned 1 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 1 [0166.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg") returned 0x42 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2258) returned 0x6f14048 [0166.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d0fd900, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d0fd900, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOML.ICO", cAlternateFileName="")) returned 1 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 1 [0166.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico") returned 0x40 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x225c) returned 0x6f14048 [0166.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1839500, ftCreationTime.dwHighDateTime=0x1c6bc1a, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1839500, ftLastWriteTime.dwHighDateTime=0x1c6bc1a, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOMS.ICO", cAlternateFileName="")) returned 1 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 1 [0166.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico") returned 0x40 [0166.232] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2260) returned 0x6f14048 [0166.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPM.CFG", cAlternateFileName="")) returned 1 [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", len=0x3d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 1 [0166.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg") returned 0x3d [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2264) returned 0x6f14048 [0166.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPML.ICO", cAlternateFileName="")) returned 1 [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 1 [0166.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico") returned 0x3e [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2268) returned 0x6f14048 [0166.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPMS.ICO", cAlternateFileName="")) returned 1 [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 1 [0166.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico") returned 0x3e [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x226c) returned 0x6f14048 [0166.233] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97071d00, ftCreationTime.dwHighDateTime=0x1c67f43, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97071d00, ftLastWriteTime.dwHighDateTime=0x1c67f43, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSL.ICO", cAlternateFileName="")) returned 1 [0166.233] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 1 [0166.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico") returned 0x3e [0166.234] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2270) returned 0x6f14048 [0166.234] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7feec00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0xf2dd30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7feec00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMSS.ICO", cAlternateFileName="")) returned 1 [0166.234] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 1 [0166.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico") returned 0x3e [0166.234] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0166.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0166.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2274) returned 0x6f14048 [0166.234] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTE.CFG", cAlternateFileName="")) returned 1 [0167.061] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 1 [0167.061] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg") returned 0x3e [0167.061] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0167.061] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.005] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0170.005] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEL.ICO", cAlternateFileName="")) returned 1 [0170.005] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 1 [0170.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico") returned 0x3f [0170.005] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.005] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0170.006] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTES.ICO", cAlternateFileName="")) returned 1 [0170.006] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 1 [0170.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico") returned 0x3f [0170.006] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.006] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0170.006] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x142d2200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x137e510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x142d2200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMMS.CFG", cAlternateFileName="")) returned 1 [0170.006] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 1 [0170.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg") returned 0x40 [0170.006] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.006] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0170.006] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x273ff200, ftCreationTime.dwHighDateTime=0x1c9d96b, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x273ff200, ftLastWriteTime.dwHighDateTime=0x1c9d96b, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSSMS.CFG", cAlternateFileName="")) returned 1 [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 1 [0170.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg") returned 0x40 [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.119] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0170.119] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFL.ICO", cAlternateFileName="")) returned 1 [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 1 [0170.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico") returned 0x3e [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.119] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0170.119] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFS.ICO", cAlternateFileName="")) returned 1 [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 1 [0170.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico") returned 0x3e [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.119] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.119] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0170.119] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4466a600, ftCreationTime.dwHighDateTime=0x1c9449a, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4466a600, ftLastWriteTime.dwHighDateTime=0x1c9449a, nFileSizeHigh=0x0, nFileSizeLow=0x33c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OOFTMPL.CFG", cAlternateFileName="")) returned 1 [0170.119] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 1 [0170.119] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg") returned 0x41 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.120] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0170.120] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fb15d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST.CFG", cAlternateFileName="")) returned 1 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 1 [0170.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg") returned 0x3e [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.120] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0170.120] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c035000, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c035000, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x309, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTIT.CFG", cAlternateFileName="")) returned 1 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 1 [0170.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg") returned 0x40 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.120] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0170.120] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITL.ICO", cAlternateFileName="")) returned 1 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 1 [0170.120] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico") returned 0x41 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.120] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.120] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0170.120] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTITS.ICO", cAlternateFileName="")) returned 1 [0170.120] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 1 [0170.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico") returned 0x41 [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.121] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0170.121] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTL.ICO", cAlternateFileName="")) returned 1 [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 1 [0170.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico") returned 0x3f [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.121] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0170.121] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTS.ICO", cAlternateFileName="")) returned 1 [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 1 [0170.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico") returned 0x3f [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.121] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0170.121] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="RCLRPT.CFG", cAlternateFileName="")) returned 1 [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 1 [0170.121] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg") returned 0x40 [0170.121] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.121] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.121] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0170.122] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x651, dwReserved0=0x0, dwReserved1=0x0, cFileName="REC.CFG", cAlternateFileName="")) returned 1 [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", len=0x3d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 1 [0170.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg") returned 0x3d [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.122] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0170.122] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECL.ICO", cAlternateFileName="")) returned 1 [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 1 [0170.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico") returned 0x3e [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.122] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0170.122] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECS.ICO", cAlternateFileName="")) returned 1 [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 1 [0170.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico") returned 0x3e [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.122] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.122] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0170.122] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1fd7730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTE.CFG", cAlternateFileName="")) returned 1 [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 1 [0170.122] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg") returned 0x40 [0170.122] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.123] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0170.123] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTEL.ICO", cAlternateFileName="")) returned 1 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 1 [0170.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico") returned 0x41 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.123] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0170.123] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMOTES.ICO", cAlternateFileName="")) returned 1 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 1 [0170.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico") returned 0x41 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.123] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0170.123] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPLTMPL.CFG", cAlternateFileName="")) returned 1 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 1 [0170.123] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg") returned 0x42 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.123] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.123] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0170.123] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d347d00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d347d00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.CFG", cAlternateFileName="")) returned 1 [0170.123] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 1 [0170.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg") returned 0x40 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.124] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0170.124] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTL.ICO", cAlternateFileName="")) returned 1 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 1 [0170.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico") returned 0x41 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.124] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0170.124] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORTS.ICO", cAlternateFileName="")) returned 1 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 1 [0170.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico") returned 0x41 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.124] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.124] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0170.124] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x30b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESEND.CFG", cAlternateFileName="")) returned 1 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 1 [0170.124] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg") returned 0x40 [0170.124] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.124] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0170.125] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x1ffd890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDL.ICO", cAlternateFileName="")) returned 1 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 1 [0170.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico") returned 0x41 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.125] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0170.125] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESENDS.ICO", cAlternateFileName="")) returned 1 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 1 [0170.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico") returned 0x41 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.125] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0170.125] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x216f7400, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x216f7400, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEM.CFG", cAlternateFileName="")) returned 1 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 1 [0170.125] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg") returned 0x41 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.125] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.125] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2214) returned 0x6f14048 [0170.125] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ecff500, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ecff500, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEML.ICO", cAlternateFileName="")) returned 1 [0170.125] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 1 [0170.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico") returned 0x42 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.126] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.126] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2218) returned 0x6f14048 [0170.126] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3081d900, ftCreationTime.dwHighDateTime=0x1c68838, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3081d900, ftLastWriteTime.dwHighDateTime=0x1c68838, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSSITEMS.ICO", cAlternateFileName="")) returned 1 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 1 [0170.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico") returned 0x42 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.126] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.126] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x221c) returned 0x6f14048 [0170.126] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLL.ICO", cAlternateFileName="")) returned 1 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 1 [0170.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico") returned 0x42 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.126] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.126] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2220) returned 0x6f14048 [0170.126] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDCNCLS.ICO", cAlternateFileName="")) returned 1 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 1 [0170.126] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico") returned 0x42 [0170.126] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.126] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2224) returned 0x6f14048 [0170.127] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQL.ICO", cAlternateFileName="")) returned 1 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 1 [0170.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico") returned 0x41 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.127] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2228) returned 0x6f14048 [0170.127] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDREQS.ICO", cAlternateFileName="")) returned 1 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 1 [0170.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico") returned 0x41 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.127] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x222c) returned 0x6f14048 [0170.127] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNL.ICO", cAlternateFileName="")) returned 1 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 1 [0170.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico") returned 0x42 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.127] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2230) returned 0x6f14048 [0170.127] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESNS.ICO", cAlternateFileName="")) returned 1 [0170.127] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 1 [0170.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico") returned 0x42 [0170.128] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.128] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2234) returned 0x6f14048 [0170.128] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPL.ICO", cAlternateFileName="")) returned 1 [0170.128] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 1 [0170.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico") returned 0x42 [0170.128] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.128] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2238) returned 0x6f14048 [0170.128] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESPS.ICO", cAlternateFileName="")) returned 1 [0170.131] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 1 [0170.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico") returned 0x42 [0170.131] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.131] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.131] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x223c) returned 0x6f14048 [0170.132] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20239f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTL.ICO", cAlternateFileName="")) returned 1 [0170.132] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 1 [0170.132] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico") returned 0x42 [0170.132] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2240) returned 0x6f14048 [0170.143] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCDRESTS.ICO", cAlternateFileName="")) returned 1 [0170.143] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 1 [0170.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico") returned 0x42 [0170.143] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2244) returned 0x6f14048 [0170.144] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e65aa00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e65aa00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDCNCL.CFG", cAlternateFileName="")) returned 1 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 1 [0170.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg") returned 0x42 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2248) returned 0x6f14048 [0170.144] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabc91200, ftCreationTime.dwHighDateTime=0x1bfc4b1, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabc91200, ftLastWriteTime.dwHighDateTime=0x1bfc4b1, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREQ.CFG", cAlternateFileName="")) returned 1 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 1 [0170.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg") returned 0x41 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x224c) returned 0x6f14048 [0170.144] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2049b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x343, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESN.CFG", cAlternateFileName="")) returned 1 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 1 [0170.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg") returned 0x42 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2250) returned 0x6f14048 [0170.144] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDRESP.CFG", cAlternateFileName="")) returned 1 [0170.144] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 1 [0170.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg") returned 0x42 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2254) returned 0x6f14048 [0170.145] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f96d700, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f96d700, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCHDREST.CFG", cAlternateFileName="")) returned 1 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 1 [0170.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg") returned 0x42 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2258) returned 0x6f14048 [0170.145] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84ca1800, ftCreationTime.dwHighDateTime=0x1c2b07e, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84ca1800, ftLastWriteTime.dwHighDateTime=0x1c2b07e, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECREC.CFG", cAlternateFileName="")) returned 1 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 1 [0170.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg") returned 0x40 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x225c) returned 0x6f14048 [0170.145] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECL.ICO", cAlternateFileName="")) returned 1 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 1 [0170.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico") returned 0x41 [0170.145] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2260) returned 0x6f14048 [0170.146] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECRECS.ICO", cAlternateFileName="")) returned 1 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 1 [0170.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico") returned 0x41 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2264) returned 0x6f14048 [0170.146] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x287, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURE.CFG", cAlternateFileName="")) returned 1 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 1 [0170.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg") returned 0x40 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2268) returned 0x6f14048 [0170.146] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURL.ICO", cAlternateFileName="")) returned 1 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 1 [0170.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico") returned 0x40 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.146] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.146] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x226c) returned 0x6f14048 [0170.146] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SECURS.ICO", cAlternateFileName="")) returned 1 [0170.146] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 1 [0170.146] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico") returned 0x40 [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2270) returned 0x6f14048 [0170.147] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b799300, ftCreationTime.dwHighDateTime=0x1c61668, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b799300, ftLastWriteTime.dwHighDateTime=0x1c61668, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHARING.CFG", cAlternateFileName="")) returned 1 [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 1 [0170.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg") returned 0x41 [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2274) returned 0x6f14048 [0170.147] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.CFG", cAlternateFileName="")) returned 1 [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG") returned 1 [0170.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg") returned 0x3e [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2278) returned 0x6f14048 [0170.147] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNL.ICO", cAlternateFileName="")) returned 1 [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 1 [0170.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico") returned 0x3f [0170.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x227c) returned 0x6f14048 [0170.148] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNS.ICO", cAlternateFileName="")) returned 1 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 1 [0170.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico") returned 0x3f [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2280) returned 0x6f14048 [0170.148] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMEE.CFG", cAlternateFileName="")) returned 1 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 1 [0170.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg") returned 0x40 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2284) returned 0x6f14048 [0170.148] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIMES.CFG", cAlternateFileName="")) returned 1 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", len=0x40 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 1 [0170.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg") returned 0x40 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2288) returned 0x6f14048 [0170.148] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ff90d00, ftCreationTime.dwHighDateTime=0x1c666e6, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ff90d00, ftLastWriteTime.dwHighDateTime=0x1c666e6, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSL.ICO", cAlternateFileName="")) returned 1 [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 1 [0170.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico") returned 0x3e [0170.148] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x228c) returned 0x6f14048 [0170.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac132a00, ftCreationTime.dwHighDateTime=0x1c6859b, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac132a00, ftLastWriteTime.dwHighDateTime=0x1c6859b, nFileSizeHigh=0x0, nFileSizeLow=0x8be, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMSS.ICO", cAlternateFileName="")) returned 1 [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 1 [0170.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico") returned 0x3e [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2290) returned 0x6f14048 [0170.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x300, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASK.CFG", cAlternateFileName="")) returned 1 [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", len=0x3e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 1 [0170.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg") returned 0x3e [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2294) returned 0x6f14048 [0170.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACC.CFG", cAlternateFileName="")) returned 1 [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 1 [0170.149] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg") returned 0x41 [0170.149] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.149] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.149] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2298) returned 0x6f14048 [0170.149] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCL.ICO", cAlternateFileName="")) returned 1 [0170.150] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 1 [0170.150] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico") returned 0x42 [0170.153] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.157] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2298) returned 0x6f14048 [0170.157] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKACCS.ICO", cAlternateFileName="")) returned 1 [0170.157] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 1 [0170.157] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico") returned 0x42 [0170.157] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.157] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.157] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x229c) returned 0x6f14048 [0170.157] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDEC.CFG", cAlternateFileName="")) returned 1 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG") returned 1 [0170.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg") returned 0x41 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.158] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a0) returned 0x6f14048 [0170.158] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x20bbf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECL.ICO", cAlternateFileName="")) returned 1 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO") returned 1 [0170.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico") returned 0x42 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.158] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a4) returned 0x6f14048 [0170.158] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKDECS.ICO", cAlternateFileName="")) returned 1 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 1 [0170.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico") returned 0x42 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.158] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.158] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22a8) returned 0x6f14048 [0170.158] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x217a650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKL.ICO", cAlternateFileName="")) returned 1 [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 1 [0170.158] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico") returned 0x3f [0170.158] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.159] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22ac) returned 0x6f14048 [0170.159] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQ.CFG", cAlternateFileName="")) returned 1 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 1 [0170.159] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg") returned 0x41 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.159] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b0) returned 0x6f14048 [0170.159] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQL.ICO", cAlternateFileName="")) returned 1 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 1 [0170.159] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico") returned 0x42 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.159] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b4) returned 0x6f14048 [0170.159] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKREQS.ICO", cAlternateFileName="")) returned 1 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", len=0x42 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO") returned 1 [0170.159] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico") returned 0x42 [0170.159] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.159] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.159] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b8) returned 0x6f14048 [0170.159] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76c87000, ftCreationTime.dwHighDateTime=0x1c50f43, ftLastAccessTime.dwLowDateTime=0x21a07b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76c87000, ftLastWriteTime.dwHighDateTime=0x1c50f43, nFileSizeHigh=0x0, nFileSizeLow=0xbb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKS.ICO", cAlternateFileName="")) returned 1 [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", len=0x3f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO") returned 1 [0170.160] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKS.ICO", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico") returned 0x3f [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.160] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.160] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22bc) returned 0x6f14048 [0170.160] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51f93100, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51f93100, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="TASKUPD.CFG", cAlternateFileName="")) returned 1 [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\tasks.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG") returned 1 [0170.160] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg") returned 0x41 [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.160] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.160] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22c0) returned 0x6f14048 [0170.160] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab104a0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x9ab104a0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg", psz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\_RESTORE FILES_.txt", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\_RESTORE FILES_.txt") returned 1 [0170.160] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\_RESTORE FILES_.txt", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\forms\\1033\\_restore files_.txt") returned 0x49 [0170.160] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0170.160] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.160] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.160] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0170.160] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.160] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0170.161] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\form.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned 1 [0170.161] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\french.lng") returned 0x35 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.161] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.161] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22c4) returned 0x6f14048 [0170.161] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\french.lng", psz="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL") returned 1 [0170.161] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GANTT.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\gantt.dll") returned 0x34 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.161] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.161] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\gantt.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL") returned 1 [0170.161] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\gfx.dll") returned 0x32 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.161] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.161] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\gfx.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll") returned 1 [0170.161] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\gkexcel.dll") returned 0x36 [0170.161] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.162] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\gkexcel.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll") returned 1 [0170.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll") returned 0x3b [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.162] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll") returned 1 [0170.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\gkword.dll") returned 0x35 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.162] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\gkword.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE") returned 1 [0170.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\graph.exe") returned 0x34 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.162] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\graph.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned 1 [0170.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\graph.exe.manifest") returned 0x3d [0170.162] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.163] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0170.163] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\graph.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO") returned 1 [0170.163] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.ICO", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\graph.ico") returned 0x34 [0170.163] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0170.163] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22c8) returned 0x6f14048 [0170.163] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0170.163] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", len=0x32 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned 1 [0170.163] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\") returned 0x32 [0170.163] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0170.163] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0170.163] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0170.184] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.184] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0170.184] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", len=0x3f | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\") returned 1 [0170.184] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\") returned 0x3f [0170.184] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0170.184] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0170.184] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0170.191] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.192] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0170.192] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", len=0x4a | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\") returned 1 [0170.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\") returned 0x4a [0170.192] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0170.192] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0170.192] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0170.200] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.212] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0170.212] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", len=0x55 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\") returned 1 [0170.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\") returned 0x55 [0170.212] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0170.212] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0170.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0170.227] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6d2c00d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.227] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2de, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedComponents.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0170.227] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 1 [0170.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer") returned 0x69 [0170.227] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0170.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0170.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x6d2c00d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0170.227] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0170.227] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\_restore files_.txt"), bFailIfExists=0) returned 1 [0170.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x22b4) returned 0x6f14048 [0170.233] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0170.233] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0170.233] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0170.233] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", len=0x59 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\") returned 1 [0170.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\") returned 0x59 [0170.233] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0170.233] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0170.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0171.168] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a95a430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.168] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcf1000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcf1000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x290, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignedManagedObjects.cer", cAlternateFileName="SIGNED~1.CER")) returned 1 [0171.168] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", len=0x71 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 1 [0171.168] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer") returned 0x71 [0171.168] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0171.168] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0171.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a95a430, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0171.169] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0171.169] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.336] GetProcessHeap () returned 0x580000 [0174.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0174.344] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.344] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.345] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Servers", cAlternateFileName="")) returned 1 [0174.345] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", len=0x52 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\") returned 1 [0174.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\") returned 0x52 [0174.345] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.345] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.345] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0174.345] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x582abeb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d169470, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.345] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Management.cer", cAlternateFileName="MANAGE~1.CER")) returned 1 [0174.346] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer") returned 1 [0174.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\Management.cer", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer") returned 0x60 [0174.346] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0174.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.346] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x582abeb0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0174.401] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.401] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.410] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3de, dwReserved0=0x0, dwReserved1=0x0, cFileName="RELAY.CER", cAlternateFileName="")) returned 1 [0174.410] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\management.cer", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER") returned 1 [0174.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Servers\\RELAY.CER", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\servers\\relay.cer") returned 0x5b [0174.410] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0174.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.410] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.410] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.410] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.410] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.410] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0174.410] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", len=0x48 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\") returned 1 [0174.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\") returned 0x48 [0174.410] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.410] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.410] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0174.415] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e490770, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.416] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Components", cAlternateFileName="COMPON~1")) returned 1 [0174.416] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\") returned 1 [0174.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\") returned 0x53 [0174.416] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.416] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0174.419] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5e490770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70744630, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.419] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cAlternateFileName="VERISI~1.CER")) returned 1 [0174.419] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", len=0x7e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer") returned 1 [0174.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Code_Signing_2001-4_CA.cer", cchLength=0x7e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer") returned 0x7e [0174.419] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0174.419] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5e490770, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0174.420] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0174.420] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.422] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSign_Class_3_Public_Primary_CA.cer", cAlternateFileName="VERISI~2.CER")) returned 1 [0174.422] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_code_signing_2001-4_ca.cer", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", len=0x79 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer") returned 1 [0174.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VeriSign_Class_3_Public_Primary_CA.cer", cchLength=0x79 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer") returned 0x79 [0174.422] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0174.422] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0174.422] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70744630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VS_ComponentSigningIntermediate.cer", cAlternateFileName="VS_COM~1.CER")) returned 1 [0174.422] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\verisign_class_3_public_primary_ca.cer", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", len=0x76 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer") returned 1 [0174.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\Verisign\\Components\\VS_ComponentSigningIntermediate.cer", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\certificates\\verisign\\components\\vs_componentsigningintermediate.cer") returned 0x76 [0174.422] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0174.422] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.422] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0174.422] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.423] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.423] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.423] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.423] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.423] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.423] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sounds", cAlternateFileName="")) returned 1 [0174.423] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", len=0x39 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\") returned 1 [0174.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\") returned 0x39 [0174.423] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.423] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.423] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0174.432] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52a72f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.432] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="People", cAlternateFileName="")) returned 1 [0174.432] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", len=0x40 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\") returned 1 [0174.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\") returned 0x40 [0174.432] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.432] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.432] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0174.486] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a72f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.486] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUGH.WAV", cAlternateFileName="")) returned 1 [0174.486] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV") returned 1 [0174.486] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\COUGH.WAV", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav") returned 0x49 [0174.486] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.486] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x52a72f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0174.490] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.490] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.497] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0174.497] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7860, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIGGLE.WAV", cAlternateFileName="")) returned 1 [0174.497] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\cough.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV") returned 1 [0174.497] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\GIGGLE.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav") returned 0x4a [0174.497] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.497] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.497] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0174.497] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="HICCUP.WAV", cAlternateFileName="")) returned 1 [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\giggle.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV") returned 1 [0174.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\HICCUP.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav") returned 0x4a [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.498] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.498] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0174.498] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MMHMM.WAV", cAlternateFileName="")) returned 1 [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\hiccup.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV") returned 1 [0174.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\MMHMM.WAV", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav") returned 0x49 [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.498] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.498] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0174.498] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9c84, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNEEZE.WAV", cAlternateFileName="")) returned 1 [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\mmhmm.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV") returned 1 [0174.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav") returned 0x4a [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.498] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.498] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.498] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="THROAT.WAV", cAlternateFileName="")) returned 1 [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV") returned 1 [0174.498] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav") returned 0x4a [0174.498] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.498] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.499] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.499] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7302, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whistling.wav", cAlternateFileName="WHISTL~1.WAV")) returned 1 [0174.499] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", len=0x4d | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav") returned 1 [0174.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav") returned 0x4d [0174.499] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.499] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.499] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.499] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.499] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.499] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0174.499] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", len=0x40 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\") returned 1 [0174.499] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\") returned 0x40 [0174.499] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.499] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0174.558] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51b925d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.558] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x84e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM.WAV", cAlternateFileName="")) returned 1 [0174.558] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV") returned 1 [0174.558] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\ALARM.WAV", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav") returned 0x49 [0174.558] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.558] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.558] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51b925d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0174.559] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.559] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.564] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0174.564] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUZZ.WAV", cAlternateFileName="")) returned 1 [0174.564] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\alarm.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV") returned 1 [0174.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\BUZZ.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav") returned 0x48 [0174.564] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.564] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.564] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0174.564] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d003d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d003d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd686, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0174.564] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\buzz.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV") returned 1 [0174.564] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\LASER.WAV", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav") returned 0x49 [0174.564] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.564] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0174.565] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADAR.WAV", cAlternateFileName="")) returned 1 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\laser.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", len=0x49 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV") returned 1 [0174.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\RADAR.WAV", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav") returned 0x49 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.565] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0174.565] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd64a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOT.WAV", cAlternateFileName="")) returned 1 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\radar.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV") returned 1 [0174.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\TOOT.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav") returned 0x48 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.565] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0174.565] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea72, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIBE.WAV", cAlternateFileName="")) returned 1 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\toot.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV") returned 1 [0174.565] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\VIBE.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav") returned 0x48 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.565] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.565] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0174.565] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WARN.WAV", cAlternateFileName="")) returned 1 [0174.565] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\vibe.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV") returned 1 [0174.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Places\\WARN.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\places\\warn.wav") returned 0x48 [0174.566] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.566] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.566] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.566] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.566] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.566] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0174.566] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", len=0x40 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\") returned 1 [0174.566] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\") returned 0x40 [0174.566] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.566] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0174.611] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51ce9230, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d299f70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0174.611] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc8fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAN.WAV", cAlternateFileName="")) returned 1 [0174.612] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", len=0x47 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV") returned 1 [0174.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\CAN.WAV", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav") returned 0x47 [0174.612] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.612] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51ce9230, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0174.612] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0174.612] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\_restore files_.txt"), bFailIfExists=0) returned 1 [0174.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0174.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPLER.WAV", cAlternateFileName="")) returned 1 [0174.614] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\can.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", len=0x4b | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV") returned 1 [0174.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\COUPLER.WAV", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav") returned 0x4b [0174.614] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0174.614] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa412, dwReserved0=0x0, dwReserved1=0x0, cFileName="HORN.WAV", cAlternateFileName="")) returned 1 [0174.614] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\coupler.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV") returned 1 [0174.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\HORN.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav") returned 0x48 [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0174.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb14e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOT.WAV", cAlternateFileName="")) returned 1 [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\horn.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", len=0x48 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV") returned 1 [0174.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOT.WAV", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav") returned 0x48 [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0174.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf548, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHOVEL.WAV", cAlternateFileName="")) returned 1 [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shot.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV") returned 1 [0174.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SHOVEL.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav") returned 0x4a [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0174.615] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xedd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPLASH.WAV", cAlternateFileName="")) returned 1 [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\shovel.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV") returned 1 [0174.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\SPLASH.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav") returned 0x4a [0174.615] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0174.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e316a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e316a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6bbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0174.616] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\splash.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", len=0x4a | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV") returned 1 [0174.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\Things\\WHOOSH.WAV", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\sounds\\things\\whoosh.wav") returned 0x4a [0174.616] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0174.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0174.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0174.616] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.616] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0174.616] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0174.616] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0174.616] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0174.616] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", len=0x3b | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\") returned 1 [0174.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\") returned 0x3b [0174.616] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0174.616] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0174.616] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0176.421] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0177.776] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0177.776] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg") returned 1 [0177.776] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImages.jpg", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg") returned 0x55 [0177.776] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0177.776] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0177.776] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51bb8730, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0177.776] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0177.776] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\_restore files_.txt"), bFailIfExists=0) returned 1 [0180.028] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0180.028] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7093c400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7093c400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp") returned 1 [0180.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CalendarToolIconImagesMask.bmp", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp") returned 0x59 [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.028] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0180.028] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImages.bmp", cAlternateFileName="CHESSI~1.BMP")) returned 1 [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\calendartooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp") returned 1 [0180.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImages.bmp", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp") returned 0x4e [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.028] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.028] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0180.028] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x0, dwReserved1=0x0, cFileName="ChessIconImagesMask.bmp", cAlternateFileName="CHESSI~2.BMP")) returned 1 [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimages.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp") returned 1 [0180.028] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\ChessIconImagesMask.bmp", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp") returned 0x52 [0180.028] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.029] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0180.029] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImage.jpg", cAlternateFileName="CREATE~1.JPG")) returned 1 [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\chessiconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg") returned 1 [0180.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImage.jpg", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg") returned 0x4f [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.029] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0180.029] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CreateSpaceImageMask.bmp", cAlternateFileName="CREATE~1.BMP")) returned 1 [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp") returned 1 [0180.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\CreateSpaceImageMask.bmp", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp") returned 0x53 [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.029] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0180.029] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImages.jpg", cAlternateFileName="DATALI~1.JPG")) returned 1 [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\createspaceimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg") returned 1 [0180.029] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImages.jpg", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg") returned 0x51 [0180.029] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.029] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.029] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0180.029] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c4f100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71c4f100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataListIconImagesMask.bmp", cAlternateFileName="DATALI~1.BMP")) returned 1 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp") returned 1 [0180.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataListIconImagesMask.bmp", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp") returned 0x55 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.030] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0180.030] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImages.jpg", cAlternateFileName="DATAVI~1.JPG")) returned 1 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\datalisticonimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg") returned 1 [0180.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImages.jpg", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg") returned 0x51 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.030] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0180.030] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataViewIconImagesMask.bmp", cAlternateFileName="DATAVI~1.BMP")) returned 1 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp") returned 1 [0180.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DataViewIconImagesMask.bmp", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp") returned 0x55 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.030] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.030] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0180.030] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2eaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0180.030] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\dataviewiconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg") returned 1 [0180.030] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImages.jpg", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg") returned 0x57 [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0180.031] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp") returned 1 [0180.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\DiscussionToolIconImagesMask.bmp", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp") returned 0x5b [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0180.031] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f61e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72f61e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a0f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImage.jpg", cAlternateFileName="FORM_S~1.JPG")) returned 1 [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\discussiontooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg") returned 1 [0180.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImage.jpg", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg") returned 0x4f [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0180.031] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3618, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form_StatusImageMask.bmp", cAlternateFileName="FORM_S~1.BMP")) returned 1 [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp") returned 1 [0180.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Form_StatusImageMask.bmp", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp") returned 0x53 [0180.031] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0180.032] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1d29, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIP.JPG", cAlternateFileName="")) returned 1 [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\form_statusimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG") returned 1 [0180.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIP.JPG", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg") returned 0x43 [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0180.032] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRIPMASK.BMP", cAlternateFileName="")) returned 1 [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\grip.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP") returned 1 [0180.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\GRIPMASK.BMP", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp") returned 0x47 [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0180.032] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe5, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIcon.jpg", cAlternateFileName="INFORM~1.JPG")) returned 1 [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\gripmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg") returned 1 [0180.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIcon.jpg", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg") returned 0x4e [0180.032] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0180.032] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74274b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74274b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="InformationIconMask.bmp", cAlternateFileName="INFORM~1.BMP")) returned 1 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp") returned 1 [0180.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\InformationIconMask.bmp", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp") returned 0x52 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.033] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.033] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0180.033] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x675aa300, ftCreationTime.dwHighDateTime=0x1c9f921, ftLastAccessTime.dwLowDateTime=0x581a1510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x675aa300, ftLastWriteTime.dwHighDateTime=0x1c9f921, nFileSizeHigh=0x0, nFileSizeLow=0xceed, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginDialogBackground.jpg", cAlternateFileName="LOGIND~1.JPG")) returned 1 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\informationiconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg") returned 1 [0180.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginDialogBackground.jpg", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg") returned 0x54 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.033] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.033] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0180.033] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e93, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24Images.jpg", cAlternateFileName="LOGINT~1.JPG")) returned 1 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logindialogbackground.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg") returned 1 [0180.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24Images.jpg", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg") returned 0x53 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.033] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.033] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0180.033] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LoginTool24x24ImagesMask.bmp", cAlternateFileName="LOGINT~1.BMP")) returned 1 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24images.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp") returned 1 [0180.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\LoginTool24x24ImagesMask.bmp", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp") returned 0x57 [0180.033] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.034] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.034] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x210c) returned 0x6f14048 [0180.034] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x25e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImages.jpg", cAlternateFileName="MESSAG~2.JPG")) returned 1 [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\logintool24x24imagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", len=0x5a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg") returned 1 [0180.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImages.jpg", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg") returned 0x5a [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.034] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.034] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2110) returned 0x6f14048 [0180.034] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageAttachmentIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", len=0x5e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp") returned 1 [0180.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageAttachmentIconImagesMask.bmp", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp") returned 0x5e [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.034] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.034] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2114) returned 0x6f14048 [0180.034] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x22f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messageattachmenticonimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg") returned 1 [0180.034] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImages.jpg", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg") returned 0x57 [0180.034] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.034] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.034] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2118) returned 0x6f14048 [0180.035] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75587800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75587800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageHistoryIconImagesMask.bmp", cAlternateFileName="MESSAG~2.BMP")) returned 1 [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", len=0x5b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp") returned 1 [0180.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\MessageHistoryIconImagesMask.bmp", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp") returned 0x5b [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.035] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.035] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x211c) returned 0x6f14048 [0180.035] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46b7a400, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46b7a400, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x3efd, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackground.jpg", cAlternateFileName="NOTIFI~1.JPG")) returned 1 [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\messagehistoryiconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg") returned 1 [0180.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackground.jpg", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg") returned 0x51 [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.035] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.035] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2120) returned 0x6f14048 [0180.035] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50410c00, ftCreationTime.dwHighDateTime=0x1c9e8b3, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50410c00, ftLastWriteTime.dwHighDateTime=0x1c9e8b3, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierBackgroundRTL.jpg", cAlternateFileName="NOTIFI~2.JPG")) returned 1 [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackground.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg") returned 1 [0180.035] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierBackgroundRTL.jpg", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg") returned 0x54 [0180.035] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.035] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.035] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2124) returned 0x6f14048 [0180.035] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79304700, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79304700, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierCloseButton.jpg", cAlternateFileName="NO00D7~1.JPG")) returned 1 [0180.036] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierbackgroundrtl.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg") returned 1 [0180.036] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierCloseButton.jpg", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg") returned 0x52 [0180.036] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.036] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.036] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2128) returned 0x6f14048 [0180.037] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f262800, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a539c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f262800, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableDownArrow.jpg", cAlternateFileName="NO74B3~1.JPG")) returned 1 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierclosebutton.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", len=0x57 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg") returned 1 [0180.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableDownArrow.jpg", cchLength=0x57 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg") returned 0x57 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.037] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.037] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x212c) returned 0x6f14048 [0180.037] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82b9af00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82b9af00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x307, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDisableUpArrow.jpg", cAlternateFileName="NOTIFI~3.JPG")) returned 1 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisabledownarrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg") returned 1 [0180.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDisableUpArrow.jpg", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg") returned 0x55 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.037] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.037] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2130) returned 0x6f14048 [0180.037] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x864d3600, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x864d3600, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x368, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierDownArrow.jpg", cAlternateFileName="NOTIFI~4.JPG")) returned 1 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdisableuparrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg") returned 1 [0180.037] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierDownArrow.jpg", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg") returned 0x50 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.037] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.037] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2134) returned 0x6f14048 [0180.037] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89e0bd00, ftCreationTime.dwHighDateTime=0x1c91151, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89e0bd00, ftLastWriteTime.dwHighDateTime=0x1c91151, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierUpArrow.jpg", cAlternateFileName="NO6669~1.JPG")) returned 1 [0180.037] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierdownarrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg") returned 1 [0180.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierUpArrow.jpg", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg") returned 0x4e [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.038] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2138) returned 0x6f14048 [0180.038] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8472000, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8472000, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMask.bmp", cAlternateFileName="NOTIFI~1.BMP")) returned 1 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifieruparrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp") returned 1 [0180.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMask.bmp", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp") returned 0x51 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.038] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x213c) returned 0x6f14048 [0180.038] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a588200, ftCreationTime.dwHighDateTime=0x1c90f02, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a588200, ftLastWriteTime.dwHighDateTime=0x1c90f02, nFileSizeHigh=0x0, nFileSizeLow=0x133a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NotifierWindowMaskRTL.bmp", cAlternateFileName="NOTIFI~2.BMP")) returned 1 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp") returned 1 [0180.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\NotifierWindowMaskRTL.bmp", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp") returned 0x54 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.038] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.038] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0180.038] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7689a500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7689a500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e35, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImages.jpg", cAlternateFileName="OUTLIN~1.JPG")) returned 1 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\notifierwindowmaskrtl.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg") returned 1 [0180.038] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImages.jpg", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg") returned 0x54 [0180.038] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0180.039] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1938, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlineToolIconImagesMask.bmp", cAlternateFileName="OUTLIN~1.BMP")) returned 1 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", len=0x58 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp") returned 1 [0180.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutlineToolIconImagesMask.bmp", cchLength=0x58 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp") returned 0x58 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0180.039] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImages.jpg", cAlternateFileName="OUTOFS~1.JPG")) returned 1 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outlinetooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg") returned 1 [0180.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImages.jpg", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg") returned 0x52 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0180.039] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutofSyncIconImagesMask.bmp", cAlternateFileName="OUTOFS~1.BMP")) returned 1 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", len=0x56 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp") returned 1 [0180.039] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp") returned 0x56 [0180.039] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.039] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.039] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0180.040] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a3c500, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a3c500, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5203, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImages.jpg", cAlternateFileName="PICTUR~1.JPG")) returned 1 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg") returned 1 [0180.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImages.jpg", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg") returned 0x55 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.040] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0180.040] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe1a5d00, ftCreationTime.dwHighDateTime=0x1ca032e, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe1a5d00, ftLastWriteTime.dwHighDateTime=0x1ca032e, nFileSizeHigh=0x0, nFileSizeLow=0x1238, dwReserved0=0x0, dwReserved1=0x0, cFileName="PicturesToolIconImagesMask.bmp", cAlternateFileName="PICTUR~1.BMP")) returned 1 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp") returned 1 [0180.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\PicturesToolIconImagesMask.bmp", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp") returned 0x59 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.040] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0180.040] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIcon.jpg", cAlternateFileName="QUESTI~1.JPG")) returned 1 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\picturestooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg") returned 1 [0180.040] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIcon.jpg", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg") returned 0x4b [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.040] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.040] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0180.040] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="QuestionIconMask.bmp", cAlternateFileName="QUESTI~1.BMP")) returned 1 [0180.040] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questionicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp") returned 1 [0180.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\QuestionIconMask.bmp", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp") returned 0x4f [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.041] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0180.041] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bad200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77bad200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16Images.jpg", cAlternateFileName="SHARED~1.JPG")) returned 1 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\questioniconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg") returned 1 [0180.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16Images.jpg", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg") returned 0x50 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.041] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0180.041] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared16x16ImagesMask.bmp", cAlternateFileName="SHARED~1.BMP")) returned 1 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16images.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp") returned 1 [0180.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared16x16ImagesMask.bmp", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp") returned 0x54 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.041] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0180.041] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1963, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24Images.jpg", cAlternateFileName="SHARED~2.JPG")) returned 1 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared16x16imagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg") returned 1 [0180.041] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24Images.jpg", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg") returned 0x50 [0180.041] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.041] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0180.042] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1638, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared24x24ImagesMask.bmp", cAlternateFileName="SHARED~2.BMP")) returned 1 [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24images.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp") returned 1 [0180.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\Shared24x24ImagesMask.bmp", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp") returned 0x54 [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0180.042] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchIconImages.bmp", cAlternateFileName="SKETCH~1.BMP")) returned 1 [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\shared24x24imagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp") returned 1 [0180.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\SketchIconImages.bmp", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp") returned 0x4f [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0180.042] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupicons.jpg", cAlternateFileName="SPACEB~1.JPG")) returned 1 [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\sketchiconimages.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg") returned 1 [0180.042] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg") returned 0x4f [0180.042] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.042] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.042] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0180.042] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="spacebackupiconsmask.bmp", cAlternateFileName="SPACEB~1.BMP")) returned 1 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", len=0x53 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp") returned 1 [0180.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupiconsmask.bmp", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp") returned 0x53 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0180.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="STOPICON.JPG", cAlternateFileName="")) returned 1 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupiconsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG") returned 1 [0180.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\STOPICON.JPG", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg") returned 0x47 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0180.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ebff00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ebff00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="StopIconMask.bmp", cAlternateFileName="STOPIC~1.BMP")) returned 1 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp") returned 1 [0180.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\StopIconMask.bmp", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp") returned 0x4b [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0180.043] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d554a00, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d554a00, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImages256Colors.bmp", cAlternateFileName="TASKBA~1.BMP")) returned 1 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\stopiconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp") returned 1 [0180.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImages256Colors.bmp", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp") returned 0x59 [0180.043] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0180.044] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd49300, ftCreationTime.dwHighDateTime=0x1ca0b45, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd49300, ftLastWriteTime.dwHighDateTime=0x1ca0b45, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaskbarIconImagesMask256Colors.bmp", cAlternateFileName="TASKBA~2.BMP")) returned 1 [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimages256colors.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", len=0x5d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp") returned 1 [0180.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TaskbarIconImagesMask256Colors.bmp", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp") returned 0x5d [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0180.044] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5adf6ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2605, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImage.jpg", cAlternateFileName="TIPSIM~1.JPG")) returned 1 [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\taskbariconimagesmask256colors.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg") returned 1 [0180.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImage.jpg", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg") returned 0x48 [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0180.044] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a1d2c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae1d030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a1d2c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipsImageMask.bmp", cAlternateFileName="TIPSIM~1.BMP")) returned 1 [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp") returned 1 [0180.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\TipsImageMask.bmp", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp") returned 0x4c [0180.044] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0180.044] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="VeriSignLogo.jpg", cAlternateFileName="VERISI~1.JPG")) returned 1 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\tipsimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", len=0x4b | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg") returned 1 [0180.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\VeriSignLogo.jpg", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg") returned 0x4b [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0180.045] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90bafc00, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90bafc00, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x5431, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImages.jpg", cAlternateFileName="WEBTOO~1.JPG")) returned 1 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\verisignlogo.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg") returned 1 [0180.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImages.jpg", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg") returned 0x50 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0180.045] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8862c100, ftCreationTime.dwHighDateTime=0x1ca032f, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8862c100, ftLastWriteTime.dwHighDateTime=0x1ca032f, nFileSizeHigh=0x0, nFileSizeLow=0x1538, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolIconImagesMask.bmp", cAlternateFileName="WEBTOO~1.BMP")) returned 1 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp") returned 1 [0180.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolIconImagesMask.bmp", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp") returned 0x54 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.045] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.045] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0180.045] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1995, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImages16x16.jpg", cAlternateFileName="WEBTOO~2.JPG")) returned 1 [0180.045] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg") returned 1 [0180.045] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImages16x16.jpg", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg") returned 0x51 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.046] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0180.046] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4e5900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b4e5900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="WebToolImagesMask16x16.bmp", cAlternateFileName="WEBTOO~2.BMP")) returned 1 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimages16x16.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp") returned 1 [0180.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WebToolImagesMask16x16.bmp", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp") returned 0x55 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.046] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0180.046] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2308, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImages.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\webtoolimagesmask16x16.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg") returned 1 [0180.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImages.jpg", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg") returned 0x55 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.046] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0180.046] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolIconImagesMask.bmp", cAlternateFileName="WSSFIL~1.BMP")) returned 1 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", len=0x59 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp") returned 1 [0180.046] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\WSSFilesToolIconImagesMask.bmp", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp") returned 0x59 [0180.046] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.046] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.046] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0180.047] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d2c340, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xa1d2c340, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0180.047] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\wssfilestooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\_RESTORE FILES_.txt", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\_RESTORE FILES_.txt") returned 1 [0180.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\_RESTORE FILES_.txt", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\_restore files_.txt") returned 0x4e [0180.047] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0180.047] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.047] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0180.047] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0180.047] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolData", cAlternateFileName="")) returned 1 [0180.047] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", len=0x3b | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\") returned 1 [0180.047] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\") returned 0x3b [0180.047] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0180.047] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0180.047] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0180.047] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51174850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.047] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 1 [0180.048] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", len=0x46 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\") returned 1 [0180.048] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\") returned 0x46 [0180.048] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0180.048] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0180.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0180.051] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.051] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar", cAlternateFileName="")) returned 1 [0180.051] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", len=0x4f | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\") returned 1 [0180.051] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\") returned 0x4f [0180.051] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0180.051] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0180.051] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0180.103] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51bb8730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61a457d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.103] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b62000, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4b62000, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0x3424, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImages.jpg", cAlternateFileName="CALEND~1.JPG")) returned 1 [0180.103] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg") returned 1 [0180.103] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg") returned 0x69 [0180.103] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.103] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51bb8730, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0180.103] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.103] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\_restore files_.txt"), bFailIfExists=0) returned 1 [0180.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0180.106] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb2cb800, ftCreationTime.dwHighDateTime=0x1ca0408, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb2cb800, ftLastWriteTime.dwHighDateTime=0x1ca0408, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarToolIconImagesMask.bmp", cAlternateFileName="CALEND~1.BMP")) returned 1 [0180.106] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", len=0x6d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp") returned 1 [0180.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp") returned 0x6d [0180.106] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0180.106] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3fa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CalendarViewButtonImages.jpg", cAlternateFileName="CALEND~2.JPG")) returned 1 [0180.106] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg") returned 1 [0180.106] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg") returned 0x6b [0180.106] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.106] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.106] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0180.106] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b49, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImage.jpg", cAlternateFileName="GLOBEB~1.JPG")) returned 1 [0180.106] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg") returned 1 [0180.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg") returned 0x63 [0180.107] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0180.107] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c7f8600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c7f8600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobeButtonImageMask.bmp", cAlternateFileName="GLOBEB~1.BMP")) returned 1 [0180.107] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp") returned 1 [0180.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp") returned 0x67 [0180.107] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.107] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.107] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0180.107] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0180.107] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.107] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommonData", cAlternateFileName="COMMON~1")) returned 1 [0180.107] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", len=0x51 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\") returned 1 [0180.107] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\") returned 0x51 [0180.107] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0180.107] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0180.107] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0180.187] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51317770, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69a5d7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.277] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633fe700, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633fe700, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x44c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Auto.jpg", cAlternateFileName="ALERTI~3.JPG")) returned 1 [0180.278] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg") returned 1 [0180.278] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Auto.jpg", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg") returned 0x64 [0180.278] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51317770, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0180.278] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0180.278] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\_restore files_.txt"), bFailIfExists=0) returned 1 [0180.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0180.280] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3390df00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3390df00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_AutoMask.bmp", cAlternateFileName="AL1E3B~1.BMP")) returned 1 [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_auto.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp") returned 1 [0180.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_AutoMask.bmp", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp") returned 0x68 [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0180.281] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3356, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHigh.jpg", cAlternateFileName="ALERTI~1.JPG")) returned 1 [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_automask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg") returned 1 [0180.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHigh.jpg", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg") returned 0x6b [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0180.281] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactHighMask.bmp", cAlternateFileName="ALERTI~1.BMP")) returned 1 [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthigh.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp") returned 1 [0180.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactHighMask.bmp", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp") returned 0x6f [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.281] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0180.281] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLow.jpg", cAlternateFileName="ALERTI~4.JPG")) returned 1 [0180.281] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contacthighmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg") returned 1 [0180.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLow.jpg", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg") returned 0x6a [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0180.282] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db0b300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7db0b300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c70, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_ContactLowMask.bmp", cAlternateFileName="AL1F1D~1.BMP")) returned 1 [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp") returned 1 [0180.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_ContactLowMask.bmp", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp") returned 0x6e [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0180.282] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc125fc00, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc125fc00, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x480d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHigh.jpg", cAlternateFileName="ALERTI~2.JPG")) returned 1 [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_contactlowmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg") returned 1 [0180.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHigh.jpg", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg") returned 0x68 [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.282] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0180.282] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b558100, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b558100, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileHighMask.bmp", cAlternateFileName="ALERTI~2.BMP")) returned 1 [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehigh.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp") returned 1 [0180.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileHighMask.bmp", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp") returned 0x6c [0180.282] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0180.283] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5eab000, ftCreationTime.dwHighDateTime=0x1c95fd3, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5eab000, ftLastWriteTime.dwHighDateTime=0x1c95fd3, nFileSizeHigh=0x0, nFileSizeLow=0x46de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOff.jpg", cAlternateFileName="AL97F4~1.JPG")) returned 1 [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_filehighmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg") returned 1 [0180.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOff.jpg", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg") returned 0x67 [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0180.283] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x427c8f00, ftCreationTime.dwHighDateTime=0x1c95fd2, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x427c8f00, ftLastWriteTime.dwHighDateTime=0x1c95fd2, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_FileOffMask.bmp", cAlternateFileName="ALFE83~1.BMP")) returned 1 [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoff.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp") returned 1 [0180.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_FileOffMask.bmp", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp") returned 0x6b [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0180.283] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2b7f600, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2b7f600, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x13ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_High.jpg", cAlternateFileName="AL5980~1.JPG")) returned 1 [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_fileoffmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg") returned 1 [0180.283] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_High.jpg", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg") returned 0x64 [0180.283] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.283] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.283] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0180.284] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3177400, ftCreationTime.dwHighDateTime=0x1c95f2a, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3177400, ftLastWriteTime.dwHighDateTime=0x1c95f2a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_HighMask.bmp", cAlternateFileName="ALERTI~3.BMP")) returned 1 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_high.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp") returned 1 [0180.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_HighMask.bmp", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp") returned 0x68 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0180.284] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefeaa500, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefeaa500, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x41de, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Medium.jpg", cAlternateFileName="ALF33C~1.JPG")) returned 1 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_highmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg") returned 1 [0180.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Medium.jpg", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg") returned 0x66 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0180.284] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd34e6d00, ftCreationTime.dwHighDateTime=0x1c95fc8, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd34e6d00, ftLastWriteTime.dwHighDateTime=0x1c95fc8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_MediumMAsk.bmp", cAlternateFileName="ALERTI~4.BMP")) returned 1 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_medium.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp") returned 1 [0180.284] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_MediumMAsk.bmp", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp") returned 0x6a [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.284] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.284] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0180.284] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e983f00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e983f00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x3e78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_Off.jpg", cAlternateFileName="AL0F2A~1.JPG")) returned 1 [0180.284] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_mediummask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg") returned 1 [0180.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_Off.jpg", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg") returned 0x63 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0180.285] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x258f8e00, ftCreationTime.dwHighDateTime=0x1c95fc9, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x258f8e00, ftLastWriteTime.dwHighDateTime=0x1c95fc9, nFileSizeHigh=0x0, nFileSizeLow=0x1c6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AlertImage_OffMask.bmp", cAlternateFileName="ALA9A1~1.BMP")) returned 1 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_off.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp") returned 1 [0180.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\AlertImage_OffMask.bmp", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp") returned 0x67 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0180.285] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb75100, ftCreationTime.dwHighDateTime=0x1c9bcb4, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbb75100, ftLastWriteTime.dwHighDateTime=0x1c9bcb4, nFileSizeHigh=0x0, nFileSizeLow=0x2256, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImage.jpg", cAlternateFileName="COMMSI~1.JPG")) returned 1 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\alertimage_offmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg") returned 1 [0180.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImage.jpg", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg") returned 0x67 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.285] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.285] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0180.285] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d183d00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d183d00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMask.bmp", cAlternateFileName="COMMSI~2.BMP")) returned 1 [0180.285] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp") returned 1 [0180.285] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMask.bmp", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp") returned 0x6b [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.286] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0180.286] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageMaskSmall.bmp", cAlternateFileName="COMMSI~1.BMP")) returned 1 [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", len=0x70 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp") returned 1 [0180.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageMaskSmall.bmp", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp") returned 0x70 [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.286] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0180.286] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1de3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsIncomingImageSmall.jpg", cAlternateFileName="COMMSI~2.JPG")) returned 1 [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagemasksmall.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg") returned 1 [0180.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsIncomingImageSmall.jpg", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg") returned 0x6c [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.286] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0180.286] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c468e00, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c468e00, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x22c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImage.jpg", cAlternateFileName="COMMSO~2.JPG")) returned 1 [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsincomingimagesmall.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg") returned 1 [0180.286] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImage.jpg", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg") returned 0x67 [0180.286] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.286] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.287] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0180.287] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf59600, ftCreationTime.dwHighDateTime=0x1c9bcb5, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bf59600, ftLastWriteTime.dwHighDateTime=0x1c9bcb5, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMask.bmp", cAlternateFileName="COMMSO~1.BMP")) returned 1 [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp") returned 1 [0180.287] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMask.bmp", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp") returned 0x6b [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.287] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.287] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0180.287] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x630, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageMaskSmall.bmp", cAlternateFileName="COMMSO~2.BMP")) returned 1 [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", len=0x70 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp") returned 1 [0180.287] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageMaskSmall.bmp", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp") returned 0x70 [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.287] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.287] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0180.287] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ee1e000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ee1e000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CommsOutgoingImageSmall.jpg", cAlternateFileName="COMMSO~1.JPG")) returned 1 [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagemasksmall.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg") returned 1 [0180.287] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\CommsOutgoingImageSmall.jpg", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg") returned 0x6c [0180.287] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.287] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.287] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0180.287] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2798, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImages.jpg", cAlternateFileName="MESSAG~1.JPG")) returned 1 [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\commsoutgoingimagesmall.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg") returned 1 [0180.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImages.jpg", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg") returned 0x69 [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.288] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0180.288] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MessageBoxIconImagesMask.bmp", cAlternateFileName="MESSAG~1.BMP")) returned 1 [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", len=0x6d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp") returned 1 [0180.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\MessageBoxIconImagesMask.bmp", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp") returned 0x6d [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.288] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0180.288] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c135400, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c135400, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1fec, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIcon.jpg", cAlternateFileName="UNREAD~1.JPG")) returned 1 [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\messageboxiconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg") returned 1 [0180.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIcon.jpg", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg") returned 0x5f [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.288] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0180.288] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98fc100, ftCreationTime.dwHighDateTime=0x1ca0330, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98fc100, ftLastWriteTime.dwHighDateTime=0x1ca0330, nFileSizeHigh=0x0, nFileSizeLow=0x1ffe, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImages.jpg", cAlternateFileName="UNREAD~2.JPG")) returned 1 [0180.288] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg") returned 1 [0180.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImages.jpg", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg") returned 0x65 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0180.289] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90c2000, ftCreationTime.dwHighDateTime=0x1ca035a, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb90c2000, ftLastWriteTime.dwHighDateTime=0x1ca035a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnreadIconImagesMask.bmp", cAlternateFileName="UNREAD~1.BMP")) returned 1 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp") returned 1 [0180.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\UnreadIconImagesMask.bmp", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp") returned 0x69 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0180.289] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa311bb80, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xa311bb80, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\unreadiconimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\_RESTORE FILES_.txt", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\_RESTORE FILES_.txt") returned 1 [0180.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\CommonData\\_RESTORE FILES_.txt", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\commondata\\_restore files_.txt") returned 0x64 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0180.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0180.289] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0180.289] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0180.289] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0180.289] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", len=0x50 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\") returned 1 [0180.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\") returned 0x50 [0181.256] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0181.256] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0181.256] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0181.256] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60440c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.256] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericon.jpg", cAlternateFileName="COMPUT~1.JPG")) returned 1 [0181.256] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg") returned 1 [0181.256] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg") returned 0x60 [0181.256] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0181.256] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0181.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51cc30d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0181.256] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0181.256] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.346] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80130d00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80130d00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x838, dwReserved0=0x0, dwReserved1=0x0, cFileName="computericonMask.bmp", cAlternateFileName="COMPUT~1.BMP")) returned 1 [0183.346] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp") returned 1 [0183.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp") returned 0x64 [0183.346] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0183.346] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.346] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.346] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion", cAlternateFileName="DISCUS~1")) returned 1 [0183.346] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", len=0x51 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\") returned 1 [0183.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\") returned 0x51 [0183.346] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0183.346] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0183.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0183.352] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x607d2d50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.352] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0009600, ftCreationTime.dwHighDateTime=0x1ca0588, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0009600, ftLastWriteTime.dwHighDateTime=0x1ca0588, nFileSizeHigh=0x0, nFileSizeLow=0x393c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImages.jpg", cAlternateFileName="DISCUS~1.JPG")) returned 1 [0183.352] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", len=0x6d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg") returned 1 [0183.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImages.jpg", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg") returned 0x6d [0183.352] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51e19d30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0183.352] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.352] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.408] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.408] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ac9e00, ftCreationTime.dwHighDateTime=0x1ca033a, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9ac9e00, ftLastWriteTime.dwHighDateTime=0x1ca033a, nFileSizeHigh=0x0, nFileSizeLow=0x1738, dwReserved0=0x0, dwReserved1=0x0, cFileName="DiscussionToolIconImagesMask.bmp", cAlternateFileName="DISCUS~1.BMP")) returned 1 [0183.409] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", len=0x71 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp") returned 1 [0183.409] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Discussion\\DiscussionToolIconImagesMask.bmp", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\discussion\\discussiontooliconimagesmask.bmp") returned 0x71 [0183.409] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.409] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.409] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.409] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.409] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.409] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentShare", cAlternateFileName="DOCUME~1")) returned 1 [0183.409] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", len=0x54 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\") returned 1 [0183.409] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\") returned 0x54 [0183.409] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0183.409] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0183.409] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0183.451] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709f1ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.451] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xab11, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSSFilesToolHomePageBackground.jpg", cAlternateFileName="WSSFIL~1.JPG")) returned 1 [0183.451] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", len=0x76 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg") returned 1 [0183.451] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg") returned 0x76 [0183.451] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.451] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x709f1ef0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0183.452] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.452] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.454] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.454] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.454] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveDocumentReview", cAlternateFileName="GROOVE~1")) returned 1 [0183.454] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", len=0x5b | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\") returned 1 [0183.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\") returned 0x5b [0183.454] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0183.454] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0183.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0183.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2519, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImage.jpg", cAlternateFileName="ACTIVE~1.JPG")) returned 1 [0183.465] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", len=0x6d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg") returned 1 [0183.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg") returned 0x6d [0183.465] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51174850, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0183.466] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.466] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.468] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81443a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e9eb8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81443a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveTabImageMask.bmp", cAlternateFileName="ACTIVE~1.BMP")) returned 1 [0183.468] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", len=0x71 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp") returned 1 [0183.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp") returned 0x71 [0183.468] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.468] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BodyPaneBackground.jpg", cAlternateFileName="BODYPA~1.JPG")) returned 1 [0183.468] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", len=0x71 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg") returned 1 [0183.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg") returned 0x71 [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImage.jpg", cAlternateFileName="INACTI~1.JPG")) returned 1 [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg") returned 1 [0183.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg") returned 0x6f [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0183.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="InactiveTabImageMask.bmp", cAlternateFileName="INACTI~1.BMP")) returned 1 [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", len=0x73 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp") returned 1 [0183.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp") returned 0x73 [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0183.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x98b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImages.jpg", cAlternateFileName="MARKUP~1.JPG")) returned 1 [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg") returned 1 [0183.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg") returned 0x6f [0183.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0183.470] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74, dwReserved0=0x0, dwReserved1=0x0, cFileName="MarkupIconImagesMask.bmp", cAlternateFileName="MARKUP~1.BMP")) returned 1 [0183.470] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", len=0x73 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp") returned 1 [0183.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp") returned 0x73 [0183.470] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0183.470] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.470] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0183.470] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms", cAlternateFileName="GROOVE~3")) returned 1 [0183.470] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", len=0x52 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\") returned 1 [0183.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\") returned 0x52 [0183.470] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0183.470] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0183.470] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0183.566] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.569] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82756700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82756700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0183.569] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg") returned 1 [0183.569] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrow.jpg", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg") returned 0x64 [0183.569] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.569] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0183.569] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.569] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.572] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2138) returned 0x6f14048 [0183.572] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp") returned 1 [0183.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\AddToViewArrowMask.bmp", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp") returned 0x68 [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.573] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.573] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x213c) returned 0x6f14048 [0183.573] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\addtoviewarrowmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif") returned 1 [0183.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\attention.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif") returned 0x5f [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.573] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.573] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2140) returned 0x6f14048 [0183.573] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\attention.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", len=0x5e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF") returned 1 [0183.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\BG_ADOBE.GIF", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif") returned 0x5e [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.573] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.573] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2144) returned 0x6f14048 [0183.573] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0183.573] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_adobe.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif") returned 1 [0183.573] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Casual.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif") returned 0x5f [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.574] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0183.574] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_casual.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif") returned 1 [0183.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Country.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif") returned 0x60 [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.574] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0183.574] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_country.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif") returned 1 [0183.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Earthy.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif") returned 0x5f [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.574] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0183.574] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_earthy.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif") returned 1 [0183.574] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePage.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif") returned 0x66 [0183.574] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.574] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2154) returned 0x6f14048 [0183.575] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepage.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif") returned 1 [0183.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_FormsHomePageBlank.gif", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif") returned 0x6b [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2158) returned 0x6f14048 [0183.575] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_formshomepageblank.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif") returned 1 [0183.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_GreenTea.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif") returned 0x61 [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x215c) returned 0x6f14048 [0183.575] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_greentea.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif") returned 1 [0183.575] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Groove.gif", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif") returned 0x5f [0183.575] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.575] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.575] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2160) returned 0x6f14048 [0183.575] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83a69400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83a69400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_groove.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif") returned 1 [0183.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_LightSpirit.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif") returned 0x64 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2164) returned 0x6f14048 [0183.576] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_lightspirit.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif") returned 1 [0183.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_OliveGreen.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif") returned 0x63 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2168) returned 0x6f14048 [0183.576] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_olivegreen.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif") returned 1 [0183.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_Premium.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif") returned 0x60 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x216c) returned 0x6f14048 [0183.576] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_premium.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif") returned 1 [0183.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_SlateBlue.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif") returned 0x62 [0183.576] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2170) returned 0x6f14048 [0183.577] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_slateblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif") returned 1 [0183.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_TexturedBlue.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif") returned 0x65 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2174) returned 0x6f14048 [0183.577] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_texturedblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif") returned 1 [0183.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\bg_VelvetRose.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif") returned 0x63 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2178) returned 0x6f14048 [0183.577] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\bg_velvetrose.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif") returned 1 [0183.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif") returned 0x61 [0183.577] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x217c) returned 0x6f14048 [0183.577] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_disable.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif") returned 1 [0183.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_disable.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif") returned 0x69 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.578] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.578] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2180) returned 0x6f14048 [0183.578] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_over.gif", cAlternateFileName="BUAC31~1.GIF")) returned 1 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_disable.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif") returned 1 [0183.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_left_over.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif") returned 0x66 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.578] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.578] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2184) returned 0x6f14048 [0183.578] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_left_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif") returned 1 [0183.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif") returned 0x60 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.578] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.578] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2188) returned 0x6f14048 [0183.578] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_disable.gif", cAlternateFileName="BUABE1~1.GIF")) returned 1 [0183.578] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif") returned 1 [0183.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_disable.gif", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif") returned 0x68 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x218c) returned 0x6f14048 [0183.579] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_over.gif", cAlternateFileName="BU1E84~1.GIF")) returned 1 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_disable.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif") returned 1 [0183.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid_over.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif") returned 0x65 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2190) returned 0x6f14048 [0183.579] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right.gif", cAlternateFileName="BU7DFA~1.GIF")) returned 1 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif") returned 1 [0183.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif") returned 0x62 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2194) returned 0x6f14048 [0183.579] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84d7c100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84d7c100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_disable.gif", cAlternateFileName="BUC143~1.GIF")) returned 1 [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif") returned 1 [0183.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_disable.gif", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif") returned 0x6a [0183.579] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2198) returned 0x6f14048 [0183.580] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x41b, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_over.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0183.580] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_disable.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif") returned 1 [0183.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif") returned 0x67 [0183.580] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.580] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0183.580] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FieldTypePreview", cAlternateFileName="FIELDT~1")) returned 1 [0183.580] SysReAllocStringLen (in: pbstr=0x6a0e2f8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", len=0x63 | out: pbstr=0x6a0e2f8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned 1 [0183.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\") returned 0x63 [0183.580] SysReAllocStringLen (in: pbstr=0x6a0e2a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e2a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0183.580] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0183.580] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*.*", lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9770 [0183.585] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.585] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0183.585] SysReAllocStringLen (in: pbstr=0x6a0e2f0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", len=0x72 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned 1 [0183.585] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg") returned 0x72 [0183.585] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.585] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dffc | out: lpFindFileData=0x6a0dffc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51741df0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0183.585] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0183.586] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\_restore files_.txt"), bFailIfExists=0) returned 1 [0183.588] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x219c) returned 0x6f14048 [0183.588] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREAK.JPG", cAlternateFileName="")) returned 1 [0183.588] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned 1 [0183.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg") returned 0x6c [0183.588] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.588] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a0) returned 0x6f14048 [0183.588] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.JPG", cAlternateFileName="")) returned 1 [0183.588] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\break.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned 1 [0183.588] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg") returned 0x6d [0183.588] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.588] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.588] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a4) returned 0x6f14048 [0183.589] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKBOX.JPG", cAlternateFileName="")) returned 1 [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\button.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned 1 [0183.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg") returned 0x6f [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.589] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.589] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21a8) returned 0x6f14048 [0183.589] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMBOBOX.JPG", cAlternateFileName="")) returned 1 [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\checkbox.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned 1 [0183.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg") returned 0x6f [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.589] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.589] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ac) returned 0x6f14048 [0183.589] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x36bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.JPG", cAlternateFileName="")) returned 1 [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\combobox.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned 1 [0183.589] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg") returned 0x6e [0183.589] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.589] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.589] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b0) returned 0x6f14048 [0183.589] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.JPG", cAlternateFileName="")) returned 1 [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\contact.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned 1 [0183.590] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg") returned 0x6f [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.590] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b4) returned 0x6f14048 [0183.590] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATE.JPG", cAlternateFileName="")) returned 1 [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\currency.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned 1 [0183.590] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg") returned 0x6b [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.590] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21b8) returned 0x6f14048 [0183.590] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4139, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATETIME.JPG", cAlternateFileName="")) returned 1 [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\date.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned 1 [0183.590] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg") returned 0x6f [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.590] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.590] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21bc) returned 0x6f14048 [0183.590] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e01, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalInk.jpg", cAlternateFileName="DIGITA~1.JPG")) returned 1 [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\datetime.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", len=0x71 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned 1 [0183.590] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg") returned 0x71 [0183.590] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.591] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.591] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c0) returned 0x6f14048 [0183.591] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbeddedView.jpg", cAlternateFileName="EMBEDD~1.JPG")) returned 1 [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\digitalink.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", len=0x73 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned 1 [0183.591] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg") returned 0x73 [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.591] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.591] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c4) returned 0x6f14048 [0183.591] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADING.JPG", cAlternateFileName="")) returned 1 [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\embeddedview.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned 1 [0183.591] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg") returned 0x6e [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.591] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.591] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21c8) returned 0x6f14048 [0183.591] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x139a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMAGE.JPG", cAlternateFileName="")) returned 1 [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\heading.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned 1 [0183.591] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg") returned 0x6c [0183.591] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.591] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.591] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21cc) returned 0x6f14048 [0183.591] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINE.JPG", cAlternateFileName="")) returned 1 [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\image.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned 1 [0183.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg") returned 0x6b [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.592] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.592] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d0) returned 0x6f14048 [0183.592] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTBOX.JPG", cAlternateFileName="")) returned 1 [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\line.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned 1 [0183.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg") returned 0x6e [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.592] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.592] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d4) returned 0x6f14048 [0183.592] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUMERIC.JPG", cAlternateFileName="")) returned 1 [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\listbox.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned 1 [0183.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg") returned 0x6e [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.592] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.592] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21d8) returned 0x6f14048 [0183.592] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSWORD.JPG", cAlternateFileName="")) returned 1 [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\numeric.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned 1 [0183.592] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg") returned 0x6f [0183.592] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.593] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.593] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21dc) returned 0x6f14048 [0183.593] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIO.JPG", cAlternateFileName="")) returned 1 [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\password.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned 1 [0183.593] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg") returned 0x6c [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.593] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.593] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e0) returned 0x6f14048 [0183.593] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ad9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SectionHeading.jpg", cAlternateFileName="SECTIO~1.JPG")) returned 1 [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\radio.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", len=0x75 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned 1 [0183.593] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg") returned 0x75 [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.593] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.593] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e4) returned 0x6f14048 [0183.593] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="StaticText.jpg", cAlternateFileName="STATIC~1.JPG")) returned 1 [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\sectionheading.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", len=0x71 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned 1 [0183.593] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg") returned 0x71 [0183.593] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.593] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.593] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21e8) returned 0x6f14048 [0183.593] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3983, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTAREA.JPG", cAlternateFileName="")) returned 1 [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\statictext.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned 1 [0183.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg") returned 0x6f [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.594] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.594] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21ec) returned 0x6f14048 [0183.594] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a97, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTBOX.JPG", cAlternateFileName="")) returned 1 [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textarea.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned 1 [0183.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg") returned 0x6e [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.594] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.594] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f0) returned 0x6f14048 [0183.594] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTVIEW.JPG", cAlternateFileName="")) returned 1 [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textbox.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned 1 [0183.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg") returned 0x6f [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.594] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.594] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f4) returned 0x6f14048 [0183.594] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 1 [0183.594] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\textview.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", len=0x79 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned 1 [0183.594] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg", cchLength=0x79 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\unformattednumeric.jpg") returned 0x79 [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0183.595] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.595] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21f8) returned 0x6f14048 [0183.595] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0183.595] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0183.595] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO") returned 1 [0183.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FORM.ICO", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico") returned 0x5a [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.595] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.595] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x21fc) returned 0x6f14048 [0183.595] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\form.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html") returned 1 [0183.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html") returned 0x65 [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.595] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.595] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2200) returned 0x6f14048 [0183.595] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html") returned 1 [0183.595] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBrowserUpgrade.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html") returned 0x6a [0183.595] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2204) returned 0x6f14048 [0183.596] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x805, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsDoNotTrust.html", cAlternateFileName="FORMSD~1.HTM")) returned 1 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsbrowserupgrade.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html") returned 1 [0183.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsDoNotTrust.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html") returned 0x66 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2208) returned 0x6f14048 [0183.596] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc96, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsdonottrust.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html") returned 1 [0183.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePage.html", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html") returned 0x64 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x220c) returned 0x6f14048 [0183.596] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x15fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js") returned 1 [0183.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageScript.js", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js") returned 0x68 [0183.596] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0183.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2210) returned 0x6f14048 [0183.597] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0183.597] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagescript.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css") returned 1 [0183.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css") returned 0x68 [0183.597] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0183.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0184.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2148) returned 0x6f14048 [0184.377] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0184.377] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html") returned 1 [0184.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPreviewTemplate.html", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html") returned 0x6b [0184.377] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0184.377] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0184.377] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x214c) returned 0x6f14048 [0184.377] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0184.377] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formspreviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html") returned 1 [0184.377] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html") returned 0x69 [0184.378] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0184.378] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0184.378] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2150) returned 0x6f14048 [0184.378] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsTemplates", cAlternateFileName="FORMST~1")) returned 1 [0184.378] SysReAllocStringLen (in: pbstr=0x6a0e2f8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", len=0x61 | out: pbstr=0x6a0e2f8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\") returned 1 [0184.378] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\") returned 0x61 [0184.378] SysReAllocStringLen (in: pbstr=0x6a0e2a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e2a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0184.378] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0184.378] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\*.*", lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9770 [0185.891] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51d354f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0185.891] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2021e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Customer Support.fdt", cAlternateFileName="CUSTOM~1.FDT")) returned 1 [0185.891] SysReAllocStringLen (in: pbstr=0x6a0e2f0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", len=0x75 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt") returned 1 [0185.891] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt") returned 0x75 [0185.891] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.891] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dffc | out: lpFindFileData=0x6a0dffc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51d354f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0185.892] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0185.892] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\_restore files_.txt"), bFailIfExists=0) returned 1 [0185.895] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a0) returned 0x6f14048 [0185.895] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20b43, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardware Tracker.fdt", cAlternateFileName="HARDWA~1.FDT")) returned 1 [0185.895] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", len=0x75 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt") returned 1 [0185.895] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt") returned 0x75 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a4) returned 0x6f14048 [0185.896] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x24051, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hiring Requisition - Customized.fdt", cAlternateFileName="HIRING~2.FDT")) returned 1 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", len=0x84 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", cchLength=0x84 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt") returned 0x84 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20a8) returned 0x6f14048 [0185.896] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x248db, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hiring Requisition.fdt", cAlternateFileName="HIRING~1.FDT")) returned 1 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", len=0x77 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition.fdt", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt") returned 0x77 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.896] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ac) returned 0x6f14048 [0185.896] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a52fdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x17d6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="POLICIES.FDT", cAlternateFileName="")) returned 1 [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT") returned 1 [0185.896] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\POLICIES.FDT", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt") returned 0x6d [0185.896] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.896] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b0) returned 0x6f14048 [0185.897] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16b33, dwReserved0=0x0, dwReserved1=0x0, cFileName="Process Library.fdt", cAlternateFileName="PROCES~1.FDT")) returned 1 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\policies.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", len=0x74 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Process Library.fdt", cchLength=0x74 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt") returned 0x74 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b4) returned 0x6f14048 [0185.897] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x18ead, dwReserved0=0x0, dwReserved1=0x0, cFileName="Status Report.fdt", cAlternateFileName="STATUS~1.FDT")) returned 1 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\process library.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", len=0x72 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Status Report.fdt", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt") returned 0x72 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20b8) returned 0x6f14048 [0185.897] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e666, dwReserved0=0x0, dwReserved1=0x0, cFileName="Track Issues.fdt", cAlternateFileName="TRACKI~1.FDT")) returned 1 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\status report.fdt", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", len=0x71 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Track Issues.fdt", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\track issues.fdt") returned 0x71 [0185.897] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0185.897] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.897] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20bc) returned 0x6f14048 [0185.897] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0185.897] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0185.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm") returned 1 [0185.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsVersion1Warning.htm", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm") returned 0x6a [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c0) returned 0x6f14048 [0185.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsversion1warning.htm", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg") returned 1 [0185.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg") returned 0x6e [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c4) returned 0x6f14048 [0185.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", len=0x72 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp") returned 1 [0185.898] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIconsMask.bmp", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp") returned 0x72 [0185.898] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.898] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.898] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20c8) returned 0x6f14048 [0185.898] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticonsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html") returned 1 [0185.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewFrame.html", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html") returned 0x65 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20cc) returned 0x6f14048 [0185.899] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewframe.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg") returned 1 [0185.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormToolImages.jpg", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg") returned 0x64 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d0) returned 0x6f14048 [0185.899] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveFormsMetaData.xml", cAlternateFileName="GROOVE~1.XML")) returned 1 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formtoolimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml") returned 1 [0185.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml") returned 0x69 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.899] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.899] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d4) returned 0x6f14048 [0185.899] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENUS.JS", cAlternateFileName="")) returned 1 [0185.899] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS") returned 1 [0185.899] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\MENUS.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js") returned 0x5a [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20d8) returned 0x6f14048 [0185.900] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899c7500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5836a590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x899c7500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_arrow.gif", cAlternateFileName="MENU_A~1.GIF")) returned 1 [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menus.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif") returned 1 [0185.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\menu_arrow.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif") returned 0x60 [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20dc) returned 0x6f14048 [0185.900] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4af, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEARCH.GIF", cAlternateFileName="")) returned 1 [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\menu_arrow.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF") returned 1 [0185.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SEARCH.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif") returned 0x5c [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e0) returned 0x6f14048 [0185.900] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x31, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\search.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF") returned 1 [0185.900] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SPACER.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif") returned 0x5c [0185.900] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.900] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.900] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e4) returned 0x6f14048 [0185.901] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc118, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\spacer.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS") returned 1 [0185.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\SUBMIT.JS", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js") returned 0x5b [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20e8) returned 0x6f14048 [0185.901] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e41e350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x103f, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\submit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js") returned 1 [0185.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\utilityfunctions.js", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js") returned 0x65 [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20ec) returned 0x6f14048 [0185.901] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\utilityfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js") returned 1 [0185.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\validation.js", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js") returned 0x5f [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.901] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.901] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f0) returned 0x6f14048 [0185.901] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.CSS", cAlternateFileName="")) returned 1 [0185.901] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\validation.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS") returned 1 [0185.901] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.CSS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css") returned 0x5a [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f4) returned 0x6f14048 [0185.902] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO") returned 1 [0185.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.ICO", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico") returned 0x5a [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20f8) returned 0x6f14048 [0185.902] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x505b, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", len=0x59 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS") returned 1 [0185.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEW.JS", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js") returned 0x59 [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.902] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x20fc) returned 0x6f14048 [0185.902] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x207, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEWBY.GIF", cAlternateFileName="")) returned 1 [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\view.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF") returned 1 [0185.902] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\VIEWBY.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif") returned 0x5c [0185.902] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.902] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2100) returned 0x6f14048 [0185.903] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewDblClick.js", cAlternateFileName="VIEWDB~1.JS")) returned 1 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewby.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js") returned 1 [0185.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewDblClick.js", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js") returned 0x61 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.903] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2104) returned 0x6f14048 [0185.903] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acda200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8acda200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewdblclick.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg") returned 1 [0185.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\ViewHeaderPreview.jpg", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg") returned 0x67 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.903] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2108) returned 0x6f14048 [0185.903] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="viewSelectionChanged.js", cAlternateFileName="VIEWSE~1.JS")) returned 1 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewheaderpreview.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js") returned 1 [0185.903] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\viewSelectionChanged.js", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js") returned 0x69 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.903] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.903] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x210c) returned 0x6f14048 [0185.903] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa507fda0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xa507fda0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0185.903] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\viewselectionchanged.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\_RESTORE FILES_.txt", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\_RESTORE FILES_.txt") returned 1 [0185.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\_RESTORE FILES_.txt", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\_restore files_.txt") returned 0x65 [0185.904] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0185.904] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0185.904] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0185.904] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0185.904] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms3", cAlternateFileName="GR96F1~1")) returned 1 [0185.904] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\") returned 1 [0185.904] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\") returned 0x53 [0185.904] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0185.904] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0185.904] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0187.919] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0189.282] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0189.282] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF") returned 1 [0189.282] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ADD.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif") returned 0x5a [0189.282] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0189.282] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0189.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0189.282] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0189.282] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0193.127] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0193.127] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\add.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg") returned 1 [0193.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrow.jpg", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg") returned 0x65 [0193.127] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.127] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0193.127] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0193.127] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp") returned 1 [0193.127] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\AddToViewArrowMask.bmp", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp") returned 0x69 [0193.127] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.127] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.127] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0193.128] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0193.128] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\addtoviewarrowmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif") returned 1 [0193.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\attention.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif") returned 0x60 [0193.128] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.128] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0193.128] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0193.128] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\attention.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF") returned 1 [0193.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\BG_ADOBE.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif") returned 0x5f [0193.128] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.128] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.128] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0193.128] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0193.128] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_adobe.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif") returned 1 [0193.128] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Casual.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif") returned 0x60 [0193.134] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0193.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0193.176] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_casual.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif") returned 1 [0193.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Country.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif") returned 0x61 [0193.176] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0193.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0193.176] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_country.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif") returned 1 [0193.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Earthy.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif") returned 0x60 [0193.176] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.176] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.176] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0193.176] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0193.176] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_earthy.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif") returned 1 [0193.176] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif") returned 0x67 [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0193.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif") returned 1 [0193.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif") returned 0x6c [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0193.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageSlice.gif", cAlternateFileName="BG_FOR~3.GIF")) returned 1 [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif") returned 1 [0193.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageSlice.gif", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif") returned 0x6c [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.177] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0193.177] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageslice.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif") returned 1 [0193.177] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_GreenTea.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif") returned 0x62 [0193.177] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.177] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0193.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bfecf00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bfecf00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_greentea.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif") returned 1 [0193.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Groove.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif") returned 0x60 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0193.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_groove.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif") returned 1 [0193.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_LightSpirit.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif") returned 0x65 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0193.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_lightspirit.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif") returned 1 [0193.178] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_OliveGreen.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif") returned 0x64 [0193.178] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.178] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.178] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0193.178] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_olivegreen.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif") returned 1 [0193.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_Premium.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif") returned 0x61 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0193.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_premium.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif") returned 1 [0193.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_SlateBlue.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif") returned 0x63 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0193.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_slateblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif") returned 1 [0193.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_TexturedBlue.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif") returned 0x66 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.179] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.179] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0193.179] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0193.179] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_texturedblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif") returned 1 [0193.179] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_VelvetRose.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif") returned 0x64 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0193.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_velvetrose.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif") returned 1 [0193.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif") returned 0x62 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0193.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_over.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif") returned 1 [0193.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_left_over.gif", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif") returned 0x67 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0193.180] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_left_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif") returned 1 [0193.180] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif") returned 0x61 [0193.180] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.180] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.180] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0193.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_over.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif") returned 1 [0193.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_mid_over.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif") returned 0x66 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0193.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right.gif", cAlternateFileName="BU7DFA~1.GIF")) returned 1 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_mid_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif") returned 1 [0193.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif") returned 0x63 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0193.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_over.gif", cAlternateFileName="BU4B4E~1.GIF")) returned 1 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif") returned 1 [0193.181] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\button_right_over.gif", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif") returned 0x68 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.181] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.181] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0193.181] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0193.181] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\button_right_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF") returned 1 [0193.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\CALENDAR.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif") returned 0x5f [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.182] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0193.182] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2ffc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d2ffc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\calendar.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF") returned 1 [0193.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif") returned 0x5d [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.182] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x205c) returned 0x6f14048 [0193.182] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60975c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF") returned 1 [0193.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif") returned 0x5c [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.182] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.182] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2060) returned 0x6f14048 [0193.182] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0193.182] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO") returned 1 [0193.182] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.ICO", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico") returned 0x5b [0193.183] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.183] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2064) returned 0x6f14048 [0193.183] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1388d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0193.183] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS") returned 1 [0193.183] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FORM.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js") returned 0x5a [0193.183] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.183] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0193.183] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45d, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0193.183] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html") returned 1 [0193.183] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBlankPage.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html") returned 0x66 [0193.183] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.183] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.183] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x206c) returned 0x6f14048 [0193.183] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x850, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0193.187] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsblankpage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html") returned 1 [0193.187] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html") returned 0x6b [0193.187] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.187] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.187] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2068) returned 0x6f14048 [0193.187] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html") returned 1 [0193.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html") returned 0x67 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x206c) returned 0x6f14048 [0193.188] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc94, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html") returned 1 [0193.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsFormTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html") returned 0x69 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2070) returned 0x6f14048 [0193.188] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsformtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html") returned 1 [0193.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePage.html", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html") returned 0x65 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.188] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.188] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2074) returned 0x6f14048 [0193.188] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1dda, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0193.188] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js") returned 1 [0193.188] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageScript.js", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js") returned 0x69 [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2078) returned 0x6f14048 [0193.189] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagescript.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css") returned 1 [0193.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsHomePageStyle.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css") returned 0x69 [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x207c) returned 0x6f14048 [0193.189] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formshomepagestyle.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html") returned 1 [0193.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsImageTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html") returned 0x6a [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.189] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2080) returned 0x6f14048 [0193.189] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x856, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsimagetemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html") returned 1 [0193.189] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsMacroTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html") returned 0x6a [0193.189] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.189] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2084) returned 0x6f14048 [0193.190] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsmacrotemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html") returned 1 [0193.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPreviewTemplate.html", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html") returned 0x6c [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.190] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2088) returned 0x6f14048 [0193.190] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formspreviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html") returned 1 [0193.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsPrintTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html") returned 0x6a [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0193.190] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.190] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x208c) returned 0x6f14048 [0193.190] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e2f8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", len=0x5f | out: pbstr=0x6a0e2f8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\") returned 1 [0193.190] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\") returned 0x5f [0193.190] SysReAllocStringLen (in: pbstr=0x6a0e2a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e2a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.190] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.190] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\*.*", lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9770 [0193.288] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.405] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0193.405] SysReAllocStringLen (in: pbstr=0x6a0e2f0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css") returned 1 [0193.405] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css") returned 0x68 [0193.405] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0193.405] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dffc | out: lpFindFileData=0x6a0dffc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0193.405] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.405] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0193.472] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0193.472] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", len=0x69 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned 1 [0193.472] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\") returned 0x69 [0193.472] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.472] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0193.550] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.550] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0193.550] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0193.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", cchLength=0x74 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif") returned 0x74 [0193.550] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528d0030, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0193.551] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.551] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.947] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0193.947] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0193.947] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0193.947] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif") returned 0x73 [0193.948] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.948] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0193.948] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.948] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.948] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0193.948] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css") returned 1 [0193.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css") returned 0x6c [0193.948] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0193.948] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.948] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0193.948] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0193.948] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", len=0x68 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned 1 [0193.948] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\") returned 0x68 [0193.948] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.948] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.948] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0193.949] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.949] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0193.949] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0193.949] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif") returned 0x72 [0193.949] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.949] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528d0030, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0193.949] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.949] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0193.952] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0193.952] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0193.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif") returned 0x72 [0193.952] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0193.952] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0193.952] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0193.952] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif") returned 0x73 [0193.952] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.952] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.952] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0193.952] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0193.953] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0193.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif") returned 0x72 [0193.953] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0193.953] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.953] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.953] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0193.953] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css") returned 1 [0193.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css") returned 0x6b [0193.953] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0193.953] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.953] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0193.953] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay", cAlternateFileName="")) returned 1 [0193.953] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", len=0x66 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned 1 [0193.953] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\") returned 0x66 [0193.953] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.953] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.953] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0193.972] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.972] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0193.972] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0193.972] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif") returned 0x71 [0193.972] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.972] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.972] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0193.972] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.972] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0193.977] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0193.977] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0193.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay\\tab_on.gif") returned 0x70 [0193.977] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.977] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.977] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0193.977] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.977] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.977] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0193.977] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css") returned 1 [0193.977] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css") returned 0x69 [0193.978] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0193.978] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.978] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0193.978] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0193.978] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", len=0x6c | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned 1 [0193.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\") returned 0x6c [0193.978] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.978] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0193.978] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.978] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0193.978] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", len=0x7a | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0193.978] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif", cchLength=0x7a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif") returned 0x7a [0193.979] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.979] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0193.979] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0193.979] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\_restore files_.txt"), bFailIfExists=0) returned 1 [0193.983] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0193.983] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="button.gif", cAlternateFileName="")) returned 1 [0193.983] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned 1 [0193.983] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif") returned 0x76 [0193.983] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.983] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.983] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0193.983] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0193.983] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", len=0x77 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned 1 [0193.984] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif") returned 0x77 [0193.984] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.984] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0193.984] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0193.984] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned 1 [0193.984] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange\\tab_on.gif") returned 0x76 [0193.984] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0193.984] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0193.984] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0193.984] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0193.984] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0193.984] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css") returned 1 [0193.984] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css") returned 0x6f [0193.984] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0193.984] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0193.984] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0193.984] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0193.985] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", len=0x6c | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\") returned 1 [0193.985] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\") returned 0x6c [0193.985] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0193.985] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0193.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0193.986] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.987] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0193.990] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0194.003] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\HEADER.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif") returned 0x76 [0194.003] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.003] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.003] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0194.003] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.003] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\_restore files_.txt"), bFailIfExists=0) returned 1 [0194.005] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0194.005] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0194.005] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0194.005] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif") returned 0x77 [0194.005] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.005] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0194.006] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0194.006] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0194.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow\\TAB_ON.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow\\tab_on.gif") returned 0x76 [0194.006] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.006] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0194.006] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.006] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.006] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0194.006] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css") returned 1 [0194.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightYellow.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css") returned 0x6f [0194.006] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.006] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.006] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2034) returned 0x6f14048 [0194.006] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0194.006] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightyellow.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css") returned 1 [0194.006] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Casual.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css") returned 0x69 [0194.006] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.007] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.007] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0194.007] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="Country.css", cAlternateFileName="")) returned 1 [0194.007] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\casual.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", len=0x6a | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css") returned 1 [0194.007] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Country.css", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css") returned 0x6a [0194.007] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.007] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.007] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0194.007] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert", cAlternateFileName="")) returned 1 [0194.007] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", len=0x66 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\") returned 1 [0194.007] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\") returned 0x66 [0194.007] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0194.007] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0194.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0194.017] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.017] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0194.017] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0194.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif") returned 0x70 [0194.018] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.024] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.028] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0194.028] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.028] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\_restore files_.txt"), bFailIfExists=0) returned 1 [0194.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2038) returned 0x6f14048 [0194.031] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0194.031] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0194.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif") returned 0x71 [0194.031] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x203c) returned 0x6f14048 [0194.031] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0194.031] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0194.031] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif") returned 0x70 [0194.031] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.031] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.031] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2040) returned 0x6f14048 [0194.031] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.031] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.031] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0194.031] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\country.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css") returned 1 [0194.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css") returned 0x69 [0194.032] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2044) returned 0x6f14048 [0194.032] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0194.032] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css") returned 1 [0194.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Earthy.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css") returned 0x69 [0194.032] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.032] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.032] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0194.032] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0194.032] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", len=0x69 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\") returned 1 [0194.032] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\") returned 0x69 [0194.032] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0194.032] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0194.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0194.033] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.033] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0194.033] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0194.033] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif") returned 0x73 [0194.033] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.033] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.033] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0194.033] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0194.033] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\_restore files_.txt"), bFailIfExists=0) returned 1 [0194.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2048) returned 0x6f14048 [0194.043] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0194.043] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0194.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", cchLength=0x74 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif") returned 0x74 [0194.043] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x204c) returned 0x6f14048 [0194.043] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0194.043] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0194.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_ON.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_on.gif") returned 0x73 [0194.043] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0194.043] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.043] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2050) returned 0x6f14048 [0194.043] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0194.043] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0194.043] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xaf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0194.043] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\earthy.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css") returned 1 [0194.043] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css") returned 0x6c [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2054) returned 0x6f14048 [0194.044] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css") returned 1 [0194.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GreenTea.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css") returned 0x6b [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2058) returned 0x6f14048 [0194.044] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x411, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\greentea.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css") returned 1 [0194.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\LightSpirit.css", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css") returned 0x6e [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0194.044] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0194.044] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x205c) returned 0x6f14048 [0194.044] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime", cAlternateFileName="")) returned 1 [0194.044] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", len=0x64 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\") returned 1 [0194.044] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\") returned 0x64 [0194.044] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0194.044] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0194.045] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0197.227] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.227] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0197.227] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0197.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif") returned 0x6f [0197.227] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0197.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0197.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0197.227] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0197.228] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0199.142] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0199.142] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0199.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif") returned 0x6e [0199.142] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0199.143] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.143] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.143] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91f4b000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91f4b000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0199.143] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lightspirit.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css") returned 1 [0199.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css") returned 0x67 [0199.143] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0199.143] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0199.143] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css") returned 1 [0199.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Maroon.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css") returned 0x69 [0199.144] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0199.144] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0199.144] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\") returned 1 [0199.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\") returned 0x65 [0199.144] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.144] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.144] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.144] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.144] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0199.144] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0199.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\HEADER.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif") returned 0x6f [0199.144] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.145] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.145] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0199.147] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0199.147] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0199.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_OFF.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif") returned 0x70 [0199.147] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0199.147] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0199.147] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0199.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis\\TAB_ON.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis\\tab_on.gif") returned 0x6f [0199.147] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0199.147] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.147] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.147] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\maroon.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css") returned 1 [0199.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Oasis.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css") returned 0x68 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0199.148] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\oasis.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css") returned 1 [0199.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\OliveGreen.css", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css") returned 0x6d [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0199.148] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\olivegreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", len=0x6a | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css") returned 1 [0199.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Premium.css", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css") returned 0x6a [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.148] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.148] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0199.148] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate", cAlternateFileName="")) returned 1 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\") returned 1 [0199.148] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\") returned 0x65 [0199.148] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.149] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.149] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.247] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.247] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0199.247] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0199.247] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_OFF.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif") returned 0x70 [0199.247] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.247] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.247] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.250] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0199.250] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0199.250] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0199.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate\\TAB_ON.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate\\tab_on.gif") returned 0x6f [0199.250] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.250] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.250] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0199.250] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.250] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.250] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0199.250] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\premium.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css") returned 1 [0199.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Slate.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css") returned 0x68 [0199.250] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.250] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.250] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0199.250] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0199.250] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slate.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css") returned 1 [0199.250] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SlateBlue.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css") returned 0x6c [0199.250] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.251] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.251] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0199.251] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0199.251] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", len=0x68 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\") returned 1 [0199.251] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\") returned 0x68 [0199.251] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.251] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.251] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.251] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0199.251] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0199.251] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\background.gif", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif") returned 0x76 [0199.251] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.251] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.252] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.252] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0199.254] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0199.254] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif") returned 1 [0199.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_off.gif", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif") returned 0x73 [0199.254] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0199.254] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0199.254] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif") returned 1 [0199.254] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue\\tab_on.gif", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue\\tab_on.gif") returned 0x72 [0199.254] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.254] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.254] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0199.254] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.254] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.254] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9325dd00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9325dd00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe34, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0199.255] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\slateblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css") returned 1 [0199.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SoftBlue.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css") returned 0x6b [0199.255] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.255] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.255] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0199.255] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0199.255] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", len=0x6b | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\") returned 1 [0199.255] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\") returned 0x6b [0199.255] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.255] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.307] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.307] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0199.307] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x75 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0199.307] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\BUTTON.GIF", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif") returned 0x75 [0199.307] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.307] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.307] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.307] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.309] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0199.310] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0199.310] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0199.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif") returned 0x76 [0199.310] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0199.310] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0199.310] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x75 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0199.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen\\TAB_ON.GIF", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen\\tab_on.gif") returned 0x75 [0199.310] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.310] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0199.310] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.310] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.310] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0199.310] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\softblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css") returned 1 [0199.310] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\SpringGreen.css", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css") returned 0x6e [0199.310] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.310] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0199.311] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x736, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0199.311] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\springgreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", len=0x66 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css") returned 1 [0199.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts.css", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css") returned 0x66 [0199.311] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.311] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.311] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0199.311] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0199.311] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", len=0x64 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\") returned 1 [0199.311] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\") returned 0x64 [0199.311] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.311] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.311] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.449] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.449] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0199.449] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif") returned 1 [0199.449] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\background.gif", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif") returned 0x72 [0199.449] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.449] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x528f6190, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.449] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.450] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f88) returned 0x6f14048 [0199.453] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.gif", cAlternateFileName="")) returned 1 [0199.453] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif") returned 1 [0199.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\header.gif", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif") returned 0x6e [0199.453] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.453] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.453] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f8c) returned 0x6f14048 [0199.453] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0199.453] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif") returned 1 [0199.453] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_off.gif", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif") returned 0x6f [0199.453] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f90) returned 0x6f14048 [0199.454] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0199.454] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif") returned 1 [0199.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\STS2\\tab_on.gif", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2\\tab_on.gif") returned 0x6e [0199.454] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f94) returned 0x6f14048 [0199.454] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.454] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.454] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94570a00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94570a00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0199.454] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css") returned 1 [0199.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Sts2.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css") returned 0x67 [0199.454] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.454] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.454] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f98) returned 0x6f14048 [0199.454] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl", cAlternateFileName="")) returned 1 [0199.454] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\") returned 1 [0199.454] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\") returned 0x65 [0199.455] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.455] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0199.455] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5291c2f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618c8a10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0199.455] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0199.455] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif") returned 1 [0199.455] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\background.gif", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif") returned 0x73 [0199.455] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.455] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5291c2f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0199.455] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0199.455] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\_restore files_.txt"), bFailIfExists=0) returned 1 [0199.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f9c) returned 0x6f14048 [0199.459] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="header.gif", cAlternateFileName="")) returned 1 [0199.459] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif") returned 1 [0199.459] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\header.gif", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif") returned 0x6f [0199.459] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.459] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.459] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa0) returned 0x6f14048 [0199.459] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0199.460] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif") returned 1 [0199.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_off.gif", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif") returned 0x70 [0199.460] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa4) returned 0x6f14048 [0199.460] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0199.460] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif") returned 1 [0199.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl\\tab_on.gif", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl\\tab_on.gif") returned 0x6f [0199.460] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0199.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fa8) returned 0x6f14048 [0199.460] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.460] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0199.460] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc23, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0199.460] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\sts2.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css") returned 1 [0199.460] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Swirl.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css") returned 0x68 [0199.460] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.460] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.460] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fac) returned 0x6f14048 [0199.460] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\swirl.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css") returned 1 [0199.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Teal.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css") returned 0x67 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb0) returned 0x6f14048 [0199.461] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\teal.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css") returned 1 [0199.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\TexturedBlue.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css") returned 0x6f [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb4) returned 0x6f14048 [0199.461] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\texturedblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css") returned 1 [0199.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\VelvetRose.css", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css") returned 0x6d [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.461] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.461] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fb8) returned 0x6f14048 [0199.461] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae39fe0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xaae39fe0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\velvetrose.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\_RESTORE FILES_.txt", len=0x72 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\_RESTORE FILES_.txt") returned 1 [0199.461] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\_RESTORE FILES_.txt", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\_restore files_.txt") returned 0x72 [0199.461] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0199.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.462] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.462] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0199.462] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0199.462] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsprinttemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm") returned 1 [0199.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsVersion1Warning.htm", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm") returned 0x6b [0199.462] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fbc) returned 0x6f14048 [0199.462] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ee3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0199.462] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsversion1warning.htm", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg") returned 1 [0199.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIcons.jpg", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg") returned 0x6f [0199.462] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.462] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.462] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc0) returned 0x6f14048 [0199.462] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0199.462] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp") returned 1 [0199.462] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewAttachmentIconsMask.bmp", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp") returned 0x73 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc4) returned 0x6f14048 [0199.463] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95883700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95883700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1313, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewattachmenticonsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html") returned 1 [0199.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewFrame.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html") returned 0x66 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fc8) returned 0x6f14048 [0199.463] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa89, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewframe.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html") returned 1 [0199.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsViewTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html") returned 0x69 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.463] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fcc) returned 0x6f14048 [0199.463] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg") returned 1 [0199.463] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormToolImages.jpg", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg") returned 0x65 [0199.463] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.463] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd0) returned 0x6f14048 [0199.464] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e612900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e612900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x23ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formtoolimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js") returned 1 [0199.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\form_edit.js", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js") returned 0x5f [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd4) returned 0x6f14048 [0199.464] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\form_edit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF") returned 1 [0199.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\LAUNCH.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif") returned 0x5d [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fd8) returned 0x6f14048 [0199.464] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x0, dwReserved1=0x0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\launch.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif") returned 1 [0199.464] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\macroprogress.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif") returned 0x64 [0199.464] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.464] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.464] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fdc) returned 0x6f14048 [0199.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1018, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\macroprogress.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js") returned 1 [0199.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\PublicFunctions.js", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js") returned 0x65 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe0) returned 0x6f14048 [0199.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\publicfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif") returned 1 [0199.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignleft.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif") returned 0x64 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe4) returned 0x6f14048 [0199.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignleft.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif") returned 1 [0199.465] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_alignright.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif") returned 0x65 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.465] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.465] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fe8) returned 0x6f14048 [0199.465] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0199.465] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_alignright.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF") returned 1 [0199.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\RTF_BOLD.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif") returned 0x5f [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1fec) returned 0x6f14048 [0199.466] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bold.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif") returned 1 [0199.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_bullets.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif") returned 0x62 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff0) returned 0x6f14048 [0199.466] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_bullets.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif") returned 1 [0199.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_center.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif") returned 0x61 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.466] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.466] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff4) returned 0x6f14048 [0199.466] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_center.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif") returned 1 [0199.466] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosecolor.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif") returned 0x66 [0199.466] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ff8) returned 0x6f14048 [0199.467] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96b96400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96b96400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosecolor.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif") returned 1 [0199.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_choosefont.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif") returned 0x65 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ffc) returned 0x6f14048 [0199.467] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_choosefont.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif") returned 1 [0199.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_decreaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif") returned 0x69 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.467] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2000) returned 0x6f14048 [0199.467] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_decreaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif") returned 1 [0199.467] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_increaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif") returned 0x69 [0199.467] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.467] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2004) returned 0x6f14048 [0199.468] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_increaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif") returned 1 [0199.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_italic.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif") returned 0x61 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2008) returned 0x6f14048 [0199.468] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_italic.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif") returned 1 [0199.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_justify.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif") returned 0x62 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x200c) returned 0x6f14048 [0199.468] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_justify.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif") returned 1 [0199.468] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_pressed.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif") returned 0x62 [0199.468] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.468] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.468] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2010) returned 0x6f14048 [0199.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_pressed.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif") returned 1 [0199.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\rtf_underline.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif") returned 0x64 [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2014) returned 0x6f14048 [0199.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\rtf_underline.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF") returned 1 [0199.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SAVE.GIF", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif") returned 0x5b [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2018) returned 0x6f14048 [0199.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97ea9100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97ea9100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\save.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS") returned 1 [0199.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\SUBMIT.JS", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js") returned 0x5c [0199.469] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.469] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x201c) returned 0x6f14048 [0199.469] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6e57, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\submit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js") returned 1 [0199.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\utilityfunctions.js", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js") returned 0x66 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2020) returned 0x6f14048 [0199.470] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6427, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\utilityfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js") returned 1 [0199.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\validation.js", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js") returned 0x60 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2024) returned 0x6f14048 [0199.470] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\validation.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO") returned 1 [0199.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.ICO", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico") returned 0x5b [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.470] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.470] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2028) returned 0x6f14048 [0199.470] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1db1, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS") returned 1 [0199.470] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\VIEW.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js") returned 0x5a [0199.470] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.471] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x202c) returned 0x6f14048 [0199.471] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\view.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg") returned 1 [0199.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ViewHeaderPreview.jpg", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg") returned 0x68 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.471] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.471] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x2030) returned 0x6f14048 [0199.471] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b8ff80, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xa8b8ff80, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\viewheaderpreview.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\_RESTORE FILES_.txt", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\_RESTORE FILES_.txt") returned 1 [0199.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\_RESTORE FILES_.txt", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\_restore files_.txt") returned 0x66 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0199.471] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0199.471] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0199.471] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0199.471] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms4", cAlternateFileName="GROOVE~4")) returned 1 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\") returned 1 [0199.471] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\") returned 0x53 [0199.471] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0199.471] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0199.472] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0199.993] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x706f8370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0200.726] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0200.726] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF") returned 1 [0200.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ADD.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif") returned 0x5a [0200.726] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0200.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0200.726] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0200.727] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0200.727] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.013] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eb8) returned 0x6f14048 [0203.013] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xbe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrow.jpg", cAlternateFileName="ADDTOV~1.JPG")) returned 1 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\add.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg") returned 1 [0203.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrow.jpg", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg") returned 0x65 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.014] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ebc) returned 0x6f14048 [0203.014] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x924, dwReserved0=0x0, dwReserved1=0x0, cFileName="AddToViewArrowMask.bmp", cAlternateFileName="ADDTOV~1.BMP")) returned 1 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrow.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp") returned 1 [0203.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\AddToViewArrowMask.bmp", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp") returned 0x69 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.014] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.014] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec0) returned 0x6f14048 [0203.014] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\addtoviewarrowmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif") returned 1 [0203.014] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\attention.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif") returned 0x60 [0203.014] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.014] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec4) returned 0x6f14048 [0203.015] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x614e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BG_ADOBE.GIF", cAlternateFileName="")) returned 1 [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\attention.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF") returned 1 [0203.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\BG_ADOBE.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif") returned 0x5f [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.015] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ec8) returned 0x6f14048 [0203.015] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x161d, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Casual.gif", cAlternateFileName="BG_CAS~1.GIF")) returned 1 [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_adobe.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif") returned 1 [0203.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Casual.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif") returned 0x60 [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.015] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ecc) returned 0x6f14048 [0203.015] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x991bbe00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x991bbe00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7dd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Country.gif", cAlternateFileName="BG_COU~1.GIF")) returned 1 [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_casual.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif") returned 1 [0203.015] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Country.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif") returned 0x61 [0203.015] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.015] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.015] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed0) returned 0x6f14048 [0203.015] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x132a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Earthy.gif", cAlternateFileName="BG_EAR~1.GIF")) returned 1 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_country.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif") returned 1 [0203.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Earthy.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif") returned 0x60 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.016] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.016] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed4) returned 0x6f14048 [0203.016] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x167bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePage.gif", cAlternateFileName="BG_FOR~1.GIF")) returned 1 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_earthy.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif") returned 1 [0203.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePage.gif", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif") returned 0x67 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.016] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.016] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ed8) returned 0x6f14048 [0203.016] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4ebb, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageBlank.gif", cAlternateFileName="BG_FOR~2.GIF")) returned 1 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepage.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif") returned 1 [0203.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageBlank.gif", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif") returned 0x6c [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.016] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.016] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1edc) returned 0x6f14048 [0203.016] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x40f, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_FormsHomePageSlice.gif", cAlternateFileName="BG_FOR~3.GIF")) returned 1 [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageblank.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif") returned 1 [0203.016] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_FormsHomePageSlice.gif", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif") returned 0x6c [0203.016] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.017] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee0) returned 0x6f14048 [0203.017] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f644b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5690, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_GreenTea.gif", cAlternateFileName="BG_GRE~1.GIF")) returned 1 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_formshomepageslice.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif") returned 1 [0203.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_GreenTea.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif") returned 0x62 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.017] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee4) returned 0x6f14048 [0203.017] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Groove.gif", cAlternateFileName="BG_GRO~1.GIF")) returned 1 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_greentea.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif") returned 1 [0203.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Groove.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif") returned 0x60 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.017] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ee8) returned 0x6f14048 [0203.017] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_LightSpirit.gif", cAlternateFileName="BG_LIG~1.GIF")) returned 1 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_groove.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif") returned 1 [0203.017] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_LightSpirit.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif") returned 0x65 [0203.017] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.017] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.017] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1eec) returned 0x6f14048 [0203.017] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d57, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_OliveGreen.gif", cAlternateFileName="BG_OLI~1.GIF")) returned 1 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_lightspirit.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif") returned 1 [0203.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_OliveGreen.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif") returned 0x64 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef0) returned 0x6f14048 [0203.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1845, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_Premium.gif", cAlternateFileName="BG_PRE~1.GIF")) returned 1 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_olivegreen.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif") returned 1 [0203.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_Premium.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif") returned 0x61 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0203.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5141, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_SlateBlue.gif", cAlternateFileName="BG_SLA~1.GIF")) returned 1 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_premium.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif") returned 1 [0203.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_SlateBlue.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif") returned 0x63 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.018] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.018] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0203.018] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f66ac70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x193c, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_TexturedBlue.gif", cAlternateFileName="BG_TEX~1.GIF")) returned 1 [0203.018] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_slateblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif") returned 1 [0203.018] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_TexturedBlue.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif") returned 0x66 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.019] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6f14048 [0203.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c64, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg_VelvetRose.gif", cAlternateFileName="BG_VEL~1.GIF")) returned 1 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_texturedblue.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif") returned 1 [0203.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\bg_VelvetRose.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif") returned 0x64 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.019] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f00) returned 0x6f14048 [0203.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a4ceb00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a4ceb00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left.gif", cAlternateFileName="BUTTON~1.GIF")) returned 1 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\bg_velvetrose.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif") returned 1 [0203.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif") returned 0x62 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.019] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.019] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f04) returned 0x6f14048 [0203.019] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_left_over.gif", cAlternateFileName="BUTTON~2.GIF")) returned 1 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif") returned 1 [0203.019] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_left_over.gif", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif") returned 0x67 [0203.019] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.020] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.020] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f08) returned 0x6f14048 [0203.020] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid.gif", cAlternateFileName="BUTTON~3.GIF")) returned 1 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_left_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif") returned 1 [0203.020] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif") returned 0x61 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.020] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.020] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f0c) returned 0x6f14048 [0203.020] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_mid_over.gif", cAlternateFileName="BU1E84~1.GIF")) returned 1 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif") returned 1 [0203.020] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_mid_over.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif") returned 0x66 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.020] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.020] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f10) returned 0x6f14048 [0203.020] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x171, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right.gif", cAlternateFileName="BUTTON~4.GIF")) returned 1 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_mid_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", len=0x63 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif") returned 1 [0203.020] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right.gif", cchLength=0x63 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif") returned 0x63 [0203.020] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.020] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.020] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f14) returned 0x6f14048 [0203.021] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="button_right_over.gif", cAlternateFileName="BU4B4E~1.GIF")) returned 1 [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif") returned 1 [0203.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\button_right_over.gif", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif") returned 0x68 [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.021] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.021] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0203.021] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\button_right_over.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF") returned 1 [0203.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\CALENDAR.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif") returned 0x5f [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.021] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.021] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0203.021] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\calendar.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF") returned 1 [0203.021] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\DELETE.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif") returned 0x5d [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.021] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.021] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0203.021] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0203.021] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\delete.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF") returned 1 [0203.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ERROR.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif") returned 0x5c [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.022] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.022] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0203.022] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.ICO", cAlternateFileName="")) returned 1 [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\error.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO") returned 1 [0203.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.ICO", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico") returned 0x5b [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.022] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.022] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0203.022] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x135f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS") returned 1 [0203.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FORM.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js") returned 0x5a [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.022] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.022] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0203.022] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x45f, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html") returned 1 [0203.022] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBlankPage.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html") returned 0x66 [0203.022] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.022] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.023] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0203.023] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x852, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0203.099] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsblankpage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html") returned 1 [0203.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsBrowserUpgrade.html", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html") returned 0x6b [0203.099] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.099] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.099] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0203.099] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0203.099] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsbrowserupgrade.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html") returned 1 [0203.099] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsColorChart.html", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html") returned 0x67 [0203.099] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.099] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.100] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0203.100] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x115a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formscolorchart.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html") returned 1 [0203.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsFormTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html") returned 0x69 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.100] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.100] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0203.100] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePage.html", cAlternateFileName="FORMSH~1.HTM")) returned 1 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsformtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html") returned 1 [0203.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePage.html", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html") returned 0x65 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.100] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.100] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0203.100] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageScript.js", cAlternateFileName="FORMSH~1.JS")) returned 1 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js") returned 1 [0203.100] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageScript.js", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js") returned 0x69 [0203.100] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.100] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.100] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0203.100] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsHomePageStyle.css", cAlternateFileName="FORMSH~1.CSS")) returned 1 [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagescript.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css") returned 1 [0203.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css") returned 0x69 [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.101] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.101] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0203.101] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html") returned 1 [0203.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsImageTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html") returned 0x6a [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.101] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.101] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0203.101] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsimagetemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html") returned 1 [0203.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsMacroTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html") returned 0x6a [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.101] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.101] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0203.101] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529685b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0203.101] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsmacrotemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html") returned 1 [0203.101] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPreviewTemplate.html", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html") returned 0x6c [0203.102] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.102] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.102] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0203.102] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x612, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0203.102] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formspreviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html") returned 1 [0203.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsPrintTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html") returned 0x6a [0203.102] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0203.102] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.102] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0203.102] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsStyles", cAlternateFileName="FORMSS~1")) returned 1 [0203.102] SysReAllocStringLen (in: pbstr=0x6a0e2f8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", len=0x5f | out: pbstr=0x6a0e2f8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\") returned 1 [0203.102] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\") returned 0x5f [0203.102] SysReAllocStringLen (in: pbstr=0x6a0e2a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e2a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.102] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.102] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\*.*", lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9770 [0203.125] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.160] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x75f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.css", cAlternateFileName="")) returned 1 [0203.160] SysReAllocStringLen (in: pbstr=0x6a0e2f0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css") returned 1 [0203.160] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css") returned 0x68 [0203.160] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.160] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dffc | out: lpFindFileData=0x6a0dffc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0203.160] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.160] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f18) returned 0x6f14048 [0203.677] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana", cAlternateFileName="AMERIC~1")) returned 1 [0203.677] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", len=0x69 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned 1 [0203.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\") returned 0x69 [0203.677] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.677] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.677] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.678] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.678] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.678] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned 1 [0203.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF", cchLength=0x74 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif") returned 0x74 [0203.678] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5133d8d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.678] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.678] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.680] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f1c) returned 0x6f14048 [0203.680] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.681] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned 1 [0203.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana\\tab_on.gif") returned 0x73 [0203.681] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f20) returned 0x6f14048 [0203.681] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.681] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.681] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Americana.css", cAlternateFileName="AMERIC~1.CSS")) returned 1 [0203.681] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css") returned 1 [0203.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css") returned 0x6c [0203.681] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f24) returned 0x6f14048 [0203.681] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue", cAlternateFileName="")) returned 1 [0203.681] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", len=0x68 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned 1 [0203.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\") returned 0x68 [0203.681] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.681] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.682] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.682] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0203.682] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned 1 [0203.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif") returned 0x72 [0203.682] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.682] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51767f50, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.682] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.682] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f28) returned 0x6f14048 [0203.684] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.684] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned 1 [0203.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif") returned 0x72 [0203.685] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f2c) returned 0x6f14048 [0203.685] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.685] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned 1 [0203.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif") returned 0x73 [0203.685] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f30) returned 0x6f14048 [0203.685] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.685] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned 1 [0203.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif") returned 0x72 [0203.685] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f34) returned 0x6f14048 [0203.685] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.685] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.685] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x100d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBlue.css", cAlternateFileName="")) returned 1 [0203.686] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css") returned 1 [0203.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css") returned 0x6b [0203.686] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.686] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f38) returned 0x6f14048 [0203.686] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay", cAlternateFileName="")) returned 1 [0203.686] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", len=0x66 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned 1 [0203.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\") returned 0x66 [0203.686] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.686] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.687] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.687] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.687] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned 1 [0203.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif") returned 0x71 [0203.687] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x519a33f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.688] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.688] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.690] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f3c) returned 0x6f14048 [0203.690] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.690] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned 1 [0203.690] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay\\tab_on.gif") returned 0x70 [0203.690] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.690] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f40) returned 0x6f14048 [0203.691] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.691] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.691] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519a33f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1103, dwReserved0=0x0, dwReserved1=0x0, cFileName="Biscay.css", cAlternateFileName="")) returned 1 [0203.691] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css") returned 1 [0203.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css") returned 0x69 [0203.691] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.691] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.691] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f44) returned 0x6f14048 [0203.691] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange", cAlternateFileName="BRIGHT~1")) returned 1 [0203.691] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", len=0x6c | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned 1 [0203.691] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\") returned 0x6c [0203.691] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.691] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.691] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.692] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.692] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0203.692] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", len=0x7a | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned 1 [0203.692] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif", cchLength=0x7a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif") returned 0x7a [0203.692] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.692] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.692] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a87c30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.692] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.692] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.696] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f48) returned 0x6f14048 [0203.696] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned 1 [0203.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif") returned 0x76 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.696] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.696] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f4c) returned 0x6f14048 [0203.696] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned 1 [0203.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif") returned 0x77 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.696] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.696] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f50) returned 0x6f14048 [0203.696] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned 1 [0203.696] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange\\tab_on.gif") returned 0x76 [0203.696] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.697] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.697] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f54) returned 0x6f14048 [0203.697] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.697] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.697] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightOrange.css", cAlternateFileName="BRIGHT~1.CSS")) returned 1 [0203.697] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css") returned 1 [0203.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css") returned 0x6f [0203.697] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.697] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.697] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f58) returned 0x6f14048 [0203.697] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow", cAlternateFileName="BRIGHT~2")) returned 1 [0203.697] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", len=0x6c | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned 1 [0203.697] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\") returned 0x6c [0203.697] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.697] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.697] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.698] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.698] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.698] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned 1 [0203.698] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif") returned 0x76 [0203.698] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.699] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a87c30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.699] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.699] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f5c) returned 0x6f14048 [0203.701] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.701] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", len=0x77 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned 1 [0203.701] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif") returned 0x77 [0203.701] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.701] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.701] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f60) returned 0x6f14048 [0203.701] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.702] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned 1 [0203.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow\\tab_on.gif") returned 0x76 [0203.702] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f64) returned 0x6f14048 [0203.702] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.702] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.702] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1074, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrightYellow.css", cAlternateFileName="BRIGHT~2.CSS")) returned 1 [0203.702] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css") returned 1 [0203.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css") returned 0x6f [0203.702] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f68) returned 0x6f14048 [0203.702] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casual.css", cAlternateFileName="")) returned 1 [0203.702] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightyellow.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css") returned 1 [0203.702] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Casual.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css") returned 0x69 [0203.702] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.702] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.702] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f6c) returned 0x6f14048 [0203.703] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Country.css", cAlternateFileName="")) returned 1 [0203.703] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\casual.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", len=0x6a | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css") returned 1 [0203.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Country.css", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css") returned 0x6a [0203.703] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.703] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.703] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f70) returned 0x6f14048 [0203.703] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert", cAlternateFileName="")) returned 1 [0203.703] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", len=0x66 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\") returned 1 [0203.703] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\") returned 0x66 [0203.703] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.703] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0203.703] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51da7910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60760930, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.703] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x94, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0203.703] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF") returned 1 [0203.704] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\HEADER.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif") returned 0x70 [0203.704] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.704] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51da7910, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0203.704] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0203.704] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\_restore files_.txt"), bFailIfExists=0) returned 1 [0203.706] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f74) returned 0x6f14048 [0203.706] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0203.706] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", len=0x71 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF") returned 1 [0203.706] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_OFF.GIF", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif") returned 0x71 [0203.706] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.706] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f78) returned 0x6f14048 [0203.707] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0203.707] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF") returned 1 [0203.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert\\TAB_ON.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert\\tab_on.gif") returned 0x70 [0203.707] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0203.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f7c) returned 0x6f14048 [0203.707] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0203.707] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0203.707] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd35, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.css", cAlternateFileName="")) returned 1 [0203.707] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\country.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css") returned 1 [0203.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Desert.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css") returned 0x69 [0203.707] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.707] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.707] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f80) returned 0x6f14048 [0203.707] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x72e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Earthy.css", cAlternateFileName="")) returned 1 [0203.707] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\desert.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css") returned 1 [0203.707] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Earthy.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css") returned 0x69 [0203.708] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0203.708] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0203.708] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1f84) returned 0x6f14048 [0203.708] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck", cAlternateFileName="GRAYCH~1")) returned 1 [0203.708] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", len=0x69 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\") returned 1 [0203.708] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\") returned 0x69 [0203.708] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0203.708] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0203.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0206.780] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52c3bfd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61ab7bf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.780] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0206.780] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF") returned 1 [0206.780] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\HEADER.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif") returned 0x73 [0206.780] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0206.780] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0206.780] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0de28, dwReserved1=0x771a1ecd, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0206.780] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0206.780] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\_restore files_.txt"), bFailIfExists=0) returned 1 [0209.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef4) returned 0x6f14048 [0209.815] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0209.815] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", len=0x74 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF") returned 1 [0209.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", cchLength=0x74 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif") returned 0x74 [0209.815] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0209.815] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1ef8) returned 0x6f14048 [0209.815] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0209.815] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF") returned 1 [0209.815] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck\\TAB_ON.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck\\tab_on.gif") returned 0x73 [0209.815] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0209.815] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.815] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6f14048, Size=0x1efc) returned 0x6dee6e0 [0209.816] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.816] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0209.816] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xeb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrayCheck.css", cAlternateFileName="GRAYCH~1.CSS")) returned 1 [0209.816] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\earthy.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css") returned 1 [0209.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GrayCheck.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css") returned 0x6c [0209.816] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0209.816] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.816] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0209.816] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x762, dwReserved0=0x0, dwReserved1=0x0, cFileName="GreenTea.css", cAlternateFileName="")) returned 1 [0209.816] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\graycheck.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css") returned 1 [0209.816] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\GreenTea.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css") returned 0x6b [0209.816] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0209.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0209.817] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightSpirit.css", cAlternateFileName="LIGHTS~1.CSS")) returned 1 [0209.817] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\greentea.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css") returned 1 [0209.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\LightSpirit.css", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css") returned 0x6e [0209.817] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0209.817] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.817] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0209.817] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime", cAlternateFileName="")) returned 1 [0209.817] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", len=0x64 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\") returned 1 [0209.817] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\") returned 0x64 [0209.817] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0209.817] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0209.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0209.817] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x568309f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66293410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0209.817] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0209.818] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF") returned 1 [0209.818] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_OFF.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif") returned 0x6f [0209.818] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0209.818] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.818] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x568309f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97f0 [0209.818] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0209.818] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\_restore files_.txt"), bFailIfExists=0) returned 1 [0209.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0209.821] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0209.821] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF") returned 1 [0209.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime\\TAB_ON.GIF", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime\\tab_on.gif") returned 0x6e [0209.821] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0209.821] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0209.821] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0209.821] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0209.821] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1091, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lime.css", cAlternateFileName="")) returned 1 [0209.821] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lightspirit.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css") returned 1 [0209.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Lime.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css") returned 0x67 [0209.821] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0209.821] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.821] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0209.821] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x720, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maroon.css", cAlternateFileName="")) returned 1 [0209.821] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\lime.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", len=0x69 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css") returned 1 [0209.821] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Maroon.css", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css") returned 0x69 [0209.822] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0209.822] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0209.822] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0209.822] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis", cAlternateFileName="")) returned 1 [0209.822] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\") returned 1 [0209.822] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\") returned 0x65 [0209.822] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0209.822] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0209.822] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0210.073] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b22b3b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0210.073] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x86c, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0210.073] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF") returned 1 [0210.073] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\HEADER.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif") returned 0x6f [0210.073] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0210.073] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0210.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5969b6f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9830 [0210.073] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0210.073] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\_restore files_.txt"), bFailIfExists=0) returned 1 [0214.539] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0214.539] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0214.539] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF") returned 1 [0214.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_OFF.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif") returned 0x70 [0214.539] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.539] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.539] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0214.539] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0214.539] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF") returned 1 [0214.539] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis\\TAB_ON.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis\\tab_on.gif") returned 0x6f [0214.539] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.539] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.539] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0214.539] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.539] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.540] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa042cc00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa042cc00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oasis.css", cAlternateFileName="")) returned 1 [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\maroon.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css") returned 1 [0214.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Oasis.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css") returned 0x68 [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.540] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.540] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0214.540] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74b, dwReserved0=0x0, dwReserved1=0x0, cFileName="OliveGreen.css", cAlternateFileName="OLIVEG~1.CSS")) returned 1 [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\oasis.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css") returned 1 [0214.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\OliveGreen.css", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css") returned 0x6d [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.540] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.540] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0214.540] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x706, dwReserved0=0x0, dwReserved1=0x0, cFileName="Premium.css", cAlternateFileName="")) returned 1 [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\olivegreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", len=0x6a | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css") returned 1 [0214.540] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Premium.css", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css") returned 0x6a [0214.540] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.540] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.541] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0214.541] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate", cAlternateFileName="")) returned 1 [0214.541] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\") returned 1 [0214.541] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\") returned 0x65 [0214.541] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0214.541] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0214.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0214.541] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a9f29b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2e6230, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.541] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0214.542] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF") returned 1 [0214.542] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_OFF.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif") returned 0x70 [0214.542] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.542] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5a9f29b0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0214.542] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.542] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\_restore files_.txt"), bFailIfExists=0) returned 1 [0214.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0214.545] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0214.545] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF") returned 1 [0214.545] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate\\TAB_ON.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate\\tab_on.gif") returned 0x6f [0214.545] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0214.546] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.546] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.546] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slate.css", cAlternateFileName="")) returned 1 [0214.546] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\premium.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css") returned 1 [0214.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Slate.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css") returned 0x68 [0214.546] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0214.546] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x74a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SlateBlue.css", cAlternateFileName="SLATEB~1.CSS")) returned 1 [0214.546] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slate.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", len=0x6c | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css") returned 1 [0214.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SlateBlue.css", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css") returned 0x6c [0214.546] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.546] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0214.546] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue", cAlternateFileName="")) returned 1 [0214.546] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", len=0x68 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\") returned 1 [0214.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\") returned 0x68 [0214.547] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0214.547] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0214.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0214.547] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d37e7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.547] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1afa, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0214.547] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif") returned 1 [0214.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif") returned 0x76 [0214.547] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.547] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5aad71f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0214.548] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.548] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\_restore files_.txt"), bFailIfExists=0) returned 1 [0214.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0214.550] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0214.550] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF") returned 1 [0214.550] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif") returned 0x73 [0214.550] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.550] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.550] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0214.550] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0214.550] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF") returned 1 [0214.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif") returned 0x72 [0214.551] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0214.551] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0214.551] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0214.551] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x11ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="SoftBlue.css", cAlternateFileName="")) returned 1 [0214.551] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\slateblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", len=0x6b | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css") returned 1 [0214.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue.css", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css") returned 0x6b [0214.551] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0214.551] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.551] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0214.551] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen", cAlternateFileName="SPRING~1")) returned 1 [0214.551] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", len=0x6b | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\") returned 1 [0214.551] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\") returned 0x6b [0214.551] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0214.551] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0214.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0214.590] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ab49610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0214.591] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0214.591] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", len=0x75 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF") returned 1 [0214.591] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif") returned 0x75 [0214.591] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0214.591] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0214.591] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5ab49610, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0214.591] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0214.591] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\_restore files_.txt"), bFailIfExists=0) returned 1 [0217.162] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0217.162] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0217.162] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", len=0x76 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF") returned 1 [0217.162] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", cchLength=0x76 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif") returned 0x76 [0217.162] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.162] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0217.163] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0217.163] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", len=0x75 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF") returned 1 [0217.163] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif") returned 0x75 [0217.163] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.163] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0217.163] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.163] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.163] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa173f900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa173f900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpringGreen.css", cAlternateFileName="SPRING~1.CSS")) returned 1 [0217.163] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", len=0x6e | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css") returned 1 [0217.163] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen.css", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css") returned 0x6e [0217.163] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.163] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.163] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0217.163] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts.css", cAlternateFileName="")) returned 1 [0217.164] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", len=0x66 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css") returned 1 [0217.164] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts.css", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css") returned 0x66 [0217.164] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.164] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.164] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0217.164] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STS2", cAlternateFileName="")) returned 1 [0217.164] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", len=0x64 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\") returned 1 [0217.164] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\") returned 0x64 [0217.164] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0217.164] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0217.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0217.165] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.166] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0217.166] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", len=0x72 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif") returned 1 [0217.166] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif") returned 0x72 [0217.166] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.166] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5abe1b90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0217.166] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.166] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\_restore files_.txt"), bFailIfExists=0) returned 1 [0217.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0217.209] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0217.209] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF") returned 1 [0217.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif") returned 0x6e [0217.209] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0217.209] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0217.209] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF") returned 1 [0217.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif") returned 0x6f [0217.209] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0217.209] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac07cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0217.209] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", len=0x6e | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF") returned 1 [0217.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif") returned 0x6e [0217.210] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0217.210] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.210] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.210] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sts2.css", cAlternateFileName="")) returned 1 [0217.210] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css") returned 1 [0217.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Sts2.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css") returned 0x67 [0217.210] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0217.210] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl", cAlternateFileName="")) returned 1 [0217.210] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", len=0x65 | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\") returned 1 [0217.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\") returned 0x65 [0217.210] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0217.210] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0217.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0217.213] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ac7a110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d43ce90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.214] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32f, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0217.214] SysReAllocStringLen (in: pbstr=0x6a0e028*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", len=0x73 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif") returned 1 [0217.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\background.gif", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif") returned 0x73 [0217.214] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0dd34 | out: lpFindFileData=0x6a0dd34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5ac7a110, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b97b0 [0217.214] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0217.214] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\_restore files_.txt"), bFailIfExists=0) returned 1 [0217.218] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0217.218] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6993, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0217.218] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\background.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF") returned 1 [0217.218] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\HEADER.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif") returned 0x6f [0217.218] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0217.219] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0217.219] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\header.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", len=0x70 | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF") returned 1 [0217.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_OFF.GIF", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif") returned 0x70 [0217.219] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0217.219] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0217.219] SysReAllocStringLen (in: pbstr=0x6a0e028*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_off.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", len=0x6f | out: pbstr=0x6a0e028*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF") returned 1 [0217.219] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl\\TAB_ON.GIF", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl\\tab_on.gif") returned 0x6f [0217.219] SysReAllocStringLen (in: pbstr=0x6a0dfc8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dfc8*="_RESTORE FILES_.txt") returned 1 [0217.219] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.219] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0217.219] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.219] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0217.219] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2a52600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2a52600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xfb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swirl.css", cAlternateFileName="")) returned 1 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", len=0x68 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css") returned 1 [0217.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Swirl.css", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css") returned 0x68 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0217.220] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5acc63d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x0, dwReserved1=0x0, cFileName="Teal.css", cAlternateFileName="")) returned 1 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\swirl.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", len=0x67 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css") returned 1 [0217.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Teal.css", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css") returned 0x67 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0217.220] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x0, dwReserved1=0x0, cFileName="TexturedBlue.css", cAlternateFileName="TEXTUR~1.CSS")) returned 1 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\teal.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", len=0x6f | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css") returned 1 [0217.220] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\TexturedBlue.css", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css") returned 0x6f [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.220] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0217.220] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x733, dwReserved0=0x0, dwReserved1=0x0, cFileName="VelvetRose.css", cAlternateFileName="VELVET~1.CSS")) returned 1 [0217.220] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\texturedblue.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", len=0x6d | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css") returned 1 [0217.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\VelvetRose.css", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css") returned 0x6d [0217.221] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0217.221] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b5bca0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xb0b5bca0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0217.221] SysReAllocStringLen (in: pbstr=0x6a0e2f0*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\velvetrose.css", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\_RESTORE FILES_.txt", len=0x72 | out: pbstr=0x6a0e2f0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\_RESTORE FILES_.txt") returned 1 [0217.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\_RESTORE FILES_.txt", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\_restore files_.txt") returned 0x72 [0217.221] SysReAllocStringLen (in: pbstr=0x6a0e290*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e290*="_RESTORE FILES_.txt") returned 1 [0217.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.221] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.221] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.221] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsVersion1Warning.htm", cAlternateFileName="FORMSV~1.HTM")) returned 1 [0217.221] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsprinttemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm") returned 1 [0217.221] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsVersion1Warning.htm", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm") returned 0x6b [0217.221] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.221] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.221] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0217.222] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsversion1warning.htm", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg") returned 1 [0217.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIcons.jpg", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg") returned 0x6f [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0217.222] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp") returned 1 [0217.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewAttachmentIconsMask.bmp", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp") returned 0x73 [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0217.222] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x164a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewFrame.html", cAlternateFileName="FORMSV~2.HTM")) returned 1 [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewattachmenticonsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html") returned 1 [0217.222] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewFrame.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html") returned 0x66 [0217.222] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.222] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.222] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0217.223] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x529b4870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewTemplate.html", cAlternateFileName="FORMSV~3.HTM")) returned 1 [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewframe.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html") returned 1 [0217.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsViewTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html") returned 0x69 [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0217.223] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1bfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormToolImages.jpg", cAlternateFileName="FORMTO~1.JPG")) returned 1 [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg") returned 1 [0217.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormToolImages.jpg", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg") returned 0x65 [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0217.223] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b7e1800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b7e1800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2577, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formtoolimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js") returned 1 [0217.223] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\form_edit.js", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js") returned 0x5f [0217.223] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.223] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.223] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0217.224] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\form_edit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF") returned 1 [0217.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\LAUNCH.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif") returned 0x5d [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0217.224] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3d65300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x58285d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3d65300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa52f, dwReserved0=0x0, dwReserved1=0x0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\launch.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif") returned 1 [0217.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\macroprogress.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif") returned 0x64 [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0217.224] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x21e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\macroprogress.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js") returned 1 [0217.224] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\PublicFunctions.js", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js") returned 0x65 [0217.224] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.224] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.224] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0217.224] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\publicfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif") returned 1 [0217.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignleft.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif") returned 0x64 [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0217.225] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignleft.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif") returned 1 [0217.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_alignright.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif") returned 0x65 [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0217.225] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x366, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTF_BOLD.GIF", cAlternateFileName="")) returned 1 [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_alignright.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF") returned 1 [0217.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\RTF_BOLD.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif") returned 0x5f [0217.225] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0217.225] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bold.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif") returned 1 [0217.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_bullets.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif") returned 0x62 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0217.226] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_bullets.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif") returned 1 [0217.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_center.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif") returned 0x61 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0217.226] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_center.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif") returned 1 [0217.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosecolor.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif") returned 0x66 [0217.226] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0217.226] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosefont.gif", cAlternateFileName="RTF_CH~2.GIF")) returned 1 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosecolor.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif") returned 1 [0217.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_choosefont.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif") returned 0x65 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0217.227] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_choosefont.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif") returned 1 [0217.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_decreaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif") returned 0x69 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0217.227] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_decreaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif") returned 1 [0217.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif") returned 0x64 [0217.227] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0217.227] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif") returned 1 [0217.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif") returned 0x69 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0217.228] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5078000, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5078000, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_italic.gif", cAlternateFileName="RTF_IT~1.GIF")) returned 1 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif") returned 1 [0217.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif") returned 0x61 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0217.228] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif") returned 1 [0217.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif") returned 0x62 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0217.228] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0217.228] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif") returned 1 [0217.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif") returned 0x62 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0217.229] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_spellcheck.gif", cAlternateFileName="RTF_SP~1.GIF")) returned 1 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif") returned 1 [0217.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif") returned 0x65 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0217.229] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_underline.gif", cAlternateFileName="RTF_UN~1.GIF")) returned 1 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif") returned 1 [0217.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif") returned 0x64 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0217.229] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0217.229] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF") returned 1 [0217.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif") returned 0x5b [0217.230] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0217.230] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14307, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0217.230] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS") returned 1 [0217.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js") returned 0x5c [0217.230] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0217.230] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xca5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0217.230] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js") returned 1 [0217.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js") returned 0x66 [0217.230] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0217.231] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x64b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js") returned 1 [0217.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js") returned 0x60 [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0217.231] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.ICO", cAlternateFileName="")) returned 1 [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO") returned 1 [0217.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.ICO", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico") returned 0x5b [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0217.231] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2095, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEW.JS", cAlternateFileName="")) returned 1 [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS") returned 1 [0217.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\VIEW.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js") returned 0x5a [0217.231] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0217.231] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x706f8370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd78, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewHeaderPreview.jpg", cAlternateFileName="VIEWHE~1.JPG")) returned 1 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\view.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg") returned 1 [0217.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\ViewHeaderPreview.jpg", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg") returned 0x68 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0217.232] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf7925c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xaf7925c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\viewheaderpreview.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\_RESTORE FILES_.txt", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\_RESTORE FILES_.txt") returned 1 [0217.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\_RESTORE FILES_.txt", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\_restore files_.txt") returned 0x66 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.232] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0217.232] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0217.232] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveForms5", cAlternateFileName="GROOVE~2")) returned 1 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\") returned 1 [0217.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\") returned 0x53 [0217.232] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0217.232] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0217.233] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0217.237] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70685f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0217.238] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADD.GIF", cAlternateFileName="")) returned 1 [0217.238] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF") returned 1 [0217.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ADD.GIF", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif") returned 0x5a [0217.238] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5127f1f0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0217.238] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0217.238] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\_restore files_.txt"), bFailIfExists=0) returned 1 [0217.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0217.241] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa638ad00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa638ad00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xae8, dwReserved0=0x0, dwReserved1=0x0, cFileName="attention.gif", cAlternateFileName="ATTENT~1.GIF")) returned 1 [0217.241] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\add.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif") returned 1 [0217.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\attention.gif", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif") returned 0x60 [0217.241] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0217.241] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.GIF", cAlternateFileName="")) returned 1 [0217.241] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\attention.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF") returned 1 [0217.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\CALENDAR.GIF", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif") returned 0x5f [0217.241] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.241] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0217.241] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa769da00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa769da00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELETE.GIF", cAlternateFileName="")) returned 1 [0217.241] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\calendar.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF") returned 1 [0217.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\DELETE.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif") returned 0x5d [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0217.242] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x369, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERROR.GIF", cAlternateFileName="")) returned 1 [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\delete.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF") returned 1 [0217.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\ERROR.GIF", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif") returned 0x5c [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0217.242] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77e3c400, ftCreationTime.dwHighDateTime=0x1ca5dc0, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77e3c400, ftLastWriteTime.dwHighDateTime=0x1ca5dc0, nFileSizeHigh=0x0, nFileSizeLow=0x14484, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.JS", cAlternateFileName="")) returned 1 [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\error.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", len=0x5a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS") returned 1 [0217.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FORM.JS", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js") returned 0x5a [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0217.242] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBlankPage.html", cAlternateFileName="FORMSB~1.HTM")) returned 1 [0217.242] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html") returned 1 [0217.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBlankPage.html", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html") returned 0x66 [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0217.243] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x829, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsBrowserUpgrade.html", cAlternateFileName="FORMSB~2.HTM")) returned 1 [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsblankpage.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html") returned 1 [0217.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsBrowserUpgrade.html", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html") returned 0x6b [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0217.243] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsColorChart.html", cAlternateFileName="FORMSC~1.HTM")) returned 1 [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsbrowserupgrade.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html") returned 1 [0217.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsColorChart.html", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html") returned 0x67 [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0217.243] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5291c2f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplate.html", cAlternateFileName="FORMSF~1.HTM")) returned 1 [0217.243] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formscolorchart.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html") returned 1 [0217.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplate.html", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html") returned 0x69 [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0217.244] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69fe8900, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618c8a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69fe8900, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x13c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsFormTemplateRTL.html", cAlternateFileName="FORMSF~2.HTM")) returned 1 [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html") returned 1 [0217.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsFormTemplateRTL.html", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html") returned 0x6c [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0217.244] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsImageTemplate.html", cAlternateFileName="FORMSI~1.HTM")) returned 1 [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsformtemplatertl.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html") returned 1 [0217.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsImageTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html") returned 0x6a [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0217.244] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x52942450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x858, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsMacroTemplate.html", cAlternateFileName="FORMSM~1.HTM")) returned 1 [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsimagetemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html") returned 1 [0217.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsMacroTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html") returned 0x6a [0217.244] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0217.245] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x46ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplate.html", cAlternateFileName="FORMSP~1.HTM")) returned 1 [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsmacrotemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html") returned 1 [0217.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplate.html", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html") returned 0x6c [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0217.245] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x797dd200, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x797dd200, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x4709, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPreviewTemplateRTL.html", cAlternateFileName="FORMSP~3.HTM")) returned 1 [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html") returned 1 [0217.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPreviewTemplateRTL.html", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html") returned 0x6f [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0217.245] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplate.html", cAlternateFileName="FORMSP~2.HTM")) returned 1 [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formspreviewtemplatertl.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html") returned 1 [0217.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplate.html", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html") returned 0x6a [0217.245] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0217.246] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2e4800, ftCreationTime.dwHighDateTime=0x1c7d303, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2e4800, ftLastWriteTime.dwHighDateTime=0x1c7d303, nFileSizeHigh=0x0, nFileSizeLow=0x5c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsPrintTemplateRTL.html", cAlternateFileName="FORMSP~4.HTM")) returned 1 [0217.246] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplate.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", len=0x6d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html") returned 1 [0217.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsPrintTemplateRTL.html", cchLength=0x6d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html") returned 0x6d [0217.246] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0217.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0217.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0217.246] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0f34200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5298e710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0f34200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1499, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIcons.jpg", cAlternateFileName="FORMSV~1.JPG")) returned 1 [0218.441] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsprinttemplatertl.html", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", len=0x6f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg") returned 1 [0218.441] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIcons.jpg", cchLength=0x6f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg") returned 0x6f [0218.441] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0218.441] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.324] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0221.324] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="FormsViewAttachmentIconsMask.bmp", cAlternateFileName="FORMSV~1.BMP")) returned 1 [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", len=0x73 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp") returned 1 [0221.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\FormsViewAttachmentIconsMask.bmp", cchLength=0x73 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp") returned 0x73 [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0221.325] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89b0700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa89b0700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_edit.js", cAlternateFileName="FORM_E~1.JS")) returned 1 [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\formsviewattachmenticonsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", len=0x5f | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js") returned 1 [0221.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\form_edit.js", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js") returned 0x5f [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0221.325] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14316, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathWelcomeImage.jpg", cAlternateFileName="INFOPA~1.JPG")) returned 1 [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\form_edit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg") returned 1 [0221.325] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\InfoPathWelcomeImage.jpg", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg") returned 0x6b [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.325] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.325] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0221.325] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="LAUNCH.GIF", cAlternateFileName="")) returned 1 [0221.325] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\infopathwelcomeimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", len=0x5d | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF") returned 1 [0221.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\LAUNCH.GIF", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif") returned 0x5d [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0221.326] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x418f4a00, ftCreationTime.dwHighDateTime=0x1c9fe9d, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x418f4a00, ftLastWriteTime.dwHighDateTime=0x1c9fe9d, nFileSizeHigh=0x0, nFileSizeLow=0x30074, dwReserved0=0x0, dwReserved1=0x0, cFileName="macroprogress.gif", cAlternateFileName="MACROP~1.GIF")) returned 1 [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\launch.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif") returned 1 [0221.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\macroprogress.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif") returned 0x64 [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0221.326] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a76b250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x275e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicFunctions.js", cAlternateFileName="PUBLIC~1.JS")) returned 1 [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\macroprogress.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js") returned 1 [0221.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\PublicFunctions.js", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js") returned 0x65 [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.326] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.326] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0221.326] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignleft.gif", cAlternateFileName="RTF_AL~1.GIF")) returned 1 [0221.326] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\publicfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif") returned 1 [0221.326] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignleft.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif") returned 0x64 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0221.327] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_alignright.gif", cAlternateFileName="RTF_AL~2.GIF")) returned 1 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignleft.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif") returned 1 [0221.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_alignright.gif", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif") returned 0x65 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0221.327] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x365, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_bullets.gif", cAlternateFileName="RTF_BU~1.GIF")) returned 1 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_alignright.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif") returned 1 [0221.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_bullets.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif") returned 0x62 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.327] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0221.327] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_center.gif", cAlternateFileName="RTF_CE~1.GIF")) returned 1 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_bullets.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif") returned 1 [0221.327] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_center.gif", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif") returned 0x61 [0221.327] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.327] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0221.328] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3031bc00, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3031bc00, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x3ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_choosecolor.gif", cAlternateFileName="RTF_CH~1.GIF")) returned 1 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_center.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif") returned 1 [0221.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_choosecolor.gif", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif") returned 0x66 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.328] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0221.328] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2246f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2246f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35f, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_decreaseindent.gif", cAlternateFileName="RTF_DE~1.GIF")) returned 1 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_choosecolor.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif") returned 1 [0221.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_decreaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif") returned 0x69 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.328] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.328] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0221.328] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_hyperlink.gif", cAlternateFileName="RTF_HY~1.GIF")) returned 1 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_decreaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif") returned 1 [0221.328] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_hyperlink.gif", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif") returned 0x64 [0221.328] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.328] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0221.329] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x35d, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_increaseindent.gif", cAlternateFileName="RTF_IN~1.GIF")) returned 1 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_hyperlink.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", len=0x69 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif") returned 1 [0221.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_increaseindent.gif", cchLength=0x69 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif") returned 0x69 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0221.329] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_justify.gif", cAlternateFileName="RTF_JU~1.GIF")) returned 1 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_increaseindent.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif") returned 1 [0221.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_justify.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif") returned 0x62 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0221.329] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x373, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtf_pressed.gif", cAlternateFileName="RTF_PR~1.GIF")) returned 1 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_justify.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", len=0x62 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif") returned 1 [0221.329] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\rtf_pressed.gif", cchLength=0x62 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif") returned 0x62 [0221.329] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.329] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0221.330] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58b9b600, ftCreationTime.dwHighDateTime=0x1ca033b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58b9b600, ftLastWriteTime.dwHighDateTime=0x1ca033b, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVE.GIF", cAlternateFileName="")) returned 1 [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\rtf_pressed.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", len=0x5b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF") returned 1 [0221.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SAVE.GIF", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif") returned 0x5b [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0221.330] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27739b00, ftCreationTime.dwHighDateTime=0x1ca408b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27739b00, ftLastWriteTime.dwHighDateTime=0x1ca408b, nFileSizeHigh=0x0, nFileSizeLow=0x15162, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUBMIT.JS", cAlternateFileName="")) returned 1 [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\save.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", len=0x5c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS") returned 1 [0221.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\SUBMIT.JS", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js") returned 0x5c [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0221.330] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70685f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xefe7, dwReserved0=0x0, dwReserved1=0x0, cFileName="utilityfunctions.js", cAlternateFileName="UTILIT~1.JS")) returned 1 [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\submit.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js") returned 1 [0221.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\utilityfunctions.js", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js") returned 0x66 [0221.330] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0221.330] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53b43100, ftCreationTime.dwHighDateTime=0x1ca0352, ftLastAccessTime.dwLowDateTime=0x5e4444b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53b43100, ftLastWriteTime.dwHighDateTime=0x1ca0352, nFileSizeHigh=0x0, nFileSizeLow=0x75aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="validation.js", cAlternateFileName="VALIDA~1.JS")) returned 1 [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\utilityfunctions.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", len=0x60 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js") returned 1 [0221.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\validation.js", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js") returned 0x60 [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.331] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0221.331] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb918d4e0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xb918d4e0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\validation.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\_RESTORE FILES_.txt", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\_RESTORE FILES_.txt") returned 1 [0221.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms5\\_RESTORE FILES_.txt", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms5\\_restore files_.txt") returned 0x66 [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.331] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.331] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.331] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0221.331] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveProjectToolset", cAlternateFileName="GRA998~1")) returned 1 [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", len=0x5b | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\") returned 1 [0221.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\", cchLength=0x5b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\") returned 0x5b [0221.331] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.331] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.331] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0221.333] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.338] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3559c00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb3559c00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x140b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIcon.jpg", cAlternateFileName="BRIEFC~1.JPG")) returned 1 [0221.338] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg") returned 1 [0221.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIcon.jpg", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg") returned 0x6c [0221.338] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a61ad0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0221.338] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.338] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\_restore files_.txt"), bFailIfExists=0) returned 1 [0221.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0221.341] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xf76, dwReserved0=0x0, dwReserved1=0x0, cFileName="BriefcaseIconMask.bmp", cAlternateFileName="BRIEFC~1.BMP")) returned 1 [0221.341] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", len=0x70 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp") returned 1 [0221.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\BriefcaseIconMask.bmp", cchLength=0x70 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp") returned 0x70 [0221.341] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0221.341] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x32cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleIcons.jpg", cAlternateFileName="CIRCLE~1.JPG")) returned 1 [0221.341] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\briefcaseiconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg") returned 1 [0221.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIcons.jpg", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg") returned 0x6a [0221.341] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0221.341] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x114c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CircleIconsMask.bmp", cAlternateFileName="CIRCLE~1.BMP")) returned 1 [0221.341] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleicons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp") returned 1 [0221.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\CircleIconsMask.bmp", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp") returned 0x6e [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0221.342] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x26ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeetingIcon.jpg", cAlternateFileName="MEETIN~1.JPG")) returned 1 [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\circleiconsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg") returned 1 [0221.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIcon.jpg", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg") returned 0x6a [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0221.342] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MeetingIconMask.bmp", cAlternateFileName="MEETIN~1.BMP")) returned 1 [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp") returned 1 [0221.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\MeetingIconMask.bmp", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp") returned 0x6e [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0221.342] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x19e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusIcons.jpg", cAlternateFileName="PROJEC~1.JPG")) returned 1 [0221.342] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\meetingiconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", len=0x71 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg") returned 1 [0221.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIcons.jpg", cchLength=0x71 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg") returned 0x71 [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0221.343] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa10, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectStatusIconsMask.bmp", cAlternateFileName="PROJEC~1.BMP")) returned 1 [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusicons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", len=0x75 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp") returned 1 [0221.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectStatusIconsMask.bmp", cchLength=0x75 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp") returned 0x75 [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0221.343] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x200e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTaskIcon.jpg", cAlternateFileName="PROJEC~2.JPG")) returned 1 [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projectstatusiconsmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg") returned 1 [0221.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIcon.jpg", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg") returned 0x6e [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0221.343] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x79c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTaskIconMask.bmp", cAlternateFileName="PROJEC~2.BMP")) returned 1 [0221.343] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskicon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", len=0x72 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp") returned 1 [0221.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTaskIconMask.bmp", cchLength=0x72 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp") returned 0x72 [0221.344] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0221.344] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectTool", cAlternateFileName="PROJEC~1")) returned 1 [0221.344] SysReAllocStringLen (in: pbstr=0x6a0e2f8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", len=0x67 | out: pbstr=0x6a0e2f8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\") returned 1 [0221.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\") returned 0x67 [0221.344] SysReAllocStringLen (in: pbstr=0x6a0e2a0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e2a0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.344] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\*.*", lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9770 [0221.381] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x538bb350, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.381] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Project Report Type", cAlternateFileName="PROJEC~1")) returned 1 [0221.381] SysReAllocStringLen (in: pbstr=0x6a0e030*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", len=0x7b | out: pbstr=0x6a0e030*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\") returned 1 [0221.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\", cchLength=0x7b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\") returned 0x7b [0221.381] SysReAllocStringLen (in: pbstr=0x6a0dfd8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dfd8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.381] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\*.*", lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97f0 [0221.381] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.381] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Basic", cAlternateFileName="")) returned 1 [0221.381] SysReAllocStringLen (in: pbstr=0x6a0dd68*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", len=0x81 | out: pbstr=0x6a0dd68*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\") returned 1 [0221.381] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\", cchLength=0x81 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\") returned 0x81 [0221.381] SysReAllocStringLen (in: pbstr=0x6a0dd10*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dd10*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.381] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.381] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\*.*", lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0221.382] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6073a7d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.382] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xced, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.XSL", cAlternateFileName="")) returned 1 [0221.382] SysReAllocStringLen (in: pbstr=0x6a0dd60*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", len=0x8c | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL") returned 1 [0221.382] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", cchLength=0x8c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl") returned 0x8c [0221.382] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.382] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0da6c | out: lpFindFileData=0x6a0da6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x6073a7d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9830 [0221.382] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0221.382] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\_restore files_.txt"), bFailIfExists=0) returned 1 [0221.385] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0221.385] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.385] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0221.385] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fancy", cAlternateFileName="")) returned 1 [0221.385] SysReAllocStringLen (in: pbstr=0x6a0dd68*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", len=0x81 | out: pbstr=0x6a0dd68*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\") returned 1 [0221.385] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\", cchLength=0x81 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\") returned 0x81 [0221.385] SysReAllocStringLen (in: pbstr=0x6a0dd10*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0dd10*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.385] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.385] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\*.*", lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b97b0 [0221.392] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x538bb350, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.392] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb486c900, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb486c900, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.js", cAlternateFileName="HIERAR~1.JS")) returned 1 [0221.392] SysReAllocStringLen (in: pbstr=0x6a0dd60*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", len=0x8d | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js") returned 1 [0221.392] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", cchLength=0x8d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js") returned 0x8d [0221.392] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.392] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0da6c | out: lpFindFileData=0x6a0da6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x538bb350, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9830 [0221.392] FindClose (in: hFindFile=0x5b9830 | out: hFindFile=0x5b9830) returned 1 [0221.392] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\_restore files_.txt"), bFailIfExists=0) returned 1 [0221.394] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0221.395] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x157e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hierarchy.xsl", cAlternateFileName="HIERAR~1.XSL")) returned 1 [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd60*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", len=0x8e | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl") returned 1 [0221.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", cchLength=0x8e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl") returned 0x8e [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.395] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.395] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0221.395] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x345, dwReserved0=0x0, dwReserved1=0x0, cFileName="MINUS.GIF", cAlternateFileName="")) returned 1 [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd60*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", len=0x8a | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF") returned 1 [0221.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", cchLength=0x8a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif") returned 0x8a [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.395] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.395] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0221.395] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a497830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x349, dwReserved0=0x0, dwReserved1=0x0, cFileName="PLUS.GIF", cAlternateFileName="")) returned 1 [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd60*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", len=0x89 | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF") returned 1 [0221.395] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", cchLength=0x89 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif") returned 0x89 [0221.395] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.395] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.395] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0221.396] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPACER.GIF", cAlternateFileName="")) returned 1 [0221.396] SysReAllocStringLen (in: pbstr=0x6a0dd60*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", len=0x8b | out: pbstr=0x6a0dd60*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF") returned 1 [0221.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", cchLength=0x8b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif") returned 0x8b [0221.396] SysReAllocStringLen (in: pbstr=0x6a0dd00*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0dd00*="_RESTORE FILES_.txt") returned 1 [0221.396] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.396] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0221.396] FindNextFileW (in: hFindFile=0x5b97b0, lpFindFileData=0x6a0dd6c | out: lpFindFileData=0x6a0dd6c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.396] FindClose (in: hFindFile=0x5b97b0 | out: hFindFile=0x5b97b0) returned 1 [0221.396] FindNextFileW (in: hFindFile=0x5b97f0, lpFindFileData=0x6a0e034 | out: lpFindFileData=0x6a0e034*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.396] FindClose (in: hFindFile=0x5b97f0 | out: hFindFile=0x5b97f0) returned 1 [0221.396] FindNextFileW (in: hFindFile=0x5b9770, lpFindFileData=0x6a0e2fc | out: lpFindFileData=0x6a0e2fc*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.396] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.396] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4f0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImages.jpg", cAlternateFileName="PROJEC~3.JPG")) returned 1 [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttaskiconmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", len=0x77 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg") returned 1 [0221.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImages.jpg", cchLength=0x77 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg") returned 0x77 [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0221.397] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2338, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProjectToolsetIconImagesMask.bmp", cAlternateFileName="PROJEC~3.BMP")) returned 1 [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", len=0x7b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp") returned 1 [0221.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectToolsetIconImagesMask.bmp", cchLength=0x7b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp") returned 0x7b [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0221.397] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashImage.jpg", cAlternateFileName="SPLASH~1.JPG")) returned 1 [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttoolseticonimagesmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", len=0x6a | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg") returned 1 [0221.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImage.jpg", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg") returned 0x6a [0221.397] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0221.397] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14078, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashImageMask.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimage.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", len=0x6e | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp") returned 1 [0221.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\SplashImageMask.bmp", cchLength=0x6e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp") returned 0x6e [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0221.398] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABMASK.BMP", cAlternateFileName="")) returned 1 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\splashimagemask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", len=0x66 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP") returned 1 [0221.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABMASK.BMP", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp") returned 0x66 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0221.398] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABOFF.JPG", cAlternateFileName="")) returned 1 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG") returned 1 [0221.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABOFF.JPG", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg") returned 0x65 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0221.398] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="TABON.JPG", cAlternateFileName="")) returned 1 [0221.398] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\taboff.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", len=0x64 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG") returned 1 [0221.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\TABON.JPG", cchLength=0x64 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg") returned 0x64 [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0221.399] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHITEBOX.JPG", cAlternateFileName="")) returned 1 [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\tabon.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", len=0x67 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG") returned 1 [0221.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WHITEBOX.JPG", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg") returned 0x67 [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0221.399] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5b7f600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5b7f600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="WhiteboxMask.bmp", cAlternateFileName="WHITEB~1.BMP")) returned 1 [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whitebox.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", len=0x6b | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp") returned 1 [0221.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\WhiteboxMask.bmp", cchLength=0x6b | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp") returned 0x6b [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0221.399] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoomIcons.jpg", cAlternateFileName="ZOOMIC~1.JPG")) returned 1 [0221.399] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\whiteboxmask.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", len=0x68 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg") returned 1 [0221.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIcons.jpg", cchLength=0x68 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg") returned 0x68 [0221.400] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.400] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0221.400] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6e92300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6e92300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZoomIconsMask.bmp", cAlternateFileName="ZOOMIC~1.BMP")) returned 1 [0221.400] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomicons.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", len=0x6c | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp") returned 1 [0221.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ZoomIconsMask.bmp", cchLength=0x6c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\zoomiconsmask.bmp") returned 0x6c [0221.400] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.400] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0221.400] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.400] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0221.413] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Tool", cAlternateFileName="WELCOM~1")) returned 1 [0221.413] SysReAllocStringLen (in: pbstr=0x6a0e5c0*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", len=0x53 | out: pbstr=0x6a0e5c0*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\") returned 1 [0221.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\") returned 0x53 [0221.413] SysReAllocStringLen (in: pbstr=0x6a0e568*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e568*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.413] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\*.*", lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96b0 [0221.414] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x53907610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.414] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbadd700, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbbadd700, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x10f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImages.jpg", cAlternateFileName="ICONIM~1.JPG")) returned 1 [0221.414] SysReAllocStringLen (in: pbstr=0x6a0e5b8*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", len=0x61 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg") returned 1 [0221.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImages.jpg", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg") returned 0x61 [0221.414] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e2c4 | out: lpFindFileData=0x6a0e2c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x53907610, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9770 [0221.414] FindClose (in: hFindFile=0x5b9770 | out: hFindFile=0x5b9770) returned 1 [0221.414] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\_restore files_.txt"), bFailIfExists=0) returned 1 [0221.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0221.418] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="IconImagesMask.bmp", cAlternateFileName="ICONIM~1.BMP")) returned 1 [0221.418] SysReAllocStringLen (in: pbstr=0x6a0e5b8*="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimages.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", len=0x65 | out: pbstr=0x6a0e5b8*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp") returned 1 [0221.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Welcome Tool\\IconImagesMask.bmp", cchLength=0x65 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\welcome tool\\iconimagesmask.bmp") returned 0x65 [0221.418] SysReAllocStringLen (in: pbstr=0x6a0e558*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e558*="_RESTORE FILES_.txt") returned 1 [0221.418] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0221.418] FindNextFileW (in: hFindFile=0x5b96b0, lpFindFileData=0x6a0e5c4 | out: lpFindFileData=0x6a0e5c4*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.418] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0221.419] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.419] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0221.419] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.419] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.419] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0221.419] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\") returned 1 [0221.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\") returned 0x3c [0221.419] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.419] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.419] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0221.422] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52a4cdf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x709f1ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0221.422] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALERT.ICO", cAlternateFileName="")) returned 1 [0221.422] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO") returned 1 [0221.422] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ALERT.ICO", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico") returned 0x45 [0221.422] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.422] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x52a4cdf0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0221.423] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0221.423] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolicons\\_restore files_.txt"), bFailIfExists=0) returned 1 [0221.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0221.425] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHEVRON.ICO", cAlternateFileName="")) returned 1 [0221.425] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\alert.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO") returned 1 [0221.425] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\CHEVRON.ICO", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico") returned 0x47 [0221.425] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.425] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.425] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0221.425] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMPUTER.ICO", cAlternateFileName="")) returned 1 [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\chevron.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO") returned 1 [0221.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\COMPUTER.ICO", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico") returned 0x48 [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.426] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0221.426] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcdf0400, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcdf0400, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xea6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactSelector.ico", cAlternateFileName="CONTAC~1.ICO")) returned 1 [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\computer.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico") returned 1 [0221.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ContactSelector.ico", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico") returned 0x4f [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.426] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0221.426] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e764200, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e764200, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrorfromgroove.ico", cAlternateFileName="GFSERR~1.ICO")) returned 1 [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\contactselector.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico") returned 1 [0221.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrorfromgroove.ico", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico") returned 0x52 [0221.426] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.426] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0221.426] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78806100, ftCreationTime.dwHighDateTime=0x1c9ff6c, ftLastAccessTime.dwLowDateTime=0x52a4cdf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78806100, ftLastWriteTime.dwHighDateTime=0x1c9ff6c, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="gfserrortogroove.ico", cAlternateFileName="GFSERR~2.ICO")) returned 1 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrorfromgroove.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", len=0x50 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico") returned 1 [0221.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\gfserrortogroove.ico", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico") returned 0x50 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0221.427] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddee4300, ftCreationTime.dwHighDateTime=0x1c9dff9, ftLastAccessTime.dwLowDateTime=0x537fcc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xddee4300, ftLastWriteTime.dwHighDateTime=0x1c9dff9, nFileSizeHigh=0x0, nFileSizeLow=0x294dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GWE.ICO", cAlternateFileName="")) returned 1 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gfserrortogroove.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO") returned 1 [0221.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\GWE.ICO", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico") returned 0x43 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0221.427] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INCOMING.ICO", cAlternateFileName="")) returned 1 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\gwe.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO") returned 1 [0221.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INCOMING.ICO", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico") returned 0x48 [0221.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0221.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe103100, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe103100, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="INDOMAIN.ICO", cAlternateFileName="")) returned 1 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\incoming.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO") returned 1 [0221.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\INDOMAIN.ICO", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico") returned 0x48 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0221.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xa2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIL.ICO", cAlternateFileName="")) returned 1 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\indomain.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", len=0x44 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO") returned 1 [0221.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MAIL.ICO", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico") returned 0x44 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0221.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MANUAL.ICO", cAlternateFileName="")) returned 1 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\mail.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO") returned 1 [0221.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\MANUAL.ICO", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico") returned 0x46 [0221.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0221.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxalert.ico", cAlternateFileName="MESSAG~2.ICO")) returned 1 [0221.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\manual.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico") returned 1 [0221.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxalert.ico", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico") returned 0x4f [0221.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0221.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxerror.ico", cAlternateFileName="MESSAG~1.ICO")) returned 1 [0221.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxalert.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico") returned 1 [0221.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxerror.ico", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico") returned 0x4f [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0221.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messageboxinfo.ico", cAlternateFileName="MESSAG~3.ICO")) returned 1 [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxerror.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", len=0x4e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico") returned 1 [0221.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\messageboxinfo.ico", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico") returned 0x4e [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0221.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1608e400, ftCreationTime.dwHighDateTime=0x1ca03f6, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1608e400, ftLastWriteTime.dwHighDateTime=0x1ca03f6, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ModifiedTelespace.ico", cAlternateFileName="MODIFI~1.ICO")) returned 1 [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\messageboxinfo.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", len=0x51 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico") returned 1 [0221.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ModifiedTelespace.ico", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico") returned 0x51 [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f1c) returned 0x6dee6e0 [0221.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x596e79b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFLINE.ICO", cAlternateFileName="")) returned 1 [0221.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\modifiedtelespace.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO") returned 1 [0221.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OFFLINE.ICO", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico") returned 0x47 [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f20) returned 0x6dee6e0 [0221.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLINE.ICO", cAlternateFileName="")) returned 1 [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\offline.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO") returned 1 [0221.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\ONLINE.ICO", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico") returned 0x46 [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f24) returned 0x6dee6e0 [0221.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf415e00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf415e00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineBusy.ico", cAlternateFileName="ONLINE~2.ICO")) returned 1 [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\online.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico") returned 1 [0221.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineBusy.ico", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico") returned 0x4a [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f28) returned 0x6dee6e0 [0221.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OnLineIdle.ico", cAlternateFileName="ONLINE~1.ICO")) returned 1 [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlinebusy.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico") returned 1 [0221.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OnLineIdle.ico", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico") returned 0x4a [0221.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f2c) returned 0x6dee6e0 [0221.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutDomain.ico", cAlternateFileName="OUTDOM~1.ICO")) returned 1 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\onlineidle.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico") returned 1 [0221.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutDomain.ico", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico") returned 0x49 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f30) returned 0x6dee6e0 [0221.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTGOING.ICO", cAlternateFileName="")) returned 1 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outdomain.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO") returned 1 [0221.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OUTGOING.ICO", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico") returned 0x48 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f34) returned 0x6dee6e0 [0221.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutSyncPC.ico", cAlternateFileName="OUTSYN~1.ICO")) returned 1 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outgoing.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico") returned 1 [0221.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\OutSyncPC.ico", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico") returned 0x49 [0221.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f38) returned 0x6dee6e0 [0221.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0728b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cdd7370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0728b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x6b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PersonalContact.ico", cAlternateFileName="PERSON~1.ICO")) returned 1 [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\outsyncpc.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico") returned 1 [0221.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\PersonalContact.ico", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico") returned 0x4f [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f3c) returned 0x6dee6e0 [0221.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionMember.ico", cAlternateFileName="SESSIO~1.ICO")) returned 1 [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\personalcontact.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico") returned 1 [0221.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionMember.ico", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico") returned 0x4d [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f40) returned 0x6dee6e0 [0221.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="SessionOwner.ico", cAlternateFileName="SESSIO~2.ICO")) returned 1 [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionmember.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico") returned 1 [0221.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SessionOwner.ico", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico") returned 0x4c [0221.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f44) returned 0x6dee6e0 [0221.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpaceSelector.ico", cAlternateFileName="SPACES~1.ICO")) returned 1 [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\sessionowner.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", len=0x4d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico") returned 1 [0221.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\SpaceSelector.ico", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico") returned 0x4d [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.435] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.435] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f48) returned 0x6dee6e0 [0221.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusAway.ico", cAlternateFileName="STATUS~1.ICO")) returned 1 [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\spaceselector.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico") returned 1 [0221.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusAway.ico", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico") returned 0x4a [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.435] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.435] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f4c) returned 0x6dee6e0 [0221.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusDoNotDisturb.ico", cAlternateFileName="STATUS~2.ICO")) returned 1 [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusaway.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", len=0x52 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico") returned 1 [0221.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusDoNotDisturb.ico", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico") returned 0x52 [0221.435] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.435] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.435] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f50) returned 0x6dee6e0 [0221.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatusOnline.ico", cAlternateFileName="STATUS~3.ICO")) returned 1 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusdonotdisturb.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", len=0x4c | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico") returned 1 [0221.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\StatusOnline.ico", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico") returned 0x4c [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.436] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f54) returned 0x6dee6e0 [0221.436] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1a3b800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1a3b800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOOLICON.ICO", cAlternateFileName="")) returned 1 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\statusonline.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO") returned 1 [0221.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\TOOLICON.ICO", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico") returned 0x48 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.436] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f58) returned 0x6dee6e0 [0221.436] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x2366, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS.ICO", cAlternateFileName="")) returned 1 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\toolicon.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", len=0x43 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO") returned 1 [0221.436] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS.ICO", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico") returned 0x43 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.436] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.436] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f5c) returned 0x6dee6e0 [0221.436] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x430b200, ftCreationTime.dwHighDateTime=0x1c9d442, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x430b200, ftLastWriteTime.dwHighDateTime=0x1c9d442, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS_DocLib.ico", cAlternateFileName="WSS_DO~1.ICO")) returned 1 [0221.436] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico") returned 1 [0221.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\WSS_DocLib.ico", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico") returned 0x4a [0221.437] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.437] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.437] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f60) returned 0x6dee6e0 [0221.437] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb96c560, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xbb96c560, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0221.437] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\wss_doclib.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\_RESTORE FILES_.txt", len=0x4f | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\_RESTORE FILES_.txt") returned 1 [0221.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolIcons\\_RESTORE FILES_.txt", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\toolicons\\_restore files_.txt") returned 0x4f [0221.437] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0221.437] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0221.437] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0221.437] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0221.437] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML Files", cAlternateFileName="XMLFIL~1")) returned 1 [0221.437] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\") returned 1 [0221.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\") returned 0x3c [0221.437] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0221.437] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0221.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0222.147] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3caa70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0222.147] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x487, dwReserved0=0x0, dwReserved1=0x0, cFileName="builtincontrolsschema.xsd", cAlternateFileName="BUILTI~1.XSD")) returned 1 [0222.147] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", len=0x55 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd") returned 1 [0222.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\builtincontrolsschema.xsd", cchLength=0x55 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd") returned 0x55 [0222.147] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0222.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0222.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x50e7acd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0222.147] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0222.147] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\xml files\\_restore files_.txt"), bFailIfExists=0) returned 1 [0223.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0223.596] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd279da00, ftCreationTime.dwHighDateTime=0x1c8a0cd, ftLastAccessTime.dwLowDateTime=0x537646f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd279da00, ftLastWriteTime.dwHighDateTime=0x1c8a0cd, nFileSizeHigh=0x0, nFileSizeLow=0x5d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="grvschema.xsd", cAlternateFileName="GRVSCH~1.XSD")) returned 1 [0223.596] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\xml files\\builtincontrolsschema.xsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd") returned 1 [0223.596] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\grvschema.xsd", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd") returned 0x49 [0223.596] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.596] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.596] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0223.596] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2d4e500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2d4e500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x14a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Messenger.xml", cAlternateFileName="MESSEN~1.XML")) returned 1 [0223.596] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\xml files\\grvschema.xsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml") returned 1 [0223.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Messenger.xml", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml") returned 0x49 [0223.597] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.597] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.597] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0223.597] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Space Templates", cAlternateFileName="SPACET~1")) returned 1 [0223.597] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", len=0x4c | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\") returned 1 [0223.597] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\space templates\\") returned 0x4c [0223.597] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0223.597] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0223.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\Space Templates\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0223.597] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.598] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.598] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.598] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a42b900, ftCreationTime.dwHighDateTime=0x1c9d747, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a42b900, ftLastWriteTime.dwHighDateTime=0x1c9d747, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterApplicationDescriptors.xml", cAlternateFileName="STARTE~1.XML")) returned 1 [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\xml files\\messenger.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", len=0x5d | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml") returned 1 [0223.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterApplicationDescriptors.xml", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml") returned 0x5d [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0223.598] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4061200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4061200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x1b875, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterNotificationDescriptors.xml", cAlternateFileName="STARTE~3.XML")) returned 1 [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\xml files\\starterapplicationdescriptors.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", len=0x5e | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml") returned 1 [0223.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterNotificationDescriptors.xml", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml") returned 0x5e [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.598] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0223.598] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22545300, ftCreationTime.dwHighDateTime=0x1c9a48f, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22545300, ftLastWriteTime.dwHighDateTime=0x1c9a48f, nFileSizeHigh=0x0, nFileSizeLow=0x1a553, dwReserved0=0x0, dwReserved1=0x0, cFileName="StarterToolTemplates.xml", cAlternateFileName="STARTE~2.XML")) returned 1 [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\groove\\xml files\\starternotificationdescriptors.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", len=0x54 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml") returned 1 [0223.598] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\XML Files\\StarterToolTemplates.xml", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove\\xml files\\startertooltemplates.xml") returned 0x54 [0223.598] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.598] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.599] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0223.599] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.599] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.599] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.599] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0223.599] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\graph.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE") returned 1 [0223.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\groove.exe") returned 0x35 [0223.599] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.599] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.599] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0223.599] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\groove.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL") returned 1 [0223.599] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\grooveex.dll") returned 0x37 [0223.599] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.599] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.600] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\grooveex.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE") returned 1 [0223.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEMN.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\groovemn.exe") returned 0x37 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.600] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.600] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\groovemn.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL") returned 1 [0223.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\HVAC.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\hvac.dll") returned 0x33 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.600] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.600] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\hvac.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL") returned 1 [0223.600] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IEAWSDC.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\ieawsdc.dll") returned 0x36 [0223.600] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.600] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.600] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ieawsdc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe") returned 1 [0223.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IEContentService.exe", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\iecontentservice.exe") returned 0x3f [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.601] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.601] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\iecontentservice.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL") returned 1 [0223.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMCOMMON.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\imcommon.dll") returned 0x37 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.601] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.601] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\imcommon.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned 1 [0223.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\imdimp.add") returned 0x35 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.601] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.601] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0223.601] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\imdimp.add", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL") returned 1 [0223.601] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMPMAIL.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\impmail.dll") returned 0x36 [0223.601] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.601] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.602] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\impmail.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL") returned 1 [0223.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMUTIL.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\imutil.dll") returned 0x35 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.602] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.602] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\imutil.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL") returned 1 [0223.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMWDD.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\imwdd.dll") returned 0x34 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.602] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.602] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\imwdd.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL") returned 1 [0223.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IMWIZ.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\imwiz.dll") returned 0x34 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.602] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.602] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\imwiz.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE") returned 1 [0223.602] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopath.exe") returned 0x37 [0223.602] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.602] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.603] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0223.603] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", len=0x36 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned 1 [0223.603] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\") returned 0x36 [0223.603] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0223.603] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0223.603] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x77167485, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0223.654] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.654] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 [0223.654] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", len=0x4d | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned 1 [0223.654] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\") returned 0x4d [0223.654] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0223.654] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0223.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0223.728] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.729] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0223.729] SysReAllocStringLen (in: pbstr=0x6a0e888*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", len=0x67 | out: pbstr=0x6a0e888*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\") returned 1 [0223.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\", cchLength=0x67 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\") returned 0x67 [0223.729] SysReAllocStringLen (in: pbstr=0x6a0e830*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0e830*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0223.729] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0223.729] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\*.*", lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b96f0 [0223.740] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.740] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x553a8c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xa770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0223.740] SysReAllocStringLen (in: pbstr=0x6a0e880*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", len=0x84 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll") returned 1 [0223.740] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.Infopath.dll", cchLength=0x84 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll") returned 0x84 [0223.741] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0223.741] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.741] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x65c9fd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0223.741] SysReAllocStringLen (in: pbstr=0x6a0e880*="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", len=0x84 | out: pbstr=0x6a0e880*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml") returned 1 [0223.741] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\Microsoft.Office.InfoPath.xml", cchLength=0x84 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\microsoft.office.infopath.xml") returned 0x84 [0223.741] SysReAllocStringLen (in: pbstr=0x6a0e820*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0e820*="_RESTORE FILES_.txt") returned 1 [0223.741] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e58c | out: lpFindFileData=0x6a0e58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e544, dwReserved1=0x553a8c30, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96b0 [0223.741] FindClose (in: hFindFile=0x5b96b0 | out: hFindFile=0x5b96b0) returned 1 [0223.741] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\infopathomformservicesv12\\_restore files_.txt"), bFailIfExists=0) returned 1 [0223.786] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0223.786] FindNextFileW (in: hFindFile=0x5b96f0, lpFindFileData=0x6a0e88c | out: lpFindFileData=0x6a0e88c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.786] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.786] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0223.786] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", len=0x6a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll") returned 1 [0223.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.Infopath.dll", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll") returned 0x6a [0223.786] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.786] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.786] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0223.786] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", len=0x6a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned 1 [0223.786] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml", cchLength=0x6a | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\microsoft.office.infopath.xml") returned 0x6a [0223.786] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.786] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0223.786] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.787] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomformservices\\_restore files_.txt"), bFailIfExists=0) returned 1 [0223.789] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0223.789] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.789] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.789] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMV12", cAlternateFileName="INFOPA~1")) returned 1 [0223.789] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", len=0x44 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned 1 [0223.789] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\") returned 0x44 [0223.790] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0223.790] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0223.790] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0223.790] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0223.790] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0223.790] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", len=0x61 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll") returned 1 [0223.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.Infopath.dll", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll") returned 0x61 [0223.790] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.790] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.790] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0223.790] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", len=0x61 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned 1 [0223.790] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml", cchLength=0x61 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\microsoft.office.infopath.xml") returned 0x61 [0223.790] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0223.790] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0e80c, dwReserved1=0x544ee410, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0223.791] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0223.791] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\infopathomv12\\_restore files_.txt"), bFailIfExists=0) returned 1 [0223.805] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0223.805] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.805] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.805] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xe770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0223.805] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll") returned 1 [0223.805] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.Infopath.dll", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll") returned 0x53 [0223.805] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0223.805] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.805] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0223.805] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml") returned 1 [0223.805] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\Microsoft.Office.InfoPath.xml", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\infopathom\\microsoft.office.infopath.xml") returned 0x53 [0223.806] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0223.806] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.806] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x6a0ead4, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0223.806] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0223.806] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\infopathom\\_restore files_.txt"), bFailIfExists=0) returned 1 [0223.808] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0223.808] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0223.809] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0223.809] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\infopath.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL") returned 1 [0223.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\INLAUNCH.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\inlaunch.dll") returned 0x37 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.809] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.809] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\inlaunch.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", len=0x44 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned 1 [0223.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\installed_resources14.xss") returned 0x44 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.809] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.809] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0223.809] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\installed_resources14.xss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned 1 [0223.809] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\installed_schemas14.xss") returned 0x42 [0223.809] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.809] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.810] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0223.810] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\installed_schemas14.xss", psz="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL") returned 1 [0223.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\INTLDATE.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\intldate.dll") returned 0x37 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.810] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.810] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\intldate.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL") returned 1 [0223.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ipdesign.dll") returned 0x37 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.810] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.810] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ipdesign.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL") returned 1 [0223.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ipeditor.dll") returned 0x37 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.810] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.810] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0223.810] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ipeditor.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned 1 [0223.810] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ipirm.xml") returned 0x34 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.811] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.811] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0223.811] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ipirm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned 1 [0223.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\ipirmv.xml") returned 0x35 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.811] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.811] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0223.811] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ipirmv.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL") returned 1 [0223.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IPOLK.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ipolk.dll") returned 0x34 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.811] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.811] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ipolk.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned 1 [0223.811] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixacs.pdl") returned 0x34 [0223.811] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.812] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.812] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0223.812] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixacs.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned 1 [0223.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixdb2.pdl") returned 0x34 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.812] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.812] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0223.812] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixdb2.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned 1 [0223.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixgenerc.pdl") returned 0x37 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.812] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.812] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0223.812] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixgenerc.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned 1 [0223.812] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixoledb.pdl") returned 0x36 [0223.812] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.812] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0223.813] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixoledb.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned 1 [0223.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixoracle.pdl") returned 0x37 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.813] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0223.813] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixoracle.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned 1 [0223.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixssrv.pdl") returned 0x35 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.813] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.813] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0223.813] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixssrv.pdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL") returned 1 [0223.813] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\IXUTIL.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\ixutil.dll") returned 0x35 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0223.813] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0223.813] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0223.813] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ixutil.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned 1 [0223.814] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\jfont.dat") returned 0x34 [0224.220] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0224.220] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.170] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0226.170] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0226.170] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\jfont.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned 1 [0226.170] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\latin1.shp") returned 0x35 [0226.170] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.170] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.171] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db0) returned 0x6dee6e0 [0226.171] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0226.171] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\latin1.shp", psz="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL") returned 1 [0226.171] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LGND.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\lgnd.dll") returned 0x33 [0226.171] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.171] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.171] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0226.171] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\") returned 1 [0226.171] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\") returned 0x33 [0226.171] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0226.171] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0226.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0226.172] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.172] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Analysis", cAlternateFileName="")) returned 1 [0226.172] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", len=0x3c | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned 1 [0226.172] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\analysis\\") returned 0x3c [0226.172] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0226.172] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0226.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0226.191] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.192] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0226.192] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned 1 [0226.192] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll") returned 0x48 [0226.192] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.192] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa1887d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0226.192] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0226.192] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\_restore files_.txt"), bFailIfExists=0) returned 1 [0226.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da4) returned 0x6dee6e0 [0226.195] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0226.195] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned 1 [0226.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam") returned 0x49 [0226.195] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da8) returned 0x6dee6e0 [0226.195] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0226.195] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam", psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned 1 [0226.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam") returned 0x48 [0226.195] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0226.195] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0226.195] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam", psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned 1 [0226.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam") returned 0x47 [0226.196] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db0) returned 0x6dee6e0 [0226.196] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0226.196] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x62688, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0226.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM") returned 1 [0226.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam") returned 0x40 [0226.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0226.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0226.196] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.196] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\_restore files_.txt"), bFailIfExists=0) returned 1 [0226.199] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db4) returned 0x6dee6e0 [0226.199] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER", cAlternateFileName="")) returned 1 [0226.199] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", len=0x3a | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned 1 [0226.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\solver\\") returned 0x3a [0226.199] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0226.199] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0226.199] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0226.199] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.199] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0226.199] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", len=0x45 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned 1 [0226.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam") returned 0x45 [0226.199] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa1ae930, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0226.200] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0226.200] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\_restore files_.txt"), bFailIfExists=0) returned 1 [0226.202] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db8) returned 0x6dee6e0 [0226.202] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0226.202] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam", psz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", len=0x46 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL") returned 1 [0226.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER32.DLL", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\library\\solver\\solver32.dll") returned 0x46 [0226.202] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0226.202] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.202] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0226.203] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0226.203] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0226.203] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0226.203] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\lgnd.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL") returned 1 [0226.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LOGELEMS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\logelems.dll") returned 0x37 [0226.203] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.203] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0226.203] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\logelems.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned 1 [0226.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\logmodel.mdl") returned 0x37 [0226.203] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dbc) returned 0x6dee6e0 [0226.203] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0226.315] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\logmodel.mdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL") returned 1 [0226.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LOGVIEW.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\logview.dll") returned 0x36 [0226.315] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.315] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.315] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0226.315] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\logview.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned 1 [0226.315] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\lookup.dat") returned 0x35 [0226.315] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.315] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.545] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d88) returned 0x6dee6e0 [0226.546] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\lookup.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL") returned 1 [0226.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MAPIPH.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\mapiph.dll") returned 0x35 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.546] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mapiph.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL") returned 1 [0226.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MAPISHELL.DLL", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\mapishell.dll") returned 0x38 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.546] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mapishell.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL") returned 1 [0226.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MCPS.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\mcps.dll") returned 0x33 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.546] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.546] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0226.546] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mcps.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL") returned 1 [0226.546] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDCAT.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\medcat.dll") returned 0x35 [0226.547] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0226.547] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.547] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0226.547] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\") returned 1 [0226.547] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\") returned 0x31 [0226.547] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0226.547] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0226.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0226.549] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0226.549] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x5ebdaad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPLAUSE.WAV", cAlternateFileName="")) returned 1 [0226.549] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV") returned 1 [0226.549] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\APPLAUSE.WAV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\applause.wav") returned 0x3d [0226.549] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0226.549] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0226.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x51a15810, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0226.550] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0226.550] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\media\\_restore files_.txt"), bFailIfExists=0) returned 1 [0230.194] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d8c) returned 0x6dee6e0 [0230.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb46b000, ftCreationTime.dwHighDateTime=0x1bfbeee, ftLastAccessTime.dwLowDateTime=0x5ed57890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb46b000, ftLastWriteTime.dwHighDateTime=0x1bfbeee, nFileSizeHigh=0x0, nFileSizeLow=0x59f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARROW.WAV", cAlternateFileName="")) returned 1 [0230.199] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\applause.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV") returned 1 [0230.225] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\ARROW.WAV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\arrow.wav") returned 0x3a [0230.225] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.225] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.225] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d8c) returned 0x6dee6e0 [0230.226] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90776900, ftCreationTime.dwHighDateTime=0x1bfbeeb, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90776900, ftLastWriteTime.dwHighDateTime=0x1bfbeeb, nFileSizeHigh=0x0, nFileSizeLow=0x2f676, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOMB.WAV", cAlternateFileName="")) returned 1 [0230.226] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\arrow.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV") returned 1 [0230.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BOMB.WAV", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\bomb.wav") returned 0x39 [0230.226] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d90) returned 0x6dee6e0 [0230.226] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106db200, ftCreationTime.dwHighDateTime=0x1bfc6e8, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x106db200, ftLastWriteTime.dwHighDateTime=0x1bfc6e8, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREEZE.WAV", cAlternateFileName="")) returned 1 [0230.226] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\bomb.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV") returned 1 [0230.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\BREEZE.WAV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\breeze.wav") returned 0x3b [0230.226] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d94) returned 0x6dee6e0 [0230.226] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAMERA.WAV", cAlternateFileName="")) returned 1 [0230.226] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\breeze.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV") returned 1 [0230.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CAMERA.WAV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\camera.wav") returned 0x3b [0230.226] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.226] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.226] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d98) returned 0x6dee6e0 [0230.226] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x1d7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CASHREG.WAV", cAlternateFileName="")) returned 1 [0230.227] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\camera.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV") returned 1 [0230.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CASHREG.WAV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\cashreg.wav") returned 0x3c [0230.227] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1d9c) returned 0x6dee6e0 [0230.227] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x91be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHIMES.WAV", cAlternateFileName="")) returned 1 [0230.227] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\cashreg.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV") returned 1 [0230.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CHIMES.WAV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\chimes.wav") returned 0x3b [0230.227] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da0) returned 0x6dee6e0 [0230.227] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffbd3c00, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffbd3c00, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x268, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLICK.WAV", cAlternateFileName="")) returned 1 [0230.227] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\chimes.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV") returned 1 [0230.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\CLICK.WAV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\click.wav") returned 0x3a [0230.227] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.227] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da4) returned 0x6dee6e0 [0230.227] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0cc600, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0cc600, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="COIN.WAV", cAlternateFileName="")) returned 1 [0230.227] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\click.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV") returned 1 [0230.227] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\COIN.WAV", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\coin.wav") returned 0x39 [0230.228] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1da8) returned 0x6dee6e0 [0230.228] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x4be2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRUMROLL.WAV", cAlternateFileName="")) returned 1 [0230.228] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\coin.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV") returned 1 [0230.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\DRUMROLL.WAV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\drumroll.wav") returned 0x3d [0230.228] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dac) returned 0x6dee6e0 [0230.228] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x5c20, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPLODE.WAV", cAlternateFileName="")) returned 1 [0230.228] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\drumroll.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV") returned 1 [0230.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\EXPLODE.WAV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\explode.wav") returned 0x3c [0230.228] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.228] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db0) returned 0x6dee6e0 [0230.228] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb836b000, ftCreationTime.dwHighDateTime=0x1bfc6e7, ftLastAccessTime.dwLowDateTime=0x53822dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb836b000, ftLastWriteTime.dwHighDateTime=0x1bfc6e7, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="HAMMER.WAV", cAlternateFileName="")) returned 1 [0230.228] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\explode.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV") returned 1 [0230.228] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\HAMMER.WAV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\hammer.wav") returned 0x3b [0230.228] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.228] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db4) returned 0x6dee6e0 [0230.229] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LASER.WAV", cAlternateFileName="")) returned 1 [0230.229] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\hammer.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV") returned 1 [0230.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\LASER.WAV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\laser.wav") returned 0x3a [0230.229] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1db8) returned 0x6dee6e0 [0230.229] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4b5dc00, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4b5dc00, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x3d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUSH.WAV", cAlternateFileName="")) returned 1 [0230.229] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\laser.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV") returned 1 [0230.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\PUSH.WAV", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\push.wav") returned 0x39 [0230.229] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dbc) returned 0x6dee6e0 [0230.229] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eba3e00, ftCreationTime.dwHighDateTime=0x1bfa2b0, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eba3e00, ftLastWriteTime.dwHighDateTime=0x1bfa2b0, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUCTION.WAV", cAlternateFileName="")) returned 1 [0230.229] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\push.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV") returned 1 [0230.229] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\SUCTION.WAV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\suction.wav") returned 0x3c [0230.229] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.229] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.229] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc0) returned 0x6dee6e0 [0230.230] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb796bf00, ftCreationTime.dwHighDateTime=0x1bd8ab7, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb796bf00, ftLastWriteTime.dwHighDateTime=0x1bd8ab7, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TYPE.WAV", cAlternateFileName="")) returned 1 [0230.230] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\suction.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV") returned 1 [0230.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\TYPE.WAV", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\type.wav") returned 0x39 [0230.230] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc4) returned 0x6dee6e0 [0230.230] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdb8800, ftCreationTime.dwHighDateTime=0x1bfbeed, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecdb8800, ftLastWriteTime.dwHighDateTime=0x1bfbeed, nFileSizeHigh=0x0, nFileSizeLow=0x35c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="VOLTAGE.WAV", cAlternateFileName="")) returned 1 [0230.230] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\type.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV") returned 1 [0230.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\VOLTAGE.WAV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\voltage.wav") returned 0x3c [0230.230] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dc8) returned 0x6dee6e0 [0230.230] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b50b600, ftCreationTime.dwHighDateTime=0x1bc8d47, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b50b600, ftLastWriteTime.dwHighDateTime=0x1bc8d47, nFileSizeHigh=0x0, nFileSizeLow=0x6de, dwReserved0=0x0, dwReserved1=0x0, cFileName="WHOOSH.WAV", cAlternateFileName="")) returned 1 [0230.230] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\voltage.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV") returned 1 [0230.230] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WHOOSH.WAV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\whoosh.wav") returned 0x3b [0230.230] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.230] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.230] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dcc) returned 0x6dee6e0 [0230.230] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcde5800, ftCreationTime.dwHighDateTime=0x1bfc6e6, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcde5800, ftLastWriteTime.dwHighDateTime=0x1bfc6e6, nFileSizeHigh=0x0, nFileSizeLow=0x2b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="WIND.WAV", cAlternateFileName="")) returned 1 [0230.230] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\media\\whoosh.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", len=0x39 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV") returned 1 [0230.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA\\WIND.WAV", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\media\\wind.wav") returned 0x39 [0230.231] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0230.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd0) returned 0x6dee6e0 [0230.231] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0230.231] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0230.231] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0230.231] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\medcat.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", len=0x45 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll") returned 1 [0230.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.dll", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll") returned 0x45 [0230.231] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.231] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0230.231] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.businessdata.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", len=0x45 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned 1 [0230.231] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml") returned 0x45 [0230.231] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.231] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.231] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd4) returned 0x6dee6e0 [0230.231] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.businessdata.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", len=0x5c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll") returned 1 [0230.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.dll", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll") returned 0x5c [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.232] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", len=0x5c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned 1 [0230.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml", cchLength=0x5c | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml") returned 0x5c [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.232] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd8) returned 0x6dee6e0 [0230.232] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtime.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", len=0x5e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll") returned 1 [0230.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.dll", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll") returned 0x5e [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.232] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", len=0x5e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned 1 [0230.232] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml", cchLength=0x5e | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml") returned 0x5e [0230.232] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.232] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0230.233] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessapplications.runtimeui.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll") returned 1 [0230.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.dll", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll") returned 0x4c [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.233] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", len=0x4c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned 1 [0230.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml") returned 0x4c [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.233] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0230.233] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.businessdata.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", len=0x60 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll") returned 1 [0230.233] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cchLength=0x60 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll") returned 0x60 [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.233] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.233] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0230.233] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.client.internal.clrhost.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", len=0x54 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll") returned 1 [0230.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.InfoPath.FormControl.dll", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll") returned 0x54 [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.234] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.infopath.formcontrol.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", len=0x5a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll") returned 1 [0230.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll") returned 0x5a [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.234] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", len=0x5a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned 1 [0230.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cchLength=0x5a | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml") returned 0x5a [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.234] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0230.234] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.semitrust.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", len=0x54 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll") returned 1 [0230.234] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.dll", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll") returned 0x54 [0230.234] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.234] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.235] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", len=0x54 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned 1 [0230.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml", cchLength=0x54 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml") returned 0x54 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.235] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0230.235] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.infopath.xml.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", len=0x5f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll") returned 1 [0230.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll") returned 0x5f [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.235] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.interop.visio.workflowauthoring.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", len=0x56 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll") returned 1 [0230.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.office.workflow.actions.proxy.dll", cchLength=0x56 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll") returned 0x56 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.235] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.235] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0230.235] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.office.workflow.actions.proxy.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", len=0x66 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll") returned 1 [0230.235] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.dll", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll") returned 0x66 [0230.236] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.236] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.236] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0230.237] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", len=0x66 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned 1 [0230.237] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml", cchLength=0x66 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml") returned 0x66 [0230.237] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.237] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.238] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0230.238] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.businessdata.administration.client.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", len=0x59 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 1 [0230.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\microsoft.sharepoint.workflowactions.proxy.dll", cchLength=0x59 | out: lpsz="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll") returned 0x59 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.238] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\microsoft.sharepoint.workflowactions.proxy.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL") returned 1 [0230.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MIMEDIR.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mimedir.dll") returned 0x36 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.238] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mimedir.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe") returned 1 [0230.238] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\misc.exe", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\misc.exe") returned 0x33 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.238] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.238] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0230.238] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\misc.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL") returned 1 [0230.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MLCFG32.CPL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mlcfg32.cpl") returned 0x36 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0230.239] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mlcfg32.cpl", psz="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL") returned 1 [0230.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MLSHEXT.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mlshext.dll") returned 0x36 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.239] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mlshext.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned 1 [0230.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\mml2omml.xsl") returned 0x37 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.239] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.239] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0230.239] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mml2omml.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL") returned 1 [0230.239] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MODELENG.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\modeleng.dll") returned 0x37 [0230.239] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.240] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\modeleng.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL") returned 1 [0230.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MORPH9.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\morph9.dll") returned 0x35 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.240] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\morph9.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL") returned 1 [0230.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MPXINT.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\mpxint.dll") returned 0x35 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.240] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mpxint.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned 1 [0230.240] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\msacc.olb") returned 0x34 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.240] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.240] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0230.240] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0230.240] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msacc.olb", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE") returned 1 [0230.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msaccess.exe") returned 0x37 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.241] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msaccess.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned 1 [0230.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest") returned 0x40 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.241] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msaccess.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL") returned 1 [0230.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSAEXP30.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msaexp30.dll") returned 0x37 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.241] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msaexp30.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned 1 [0230.241] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mscol11.inf") returned 0x36 [0230.241] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.241] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0230.242] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscol11.inf", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned 1 [0230.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mscol11.ppd") returned 0x36 [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0230.242] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscol11.ppd", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned 1 [0230.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub") returned 0x3a [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0230.242] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7cm_en.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned 1 [0230.242] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub") returned 0x3a [0230.242] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.242] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.242] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0230.243] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7cm_es.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned 1 [0230.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub") returned 0x3a [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.243] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0230.243] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7cm_fr.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll") returned 1 [0230.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7en.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7en.dll") returned 0x37 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.243] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7en.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll") returned 1 [0230.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7es.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7es.dll") returned 0x37 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.243] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0230.243] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7es.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll") returned 1 [0230.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7fr.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7fr.dll") returned 0x37 [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.244] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7fr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned 1 [0230.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub") returned 0x3b [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0230.244] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7wre_en.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned 1 [0230.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub") returned 0x3b [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.244] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0230.244] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7wre_es.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned 1 [0230.244] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub") returned 0x3b [0230.244] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.244] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0230.245] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mscss7wre_fr.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll") returned 1 [0230.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7.dll", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7.dll") returned 0x34 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.245] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned 1 [0230.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7db.kic") returned 0x36 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0230.245] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7db.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned 1 [0230.245] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7en.kic") returned 0x36 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.245] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.245] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0230.245] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0230.245] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7en.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned 1 [0230.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7es.kic") returned 0x36 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0230.246] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7es.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned 1 [0230.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7fr.kic") returned 0x36 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0230.246] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7fr.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned 1 [0230.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7ge.kic") returned 0x36 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.246] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.246] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0230.246] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0230.246] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7ge.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned 1 [0230.246] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7jp.kic") returned 0x36 [0230.247] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.247] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.247] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0230.247] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0230.251] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7jp.kic", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll") returned 1 [0230.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7tk.dll", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7tk.dll") returned 0x36 [0230.288] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.288] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0230.288] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7tk.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll") returned 1 [0230.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mset7tkjp.dll", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\mset7tkjp.dll") returned 0x38 [0230.288] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.288] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0230.288] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mset7tkjp.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO") returned 1 [0230.288] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSN.ICO", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\msn.ico") returned 0x32 [0230.288] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.288] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.288] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0230.288] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msn.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned 1 [0230.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mso0127.acl") returned 0x36 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.289] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0230.289] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mso0127.acl", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL") returned 1 [0230.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCF.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\msocf.dll") returned 0x34 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.289] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msocf.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL") returned 1 [0230.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFU.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\msocfu.dll") returned 0x35 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.289] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.289] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msocfu.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL") returned 1 [0230.289] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOCFUIUTILITIESDLL.DLL", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll") returned 0x42 [0230.289] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.290] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msocfuiutilitiesdll.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL") returned 1 [0230.290] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSODCW.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\msodcw.dll") returned 0x35 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.290] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msodcw.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL") returned 1 [0230.290] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEV.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\msohev.dll") returned 0x35 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.290] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msohev.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL") returned 1 [0230.290] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHEVI.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\msohevi.dll") returned 0x36 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.290] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.290] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0230.290] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msohevi.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE") returned 1 [0230.290] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOHTMED.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msohtmed.exe") returned 0x37 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.291] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msohtmed.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL") returned 1 [0230.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOSTYLE.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msostyle.dll") returned 0x37 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.291] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msostyle.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE") returned 1 [0230.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOSYNC.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\msosync.exe") returned 0x36 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.291] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msosync.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE") returned 1 [0230.291] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUC.EXE", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\msouc.exe") returned 0x34 [0230.291] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.291] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.291] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msouc.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned 1 [0230.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\msoutl.olb") returned 0x35 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.292] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0230.292] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msoutl.olb", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL") returned 1 [0230.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTLS.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\msoutls.dll") returned 0x36 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.292] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msoutls.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL") returned 1 [0230.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPJEVTS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\mspjevts.dll") returned 0x37 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.292] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mspjevts.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned 1 [0230.292] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\msppt.olb") returned 0x34 [0230.292] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.292] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0230.293] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msppt.olb", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned 1 [0230.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\msprj.olb") returned 0x34 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.293] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0230.293] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msprj.olb", psz="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll") returned 1 [0230.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\msproof7.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msproof7.dll") returned 0x37 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.293] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msproof7.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL") returned 1 [0230.293] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mspst32.dll") returned 0x36 [0230.293] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.293] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.293] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mspst32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE") returned 1 [0230.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\mspub.exe") returned 0x34 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.294] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mspub.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned 1 [0230.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\mspub.exe.manifest") returned 0x3d [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.294] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mspub.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned 1 [0230.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\mspub.tlb") returned 0x34 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.294] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.294] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0230.294] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mspub.tlb", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE") returned 1 [0230.294] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSQRY32.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\msqry32.exe") returned 0x36 [0230.294] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.295] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msqry32.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL") returned 1 [0230.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSRTEDIT.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msrtedit.dll") returned 0x37 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.295] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msrtedit.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE") returned 1 [0230.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORDB.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mstordb.exe") returned 0x36 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.295] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mstordb.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE") returned 1 [0230.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORE.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\mstore.exe") returned 0x35 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.295] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.295] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0230.295] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mstore.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL") returned 1 [0230.295] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSTORES.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\mstores.dll") returned 0x36 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mstores.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned 1 [0230.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\msword.olb") returned 0x35 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0230.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msword.olb", psz="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL") returned 1 [0230.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MSYUBIN7.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\msyubin7.dll") returned 0x37 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.296] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\msyubin7.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO") returned 1 [0230.296] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\MYSL.ICO", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\mysl.ico") returned 0x33 [0230.296] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.296] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.296] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0230.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\mysl.ico", psz="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL") returned 1 [0230.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NAME.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\name.dll") returned 0x33 [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\name.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL") returned 1 [0230.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLPROXY.DLL", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll") returned 0x3f [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\namecontrolproxy.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE") returned 1 [0230.297] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NAMECONTROLSERVER.EXE", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\namecontrolserver.exe") returned 0x40 [0230.297] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.297] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.297] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\namecontrolserver.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL") returned 1 [0230.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NAMEEXT.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\nameext.dll") returned 0x36 [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nameext.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL") returned 1 [0230.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7data0011.dll") returned 0x3a [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7data0011.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL") returned 1 [0230.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll") returned 0x3e [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.298] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll") returned 1 [0230.298] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7models0009.dll") returned 0x3c [0230.298] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.298] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7models0009.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll") returned 1 [0230.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7models000a.dll") returned 0x3c [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7models000a.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll") returned 1 [0230.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7models000c.dll") returned 0x3c [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7models000c.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", len=0x3c | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL") returned 1 [0230.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\nl7models0011.dll") returned 0x3c [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.299] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.299] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0230.299] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\nl7models0011.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL") returned 1 [0230.299] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\NPAUTHZ.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\npauthz.dll") returned 0x36 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\npauthz.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL") returned 1 [0230.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\oart.dll") returned 0x33 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oart.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL") returned 1 [0230.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\oartconv.dll") returned 0x37 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oartconv.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned 1 [0230.300] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ocrhc.dat") returned 0x34 [0230.300] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.300] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.300] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0230.300] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ocrhc.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned 1 [0230.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ocrvc.dat") returned 0x34 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0230.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ocrvc.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned 1 [0230.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\oemprint.cat") returned 0x37 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.301] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0230.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oemprint.cat", psz="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL") returned 1 [0230.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\offowc.dll") returned 0x35 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.301] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.301] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0230.301] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\offowc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL") returned 1 [0230.301] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OFFRHD.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\offrhd.dll") returned 0x35 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\offrhd.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL") returned 1 [0230.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OFFXML.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\offxml.dll") returned 0x35 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\offxml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll") returned 1 [0230.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ogalegit.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ogalegit.dll") returned 0x37 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ogalegit.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL") returned 1 [0230.302] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\oimg.dll") returned 0x33 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.302] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.302] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0230.302] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oimg.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE") returned 1 [0230.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OIS.EXE", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\ois.exe") returned 0x32 [0230.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0230.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ois.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL") returned 1 [0230.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OISAPP.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\oisapp.dll") returned 0x35 [0230.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0230.303] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0230.303] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oisapp.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll") returned 1 [0230.303] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\oisctrl.dll", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\oisctrl.dll") returned 0x36 [0230.303] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0230.303] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.409] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oisctrl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL") returned 1 [0232.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OISGRAPH.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\oisgraph.dll") returned 0x37 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.410] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\oisgraph.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL") returned 1 [0232.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OLKFSTUB.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\olkfstub.dll") returned 0x37 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.410] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\olkfstub.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned 1 [0232.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\olkirm.xml") returned 0x35 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0232.410] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0232.410] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\olkirm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned 1 [0232.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\olkirmv.xml") returned 0x36 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0232.411] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\olkirmv.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL") returned 1 [0232.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\olmapi32.dll") returned 0x37 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.411] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\olmapi32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned 1 [0232.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\omml2mml.xsl") returned 0x37 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0232.411] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\omml2mml.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL") returned 1 [0232.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OMSMAIN.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\omsmain.dll") returned 0x36 [0232.411] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.412] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\omsmain.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL") returned 1 [0232.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OMSXP32.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\omsxp32.dll") returned 0x36 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.412] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\omsxp32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll") returned 1 [0232.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIE.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\onbttnie.dll") returned 0x37 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.412] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onbttnie.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll") returned 1 [0232.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnIELinkedNotes.dll", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll") returned 0x42 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.412] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0232.412] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onbttnielinkednotes.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll") returned 1 [0232.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnOL.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\onbttnol.dll") returned 0x37 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.413] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onbttnol.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll") returned 1 [0232.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnPPT.dll", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\onbttnppt.dll") returned 0x38 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.413] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onbttnppt.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll") returned 1 [0232.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONBttnWD.dll", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\onbttnwd.dll") returned 0x37 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0232.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0232.413] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\") returned 1 [0232.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\") returned 0x33 [0232.413] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0232.414] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0232.414] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0234.313] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0234.313] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fd1300, ftCreationTime.dwHighDateTime=0x1c8e623, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fd1300, ftLastWriteTime.dwHighDateTime=0x1c8e623, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote-PipelineConfig.xml", cAlternateFileName="SENDTO~1.XML")) returned 1 [0234.313] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", len=0x53 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml") returned 1 [0234.313] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", cchLength=0x53 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml") returned 0x53 [0234.313] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0234.313] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0234.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x50e7acd0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0234.314] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0234.314] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\_restore files_.txt"), bFailIfExists=0) returned 1 [0239.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0239.576] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7167100, ftCreationTime.dwHighDateTime=0x1c9d832, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7167100, ftLastWriteTime.dwHighDateTime=0x1c9d832, nFileSizeHigh=0x0, nFileSizeLow=0x2580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.gpd", cAlternateFileName="SENDTO~1.GPD")) returned 1 [0239.576] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd") returned 1 [0239.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd") returned 0x44 [0239.576] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.576] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.576] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0239.576] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d77db00, ftCreationTime.dwHighDateTime=0x1c8e25a, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d77db00, ftLastWriteTime.dwHighDateTime=0x1c8e25a, nFileSizeHigh=0x0, nFileSizeLow=0x7b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNote.ini", cAlternateFileName="SENDTO~1.INI")) returned 1 [0239.576] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini", len=0x44 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini") returned 1 [0239.576] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.ini", cchLength=0x44 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini") returned 0x44 [0239.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0239.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x1bf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNOteFilter.dll", cAlternateFileName="SENDTO~1.DLL")) returned 1 [0239.577] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.ini", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll") returned 1 [0239.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNOteFilter.dll", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll") returned 0x4a [0239.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5b7d200, ftCreationTime.dwHighDateTime=0x1c8edfe, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf5b7d200, ftLastWriteTime.dwHighDateTime=0x1c8edfe, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendtoOneNoteFilter.gpd", cAlternateFileName="SENDTO~2.GPD")) returned 1 [0239.577] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd", len=0x4a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd") returned 1 [0239.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendtoOneNoteFilter.gpd", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd") returned 0x4a [0239.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.577] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0239.577] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a1fd700, ftCreationTime.dwHighDateTime=0x1c8e624, ftLastAccessTime.dwLowDateTime=0x5983e610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a1fd700, ftLastWriteTime.dwHighDateTime=0x1c8e624, nFileSizeHigh=0x0, nFileSizeLow=0x1ca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteNames.gpd", cAlternateFileName="SENDTO~3.GPD")) returned 1 [0239.577] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotefilter.gpd", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd", len=0x49 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd") returned 1 [0239.577] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteNames.gpd", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd") returned 0x49 [0239.577] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.577] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.578] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0239.578] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xeb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendToOneNoteUI.dll", cAlternateFileName="SENDTO~2.DLL")) returned 1 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenotenames.gpd", psz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll", len=0x46 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll") returned 1 [0239.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNoteUI.dll", cchLength=0x46 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenoteui.dll") returned 0x46 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.578] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.578] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0239.578] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.578] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onbttnwd.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE") returned 1 [0239.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenote.exe") returned 0x36 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.578] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.578] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onenote.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", len=0x39 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned 1 [0239.578] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenoteirm.xml") returned 0x39 [0239.578] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.579] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0239.579] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onenoteirm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE") returned 1 [0239.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEM.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\onenotem.exe") returned 0x37 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.579] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onenotem.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL") returned 1 [0239.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEMANAGED.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\onenotemanaged.dll") returned 0x3d [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.579] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onenotemanaged.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL") returned 1 [0239.579] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\onfilter.dll") returned 0x37 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.579] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.579] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0239.579] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onfilter.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL") returned 1 [0239.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONLNTCOMLIB.DLL", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\onlntcomlib.dll") returned 0x3a [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.580] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onlntcomlib.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL") returned 1 [0239.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\onmain.dll") returned 0x35 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.580] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onmain.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", len=0x39 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll") returned 1 [0239.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONPPTAddin.dll", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\onpptaddin.dll") returned 0x39 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.580] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onpptaddin.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll", len=0x3a | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll") returned 1 [0239.580] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ONWordAddin.dll", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\onwordaddin.dll") returned 0x3a [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.580] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.580] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0239.580] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\onwordaddin.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL") returned 1 [0239.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\orgchart.dll") returned 0x37 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.581] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\orgchart.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL") returned 1 [0239.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHWIZ.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\orgchwiz.dll") returned 0x37 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.581] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\orgchwiz.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE") returned 1 [0239.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ORGWIZ.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\orgwiz.exe") returned 0x35 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.581] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\orgwiz.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL") returned 1 [0239.581] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ORMELEMS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ormelems.dll") returned 0x37 [0239.581] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.581] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.581] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ormelems.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned 1 [0239.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\ormmodel.mdl") returned 0x37 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0239.582] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ormmodel.mdl", psz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned 1 [0239.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\ospp.htm") returned 0x33 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0239.582] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ospp.htm", psz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", len=0x33 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned 1 [0239.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\ospp.vbs") returned 0x33 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.582] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.582] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0239.582] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0239.582] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ospp.vbs", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL") returned 1 [0239.582] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLACCT.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlacct.dll") returned 0x37 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.583] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlacct.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL") returned 1 [0239.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLCTL.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlctl.dll") returned 0x36 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.583] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlctl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned 1 [0239.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlfltr.dat") returned 0x37 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.583] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0239.583] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlfltr.dat", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL") returned 1 [0239.583] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlfltr.dll") returned 0x37 [0239.583] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.583] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.583] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlfltr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL") returned 1 [0239.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLMIME.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlmime.dll") returned 0x37 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.584] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.584] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlmime.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE") returned 1 [0239.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlook.exe") returned 0x36 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.584] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.584] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlook.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", len=0x3f | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned 1 [0239.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlook.exe.manifest") returned 0x3f [0239.584] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.584] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.584] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0239.584] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", len=0x3f | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\") returned 1 [0239.584] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\") returned 0x3f [0239.584] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0239.584] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0239.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0239.600] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0239.717] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0239.717] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML") returned 1 [0239.717] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml") returned 0x50 [0239.717] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.717] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x5133d8d0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0239.717] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0239.717] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\_restore files_.txt"), bFailIfExists=0) returned 1 [0239.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0239.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTINTERNET.NET.XML", cAlternateFileName="BTINTE~1.XML")) returned 1 [0239.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", len=0x51 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML") returned 1 [0239.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", cchLength=0x51 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml") returned 0x51 [0239.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0239.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x51b201b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="BTOPENWORLD.COM.XML", cAlternateFileName="BTOPEN~1.XML")) returned 1 [0239.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", len=0x52 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML") returned 1 [0239.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTOPENWORLD.COM.XML", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml") returned 0x52 [0239.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.720] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0239.720] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x52837ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLASH.NET.XML", cAlternateFileName="FLASHN~1.XML")) returned 1 [0239.720] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btopenworld.com.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML") returned 1 [0239.720] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\FLASH.NET.XML", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml") returned 0x4c [0239.720] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.720] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0239.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL.ROGERS.COM.XML", cAlternateFileName="NLROGE~1.XML")) returned 1 [0239.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\flash.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML") returned 1 [0239.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NL.ROGERS.COM.XML", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml") returned 0x50 [0239.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0239.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NVBELL.NET.XML", cAlternateFileName="NVBELL~1.XML")) returned 1 [0239.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nl.rogers.com.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML") returned 1 [0239.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\NVBELL.NET.XML", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml") returned 0x4d [0239.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.721] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0239.721] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PACBELL.NET.XML", cAlternateFileName="PACBEL~1.XML")) returned 1 [0239.721] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\nvbell.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML") returned 1 [0239.721] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PACBELL.NET.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml") returned 0x4e [0239.721] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.721] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0239.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRODIGY.NET.XML", cAlternateFileName="PRODIG~1.XML")) returned 1 [0239.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\pacbell.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML") returned 1 [0239.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\PRODIGY.NET.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml") returned 0x4e [0239.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0239.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d227b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x0, dwReserved1=0x0, cFileName="ROGERS.COM.XML", cAlternateFileName="ROGERS~1.XML")) returned 1 [0239.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\prodigy.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML") returned 1 [0239.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\ROGERS.COM.XML", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml") returned 0x4d [0239.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.722] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0239.722] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="SBCGLOBAL.NET.XML", cAlternateFileName="SBCGLO~1.XML")) returned 1 [0239.722] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\rogers.com.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML", len=0x50 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML") returned 1 [0239.722] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SBCGLOBAL.NET.XML", cchLength=0x50 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml") returned 0x50 [0239.722] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.722] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0239.723] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNET.NET.XML", cAlternateFileName="SNETNE~1.XML")) returned 1 [0239.723] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\sbcglobal.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML") returned 1 [0239.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SNET.NET.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml") returned 0x4b [0239.723] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0239.723] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SWBELL.NET.XML", cAlternateFileName="SWBELL~1.XML")) returned 1 [0239.723] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\snet.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML") returned 1 [0239.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\SWBELL.NET.XML", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml") returned 0x4d [0239.723] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0239.723] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="TALK21.COM.XML", cAlternateFileName="TALK21~1.XML")) returned 1 [0239.723] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\swbell.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML", len=0x4d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML") returned 1 [0239.723] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\TALK21.COM.XML", cchLength=0x4d | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml") returned 0x4d [0239.723] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.723] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.723] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0239.724] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="WANS.NET.XML", cAlternateFileName="WANSNE~1.XML")) returned 1 [0239.724] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\talk21.com.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML") returned 1 [0239.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\WANS.NET.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml") returned 0x4b [0239.724] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0239.724] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CA.XML", cAlternateFileName="YAHOOC~2.XML")) returned 1 [0239.724] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\wans.net.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML") returned 1 [0239.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CA.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml") returned 0x4b [0239.724] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.724] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0239.724] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.ID.XML", cAlternateFileName="YA6C44~1.XML")) returned 1 [0239.724] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ca.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML") returned 1 [0239.724] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.ID.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml") returned 0x4e [0239.724] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.724] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0239.725] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.IN.XML", cAlternateFileName="YA8E91~1.XML")) returned 1 [0239.725] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.id.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML") returned 1 [0239.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.IN.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml") returned 0x4e [0239.725] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0239.725] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.JP.XML", cAlternateFileName="YAHOOC~3.XML")) returned 1 [0239.725] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.in.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML") returned 1 [0239.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.JP.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml") returned 0x4e [0239.725] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0239.725] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.KR.XML", cAlternateFileName="YAEF96~1.XML")) returned 1 [0239.725] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.jp.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML") returned 1 [0239.725] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.KR.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml") returned 0x4e [0239.725] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.725] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.725] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0239.726] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.NZ.XML", cAlternateFileName="YA186B~1.XML")) returned 1 [0239.726] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.kr.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML") returned 1 [0239.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.NZ.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml") returned 0x4e [0239.726] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0239.726] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.TH.XML", cAlternateFileName="YACB7D~1.XML")) returned 1 [0239.726] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.nz.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML") returned 1 [0239.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.TH.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml") returned 0x4e [0239.726] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0239.726] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.CO.UK.XML", cAlternateFileName="YAE791~1.XML")) returned 1 [0239.726] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.th.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML", len=0x4e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML") returned 1 [0239.726] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.CO.UK.XML", cchLength=0x4e | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml") returned 0x4e [0239.726] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.726] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.726] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0239.727] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AR.XML", cAlternateFileName="YA81CD~1.XML")) returned 1 [0239.727] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.co.uk.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML") returned 1 [0239.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AR.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml") returned 0x4f [0239.727] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0239.727] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.AU.XML", cAlternateFileName="YA02CD~1.XML")) returned 1 [0239.727] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ar.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML") returned 1 [0239.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.AU.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml") returned 0x4f [0239.727] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0239.727] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.BR.XML", cAlternateFileName="YAHOOC~1.XML")) returned 1 [0239.727] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.au.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML") returned 1 [0239.727] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml") returned 0x4f [0239.727] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.727] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.727] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0239.727] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.CN.XML", cAlternateFileName="YAHOOC~4.XML")) returned 1 [0239.728] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML") returned 1 [0239.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.CN.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml") returned 0x4f [0239.728] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.728] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0239.728] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.HK.XML", cAlternateFileName="YA56AC~1.XML")) returned 1 [0239.728] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.cn.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML") returned 1 [0239.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.HK.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml") returned 0x4f [0239.728] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.728] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0239.728] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MX.XML", cAlternateFileName="YAEA08~1.XML")) returned 1 [0239.728] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.hk.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML") returned 1 [0239.728] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MX.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml") returned 0x4f [0239.728] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.728] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.728] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0239.728] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.MY.XML", cAlternateFileName="YA0670~1.XML")) returned 1 [0239.729] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.mx.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML") returned 1 [0239.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.MY.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml") returned 0x4f [0239.729] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0239.729] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.PH.XML", cAlternateFileName="YA6D1B~1.XML")) returned 1 [0239.729] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.my.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML") returned 1 [0239.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.PH.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml") returned 0x4f [0239.729] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0239.729] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.SG.XML", cAlternateFileName="YAC50A~1.XML")) returned 1 [0239.729] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.ph.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML") returned 1 [0239.729] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.SG.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml") returned 0x4f [0239.729] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.729] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.729] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0239.729] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.TW.XML", cAlternateFileName="YAB0F6~1.XML")) returned 1 [0239.730] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.sg.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML") returned 1 [0239.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.TW.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml") returned 0x4f [0239.730] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0239.730] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.VN.XML", cAlternateFileName="YA38FD~1.XML")) returned 1 [0239.730] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.tw.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML", len=0x4f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML") returned 1 [0239.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.VN.XML", cchLength=0x4f | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml") returned 0x4f [0239.730] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0239.730] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.COM.XML", cAlternateFileName="YA531A~1.XML")) returned 1 [0239.730] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.vn.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML", len=0x4c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML") returned 1 [0239.730] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.XML", cchLength=0x4c | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml") returned 0x4c [0239.730] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.730] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.730] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0239.731] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.DE.XML", cAlternateFileName="YAHOOD~1.XML")) returned 1 [0239.731] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML") returned 1 [0239.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.DE.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml") returned 0x4b [0239.731] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0239.731] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x328, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.ES.XML", cAlternateFileName="YAHOOE~1.XML")) returned 1 [0239.731] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.de.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML") returned 1 [0239.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.ES.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml") returned 0x4b [0239.731] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0239.731] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.FR.XML", cAlternateFileName="YAHOOF~1.XML")) returned 1 [0239.731] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.es.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML") returned 1 [0239.731] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.FR.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml") returned 0x4b [0239.731] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.731] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.731] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0239.731] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.HK.XML", cAlternateFileName="YAHOOH~1.XML")) returned 1 [0239.732] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.fr.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML") returned 1 [0239.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.HK.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml") returned 0x4b [0239.732] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0239.732] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x32a, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IE.XML", cAlternateFileName="YAHOOI~1.XML")) returned 1 [0239.732] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.hk.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML") returned 1 [0239.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IE.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml") returned 0x4b [0239.732] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0239.732] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.IT.XML", cAlternateFileName="YAHOOI~2.XML")) returned 1 [0239.732] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.ie.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML") returned 1 [0239.732] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.IT.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml") returned 0x4b [0239.732] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.732] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.732] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0239.732] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a900, ftCreationTime.dwHighDateTime=0x1c6ea7d, ftLastAccessTime.dwLowDateTime=0x70c79650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a900, ftLastWriteTime.dwHighDateTime=0x1c6ea7d, nFileSizeHigh=0x0, nFileSizeLow=0x331, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.JP.XML", cAlternateFileName="YAHOOJ~1.XML")) returned 1 [0239.732] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.it.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML") returned 1 [0239.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.JP.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml") returned 0x4b [0239.733] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0239.733] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.NO.XML", cAlternateFileName="YAHOON~1.XML")) returned 1 [0239.733] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.jp.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML") returned 1 [0239.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.NO.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml") returned 0x4b [0239.733] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0239.733] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.PL.XML", cAlternateFileName="YAHOOP~1.XML")) returned 1 [0239.733] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.no.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML") returned 1 [0239.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.PL.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml") returned 0x4b [0239.733] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.733] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.733] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0239.733] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="YAHOO.SE.XML", cAlternateFileName="YAHOOS~1.XML")) returned 1 [0239.733] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.pl.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML", len=0x4b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML") returned 1 [0239.733] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.SE.XML", cchLength=0x4b | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml") returned 0x4b [0239.733] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.734] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0239.734] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6672480, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xc6672480, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.se.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\_RESTORE FILES_.txt", len=0x52 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\_RESTORE FILES_.txt") returned 1 [0239.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\_RESTORE FILES_.txt", cchLength=0x52 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlookautodiscover\\_restore files_.txt") returned 0x52 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0239.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.734] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0239.734] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0239.734] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlook.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL") returned 1 [0239.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLPH.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlph.dll") returned 0x35 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.734] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.734] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlph.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL") returned 1 [0239.734] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLRPC.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlrpc.dll") returned 0x36 [0239.734] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.735] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0239.735] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlrpc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL") returned 1 [0239.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\OUTLVBS.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\outlvbs.dll") returned 0x36 [0239.735] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0239.735] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0239.735] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0239.735] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", len=0x34 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned 1 [0239.735] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\") returned 0x34 [0239.735] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0239.735] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0239.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0240.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0240.242] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0240.243] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned 1 [0240.243] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml") returned 0x40 [0240.243] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0240.243] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0240.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x59d27370, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0240.243] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0240.243] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\_restore files_.txt"), bFailIfExists=0) returned 1 [0241.329] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd0) returned 0x6dee6e0 [0241.329] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0241.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl001.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned 1 [0241.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml") returned 0x40 [0241.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd4) returned 0x6dee6e0 [0241.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0241.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl002.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned 1 [0241.330] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml") returned 0x40 [0241.330] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.330] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.330] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dd8) returned 0x6dee6e0 [0241.330] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0241.330] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl010.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned 1 [0241.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml") returned 0x40 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.331] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ddc) returned 0x6dee6e0 [0241.331] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl011.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned 1 [0241.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml") returned 0x40 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.331] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de0) returned 0x6dee6e0 [0241.331] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl012.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned 1 [0241.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml") returned 0x40 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.331] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.331] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de4) returned 0x6dee6e0 [0241.331] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0241.331] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl016.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned 1 [0241.331] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml") returned 0x40 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1de8) returned 0x6dee6e0 [0241.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl020.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned 1 [0241.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml") returned 0x40 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dec) returned 0x6dee6e0 [0241.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl022.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned 1 [0241.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml") returned 0x40 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.332] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.332] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df0) returned 0x6dee6e0 [0241.332] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl026.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned 1 [0241.332] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml") returned 0x40 [0241.332] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df4) returned 0x6dee6e0 [0241.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl027.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned 1 [0241.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml") returned 0x40 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1df8) returned 0x6dee6e0 [0241.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl044.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned 1 [0241.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml") returned 0x40 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1dfc) returned 0x6dee6e0 [0241.333] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl048.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned 1 [0241.333] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml") returned 0x40 [0241.333] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.333] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.333] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e00) returned 0x6dee6e0 [0241.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl054.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned 1 [0241.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml") returned 0x40 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e04) returned 0x6dee6e0 [0241.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl058.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned 1 [0241.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml") returned 0x40 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e08) returned 0x6dee6e0 [0241.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl065.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned 1 [0241.334] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml") returned 0x40 [0241.334] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.334] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.334] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e0c) returned 0x6dee6e0 [0241.334] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl075.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned 1 [0241.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml") returned 0x40 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e10) returned 0x6dee6e0 [0241.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl077.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned 1 [0241.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml") returned 0x40 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e14) returned 0x6dee6e0 [0241.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl078.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned 1 [0241.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml") returned 0x40 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.335] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.335] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e18) returned 0x6dee6e0 [0241.335] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67337900, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67337900, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1 [0241.335] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl081.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned 1 [0241.335] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml") returned 0x40 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e1c) returned 0x6dee6e0 [0241.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf103000, ftCreationTime.dwHighDateTime=0x1ca25ea, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf103000, ftLastWriteTime.dwHighDateTime=0x1ca25ea, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl082.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned 1 [0241.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml") returned 0x40 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e20) returned 0x6dee6e0 [0241.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9141f00, ftCreationTime.dwHighDateTime=0x1c6d896, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9141f00, ftLastWriteTime.dwHighDateTime=0x1c6d896, nFileSizeHigh=0x0, nFileSizeLow=0xab732, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl083.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned 1 [0241.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml") returned 0x40 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e24) returned 0x6dee6e0 [0241.336] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d69800, ftCreationTime.dwHighDateTime=0x1c6bedf, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8d69800, ftLastWriteTime.dwHighDateTime=0x1c6bedf, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl086.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned 1 [0241.336] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml") returned 0x40 [0241.336] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.336] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.336] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e28) returned 0x6dee6e0 [0241.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned 1 [0241.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml") returned 0x40 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0241.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned 1 [0241.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml") returned 0x40 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0241.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4628f00, ftLastWriteTime.dwHighDateTime=0x1ca1b44, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL092.XML", cAlternateFileName="")) returned 1 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned 1 [0241.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml") returned 0x40 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.337] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.337] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0241.337] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x206de900, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL093.XML", cAlternateFileName="")) returned 1 [0241.337] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned 1 [0241.337] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml") returned 0x40 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0241.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b48300, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x1a1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL095.XML", cAlternateFileName="")) returned 1 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned 1 [0241.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml") returned 0x40 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0241.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39db9100, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x19ede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL096.XML", cAlternateFileName="")) returned 1 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned 1 [0241.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml") returned 0x40 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.338] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0241.338] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f636100, ftLastWriteTime.dwHighDateTime=0x1c9ef1a, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL097.XML", cAlternateFileName="")) returned 1 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned 1 [0241.338] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml") returned 0x40 [0241.338] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.338] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0241.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c357500, ftLastWriteTime.dwHighDateTime=0x1c6d897, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL102.XML", cAlternateFileName="")) returned 1 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned 1 [0241.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml") returned 0x40 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.339] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0241.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45027800, ftLastWriteTime.dwHighDateTime=0x1ca0f15, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL103.XML", cAlternateFileName="")) returned 1 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned 1 [0241.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml") returned 0x40 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.339] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0241.339] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf61dc500, ftLastWriteTime.dwHighDateTime=0x1ca1702, nFileSizeHigh=0x0, nFileSizeLow=0x1fcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL104.XML", cAlternateFileName="")) returned 1 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned 1 [0241.339] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml") returned 0x40 [0241.339] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.339] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.339] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0241.340] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0x15090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL105.XML", cAlternateFileName="")) returned 1 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned 1 [0241.340] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml") returned 0x40 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.340] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0241.340] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fb7700, ftLastWriteTime.dwHighDateTime=0x1ca1b41, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL106.XML", cAlternateFileName="")) returned 1 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned 1 [0241.340] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml") returned 0x40 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.340] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0241.340] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45218b00, ftCreationTime.dwHighDateTime=0x1ca1b45, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45218b00, ftLastWriteTime.dwHighDateTime=0x1ca1b45, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL107.XML", cAlternateFileName="")) returned 1 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned 1 [0241.340] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml") returned 0x40 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.340] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.340] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0241.340] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x2dbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL108.XML", cAlternateFileName="")) returned 1 [0241.340] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned 1 [0241.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml") returned 0x40 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0241.341] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b1600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0b1600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL109.XML", cAlternateFileName="")) returned 1 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned 1 [0241.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml") returned 0x40 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0241.341] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643bf200, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x643bf200, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL110.XML", cAlternateFileName="")) returned 1 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned 1 [0241.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml") returned 0x40 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.341] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0241.341] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d1f00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x656d1f00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x40198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL111.XML", cAlternateFileName="")) returned 1 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned 1 [0241.341] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml") returned 0x40 [0241.341] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.341] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0241.342] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07a0100, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07a0100, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x2247e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN001.XML", cAlternateFileName="")) returned 1 [0241.342] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pglbl111.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned 1 [0241.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml") returned 0x3f [0241.342] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0241.342] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e4c00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x669e4c00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xeb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN002.XML", cAlternateFileName="")) returned 1 [0241.342] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned 1 [0241.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml") returned 0x3f [0241.342] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0241.342] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN010.XML", cAlternateFileName="")) returned 1 [0241.342] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn002.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned 1 [0241.342] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml") returned 0x3f [0241.342] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.342] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.342] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0241.342] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa5500, ftCreationTime.dwHighDateTime=0x1ca1b39, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94fa5500, ftLastWriteTime.dwHighDateTime=0x1ca1b39, nFileSizeHigh=0x0, nFileSizeLow=0xe2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN011.XML", cAlternateFileName="")) returned 1 [0241.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn010.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned 1 [0241.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml") returned 0x3f [0241.343] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0241.343] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc63d500, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc63d500, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x2936, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN020.XML", cAlternateFileName="")) returned 1 [0241.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn011.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned 1 [0241.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml") returned 0x3f [0241.343] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0241.343] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17af0200, ftCreationTime.dwHighDateTime=0x1ca06ab, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17af0200, ftLastWriteTime.dwHighDateTime=0x1ca06ab, nFileSizeHigh=0x0, nFileSizeLow=0x167d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN022.XML", cAlternateFileName="")) returned 1 [0241.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn020.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned 1 [0241.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml") returned 0x3f [0241.343] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.343] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.343] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0241.343] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x21be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN026.XML", cAlternateFileName="")) returned 1 [0241.343] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn022.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned 1 [0241.343] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml") returned 0x3f [0241.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0241.344] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x5e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN027.XML", cAlternateFileName="")) returned 1 [0241.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn026.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned 1 [0241.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml") returned 0x3f [0241.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0241.344] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60487100, ftCreationTime.dwHighDateTime=0x1c9e332, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60487100, ftLastWriteTime.dwHighDateTime=0x1c9e332, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN044.XML", cAlternateFileName="")) returned 1 [0241.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn027.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned 1 [0241.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml") returned 0x3f [0241.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.344] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0241.344] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4233cc00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4233cc00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x9c4ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN048.XML", cAlternateFileName="")) returned 1 [0241.344] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn044.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned 1 [0241.344] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml") returned 0x3f [0241.344] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.344] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0241.345] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x662faf00, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x662faf00, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x8250, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN054.XML", cAlternateFileName="")) returned 1 [0241.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn048.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned 1 [0241.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml") returned 0x3f [0241.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0241.345] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409da800, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x409da800, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x8e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN058.XML", cAlternateFileName="")) returned 1 [0241.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn054.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned 1 [0241.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml") returned 0x3f [0241.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0241.345] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c896a00, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c896a00, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1326, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN065.XML", cAlternateFileName="")) returned 1 [0241.345] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn058.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned 1 [0241.345] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml") returned 0x3f [0241.345] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.345] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.345] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0241.345] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a49300, ftCreationTime.dwHighDateTime=0x1c6946d, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7a49300, ftLastWriteTime.dwHighDateTime=0x1c6946d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN075.XML", cAlternateFileName="")) returned 1 [0241.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn065.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned 1 [0241.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml") returned 0x3f [0241.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0241.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a4d100, ftCreationTime.dwHighDateTime=0x1ca0452, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a4d100, ftLastWriteTime.dwHighDateTime=0x1ca0452, nFileSizeHigh=0x0, nFileSizeLow=0x101198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN081.XML", cAlternateFileName="")) returned 1 [0241.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn075.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned 1 [0241.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml") returned 0x3f [0241.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0241.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66024c00, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66024c00, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x31a78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN082.XML", cAlternateFileName="")) returned 1 [0241.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn081.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned 1 [0241.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml") returned 0x3f [0241.346] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.346] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.346] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0241.346] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2620df00, ftCreationTime.dwHighDateTime=0x1c6a62f, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2620df00, ftLastWriteTime.dwHighDateTime=0x1c6a62f, nFileSizeHigh=0x0, nFileSizeLow=0x2d34, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN086.XML", cAlternateFileName="")) returned 1 [0241.346] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn082.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned 1 [0241.346] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml") returned 0x3f [0241.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0241.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0x11a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN089.XML", cAlternateFileName="")) returned 1 [0241.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn086.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned 1 [0241.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml") returned 0x3f [0241.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0241.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc44d00, ftCreationTime.dwHighDateTime=0x1c6b4fb, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fc44d00, ftLastWriteTime.dwHighDateTime=0x1c6b4fb, nFileSizeHigh=0x0, nFileSizeLow=0xa246, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN090.XML", cAlternateFileName="")) returned 1 [0241.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn089.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned 1 [0241.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml") returned 0x3f [0241.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.347] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0241.347] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7f300, ftCreationTime.dwHighDateTime=0x1c67971, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63d7f300, ftLastWriteTime.dwHighDateTime=0x1c67971, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN092.XML", cAlternateFileName="")) returned 1 [0241.347] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned 1 [0241.347] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml") returned 0x3f [0241.347] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.347] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0241.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5677c900, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5677c900, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x7aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN095.XML", cAlternateFileName="")) returned 1 [0241.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned 1 [0241.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml") returned 0x3f [0241.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0241.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6daa00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6daa00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN096.XML", cAlternateFileName="")) returned 1 [0241.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned 1 [0241.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml") returned 0x3f [0241.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0241.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7ad200, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf7ad200, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0x11424, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN097.XML", cAlternateFileName="")) returned 1 [0241.348] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned 1 [0241.348] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml") returned 0x3f [0241.348] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.348] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.348] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0241.348] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9d600, ftCreationTime.dwHighDateTime=0x1c6c5a1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96f9d600, ftLastWriteTime.dwHighDateTime=0x1c6c5a1, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN102.XML", cAlternateFileName="")) returned 1 [0241.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned 1 [0241.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml") returned 0x3f [0241.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0241.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55662300, ftCreationTime.dwHighDateTime=0x1ca0f14, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55662300, ftLastWriteTime.dwHighDateTime=0x1ca0f14, nFileSizeHigh=0x0, nFileSizeLow=0xde0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN103.XML", cAlternateFileName="")) returned 1 [0241.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned 1 [0241.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml") returned 0x3f [0241.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0241.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN105.XML", cAlternateFileName="")) returned 1 [0241.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned 1 [0241.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml") returned 0x3f [0241.349] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.349] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.349] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0241.349] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b6fc00, ftCreationTime.dwHighDateTime=0x1c9fa26, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7b6fc00, ftLastWriteTime.dwHighDateTime=0x1c9fa26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN107.XML", cAlternateFileName="")) returned 1 [0241.349] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned 1 [0241.349] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml") returned 0x3f [0241.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0241.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN108.XML", cAlternateFileName="")) returned 1 [0241.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned 1 [0241.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml") returned 0x3f [0241.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0241.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908ec600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x908ec600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN109.XML", cAlternateFileName="")) returned 1 [0241.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned 1 [0241.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml") returned 0x3f [0241.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.350] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0241.350] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf7900, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf7900, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN110.XML", cAlternateFileName="")) returned 1 [0241.350] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn109.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned 1 [0241.350] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml") returned 0x3f [0241.350] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.350] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0241.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6900a600, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6900a600, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x45792, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN111.XML", cAlternateFileName="")) returned 1 [0241.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn110.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned 1 [0241.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml") returned 0x3f [0241.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0241.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3aa00, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89d3aa00, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x878c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PG_INDEX.XML", cAlternateFileName="")) returned 1 [0241.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pgmn111.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML", len=0x40 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML") returned 1 [0241.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml") returned 0x40 [0241.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.351] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0241.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b81340, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xc6b81340, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0241.351] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pagesize\\pg_index.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\_RESTORE FILES_.txt", len=0x47 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\_RESTORE FILES_.txt") returned 1 [0241.351] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\_RESTORE FILES_.txt", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\pagesize\\_restore files_.txt") returned 0x47 [0241.351] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0241.351] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.351] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0241.352] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0241.352] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0241.352] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\outlvbs.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL") returned 1 [0241.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PDSBASE.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\pdsbase.dll") returned 0x36 [0241.352] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.352] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd09c6440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xecd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.DLL", cAlternateFileName="")) returned 1 [0241.352] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pdsbase.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL") returned 1 [0241.352] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PE.DLL", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\pe.dll") returned 0x31 [0241.352] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.352] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.352] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd84cf560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PEOPLEDATAHANDLER.DLL", cAlternateFileName="PEOPLE~1.DLL")) returned 1 [0241.437] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pe.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL") returned 1 [0241.437] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PEOPLEDATAHANDLER.DLL", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\peopledatahandler.dll") returned 0x40 [0241.437] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.438] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2e960, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJCALEND.DLL", cAlternateFileName="")) returned 1 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\peopledatahandler.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL") returned 1 [0241.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PJCALEND.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\pjcalend.dll") returned 0x37 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.438] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0x210368, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.EXE", cAlternateFileName="")) returned 1 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pjcalend.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE") returned 1 [0241.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\powerpnt.exe") returned 0x37 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.438] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88f02f00, ftCreationTime.dwHighDateTime=0x1cabe9f, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88f02f00, ftLastWriteTime.dwHighDateTime=0x1cabe9f, nFileSizeHigh=0x0, nFileSizeLow=0xdb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="powerpnt.exe.manifest", cAlternateFileName="POWERP~1.MAN")) returned 1 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\powerpnt.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest", len=0x40 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned 1 [0241.438] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest", cchLength=0x40 | out: lpsz="c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest") returned 0x40 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.438] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.438] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x6cfec6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0xee1768, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPCORE.DLL", cAlternateFileName="")) returned 1 [0241.438] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest", psz="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL") returned 1 [0241.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\ppcore.dll") returned 0x35 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.439] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c0c100, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3c0c100, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x77d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ppcore.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL") returned 1 [0241.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PPSLAX.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\ppslax.dll") returned 0x35 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.439] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x39df60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTICO.EXE", cAlternateFileName="")) returned 1 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ppslax.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE") returned 1 [0241.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\pptico.exe") returned 0x35 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.439] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRM.XML", cAlternateFileName="")) returned 1 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pptico.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned 1 [0241.439] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\pptirm.xml") returned 0x35 [0241.439] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.439] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.439] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0241.440] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRMV.XML", cAlternateFileName="")) returned 1 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pptirm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned 1 [0241.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\pptirmv.xml") returned 0x36 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.440] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0241.440] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14988, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJIMPT.EXE", cAlternateFileName="")) returned 1 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pptirmv.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE") returned 1 [0241.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROJIMPT.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\projimpt.exe") returned 0x37 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.440] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJMODL.DLL", cAlternateFileName="")) returned 1 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\projimpt.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL") returned 1 [0241.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROJMODL.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\projmodl.dll") returned 0x37 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0241.440] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0241.440] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0241.440] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\") returned 1 [0241.440] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\") returned 0x31 [0241.441] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0241.441] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0241.441] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0243.001] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.001] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0243.001] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\") returned 1 [0243.001] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\1033\\") returned 0x36 [0243.001] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0243.001] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0243.001] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0243.517] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.517] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0243.518] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL") returned 1 [0243.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll") returned 0x41 [0243.518] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0243.518] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0243.518] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0243.518] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0243.518] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0243.518] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\") returned 1 [0243.518] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\1036\\") returned 0x36 [0243.518] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0243.518] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0243.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0243.519] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.519] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0243.519] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL") returned 1 [0243.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll") returned 0x41 [0243.519] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0243.519] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0243.519] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0243.519] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0243.519] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0243.519] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", len=0x36 | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\") returned 1 [0243.519] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\3082\\") returned 0x36 [0243.519] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0243.519] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0243.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0243.520] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0243.520] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0243.520] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", len=0x41 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL") returned 1 [0243.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll") returned 0x41 [0243.520] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0243.520] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0243.520] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0243.520] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0243.520] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69511700, ftCreationTime.dwHighDateTime=0x1c4a9a0, ftLastAccessTime.dwLowDateTime=0x97e6cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69511700, ftLastWriteTime.dwHighDateTime=0x1c4a9a0, nFileSizeHigh=0x0, nFileSizeLow=0x39cf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.LEX", cAlternateFileName="")) returned 1 [0243.520] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX") returned 1 [0243.520] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex") returned 0x3c [0243.520] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0243.520] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0243.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0243.520] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0243.520] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\_restore files_.txt"), bFailIfExists=0) returned 1 [0248.259] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e2c) returned 0x6dee6e0 [0248.260] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade5d100, ftCreationTime.dwHighDateTime=0x1c04525, ftLastAccessTime.dwLowDateTime=0x59b6e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xade5d100, ftLastWriteTime.dwHighDateTime=0x1c04525, nFileSizeHigh=0x0, nFileSizeLow=0x4112e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.LEX", cAlternateFileName="")) returned 1 [0248.260] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX") returned 1 [0248.260] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex") returned 0x3c [0248.260] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.260] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.260] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e30) returned 0x6dee6e0 [0248.260] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373ef00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xa459d340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x373ef00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x19, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.LEX", cAlternateFileName="")) returned 1 [0248.260] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX") returned 1 [0248.260] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3FR.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex") returned 0x3c [0248.260] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.260] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.260] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e34) returned 0x6dee6e0 [0248.260] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4343d200, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa206bb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4343d200, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.DLL", cAlternateFileName="")) returned 1 [0248.261] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msgr3fr.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL") returned 1 [0248.261] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll") returned 0x3c [0248.261] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.261] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.261] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x74200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7EN.LEX", cAlternateFileName="")) returned 1 [0248.261] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7en.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX") returned 1 [0248.261] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7EN.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex") returned 0x3c [0248.261] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.261] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.261] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e38) returned 0x6dee6e0 [0248.261] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccd3a00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4ccd3a00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.DLL", cAlternateFileName="")) returned 1 [0248.261] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7en.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL") returned 1 [0248.261] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll") returned 0x3c [0248.261] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.261] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.261] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16d58900, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e3aaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x16d58900, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x23800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7ES.LEX", cAlternateFileName="")) returned 1 [0248.261] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7es.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX") returned 1 [0248.261] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7ES.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex") returned 0x3c [0248.261] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.262] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e3c) returned 0x6dee6e0 [0248.262] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x36988, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.DLL", cAlternateFileName="")) returned 1 [0248.262] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7es.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL") returned 1 [0248.262] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll") returned 0x3c [0248.262] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.262] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.262] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14732f00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45c34a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x14732f00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x43e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSHY7FR.LEX", cAlternateFileName="")) returned 1 [0248.262] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX") returned 1 [0248.262] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSHY7FR.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex") returned 0x3c [0248.262] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.262] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.262] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e40) returned 0x6dee6e0 [0248.262] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa20ddfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.DLL", cAlternateFileName="")) returned 1 [0248.262] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mshy7fr.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL") returned 1 [0248.262] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll") returned 0x3c [0248.262] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.262] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.263] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2c5600, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa22cd180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e2c5600, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.dub", cAlternateFileName="")) returned 1 [0248.263] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub") returned 1 [0248.263] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.dub", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub") returned 0x3c [0248.263] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.263] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e44) returned 0x6dee6e0 [0248.263] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2980600, ftCreationTime.dwHighDateTime=0x1cbae31, ftLastAccessTime.dwLowDateTime=0xa2091ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd2980600, ftLastWriteTime.dwHighDateTime=0x1cbae31, nFileSizeHigh=0x0, nFileSizeLow=0x145e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7EN.LEX", cAlternateFileName="")) returned 1 [0248.263] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX") returned 1 [0248.263] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex") returned 0x3c [0248.263] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.263] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.263] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e48) returned 0x6dee6e0 [0248.263] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f4aef00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa6ed3020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f4aef00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.DLL", cAlternateFileName="")) returned 1 [0248.263] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7en.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL") returned 1 [0248.263] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll") returned 0x3c [0248.263] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.263] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.263] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.dub", cAlternateFileName="")) returned 1 [0248.263] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub") returned 1 [0248.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.dub", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub") returned 0x3c [0248.264] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e4c) returned 0x6dee6e0 [0248.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47b5be00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6e60c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47b5be00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1e0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7ES.LEX", cAlternateFileName="")) returned 1 [0248.264] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX") returned 1 [0248.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex") returned 0x3c [0248.264] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.264] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e50) returned 0x6dee6e0 [0248.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19c200, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa471a100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19c200, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x1ee380, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.DLL", cAlternateFileName="")) returned 1 [0248.264] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL") returned 1 [0248.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll") returned 0x3c [0248.264] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.264] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.264] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bfdd00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa4c28fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x41bfdd00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.dub", cAlternateFileName="")) returned 1 [0248.264] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub") returned 1 [0248.264] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub") returned 0x3c [0248.264] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e54) returned 0x6dee6e0 [0248.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42f10a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa45e9600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x42f10a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x1b1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSP7FR.LEX", cAlternateFileName="")) returned 1 [0248.265] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX") returned 1 [0248.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex") returned 0x3c [0248.265] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.265] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e58) returned 0x6dee6e0 [0248.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa2176520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.DLL", cAlternateFileName="")) returned 1 [0248.265] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL") returned 1 [0248.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll") returned 0x3c [0248.265] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.265] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa395100, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa21503c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfa395100, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0x40de00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7EN.LEX", cAlternateFileName="")) returned 1 [0248.265] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msth7en.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX") returned 1 [0248.265] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex") returned 0x3c [0248.265] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.265] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.266] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e5c) returned 0x6dee6e0 [0248.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.DLL", cAlternateFileName="")) returned 1 [0248.266] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL") returned 1 [0248.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll") returned 0x3c [0248.266] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.266] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2918c00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6f45440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2918c00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x5b3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7ES.LEX", cAlternateFileName="")) returned 1 [0248.266] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msth7es.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX") returned 1 [0248.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex") returned 0x3c [0248.266] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.266] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.266] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e60) returned 0x6dee6e0 [0248.266] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4824aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x6ef80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.DLL", cAlternateFileName="")) returned 1 [0248.266] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL") returned 1 [0248.266] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.DLL", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll") returned 0x3c [0248.266] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.267] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.267] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6a7e00, ftCreationTime.dwHighDateTime=0x1cba071, ftLastAccessTime.dwLowDateTime=0xa47fe940, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfb6a7e00, ftLastWriteTime.dwHighDateTime=0x1cba071, nFileSizeHigh=0x0, nFileSizeLow=0xc6aa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTH7FR.LEX", cAlternateFileName="")) returned 1 [0248.267] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\proof\\msth7fr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX") returned 1 [0248.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex") returned 0x3c [0248.267] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.267] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.267] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e64) returned 0x6dee6e0 [0248.267] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0248.267] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.267] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0248.267] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\projmodl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL") returned 1 [0248.267] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROPMGR.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\propmgr.dll") returned 0x36 [0248.267] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.267] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.268] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65b7600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x130b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.DLL", cAlternateFileName="")) returned 1 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\propmgr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL") returned 1 [0248.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PROPRPT.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\proprpt.dll") returned 0x36 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.268] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRTF9.DLL", cAlternateFileName="")) returned 1 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\proprpt.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL") returned 1 [0248.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PRTF9.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\prtf9.dll") returned 0x34 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.268] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x68368, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSTPRX32.DLL", cAlternateFileName="")) returned 1 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\prtf9.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL") returned 1 [0248.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PSTPRX32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\pstprx32.dll") returned 0x37 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.268] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.268] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTXT9.DLL", cAlternateFileName="")) returned 1 [0248.268] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pstprx32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL") returned 1 [0248.268] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PTXT9.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ptxt9.dll") returned 0x34 [0248.269] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.269] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.269] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBBA", cAlternateFileName="")) returned 1 [0248.269] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", len=0x31 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\") returned 1 [0248.269] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\") returned 0x31 [0248.269] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0248.269] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0248.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0248.271] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.271] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xca60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB10.BDR", cAlternateFileName="")) returned 1 [0248.271] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR") returned 1 [0248.271] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB10.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr") returned 0x3c [0248.271] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.271] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x59413f90, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0248.272] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.272] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\_restore files_.txt"), bFailIfExists=0) returned 1 [0248.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e68) returned 0x6dee6e0 [0248.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x69e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB11.BDR", cAlternateFileName="")) returned 1 [0248.276] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub10.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR") returned 1 [0248.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB11.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr") returned 0x3c [0248.276] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e6c) returned 0x6dee6e0 [0248.276] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf254, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1A.BDR", cAlternateFileName="")) returned 1 [0248.276] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub11.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR") returned 1 [0248.276] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1A.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr") returned 0x3c [0248.276] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.276] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.276] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e70) returned 0x6dee6e0 [0248.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB1B.BDR", cAlternateFileName="")) returned 1 [0248.277] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub1a.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR") returned 1 [0248.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr") returned 0x3c [0248.277] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.277] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.277] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e74) returned 0x6dee6e0 [0248.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2A.BDR", cAlternateFileName="")) returned 1 [0248.277] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR") returned 1 [0248.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2A.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr") returned 0x3c [0248.277] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.277] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.277] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e78) returned 0x6dee6e0 [0248.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB2B.BDR", cAlternateFileName="")) returned 1 [0248.277] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub2a.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR") returned 1 [0248.277] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB2B.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr") returned 0x3c [0248.277] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.277] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.277] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e7c) returned 0x6dee6e0 [0248.277] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xde58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3A.BDR", cAlternateFileName="")) returned 1 [0248.278] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub2b.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR") returned 1 [0248.278] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3A.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr") returned 0x3c [0248.278] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e80) returned 0x6dee6e0 [0248.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xf4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB3B.BDR", cAlternateFileName="")) returned 1 [0248.278] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub3a.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR") returned 1 [0248.278] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB3B.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr") returned 0x3c [0248.278] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e84) returned 0x6dee6e0 [0248.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xc144, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB4.BDR", cAlternateFileName="")) returned 1 [0248.278] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub3b.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR") returned 1 [0248.278] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB4.BDR", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr") returned 0x3b [0248.278] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.278] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.278] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e88) returned 0x6dee6e0 [0248.278] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xcfb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5A.BDR", cAlternateFileName="")) returned 1 [0248.279] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub4.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR") returned 1 [0248.279] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5A.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr") returned 0x3c [0248.279] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.279] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e8c) returned 0x6dee6e0 [0248.279] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x2476, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB5B.BDR", cAlternateFileName="")) returned 1 [0248.279] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub5a.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR") returned 1 [0248.279] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB5B.BDR", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr") returned 0x3c [0248.279] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.279] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0248.279] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x7f46, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB6.BDR", cAlternateFileName="")) returned 1 [0248.279] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub5b.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR") returned 1 [0248.279] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB6.BDR", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr") returned 0x3b [0248.279] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.279] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.279] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0248.279] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x799a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB7.BDR", cAlternateFileName="")) returned 1 [0248.279] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub6.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR") returned 1 [0248.279] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB7.BDR", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr") returned 0x3b [0248.280] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.280] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0248.280] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0xe6aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB8.BDR", cAlternateFileName="")) returned 1 [0248.280] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub7.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR") returned 1 [0248.280] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB8.BDR", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr") returned 0x3b [0248.280] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.280] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0248.280] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcde5600, ftCreationTime.dwHighDateTime=0x1c458e1, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcde5600, ftLastWriteTime.dwHighDateTime=0x1c458e1, nFileSizeHigh=0x0, nFileSizeLow=0x6bbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB9.BDR", cAlternateFileName="")) returned 1 [0248.280] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubba\\mspub8.bdr", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR") returned 1 [0248.280] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB9.BDR", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubba\\mspub9.bdr") returned 0x3b [0248.280] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.280] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.280] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0248.280] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0248.280] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0248.280] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ptxt9.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL") returned 1 [0248.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBCONV.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubconv.dll") returned 0x36 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.281] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe778, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBTRAP.DLL", cAlternateFileName="")) returned 1 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pubconv.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL") returned 1 [0248.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBTRAP.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubtrap.dll") returned 0x36 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0248.281] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.281] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWIZ", cAlternateFileName="")) returned 1 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", len=0x32 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\") returned 1 [0248.281] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\") returned 0x32 [0248.281] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0248.281] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0248.281] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0248.326] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0248.384] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x2d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCSBAR.POC", cAlternateFileName="")) returned 1 [0248.384] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC") returned 1 [0248.384] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCSBAR.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc") returned 0x3d [0248.384] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.384] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x511e6c70, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0248.384] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0248.384] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\_restore files_.txt"), bFailIfExists=0) returned 1 [0248.396] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e90) returned 0x6dee6e0 [0248.396] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x1cba, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCTBOX.POC", cAlternateFileName="")) returned 1 [0248.396] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\accsbar.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC") returned 1 [0248.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ACCTBOX.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc") returned 0x3d [0248.396] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.396] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.396] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e94) returned 0x6dee6e0 [0248.396] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x5f09, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.DPV", cAlternateFileName="")) returned 1 [0248.396] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\acctbox.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV") returned 1 [0248.396] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.DPV", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv") returned 0x38 [0248.396] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.396] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e98) returned 0x6dee6e0 [0248.397] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52fa4f00, ftCreationTime.dwHighDateTime=0x1c917c2, ftLastAccessTime.dwLowDateTime=0x511e6c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52fa4f00, ftLastWriteTime.dwHighDateTime=0x1c917c2, nFileSizeHigh=0x0, nFileSizeLow=0x40a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD.XML", cAlternateFileName="")) returned 1 [0248.397] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ad.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML") returned 1 [0248.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD.XML", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml") returned 0x38 [0248.397] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1e9c) returned 0x6dee6e0 [0248.397] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5eaf6290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xb95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AD98.POC", cAlternateFileName="")) returned 1 [0248.397] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ad.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC") returned 1 [0248.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AD98.POC", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc") returned 0x3a [0248.397] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0248.397] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9e2a200, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5127f1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9e2a200, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x854, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADRESPEL.POC", cAlternateFileName="")) returned 1 [0248.397] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ad98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC") returned 1 [0248.397] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ADRESPEL.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc") returned 0x3e [0248.397] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.397] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.397] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0248.398] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x594c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR98.POC", cAlternateFileName="")) returned 1 [0248.398] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\adrespel.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC") returned 1 [0248.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AIR98.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc") returned 0x3b [0248.398] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0248.398] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa402, dwReserved0=0x0, dwReserved1=0x0, cFileName="AWARDHM.POC", cAlternateFileName="")) returned 1 [0248.398] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\air98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC") returned 1 [0248.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\AWARDHM.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc") returned 0x3d [0248.398] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0248.398] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x91cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BAN98.POC", cAlternateFileName="")) returned 1 [0248.398] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\awardhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC") returned 1 [0248.398] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BAN98.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc") returned 0x3b [0248.398] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.398] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.398] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0248.398] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16892b00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16892b00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xd2e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.DPV", cAlternateFileName="")) returned 1 [0248.399] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ban98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV") returned 1 [0248.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv") returned 0x3c [0248.399] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0248.399] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fd27b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3fd27b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x236c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BANNER.XML", cAlternateFileName="")) returned 1 [0248.399] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\banner.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML") returned 1 [0248.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BANNER.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml") returned 0x3c [0248.399] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0248.399] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab13cf00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab13cf00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x4d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="BDRTKFUL.POC", cAlternateFileName="")) returned 1 [0248.399] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\banner.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC") returned 1 [0248.399] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BDRTKFUL.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc") returned 0x3e [0248.399] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.399] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.399] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0248.399] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x3f40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.DPV", cAlternateFileName="")) returned 1 [0248.400] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bdrtkful.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV") returned 1 [0248.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv") returned 0x3d [0248.400] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.400] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0248.400] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cde200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47cde200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x31ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZCARD.XML", cAlternateFileName="")) returned 1 [0248.400] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML") returned 1 [0248.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZCARD.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml") returned 0x3d [0248.400] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.400] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0248.400] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d76700, ftCreationTime.dwHighDateTime=0x1c5ee67, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d76700, ftLastWriteTime.dwHighDateTime=0x1c5ee67, nFileSizeHigh=0x0, nFileSizeLow=0x1b7ebe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.DPV", cAlternateFileName="")) returned 1 [0248.400] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bizcard.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV") returned 1 [0248.400] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv") returned 0x3d [0248.400] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.400] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.400] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0248.400] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x397fc500, ftCreationTime.dwHighDateTime=0x1ca5c59, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x397fc500, ftLastWriteTime.dwHighDateTime=0x1ca5c59, nFileSizeHigh=0x0, nFileSizeLow=0x10a46, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIZFORM.XML", cAlternateFileName="")) returned 1 [0248.400] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML") returned 1 [0248.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml") returned 0x3d [0248.401] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.401] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.401] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0248.401] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e02aa00, ftCreationTime.dwHighDateTime=0x1c9c882, ftLastAccessTime.dwLowDateTime=0x51a3b970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e02aa00, ftLastWriteTime.dwHighDateTime=0x1c9c882, nFileSizeHigh=0x0, nFileSizeLow=0xf0ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.DPV", cAlternateFileName="")) returned 1 [0248.401] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV") returned 1 [0248.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv") returned 0x3e [0248.401] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.401] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.401] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0248.401] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ef0c00, ftCreationTime.dwHighDateTime=0x1c97a03, ftLastAccessTime.dwLowDateTime=0x5fff0470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ef0c00, ftLastWriteTime.dwHighDateTime=0x1c97a03, nFileSizeHigh=0x0, nFileSizeLow=0x4e42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERBB.POC", cAlternateFileName="")) returned 1 [0248.401] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC") returned 1 [0248.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BORDERBB.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc") returned 0x3e [0248.401] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.401] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.401] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0248.401] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafd88300, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600165d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xafd88300, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3f046, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCH98SP.POC", cAlternateFileName="")) returned 1 [0248.401] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\borderbb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC") returned 1 [0248.401] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCH98SP.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc") returned 0x3e [0248.402] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.402] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0248.402] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba931800, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba931800, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x98f72, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR11.POC", cAlternateFileName="")) returned 1 [0248.402] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\brch98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC") returned 1 [0248.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc") returned 0x3e [0248.402] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.402] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0248.402] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x243f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRCHUR98.POC", cAlternateFileName="")) returned 1 [0248.402] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\brchur11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC") returned 1 [0248.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc") returned 0x3e [0248.402] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.402] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.402] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0248.402] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bfe5500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfe5500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xa7190, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.DPV", cAlternateFileName="")) returned 1 [0248.402] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV") returned 1 [0248.402] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv") returned 0x3e [0248.403] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.403] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0248.403] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x181eda00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x181eda00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x757a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BROCHURE.XML", cAlternateFileName="")) returned 1 [0248.403] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML") returned 1 [0248.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BROCHURE.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml") returned 0x3e [0248.403] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.403] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0248.403] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS2BARB.POC", cAlternateFileName="")) returned 1 [0248.403] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\brochure.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC") returned 1 [0248.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS2BARB.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc") returned 0x3d [0248.403] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.403] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.403] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0248.403] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51ad3ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS4BOXES.POC", cAlternateFileName="")) returned 1 [0248.403] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bs2barb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC") returned 1 [0248.403] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc") returned 0x3e [0248.403] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.403] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0248.404] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS53BOXS.POC", cAlternateFileName="")) returned 1 [0248.404] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC") returned 1 [0248.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc") returned 0x3e [0248.404] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.404] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0248.404] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd991aa00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd991aa00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x12c2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARD11.POC", cAlternateFileName="")) returned 1 [0248.404] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC") returned 1 [0248.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc") returned 0x3e [0248.404] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.404] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0248.404] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0xe6f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCARDHM.POC", cAlternateFileName="")) returned 1 [0248.404] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC") returned 1 [0248.404] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc") returned 0x3e [0248.404] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.404] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.404] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0248.405] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdac2d700, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdac2d700, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x6214, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCD98SP.POC", cAlternateFileName="")) returned 1 [0248.405] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC") returned 1 [0248.405] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc") returned 0x3e [0248.405] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.405] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.405] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0248.405] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde565e00, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde565e00, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x3caa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BZCRD98.POC", cAlternateFileName="")) returned 1 [0248.405] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC") returned 1 [0248.405] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc") returned 0x3d [0248.405] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.405] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.405] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0248.405] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36b8ea00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51bb8730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36b8ea00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x148f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.DPV", cAlternateFileName="")) returned 1 [0248.405] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV") returned 1 [0248.405] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv") returned 0x3e [0248.405] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.405] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.405] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0248.405] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f308b00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f308b00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x2614, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALENDAR.XML", cAlternateFileName="")) returned 1 [0248.406] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML") returned 1 [0248.406] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml") returned 0x3e [0248.406] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.406] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.406] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0248.406] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9e500, ftCreationTime.dwHighDateTime=0x1c4a10f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9e500, ftLastWriteTime.dwHighDateTime=0x1c4a10f, nFileSizeHigh=0x0, nFileSizeLow=0x329e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALHM.POC", cAlternateFileName="")) returned 1 [0248.406] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC") returned 1 [0248.406] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc") returned 0x3b [0248.406] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0248.406] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0248.406] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0248.406] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x940b200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c049f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x940b200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1a6da2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALNDR98.POC", cAlternateFileName="")) returned 1 [0249.226] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC") returned 1 [0249.226] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc") returned 0x3e [0249.227] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0249.227] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.607] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea0) returned 0x6dee6e0 [0253.608] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd43900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd43900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1b8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO11.POC", cAlternateFileName="")) returned 1 [0253.608] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC") returned 1 [0253.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc") returned 0x3d [0253.608] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.608] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.608] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea4) returned 0x6dee6e0 [0253.608] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x178ece00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60251a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x178ece00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x696d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALSO98.POC", cAlternateFileName="")) returned 1 [0253.608] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC") returned 1 [0253.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc") returned 0x3d [0253.608] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.608] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.608] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ea8) returned 0x6dee6e0 [0253.608] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24d74700, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24d74700, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x4e4ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.DPV", cAlternateFileName="")) returned 1 [0253.608] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV") returned 1 [0253.608] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv") returned 0x3d [0253.608] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.608] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.608] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eac) returned 0x6dee6e0 [0253.609] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6579900, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6579900, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x1e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATALOG.XML", cAlternateFileName="")) returned 1 [0253.609] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML") returned 1 [0253.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml") returned 0x3d [0253.609] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.609] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.609] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb0) returned 0x6dee6e0 [0253.609] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c538200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6035c410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c538200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x62f96, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ.POC", cAlternateFileName="")) returned 1 [0253.609] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC") returned 1 [0253.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc") returned 0x3c [0253.609] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.609] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.609] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb4) returned 0x6dee6e0 [0253.609] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x24f44, dwReserved0=0x0, dwReserved1=0x0, cFileName="CATWIZ11.POC", cAlternateFileName="")) returned 1 [0253.609] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC") returned 1 [0253.609] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc") returned 0x3e [0253.609] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.609] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.609] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eb8) returned 0x6dee6e0 [0253.610] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73b44000, ftCreationTime.dwHighDateTime=0x1c65228, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73b44000, ftLastWriteTime.dwHighDateTime=0x1c65228, nFileSizeHigh=0x0, nFileSizeLow=0x2c1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.DPV", cAlternateFileName="")) returned 1 [0253.610] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV") returned 1 [0253.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv") returned 0x3a [0253.610] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.610] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ebc) returned 0x6dee6e0 [0253.610] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1122e00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1122e00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x170a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT.XML", cAlternateFileName="")) returned 1 [0253.610] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML") returned 1 [0253.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml") returned 0x3a [0253.610] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.610] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.610] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec0) returned 0x6dee6e0 [0253.610] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x11b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98.POC", cAlternateFileName="")) returned 1 [0253.610] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC") returned 1 [0253.610] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc") returned 0x3c [0253.610] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.610] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.611] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec4) returned 0x6dee6e0 [0253.611] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1eb5dc00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1eb5dc00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x53bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERT98SP.POC", cAlternateFileName="")) returned 1 [0253.611] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC") returned 1 [0253.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98SP.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc") returned 0x3e [0253.611] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.611] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.611] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ec8) returned 0x6dee6e0 [0253.611] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x170e, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKER.POC", cAlternateFileName="")) returned 1 [0253.611] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\cert98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC") returned 1 [0253.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CHECKER.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc") returned 0x3d [0253.611] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.611] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.611] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ecc) returned 0x6dee6e0 [0253.611] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932e9200, ftCreationTime.dwHighDateTime=0x1c9c700, ftLastAccessTime.dwLowDateTime=0x51ce9230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x932e9200, ftLastWriteTime.dwHighDateTime=0x1c9c700, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.DPV", cAlternateFileName="CONTAC~1.DPV")) returned 1 [0253.611] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\checker.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV") returned 1 [0253.611] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.DPV", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv") returned 0x43 [0253.611] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.611] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed0) returned 0x6dee6e0 [0253.612] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x854dcb00, ftCreationTime.dwHighDateTime=0x1c9c314, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x854dcb00, ftLastWriteTime.dwHighDateTime=0x1c9c314, nFileSizeHigh=0x0, nFileSizeLow=0x4ce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACTINFOBB.POC", cAlternateFileName="CONTAC~1.POC")) returned 1 [0253.612] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC") returned 1 [0253.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CONTACTINFOBB.POC", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc") returned 0x43 [0253.612] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed4) returned 0x6dee6e0 [0253.612] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x604d91d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc692, dwReserved0=0x0, dwReserved1=0x0, cFileName="COUPON.POC", cAlternateFileName="")) returned 1 [0253.612] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\contactinfobb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC") returned 1 [0253.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\COUPON.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc") returned 0x3c [0253.612] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.612] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ed8) returned 0x6dee6e0 [0253.612] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ff04000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ff04000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.DPV", cAlternateFileName="")) returned 1 [0253.612] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\coupon.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV") returned 1 [0253.612] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv") returned 0x3e [0253.612] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.612] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1edc) returned 0x6dee6e0 [0253.613] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0xb22, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBAR.XML", cAlternateFileName="")) returned 1 [0253.613] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML") returned 1 [0253.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBAR.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml") returned 0x3e [0253.613] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee0) returned 0x6dee6e0 [0253.613] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ebf1300, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8ebf1300, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.DPV", cAlternateFileName="")) returned 1 [0253.613] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbar.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV") returned 1 [0253.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv") returned 0x3e [0253.613] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee4) returned 0x6dee6e0 [0253.613] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6027400, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6027400, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGACCBOX.XML", cAlternateFileName="")) returned 1 [0253.613] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML") returned 1 [0253.613] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGACCBOX.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml") returned 0x3e [0253.613] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.613] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.613] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ee8) returned 0x6dee6e0 [0253.614] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe82ce100, ftCreationTime.dwHighDateTime=0x1c5ffa1, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe82ce100, ftLastWriteTime.dwHighDateTime=0x1c5ffa1, nFileSizeHigh=0x0, nFileSizeLow=0x4b2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.DPV", cAlternateFileName="")) returned 1 [0253.614] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgaccbox.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV") returned 1 [0253.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv") returned 0x3a [0253.614] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1eec) returned 0x6dee6e0 [0253.614] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5aaf00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5aaf00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x3be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGAD.XML", cAlternateFileName="")) returned 1 [0253.614] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML") returned 1 [0253.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGAD.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml") returned 0x3a [0253.614] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef0) returned 0x6dee6e0 [0253.614] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc92fc900, ftCreationTime.dwHighDateTime=0x1c7e8c2, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92fc900, ftLastWriteTime.dwHighDateTime=0x1c7e8c2, nFileSizeHigh=0x0, nFileSizeLow=0x5269, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.DPV", cAlternateFileName="")) returned 1 [0253.614] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgad.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV") returned 1 [0253.614] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv") returned 0x3e [0253.614] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.614] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.614] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef4) returned 0x6dee6e0 [0253.615] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b2ea00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b2ea00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGATNGET.XML", cAlternateFileName="")) returned 1 [0253.615] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML") returned 1 [0253.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGATNGET.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml") returned 0x3e [0253.615] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1ef8) returned 0x6dee6e0 [0253.615] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.DPV", cAlternateFileName="")) returned 1 [0253.615] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgatnget.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV") returned 1 [0253.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv") returned 0x3e [0253.615] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1efc) returned 0x6dee6e0 [0253.615] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x456, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBARBLL.XML", cAlternateFileName="")) returned 1 [0253.615] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML") returned 1 [0253.615] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBARBLL.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml") returned 0x3e [0253.615] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.615] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.615] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f00) returned 0x6dee6e0 [0253.616] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.DPV", cAlternateFileName="")) returned 1 [0253.616] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgbarbll.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV") returned 1 [0253.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv") returned 0x3e [0253.616] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f04) returned 0x6dee6e0 [0253.616] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9924200, ftCreationTime.dwHighDateTime=0x1c9a14d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9924200, ftLastWriteTime.dwHighDateTime=0x1c9a14d, nFileSizeHigh=0x0, nFileSizeLow=0x9a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBORDER.XML", cAlternateFileName="")) returned 1 [0253.616] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML") returned 1 [0253.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBORDER.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml") returned 0x3e [0253.616] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f08) returned 0x6dee6e0 [0253.616] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98487b00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98487b00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.DPV", cAlternateFileName="")) returned 1 [0253.616] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgborder.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV") returned 1 [0253.616] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv") returned 0x3d [0253.616] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.616] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.616] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f0c) returned 0x6dee6e0 [0253.617] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x321df500, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x321df500, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGBOXES.XML", cAlternateFileName="")) returned 1 [0253.617] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML") returned 1 [0253.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGBOXES.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml") returned 0x3d [0253.617] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f10) returned 0x6dee6e0 [0253.617] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1497e200, ftCreationTime.dwHighDateTime=0x1c6856f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1497e200, ftLastWriteTime.dwHighDateTime=0x1c6856f, nFileSizeHigh=0x0, nFileSizeLow=0x35468, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.DPV", cAlternateFileName="")) returned 1 [0253.617] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgboxes.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV") returned 1 [0253.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv") returned 0x3b [0253.617] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f14) returned 0x6dee6e0 [0253.617] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba75d00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba75d00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x1e66, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCAL.XML", cAlternateFileName="")) returned 1 [0253.617] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML") returned 1 [0253.617] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCAL.XML", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml") returned 0x3b [0253.617] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.617] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.617] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0253.617] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca59dd00, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca59dd00, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.DPV", cAlternateFileName="")) returned 1 [0253.618] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcal.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV") returned 1 [0253.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv") returned 0x3e [0253.618] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f1c) returned 0x6dee6e0 [0253.618] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ded00, ftCreationTime.dwHighDateTime=0x1c98d98, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa0ded00, ftLastWriteTime.dwHighDateTime=0x1c98d98, nFileSizeHigh=0x0, nFileSizeLow=0x29e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCHKBRD.XML", cAlternateFileName="")) returned 1 [0253.618] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML") returned 1 [0253.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCHKBRD.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml") returned 0x3e [0253.618] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f20) returned 0x6dee6e0 [0253.618] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x147eee00, ftCreationTime.dwHighDateTime=0x1c9c48f, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x147eee00, ftLastWriteTime.dwHighDateTime=0x1c9c48f, nFileSizeHigh=0x0, nFileSizeLow=0x49e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCINFO.XML", cAlternateFileName="")) returned 1 [0253.618] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgchkbrd.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML") returned 1 [0253.618] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCINFO.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml") returned 0x3d [0253.618] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.618] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.618] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f24) returned 0x6dee6e0 [0253.618] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4caf000, ftCreationTime.dwHighDateTime=0x1c5e8f4, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4caf000, ftLastWriteTime.dwHighDateTime=0x1c5e8f4, nFileSizeHigh=0x0, nFileSizeLow=0x6082, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCOUPON.DPV", cAlternateFileName="")) returned 1 [0253.667] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcinfo.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV") returned 1 [0253.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv") returned 0x3e [0253.667] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.667] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f18) returned 0x6dee6e0 [0253.667] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c57d300, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c57d300, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGCOUPON.XML", cAlternateFileName="")) returned 1 [0253.667] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML") returned 1 [0253.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml") returned 0x3e [0253.667] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.667] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.667] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f1c) returned 0x6dee6e0 [0253.667] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8274200, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8274200, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGDOTS.DPV", cAlternateFileName="")) returned 1 [0253.667] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV") returned 1 [0253.667] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv") returned 0x3c [0253.667] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.667] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f20) returned 0x6dee6e0 [0253.668] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d44000, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99d44000, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x2b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGDOTS.XML", cAlternateFileName="")) returned 1 [0253.668] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML") returned 1 [0253.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml") returned 0x3c [0253.668] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f24) returned 0x6dee6e0 [0253.668] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38629c00, ftCreationTime.dwHighDateTime=0x1ca08e5, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38629c00, ftLastWriteTime.dwHighDateTime=0x1ca08e5, nFileSizeHigh=0x0, nFileSizeLow=0x1ba4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGHEADING.XML", cAlternateFileName="DGHEAD~1.XML")) returned 1 [0253.668] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML") returned 1 [0253.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml") returned 0x3f [0253.668] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.668] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f28) returned 0x6dee6e0 [0253.668] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8274200, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8274200, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLINACC.DPV", cAlternateFileName="")) returned 1 [0253.668] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV") returned 1 [0253.668] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv") returned 0x3e [0253.668] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.668] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f2c) returned 0x6dee6e0 [0253.669] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa22c7b00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51dcda70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa22c7b00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLINACC.XML", cAlternateFileName="")) returned 1 [0253.669] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML") returned 1 [0253.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml") returned 0x3e [0253.669] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.669] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f30) returned 0x6dee6e0 [0253.669] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e5000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef4e5000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2ebf, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLOGO.DPV", cAlternateFileName="")) returned 1 [0253.669] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV") returned 1 [0253.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv") returned 0x3c [0253.669] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.669] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.669] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f34) returned 0x6dee6e0 [0253.669] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa84b600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa84b600, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x7ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGLOGO.XML", cAlternateFileName="")) returned 1 [0253.669] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML") returned 1 [0253.669] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml") returned 0x3c [0253.669] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.669] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f38) returned 0x6dee6e0 [0253.670] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d1c200, ftCreationTime.dwHighDateTime=0x1ca579b, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0d1c200, ftLastWriteTime.dwHighDateTime=0x1ca579b, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMAIN.XML", cAlternateFileName="")) returned 1 [0253.670] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML") returned 1 [0253.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml") returned 0x3c [0253.670] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f3c) returned 0x6dee6e0 [0253.670] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e5000, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef4e5000, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMARQ.DPV", cAlternateFileName="")) returned 1 [0253.670] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV") returned 1 [0253.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv") returned 0x3c [0253.670] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f40) returned 0x6dee6e0 [0253.670] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba03ff00, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba03ff00, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x33a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMARQ.XML", cAlternateFileName="")) returned 1 [0253.670] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML") returned 1 [0253.670] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml") returned 0x3c [0253.670] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.670] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.670] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f44) returned 0x6dee6e0 [0253.671] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e00d500, ftCreationTime.dwHighDateTime=0x1c7e8c8, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e00d500, ftLastWriteTime.dwHighDateTime=0x1c7e8c8, nFileSizeHigh=0x0, nFileSizeLow=0x50f94, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGMASTHD.DPV", cAlternateFileName="")) returned 1 [0253.671] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV") returned 1 [0253.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv") returned 0x3e [0253.671] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f48) returned 0x6dee6e0 [0253.671] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c37b00, ftCreationTime.dwHighDateTime=0x1c6272e, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8c37b00, ftLastWriteTime.dwHighDateTime=0x1c6272e, nFileSizeHigh=0x0, nFileSizeLow=0x71a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.DPV", cAlternateFileName="")) returned 1 [0253.671] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV") returned 1 [0253.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv") returned 0x3e [0253.671] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f4c) returned 0x6dee6e0 [0253.671] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fc98600, ftCreationTime.dwHighDateTime=0x1c94493, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8fc98600, ftLastWriteTime.dwHighDateTime=0x1c94493, nFileSizeHigh=0x0, nFileSizeLow=0x11c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGNAVBAR.XML", cAlternateFileName="")) returned 1 [0253.671] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML") returned 1 [0253.671] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml") returned 0x3e [0253.671] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.671] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.671] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f50) returned 0x6dee6e0 [0253.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb8e7500, ftCreationTime.dwHighDateTime=0x1c9a6a9, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb8e7500, ftLastWriteTime.dwHighDateTime=0x1c9a6a9, nFileSizeHigh=0x0, nFileSizeLow=0x1eeda, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.DPV", cAlternateFileName="")) returned 1 [0253.672] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV") returned 1 [0253.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv") returned 0x3e [0253.672] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f54) returned 0x6dee6e0 [0253.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb78a5e00, ftCreationTime.dwHighDateTime=0x1c9a6c0, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb78a5e00, ftLastWriteTime.dwHighDateTime=0x1c9a6c0, nFileSizeHigh=0x0, nFileSizeLow=0x1aca, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPICCAP.XML", cAlternateFileName="")) returned 1 [0253.672] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML") returned 1 [0253.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml") returned 0x3e [0253.672] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.672] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f58) returned 0x6dee6e0 [0253.672] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36e97a00, ftCreationTime.dwHighDateTime=0x1c7e417, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36e97a00, ftLastWriteTime.dwHighDateTime=0x1c7e417, nFileSizeHigh=0x0, nFileSizeLow=0x938f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.DPV", cAlternateFileName="")) returned 1 [0253.672] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV") returned 1 [0253.672] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv") returned 0x3d [0253.672] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.672] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f5c) returned 0x6dee6e0 [0253.673] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3150300, ftCreationTime.dwHighDateTime=0x1c97a05, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3150300, ftLastWriteTime.dwHighDateTime=0x1c97a05, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPQUOT.XML", cAlternateFileName="")) returned 1 [0253.673] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML") returned 1 [0253.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml") returned 0x3d [0253.673] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f60) returned 0x6dee6e0 [0253.673] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b69d100, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b69d100, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.DPV", cAlternateFileName="")) returned 1 [0253.673] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV") returned 1 [0253.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv") returned 0x3d [0253.673] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.673] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f64) returned 0x6dee6e0 [0253.673] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5039ff00, ftCreationTime.dwHighDateTime=0x1c9c865, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5039ff00, ftLastWriteTime.dwHighDateTime=0x1c9c865, nFileSizeHigh=0x0, nFileSizeLow=0x556, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGPUNCT.XML", cAlternateFileName="")) returned 1 [0253.673] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML") returned 1 [0253.673] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml") returned 0x3d [0253.673] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.673] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f68) returned 0x6dee6e0 [0253.674] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2465f500, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2465f500, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6e87, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.DPV", cAlternateFileName="")) returned 1 [0253.674] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV") returned 1 [0253.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv") returned 0x3e [0253.674] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f6c) returned 0x6dee6e0 [0253.674] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6cff600, ftCreationTime.dwHighDateTime=0x1c91701, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6cff600, ftLastWriteTime.dwHighDateTime=0x1c91701, nFileSizeHigh=0x0, nFileSizeLow=0x75c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGREPFRM.XML", cAlternateFileName="")) returned 1 [0253.674] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML") returned 1 [0253.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml") returned 0x3e [0253.674] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f70) returned 0x6dee6e0 [0253.674] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b6bca00, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b6bca00, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xae41, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.DPV", cAlternateFileName="")) returned 1 [0253.674] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV") returned 1 [0253.674] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv") returned 0x3e [0253.674] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.674] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.674] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f74) returned 0x6dee6e0 [0253.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2d1d600, ftCreationTime.dwHighDateTime=0x1c976eb, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2d1d600, ftLastWriteTime.dwHighDateTime=0x1c976eb, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBR.XML", cAlternateFileName="")) returned 1 [0253.675] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML") returned 1 [0253.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml") returned 0x3e [0253.675] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f78) returned 0x6dee6e0 [0253.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x109f3b00, ftCreationTime.dwHighDateTime=0x1c976ec, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x109f3b00, ftLastWriteTime.dwHighDateTime=0x1c976ec, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSIDEBRV.XML", cAlternateFileName="DGSIDE~1.XML")) returned 1 [0253.675] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML") returned 1 [0253.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBRV.XML", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml") returned 0x3f [0253.675] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f7c) returned 0x6dee6e0 [0253.675] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd73700, ftCreationTime.dwHighDateTime=0x1c976e8, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdd73700, ftLastWriteTime.dwHighDateTime=0x1c976e8, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORY.XML", cAlternateFileName="")) returned 1 [0253.675] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebrv.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML") returned 1 [0253.675] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORY.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml") returned 0x3d [0253.675] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.675] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.675] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f80) returned 0x6dee6e0 [0253.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f7200, ftCreationTime.dwHighDateTime=0x1c976e9, ftLastAccessTime.dwLowDateTime=0x60786a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62f7200, ftLastWriteTime.dwHighDateTime=0x1c976e9, nFileSizeHigh=0x0, nFileSizeLow=0xb84, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGSTORYVERT.XML", cAlternateFileName="DGSTOR~1.XML")) returned 1 [0253.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgstory.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML") returned 1 [0253.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSTORYVERT.XML", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml") returned 0x41 [0253.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f84) returned 0x6dee6e0 [0253.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573f000, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573f000, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTEAR.DPV", cAlternateFileName="")) returned 1 [0253.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgstoryvert.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV") returned 1 [0253.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTEAR.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv") returned 0x3c [0253.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f88) returned 0x6dee6e0 [0253.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef0dd700, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef0dd700, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0xe50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.DPV", cAlternateFileName="")) returned 1 [0253.676] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtear.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV") returned 1 [0253.676] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv") returned 0x3b [0253.676] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.676] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.676] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f8c) returned 0x6dee6e0 [0253.676] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd764d00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd764d00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1712, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGTOC.XML", cAlternateFileName="")) returned 1 [0253.677] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML") returned 1 [0253.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGTOC.XML", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml") returned 0x3b [0253.677] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f90) returned 0x6dee6e0 [0253.677] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x149d5b00, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x149d5b00, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBAD.XML", cAlternateFileName="")) returned 1 [0253.677] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgtoc.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML") returned 1 [0253.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBAD.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml") returned 0x3d [0253.677] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f94) returned 0x6dee6e0 [0253.677] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aaad500, ftCreationTime.dwHighDateTime=0x1c5d95d, ftLastAccessTime.dwLowDateTime=0x51df3bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9aaad500, ftLastWriteTime.dwHighDateTime=0x1c5d95d, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.DPV", cAlternateFileName="")) returned 1 [0253.677] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebad.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV") returned 1 [0253.677] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv") returned 0x3e [0253.677] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.677] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.677] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f98) returned 0x6dee6e0 [0253.677] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cf59600, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cf59600, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x110e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBBTN.XML", cAlternateFileName="")) returned 1 [0253.678] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML") returned 1 [0253.678] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBBTN.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml") returned 0x3e [0253.678] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.678] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.678] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f9c) returned 0x6dee6e0 [0253.678] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af16e00, ftCreationTime.dwHighDateTime=0x1c6856e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af16e00, ftLastWriteTime.dwHighDateTime=0x1c6856e, nFileSizeHigh=0x0, nFileSizeLow=0x301be, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.DPV", cAlternateFileName="")) returned 1 [0253.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebbtn.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV") returned 1 [0253.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv") returned 0x3e [0253.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1f9c) returned 0x6dee6e0 [0253.681] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22eb7700, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22eb7700, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1cb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBCAL.XML", cAlternateFileName="")) returned 1 [0253.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML") returned 1 [0253.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBCAL.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml") returned 0x3e [0253.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.681] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fa0) returned 0x6dee6e0 [0253.681] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4317bc00, ftCreationTime.dwHighDateTime=0x1c68573, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4317bc00, ftLastWriteTime.dwHighDateTime=0x1c68573, nFileSizeHigh=0x0, nFileSizeLow=0x2f814, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.DPV", cAlternateFileName="")) returned 1 [0253.681] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebcal.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV") returned 1 [0253.681] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv") returned 0x3d [0253.681] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.681] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fa4) returned 0x6dee6e0 [0253.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a128500, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a128500, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0x1dbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBHD.XML", cAlternateFileName="")) returned 1 [0253.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML") returned 1 [0253.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBHD.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml") returned 0x3d [0253.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fa8) returned 0x6dee6e0 [0253.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x438bc800, ftCreationTime.dwHighDateTime=0x1c6157c, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x438bc800, ftLastWriteTime.dwHighDateTime=0x1c6157c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.DPV", cAlternateFileName="")) returned 1 [0253.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebhd.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV") returned 1 [0253.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv") returned 0x3e [0253.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.682] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fac) returned 0x6dee6e0 [0253.682] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x326ac000, ftCreationTime.dwHighDateTime=0x1c91702, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x326ac000, ftLastWriteTime.dwHighDateTime=0x1c91702, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBPQT.XML", cAlternateFileName="")) returned 1 [0253.682] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML") returned 1 [0253.682] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBPQT.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml") returned 0x3e [0253.682] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.682] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fb0) returned 0x6dee6e0 [0253.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67294800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67294800, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBREF.XML", cAlternateFileName="")) returned 1 [0253.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebpqt.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML") returned 1 [0253.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBREF.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml") returned 0x3e [0253.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fb4) returned 0x6dee6e0 [0253.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4495b400, ftCreationTime.dwHighDateTime=0x1c68574, ftLastAccessTime.dwLowDateTime=0x607acbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4495b400, ftLastWriteTime.dwHighDateTime=0x1c68574, nFileSizeHigh=0x0, nFileSizeLow=0x6df7, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.DPV", cAlternateFileName="")) returned 1 [0253.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebref.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV") returned 1 [0253.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv") returned 0x3e [0253.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.683] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fb8) returned 0x6dee6e0 [0253.683] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57a9ff00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57a9ff00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGWEBSBR.XML", cAlternateFileName="")) returned 1 [0253.683] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML") returned 1 [0253.683] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGWEBSBR.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml") returned 0x3e [0253.683] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.683] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fbc) returned 0x6dee6e0 [0253.684] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d4dc00, ftCreationTime.dwHighDateTime=0x1c5d95e, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36d4dc00, ftLastWriteTime.dwHighDateTime=0x1c5d95e, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIP.DPV", cAlternateFileName="")) returned 1 [0253.684] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgwebsbr.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV") returned 1 [0253.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIP.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv") returned 0x3b [0253.684] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.684] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fc0) returned 0x6dee6e0 [0253.684] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8d1000, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8d1000, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGZIPC.XML", cAlternateFileName="")) returned 1 [0253.684] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgzip.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML") returned 1 [0253.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGZIPC.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml") returned 0x3c [0253.684] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.684] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.684] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fc4) returned 0x6dee6e0 [0253.684] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fe70900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fe70900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1c56, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOTS.POC", cAlternateFileName="")) returned 1 [0253.684] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dgzipc.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC") returned 1 [0253.684] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DOTS.POC", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc") returned 0x3a [0253.684] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.684] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fc8) returned 0x6dee6e0 [0253.685] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21183600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21183600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x10c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVDHM.POC", cAlternateFileName="")) returned 1 [0253.685] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dots.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC") returned 1 [0253.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DVDHM.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc") returned 0x3b [0253.685] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x6dee6e0, Size=0x1fcc) returned 0x72e5948 [0253.685] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18eb8500, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18eb8500, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x7dc55, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.DPV", cAlternateFileName="")) returned 1 [0253.685] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\dvdhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV") returned 1 [0253.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv") returned 0x3b [0253.685] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.685] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd0) returned 0x72e5948 [0253.685] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8393c00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8393c00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0xd066, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL.XML", cAlternateFileName="")) returned 1 [0253.685] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\email.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML") returned 1 [0253.685] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL.XML", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml") returned 0x3b [0253.685] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.685] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd4) returned 0x72e5948 [0253.686] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAIL11.POC", cAlternateFileName="")) returned 1 [0253.686] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\email.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC") returned 1 [0253.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAIL11.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc") returned 0x3d [0253.686] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.686] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd8) returned 0x72e5948 [0253.686] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadcdd400, ftCreationTime.dwHighDateTime=0x1c513d0, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadcdd400, ftLastWriteTime.dwHighDateTime=0x1c513d0, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMAILMOD.POC", cAlternateFileName="")) returned 1 [0253.686] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\email11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC") returned 1 [0253.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\EMAILMOD.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc") returned 0x3e [0253.686] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.686] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.686] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fdc) returned 0x72e5948 [0253.686] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2aa19e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2aa19e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xc5fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV11.POC", cAlternateFileName="")) returned 1 [0253.686] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\emailmod.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC") returned 1 [0253.686] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV11.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc") returned 0x3b [0253.686] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.686] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe0) returned 0x72e5948 [0253.687] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2a052, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98.POC", cAlternateFileName="")) returned 1 [0253.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\env11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC") returned 1 [0253.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc") returned 0x3b [0253.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe4) returned 0x72e5948 [0253.687] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x4af4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENV98SP.POC", cAlternateFileName="")) returned 1 [0253.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\env98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC") returned 1 [0253.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENV98SP.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc") returned 0x3d [0253.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe8) returned 0x72e5948 [0253.687] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1cb200, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x24efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DPV", cAlternateFileName="")) returned 1 [0253.687] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\env98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV") returned 1 [0253.687] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv") returned 0x3e [0253.687] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0253.687] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0253.687] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fec) returned 0x72e5948 [0254.469] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df38200, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6df38200, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x30de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.XML", cAlternateFileName="")) returned 1 [0254.469] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML") returned 1 [0254.469] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVELOPE.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml") returned 0x3e [0254.469] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0254.469] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.365] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f4c) returned 0x72e5948 [0255.365] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x8a32, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVHM.POC", cAlternateFileName="")) returned 1 [0255.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\envelope.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC") returned 1 [0255.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ENVHM.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc") returned 0x3b [0255.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f50) returned 0x72e5948 [0255.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d03f800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d03f800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x0, dwReserved1=0x0, cFileName="FEZIP.POC", cAlternateFileName="")) returned 1 [0255.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\envhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC") returned 1 [0255.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FEZIP.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc") returned 0x3b [0255.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.366] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f54) returned 0x72e5948 [0255.366] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e352500, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e352500, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xfd00, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLY98SP.POC", cAlternateFileName="")) returned 1 [0255.366] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\fezip.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC") returned 1 [0255.366] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLY98SP.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc") returned 0x3d [0255.366] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.366] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f58) returned 0x72e5948 [0255.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd64c00, ftCreationTime.dwHighDateTime=0x1c8f193, ftLastAccessTime.dwLowDateTime=0x52883d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3dd64c00, ftLastWriteTime.dwHighDateTime=0x1c8f193, nFileSizeHigh=0x0, nFileSizeLow=0x15369c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER.DPV", cAlternateFileName="")) returned 1 [0255.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\fly98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV") returned 1 [0255.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv") returned 0x3b [0255.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.367] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f5c) returned 0x72e5948 [0255.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9709c00, ftCreationTime.dwHighDateTime=0x1ca5799, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9709c00, ftLastWriteTime.dwHighDateTime=0x1ca5799, nFileSizeHigh=0x0, nFileSizeLow=0x13d7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER.XML", cAlternateFileName="")) returned 1 [0255.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML") returned 1 [0255.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER.XML", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml") returned 0x3b [0255.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.367] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.367] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f60) returned 0x72e5948 [0255.367] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30977f00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30977f00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x369a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER11.POC", cAlternateFileName="")) returned 1 [0255.367] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC") returned 1 [0255.367] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER11.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc") returned 0x3d [0255.367] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f64) returned 0x72e5948 [0255.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db46e00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3db46e00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xe498e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYER98.POC", cAlternateFileName="")) returned 1 [0255.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC") returned 1 [0255.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYER98.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc") returned 0x3d [0255.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f68) returned 0x72e5948 [0255.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ee59b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ee59b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xd988, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLYERHM.POC", cAlternateFileName="")) returned 1 [0255.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\flyer98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC") returned 1 [0255.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FLYERHM.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc") returned 0x3d [0255.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.368] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.368] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f6c) returned 0x72e5948 [0255.368] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20129300, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20129300, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x56ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDPROJ.DPV", cAlternateFileName="")) returned 1 [0255.368] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\flyerhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV") returned 1 [0255.368] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv") returned 0x3e [0255.368] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f70) returned 0x72e5948 [0255.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2800, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2800, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x62c, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOLDPROJ.XML", cAlternateFileName="")) returned 1 [0255.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML") returned 1 [0255.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FOLDPROJ.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml") returned 0x3e [0255.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f74) returned 0x72e5948 [0255.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x8c952, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM98.POC", cAlternateFileName="")) returned 1 [0255.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\foldproj.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC") returned 1 [0255.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORM98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc") returned 0x3c [0255.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.369] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f78) returned 0x72e5948 [0255.369] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMCTL.POC", cAlternateFileName="")) returned 1 [0255.369] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\form98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC") returned 1 [0255.369] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FORMCTL.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc") returned 0x3d [0255.369] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0255.369] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0255.370] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f7c) returned 0x72e5948 [0255.370] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a03000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x52a00b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a03000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="FS3BOX.POC", cAlternateFileName="")) returned 1 [0257.424] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\formctl.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC") returned 1 [0257.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\FS3BOX.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc") returned 0x3c [0257.425] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0257.425] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f78) returned 0x72e5948 [0258.986] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1cb200, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1cb200, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xb0c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT.DPV", cAlternateFileName="")) returned 1 [0258.986] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\fs3box.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV") returned 1 [0258.986] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv") returned 0x3a [0258.986] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.986] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f7c) returned 0x72e5948 [0258.986] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe454bd00, ftCreationTime.dwHighDateTime=0x1c916ff, ftLastAccessTime.dwLowDateTime=0x52a72f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe454bd00, ftLastWriteTime.dwHighDateTime=0x1c916ff, nFileSizeHigh=0x0, nFileSizeLow=0x14c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT.XML", cAlternateFileName="")) returned 1 [0258.986] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\gift.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML") returned 1 [0258.986] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml") returned 0x3a [0258.986] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.986] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.986] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f80) returned 0x72e5948 [0258.986] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad15d00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x619f9510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad15d00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x22cf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="GIFT98.POC", cAlternateFileName="")) returned 1 [0258.987] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\gift.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC") returned 1 [0258.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GIFT98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc") returned 0x3c [0258.987] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.987] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f84) returned 0x72e5948 [0258.987] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x591f7900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x591f7900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xd6314, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREET11.POC", cAlternateFileName="")) returned 1 [0258.987] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\gift98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC") returned 1 [0258.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREET11.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc") returned 0x3d [0258.987] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.987] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f88) returned 0x72e5948 [0258.987] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48212100, ftCreationTime.dwHighDateTime=0x1c5dbc8, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48212100, ftLastWriteTime.dwHighDateTime=0x1c5dbc8, nFileSizeHigh=0x0, nFileSizeLow=0x124b3b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREETING.DPV", cAlternateFileName="")) returned 1 [0258.987] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\greet11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV") returned 1 [0258.987] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv") returned 0x3e [0258.987] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.987] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.987] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f8c) returned 0x72e5948 [0258.987] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7d700, ftCreationTime.dwHighDateTime=0x1ca5794, ftLastAccessTime.dwLowDateTime=0x61c0e850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe7d700, ftLastWriteTime.dwHighDateTime=0x1ca5794, nFileSizeHigh=0x0, nFileSizeLow=0xfb0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GREETING.XML", cAlternateFileName="")) returned 1 [0258.988] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML") returned 1 [0258.988] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml") returned 0x3e [0258.988] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.988] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.988] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f90) returned 0x72e5948 [0258.988] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfac75100, ftCreationTime.dwHighDateTime=0x1c976be, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfac75100, ftLastWriteTime.dwHighDateTime=0x1c976be, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADINGBB.DPV", cAlternateFileName="HEADIN~1.DPV")) returned 1 [0258.988] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV") returned 1 [0258.988] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.DPV", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv") returned 0x3f [0258.988] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.988] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.988] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f94) returned 0x72e5948 [0258.988] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf392a100, ftCreationTime.dwHighDateTime=0x1c97a38, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf392a100, ftLastWriteTime.dwHighDateTime=0x1c97a38, nFileSizeHigh=0x0, nFileSizeLow=0x27e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADINGBB.POC", cAlternateFileName="HEADIN~1.POC")) returned 1 [0258.988] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC") returned 1 [0258.988] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\HEADINGBB.POC", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc") returned 0x3f [0258.988] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.988] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.988] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f98) returned 0x72e5948 [0258.988] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376aae00, ftCreationTime.dwHighDateTime=0x1c5dbbc, ftLastAccessTime.dwLowDateTime=0x61e6fe50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376aae00, ftLastWriteTime.dwHighDateTime=0x1c5dbbc, nFileSizeHigh=0x0, nFileSizeLow=0x3cbaf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE.DPV", cAlternateFileName="")) returned 1 [0258.989] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\headingbb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV") returned 1 [0258.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv") returned 0x3c [0258.989] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.989] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.989] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1f9c) returned 0x72e5948 [0258.989] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc31f00, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7dc31f00, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x49c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE.XML", cAlternateFileName="")) returned 1 [0258.989] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML") returned 1 [0258.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml") returned 0x3c [0258.989] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.989] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.989] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa0) returned 0x72e5948 [0258.989] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a8e100, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x61e6fe50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62a8e100, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbc448, dwReserved0=0x0, dwReserved1=0x0, cFileName="INVITE11.POC", cAlternateFileName="")) returned 1 [0258.989] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\invite.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC") returned 1 [0258.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc") returned 0x3e [0258.989] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.989] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.989] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa4) returned 0x72e5948 [0258.989] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db03900, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db03900, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x2a1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL.DPV", cAlternateFileName="")) returned 1 [0258.989] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\invite11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV") returned 1 [0258.989] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.DPV", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv") returned 0x3b [0258.990] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.990] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.990] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fa8) returned 0x72e5948 [0258.990] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc1b100, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc1b100, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x48c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL.XML", cAlternateFileName="")) returned 1 [0258.990] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\label.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML") returned 1 [0258.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL.XML", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml") returned 0x3b [0258.990] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.990] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.990] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fac) returned 0x72e5948 [0258.990] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x27842, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABEL98.POC", cAlternateFileName="")) returned 1 [0258.990] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\label.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC") returned 1 [0258.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABEL98.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc") returned 0x3d [0258.990] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.990] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.990] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb0) returned 0x72e5948 [0258.990] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3464, dwReserved0=0x0, dwReserved1=0x0, cFileName="LABELHM.POC", cAlternateFileName="")) returned 1 [0258.990] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\label98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC") returned 1 [0258.990] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LABELHM.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc") returned 0x3d [0258.991] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.991] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.991] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb4) returned 0x72e5948 [0258.991] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee16600, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ee16600, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x1f89d, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.DPV", cAlternateFileName="")) returned 1 [0258.991] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\labelhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV") returned 1 [0258.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv") returned 0x3e [0258.991] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.991] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.991] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb8) returned 0x72e5948 [0258.991] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c11df00, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x5680a890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c11df00, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x309e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LETTHEAD.XML", cAlternateFileName="")) returned 1 [0258.991] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML") returned 1 [0258.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LETTHEAD.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml") returned 0x3e [0258.991] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.991] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0258.991] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fbc) returned 0x72e5948 [0258.991] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x650b3b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x650b3b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEACT.POC", cAlternateFileName="")) returned 1 [0258.991] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\letthead.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC") returned 1 [0258.991] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LINEACT.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc") returned 0x3d [0258.991] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0258.992] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.140] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb0) returned 0x72e5948 [0259.140] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663c6800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x663c6800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb026, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGO98.POC", cAlternateFileName="")) returned 1 [0259.141] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\lineact.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC") returned 1 [0259.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LOGO98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc") returned 0x3c [0259.141] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb4) returned 0x72e5948 [0259.141] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x663c6800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5825fbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x663c6800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xa82a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD11.POC", cAlternateFileName="")) returned 1 [0259.141] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\logo98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC") returned 1 [0259.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD11.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc") returned 0x3c [0259.141] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fb8) returned 0x72e5948 [0259.141] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x69659290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2383c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD98.POC", cAlternateFileName="")) returned 1 [0259.141] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC") returned 1 [0259.141] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc") returned 0x3c [0259.141] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.141] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.141] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fbc) returned 0x72e5948 [0259.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x696cb6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHD98SP.POC", cAlternateFileName="")) returned 1 [0259.142] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC") returned 1 [0259.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHD98SP.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc") returned 0x3e [0259.142] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc0) returned 0x72e5948 [0259.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5825fbf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x9a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LTHDHM.POC", cAlternateFileName="")) returned 1 [0259.142] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\lthd98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC") returned 1 [0259.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\LTHDHM.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc") returned 0x3c [0259.142] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc4) returned 0x72e5948 [0259.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88d6ff00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88d6ff00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x2694, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAIN.XML", cAlternateFileName="")) returned 1 [0259.142] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\lthdhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML") returned 1 [0259.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml") returned 0x3a [0259.142] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fc8) returned 0x72e5948 [0259.143] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x689ec200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x689ec200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="MARQUEE.POC", cAlternateFileName="")) returned 1 [0259.143] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC") returned 1 [0259.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc") returned 0x3d [0259.143] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fcc) returned 0x72e5948 [0259.143] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d6c200, ftCreationTime.dwHighDateTime=0x1c61d74, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d6c200, ftLastWriteTime.dwHighDateTime=0x1c61d74, nFileSizeHigh=0x0, nFileSizeLow=0x14a14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU.DPV", cAlternateFileName="")) returned 1 [0259.143] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV") returned 1 [0259.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv") returned 0x3a [0259.143] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd0) returned 0x72e5948 [0259.143] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x912f3a00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x69a5d7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x912f3a00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x138a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU.XML", cAlternateFileName="")) returned 1 [0259.143] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML") returned 1 [0259.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml") returned 0x3a [0259.143] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.143] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd4) returned 0x72e5948 [0259.144] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c324900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c324900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1fd7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MENU98.POC", cAlternateFileName="")) returned 1 [0259.144] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC") returned 1 [0259.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc") returned 0x3c [0259.144] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fd8) returned 0x72e5948 [0259.144] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e94a300, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a2661f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e94a300, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x208fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTHED98.POC", cAlternateFileName="")) returned 1 [0259.144] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC") returned 1 [0259.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc") returned 0x3e [0259.144] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fdc) returned 0x72e5948 [0259.144] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc5d000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fc5d000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1da0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBAR11.POC", cAlternateFileName="")) returned 1 [0259.144] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC") returned 1 [0259.144] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc") returned 0x3e [0259.144] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.144] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.144] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe0) returned 0x72e5948 [0259.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1ccde, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBARV.POC", cAlternateFileName="")) returned 1 [0259.145] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC") returned 1 [0259.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc") returned 0x3d [0259.145] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe4) returned 0x72e5948 [0259.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBRPH1.POC", cAlternateFileName="")) returned 1 [0259.145] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC") returned 1 [0259.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH1.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc") returned 0x3e [0259.145] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fe8) returned 0x72e5948 [0259.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f6fd00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70f6fd00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x396, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAVBRPH2.POC", cAlternateFileName="")) returned 1 [0259.145] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph1.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC") returned 1 [0259.145] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBRPH2.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc") returned 0x3e [0259.145] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.145] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.145] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1fec) returned 0x72e5948 [0259.145] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31f43600, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31f43600, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x9965a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS.DPV", cAlternateFileName="")) returned 1 [0259.147] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\navbrph2.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV") returned 1 [0259.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv") returned 0x3a [0259.147] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ff0) returned 0x72e5948 [0259.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3389e500, ftCreationTime.dwHighDateTime=0x1c9d396, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3389e500, ftLastWriteTime.dwHighDateTime=0x1c9d396, nFileSizeHigh=0x0, nFileSizeLow=0x4260, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS.XML", cAlternateFileName="")) returned 1 [0259.147] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\news.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML") returned 1 [0259.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml") returned 0x3a [0259.147] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.147] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ff4) returned 0x72e5948 [0259.147] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x781e0b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x781e0b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x87d24, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS11.POC", cAlternateFileName="")) returned 1 [0259.147] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\news.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC") returned 1 [0259.147] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS11.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc") returned 0x3c [0259.147] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.147] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ff4) returned 0x72e5948 [0259.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ea0200, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a3e2fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4ea0200, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2dc320, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWS98.POC", cAlternateFileName="")) returned 1 [0259.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\news11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC") returned 1 [0259.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc") returned 0x3c [0259.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ff8) returned 0x72e5948 [0259.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6a409110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x5166c, dwReserved0=0x0, dwReserved1=0x0, cFileName="NEWSHM.POC", cAlternateFileName="")) returned 1 [0259.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC") returned 1 [0259.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWSHM.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc") returned 0x3c [0259.195] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.195] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.195] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x1ffc) returned 0x72e5948 [0259.195] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x82e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORIG98.POC", cAlternateFileName="")) returned 1 [0259.195] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\newshm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC") returned 1 [0259.195] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\ORIG98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc") returned 0x3c [0259.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2000) returned 0x72e5948 [0259.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bd08900, ftCreationTime.dwHighDateTime=0x1c9a6bb, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bd08900, ftLastWriteTime.dwHighDateTime=0x1c9a6bb, nFileSizeHigh=0x0, nFileSizeLow=0x4eba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICCAP98.POC", cAlternateFileName="")) returned 1 [0259.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\orig98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC") returned 1 [0259.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICCAP98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc") returned 0x3e [0259.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2004) returned 0x72e5948 [0259.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b3ac900, ftCreationTime.dwHighDateTime=0x1c9900f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b3ac900, ftLastWriteTime.dwHighDateTime=0x1c9900f, nFileSizeHigh=0x0, nFileSizeLow=0x1eac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICSTYLES.DPV", cAlternateFileName="PICSTY~1.DPV")) returned 1 [0259.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\piccap98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV") returned 1 [0259.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICSTYLES.DPV", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv") returned 0x3f [0259.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.196] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.196] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2008) returned 0x72e5948 [0259.196] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x0, dwReserved1=0x0, cFileName="PICTPH.POC", cAlternateFileName="")) returned 1 [0259.196] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\picstyles.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC") returned 1 [0259.196] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PICTPH.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc") returned 0x3c [0259.196] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x200c) returned 0x72e5948 [0259.197] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x1722, dwReserved0=0x0, dwReserved1=0x0, cFileName="PNCTUATE.POC", cAlternateFileName="")) returned 1 [0259.197] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\pictph.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC") returned 1 [0259.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PNCTUATE.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc") returned 0x3e [0259.197] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2010) returned 0x72e5948 [0259.197] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9aeb600, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a555f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9aeb600, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xb9b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POST98SP.POC", cAlternateFileName="")) returned 1 [0259.197] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\pnctuate.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC") returned 1 [0259.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POST98SP.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc") returned 0x3e [0259.197] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.197] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2014) returned 0x72e5948 [0259.197] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33646e00, ftCreationTime.dwHighDateTime=0x1c66432, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33646e00, ftLastWriteTime.dwHighDateTime=0x1c66432, nFileSizeHigh=0x0, nFileSizeLow=0xa194b, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCARD.DPV", cAlternateFileName="")) returned 1 [0259.197] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\post98sp.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV") returned 1 [0259.197] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv") returned 0x3e [0259.197] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.197] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2018) returned 0x72e5948 [0259.198] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dea000, ftCreationTime.dwHighDateTime=0x1ca579a, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9dea000, ftLastWriteTime.dwHighDateTime=0x1ca579a, nFileSizeHigh=0x0, nFileSizeLow=0x9a98, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCARD.XML", cAlternateFileName="")) returned 1 [0259.198] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML") returned 1 [0259.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCARD.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml") returned 0x3e [0259.198] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x201c) returned 0x72e5948 [0259.198] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbadfe300, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbadfe300, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCD11.POC", cAlternateFileName="")) returned 1 [0259.198] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\postcard.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC") returned 1 [0259.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD11.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc") returned 0x3e [0259.198] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.198] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2020) returned 0x72e5948 [0259.198] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a57c070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xa84e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="POSTCD98.POC", cAlternateFileName="")) returned 1 [0259.198] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\postcd11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC") returned 1 [0259.198] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\POSTCD98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc") returned 0x3e [0259.198] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.198] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.199] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2024) returned 0x72e5948 [0259.199] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xaf86, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROG98.POC", cAlternateFileName="")) returned 1 [0259.199] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\postcd98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC") returned 1 [0259.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROG98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc") returned 0x3c [0259.199] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.199] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2028) returned 0x72e5948 [0259.199] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2143c000, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2143c000, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROGRAM.DPV", cAlternateFileName="")) returned 1 [0259.199] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\prog98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV") returned 1 [0259.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv") returned 0x3d [0259.199] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.199] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x202c) returned 0x72e5948 [0259.199] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb02dcc00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb02dcc00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x26c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROGRAM.XML", cAlternateFileName="")) returned 1 [0259.199] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\program.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML") returned 1 [0259.199] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PROGRAM.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml") returned 0x3d [0259.199] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.199] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.200] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2030) returned 0x72e5948 [0259.200] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x934, dwReserved0=0x0, dwReserved1=0x0, cFileName="PS10TARG.POC", cAlternateFileName="")) returned 1 [0259.200] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\program.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC") returned 1 [0259.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS10TARG.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc") returned 0x3e [0259.200] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.200] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.200] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2034) returned 0x72e5948 [0259.200] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PS2SWOOS.POC", cAlternateFileName="")) returned 1 [0259.200] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ps10targ.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC") returned 1 [0259.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS2SWOOS.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc") returned 0x3e [0259.200] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.200] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.200] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2038) returned 0x72e5948 [0259.200] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4694b00, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4694b00, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PS9CRNRH.POC", cAlternateFileName="")) returned 1 [0259.200] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ps2swoos.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC") returned 1 [0259.200] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PS9CRNRH.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc") returned 0x3e [0259.200] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.200] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.201] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x203c) returned 0x72e5948 [0259.201] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ecf0800, ftCreationTime.dwHighDateTime=0x1c976c2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ecf0800, ftLastWriteTime.dwHighDateTime=0x1c976c2, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PULLQUOTEBB.DPV", cAlternateFileName="PULLQU~1.DPV")) returned 1 [0259.201] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\ps9crnrh.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV") returned 1 [0259.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.DPV", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv") returned 0x41 [0259.201] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.201] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.201] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2040) returned 0x72e5948 [0259.201] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58023000, ftCreationTime.dwHighDateTime=0x1c97a3a, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58023000, ftLastWriteTime.dwHighDateTime=0x1c97a3a, nFileSizeHigh=0x0, nFileSizeLow=0x18c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PULLQUOTEBB.POC", cAlternateFileName="PULLQU~1.POC")) returned 1 [0259.201] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC") returned 1 [0259.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULLQUOTEBB.POC", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc") returned 0x41 [0259.201] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.201] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.201] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2044) returned 0x72e5948 [0259.201] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc59a7800, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a7913b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc59a7800, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PULQOT98.POC", cAlternateFileName="")) returned 1 [0259.201] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\pullquotebb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC") returned 1 [0259.201] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc") returned 0x3e [0259.202] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.202] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.202] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2048) returned 0x72e5948 [0259.202] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f02f00, ftCreationTime.dwHighDateTime=0x1c8f148, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f02f00, ftLastWriteTime.dwHighDateTime=0x1c8f148, nFileSizeHigh=0x0, nFileSizeLow=0x8d1db, dwReserved0=0x0, dwReserved1=0x0, cFileName="QP.DPV", cAlternateFileName="")) returned 1 [0259.202] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV") returned 1 [0259.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.DPV", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv") returned 0x38 [0259.202] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.202] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.202] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x204c) returned 0x72e5948 [0259.202] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb754da00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb754da00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x33e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="QP.XML", cAlternateFileName="")) returned 1 [0259.202] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\qp.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML", len=0x38 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML") returned 1 [0259.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QP.XML", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml") returned 0x38 [0259.202] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.202] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.202] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2050) returned 0x72e5948 [0259.202] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb905900, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb905900, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x6f882, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUIKPUBS.POC", cAlternateFileName="")) returned 1 [0259.202] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\qp.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC") returned 1 [0259.202] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\QUIKPUBS.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc") returned 0x3e [0259.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2054) returned 0x72e5948 [0259.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf23e000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x6d169470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf23e000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x4d57e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPTWIZ.POC", cAlternateFileName="")) returned 1 [0259.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\quikpubs.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC") returned 1 [0259.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\REPTWIZ.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc") returned 0x3d [0259.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2058) returned 0x72e5948 [0259.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf23e000, ftCreationTime.dwHighDateTime=0x1c4a110, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf23e000, ftLastWriteTime.dwHighDateTime=0x1c4a110, nFileSizeHigh=0x0, nFileSizeLow=0x5df4, dwReserved0=0x0, dwReserved1=0x0, cFileName="RES98.POC", cAlternateFileName="")) returned 1 [0259.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\reptwiz.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC") returned 1 [0259.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RES98.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc") returned 0x3b [0259.203] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.203] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.203] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x205c) returned 0x72e5948 [0259.203] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa6c00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x6d1b5730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16aa6c00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1effa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESP98.POC", cAlternateFileName="")) returned 1 [0259.203] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\res98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC") returned 1 [0259.203] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESP98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc") returned 0x3c [0259.204] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2060) returned 0x72e5948 [0259.204] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2274ed00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2274ed00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESUME.DPV", cAlternateFileName="")) returned 1 [0259.204] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\resp98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV") returned 1 [0259.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.DPV", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv") returned 0x3c [0259.204] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2064) returned 0x72e5948 [0259.204] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfad1500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x6d1b5730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfad1500, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RESUME.XML", cAlternateFileName="")) returned 1 [0259.204] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\resume.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML") returned 1 [0259.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RESUME.XML", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml") returned 0x3c [0259.204] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.204] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.204] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0259.204] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16aa6c00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16aa6c00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x2aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSPMECH.POC", cAlternateFileName="")) returned 1 [0259.204] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\resume.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC") returned 1 [0259.204] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\RSPMECH.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc") returned 0x3d [0259.205] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.205] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.205] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0259.205] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17db9900, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17db9900, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDBAR98.POC", cAlternateFileName="")) returned 1 [0259.205] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\rspmech.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC") returned 1 [0259.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDBAR98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc") returned 0x3e [0259.205] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.205] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.205] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2070) returned 0x72e5948 [0259.205] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb3100, ftCreationTime.dwHighDateTime=0x1c9c70f, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb3100, ftLastWriteTime.dwHighDateTime=0x1c9c70f, nFileSizeHigh=0x0, nFileSizeLow=0x4c4d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARBB.DPV", cAlternateFileName="SIDEBA~1.DPV")) returned 1 [0259.205] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sidbar98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV") returned 1 [0259.205] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv") returned 0x3f [0259.205] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.205] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.205] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2074) returned 0x72e5948 [0259.205] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e5ea000, ftCreationTime.dwHighDateTime=0x1c98d8b, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5e5ea000, ftLastWriteTime.dwHighDateTime=0x1c98d8b, nFileSizeHigh=0x0, nFileSizeLow=0xb08a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARBB.POC", cAlternateFileName="SIDEBA~1.POC")) returned 1 [0259.205] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC") returned 1 [0259.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc") returned 0x3f [0259.206] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.206] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.206] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2078) returned 0x72e5948 [0259.206] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x641f1d00, ftCreationTime.dwHighDateTime=0x1c9c70e, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x641f1d00, ftLastWriteTime.dwHighDateTime=0x1c9c70e, nFileSizeHigh=0x0, nFileSizeLow=0x49e01, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARVERTBB.DPV", cAlternateFileName="SIDEBA~2.DPV")) returned 1 [0259.206] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV") returned 1 [0259.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv") returned 0x43 [0259.206] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.206] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.206] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x207c) returned 0x72e5948 [0259.206] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42f1b00, ftCreationTime.dwHighDateTime=0x1c98d8c, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe42f1b00, ftLastWriteTime.dwHighDateTime=0x1c98d8c, nFileSizeHigh=0x0, nFileSizeLow=0xa71a, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIDEBARVERTBB.POC", cAlternateFileName="SIDEBA~2.POC")) returned 1 [0259.206] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC", len=0x43 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC") returned 1 [0259.206] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC", cchLength=0x43 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc") returned 0x43 [0259.206] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.206] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.206] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2080) returned 0x72e5948 [0259.206] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17ba5800, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17ba5800, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x17e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.DPV", cAlternateFileName="")) returned 1 [0259.206] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV") returned 1 [0259.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv") returned 0x3a [0259.207] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.207] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.207] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2084) returned 0x72e5948 [0259.207] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa373d00, ftCreationTime.dwHighDateTime=0x1ca1adc, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa373d00, ftLastWriteTime.dwHighDateTime=0x1ca1adc, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN.XML", cAlternateFileName="")) returned 1 [0259.207] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML", len=0x3a | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML") returned 1 [0259.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML", cchLength=0x3a | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml") returned 0x3a [0259.207] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.207] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.207] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2088) returned 0x72e5948 [0259.207] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17db9900, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17db9900, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0xbb82, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGN98.POC", cAlternateFileName="")) returned 1 [0259.207] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC") returned 1 [0259.207] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc") returned 0x3c [0259.207] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.207] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.207] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x208c) returned 0x72e5948 [0259.207] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x6d6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNHM.POC", cAlternateFileName="")) returned 1 [0259.207] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC", len=0x3c | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC") returned 1 [0259.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC", cchLength=0x3c | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc") returned 0x3c [0259.208] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.208] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2090) returned 0x72e5948 [0259.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x760e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SNIPE.POC", cAlternateFileName="")) returned 1 [0259.208] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC") returned 1 [0259.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc") returned 0x3b [0259.208] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.208] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2094) returned 0x72e5948 [0259.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf89f6100, ftCreationTime.dwHighDateTime=0x1ca1016, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf89f6100, ftLastWriteTime.dwHighDateTime=0x1ca1016, nFileSizeHigh=0x0, nFileSizeLow=0x5f93b, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYBB.DPV", cAlternateFileName="")) returned 1 [0259.208] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV") returned 1 [0259.208] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv") returned 0x3d [0259.208] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.208] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.208] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2098) returned 0x72e5948 [0259.208] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc012a00, ftCreationTime.dwHighDateTime=0x1ca1012, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc012a00, ftLastWriteTime.dwHighDateTime=0x1ca1012, nFileSizeHigh=0x0, nFileSizeLow=0x7d36, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYBB.POC", cAlternateFileName="")) returned 1 [0259.208] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC") returned 1 [0259.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc") returned 0x3d [0259.209] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x209c) returned 0x72e5948 [0259.209] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211e800, ftCreationTime.dwHighDateTime=0x1c9c70d, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211e800, ftLastWriteTime.dwHighDateTime=0x1c9c70d, nFileSizeHigh=0x0, nFileSizeLow=0x4c9a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYVERTBB.DPV", cAlternateFileName="STORYV~1.DPV")) returned 1 [0259.209] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV") returned 1 [0259.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.DPV", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv") returned 0x41 [0259.209] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a0) returned 0x72e5948 [0259.209] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc912da00, ftCreationTime.dwHighDateTime=0x1c98d91, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc912da00, ftLastWriteTime.dwHighDateTime=0x1c98d91, nFileSizeHigh=0x0, nFileSizeLow=0x6f7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="STORYVERTBB.POC", cAlternateFileName="STORYV~1.POC")) returned 1 [0259.209] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC", len=0x41 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC") returned 1 [0259.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYVERTBB.POC", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc") returned 0x41 [0259.209] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.209] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.209] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a4) returned 0x72e5948 [0259.209] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="STRBRST.POC", cAlternateFileName="")) returned 1 [0259.209] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\storyvertbb.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC") returned 1 [0259.209] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STRBRST.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc") returned 0x3d [0259.209] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a8) returned 0x72e5948 [0259.210] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x190cc600, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5acec530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x190cc600, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEAROFF.POC", cAlternateFileName="")) returned 1 [0259.210] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\strbrst.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC") returned 1 [0259.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TEAROFF.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc") returned 0x3d [0259.210] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20ac) returned 0x72e5948 [0259.210] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd17a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1dd17a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x40a0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TOC98.POC", cAlternateFileName="")) returned 1 [0259.210] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\tearoff.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC") returned 1 [0259.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\TOC98.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc") returned 0x3b [0259.210] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.210] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.210] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b0) returned 0x72e5948 [0259.210] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2033d400, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2033d400, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x1eab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WCOMP98.POC", cAlternateFileName="")) returned 1 [0259.210] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\toc98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC") returned 1 [0259.210] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WCOMP98.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc") returned 0x3d [0259.210] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b4) returned 0x72e5948 [0259.211] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a8fe00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a8fe00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x166484, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEB11.POC", cAlternateFileName="")) returned 1 [0259.211] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\wcomp98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC", len=0x3b | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC") returned 1 [0259.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEB11.POC", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc") returned 0x3b [0259.211] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b8) returned 0x72e5948 [0259.211] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBCALSO.POC", cAlternateFileName="")) returned 1 [0259.211] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\web11.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC") returned 1 [0259.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBCALSO.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc") returned 0x3e [0259.211] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.211] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20bc) returned 0x72e5948 [0259.211] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBEMAIL.POC", cAlternateFileName="")) returned 1 [0259.211] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webcalso.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC") returned 1 [0259.211] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBEMAIL.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc") returned 0x3e [0259.211] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.211] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c0) returned 0x72e5948 [0259.212] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x12a02, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBHED98.POC", cAlternateFileName="")) returned 1 [0259.212] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webemail.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC") returned 1 [0259.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc") returned 0x3e [0259.212] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c4) returned 0x72e5948 [0259.212] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBHOME.POC", cAlternateFileName="")) returned 1 [0259.212] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC") returned 1 [0259.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc") returned 0x3d [0259.212] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c8) returned 0x72e5948 [0259.212] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c5ed00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x708c13f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42c5ed00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x34a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBLINK.POC", cAlternateFileName="")) returned 1 [0259.212] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC") returned 1 [0259.212] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc") returned 0x3d [0259.212] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.212] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.212] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20cc) returned 0x72e5948 [0259.213] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec02d00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ec02d00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xfeb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBPAGE.DPV", cAlternateFileName="")) returned 1 [0259.213] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV") returned 1 [0259.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv") returned 0x3d [0259.213] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d0) returned 0x72e5948 [0259.213] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd7a7a00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd7a7a00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x3d6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WEBPAGE.XML", cAlternateFileName="")) returned 1 [0259.213] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML") returned 1 [0259.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml") returned 0x3d [0259.213] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d4) returned 0x72e5948 [0259.213] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2274ed00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2274ed00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0xba14, dwReserved0=0x0, dwReserved1=0x0, cFileName="WITHCOMP.DPV", cAlternateFileName="")) returned 1 [0259.213] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV") returned 1 [0259.213] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv") returned 0x3e [0259.213] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.213] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.213] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d8) returned 0x72e5948 [0259.213] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5d2b500, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5d2b500, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x1716, dwReserved0=0x0, dwReserved1=0x0, cFileName="WITHCOMP.XML", cAlternateFileName="")) returned 1 [0259.213] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML") returned 1 [0259.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml") returned 0x3e [0259.214] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20dc) returned 0x72e5948 [0259.214] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b4ddf00, ftCreationTime.dwHighDateTime=0x1c5d926, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b4ddf00, ftLastWriteTime.dwHighDateTime=0x1c5d926, nFileSizeHigh=0x0, nFileSizeLow=0x79e6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDREP.DPV", cAlternateFileName="")) returned 1 [0259.214] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV") returned 1 [0259.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv") returned 0x3d [0259.214] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e0) returned 0x72e5948 [0259.214] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef5c1d00, ftCreationTime.dwHighDateTime=0x1c91700, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef5c1d00, ftLastWriteTime.dwHighDateTime=0x1c91700, nFileSizeHigh=0x0, nFileSizeLow=0x1854, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDREP.XML", cAlternateFileName="")) returned 1 [0259.214] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML", len=0x3d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML") returned 1 [0259.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml") returned 0x3d [0259.214] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.214] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.214] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e4) returned 0x72e5948 [0259.214] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f71a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43f71a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x2dd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPULQT98.POC", cAlternateFileName="")) returned 1 [0259.214] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC") returned 1 [0259.214] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc") returned 0x3e [0259.215] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e8) returned 0x72e5948 [0259.215] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43f71a00, ftCreationTime.dwHighDateTime=0x1c4a111, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43f71a00, ftLastWriteTime.dwHighDateTime=0x1c4a111, nFileSizeHigh=0x0, nFileSizeLow=0x31d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSIDBR98.POC", cAlternateFileName="")) returned 1 [0259.215] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC", len=0x3e | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC") returned 1 [0259.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc") returned 0x3e [0259.215] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.215] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20ec) returned 0x72e5948 [0259.215] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb92a100, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0xcb92a100, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="_RESTORE FILES_.txt", cAlternateFileName="_RESTO~1.TXT")) returned 1 [0259.215] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc", psz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\_RESTORE FILES_.txt", len=0x45 | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\_RESTORE FILES_.txt") returned 1 [0259.215] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\_RESTORE FILES_.txt", cchLength=0x45 | out: lpsz="c:\\program files\\microsoft office\\office14\\pubwiz\\_restore files_.txt") returned 0x45 [0259.215] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0259.215] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0259.215] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0259.215] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0259.216] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0259.216] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\") returned 1 [0259.216] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\queries\\") returned 0x33 [0259.216] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0259.216] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0259.216] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0261.131] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.131] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49110e00, ftCreationTime.dwHighDateTime=0x1bf97c1, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49110e00, ftLastWriteTime.dwHighDateTime=0x1bf97c1, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Currency Rates.iqy", cAlternateFileName="MSNMON~1.IQY")) returned 1 [0261.131] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy", len=0x5f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy") returned 1 [0261.131] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Currency Rates.iqy", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy") returned 0x5f [0261.131] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0261.132] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa5ff110, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0261.132] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0261.132] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\queries\\_restore files_.txt"), bFailIfExists=0) returned 1 [0261.135] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x205c) returned 0x72e5948 [0261.135] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ce00, ftCreationTime.dwHighDateTime=0x1c2d8b4, ftLastAccessTime.dwLowDateTime=0xfa625270, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9aa4ce00, ftLastWriteTime.dwHighDateTime=0x1c2d8b4, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Major Indicies.iqy", cAlternateFileName="MSNMON~2.IQY")) returned 1 [0261.135] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor currency rates.iqy", psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy", len=0x5f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy") returned 1 [0261.135] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Major Indicies.iqy", cchLength=0x5f | out: lpsz="c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy") returned 0x5f [0261.135] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0261.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2060) returned 0x72e5948 [0261.136] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa56b6d00, ftCreationTime.dwHighDateTime=0x1bf1150, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa56b6d00, ftLastWriteTime.dwHighDateTime=0x1bf1150, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN MoneyCentral Investor Stock Quotes.iqy", cAlternateFileName="MSNMON~3.IQY")) returned 1 [0261.136] SysReAllocStringLen (in: pbstr=0x6a0ee10*="c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor major indicies.iqy", psz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy", len=0x5d | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy") returned 1 [0261.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES\\MSN MoneyCentral Investor Stock Quotes.iqy", cchLength=0x5d | out: lpsz="c:\\program files\\microsoft office\\office14\\queries\\msn moneycentral investor stock quotes.iqy") returned 0x5d [0261.136] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0261.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.136] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2064) returned 0x72e5948 [0261.136] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0261.136] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0261.136] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0261.136] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\pubtrap.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL") returned 1 [0261.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\RECALL.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\recall.dll") returned 0x35 [0261.136] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.136] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.136] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xa958, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFEDIT.DLL", cAlternateFileName="")) returned 1 [0261.136] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\recall.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL") returned 1 [0261.136] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\REFEDIT.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\refedit.dll") returned 0x36 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.137] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1a900, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMINDER.WAV", cAlternateFileName="")) returned 1 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\refedit.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV") returned 1 [0261.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\reminder.wav") returned 0x37 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.137] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0261.137] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66038c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38588, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.DLL", cAlternateFileName="")) returned 1 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\reminder.wav", psz="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL") returned 1 [0261.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\REPORT.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\report.dll") returned 0x35 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.137] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="REVERSE.DLL", cAlternateFileName="")) returned 1 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\report.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL") returned 1 [0261.137] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\REVERSE.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\reverse.dll") returned 0x36 [0261.137] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.137] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.137] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b753100, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b753100, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x353f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWOP.ICM", cAlternateFileName="")) returned 1 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\reverse.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM") returned 1 [0261.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\rswop.icm") returned 0x34 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.138] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0261.138] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x8f770, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTFHTML.DLL", cAlternateFileName="")) returned 1 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\rswop.icm", psz="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL") returned 1 [0261.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\RTFHTML.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\rtfhtml.dll") returned 0x36 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.138] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe412d900, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe412d900, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x49580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAEXT.DLL", cAlternateFileName="")) returned 1 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\rtfhtml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL") returned 1 [0261.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAEXT.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\saext.dll") returned 0x34 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.138] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.138] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAMPLES", cAlternateFileName="")) returned 1 [0261.138] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\") returned 1 [0261.138] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\samples\\") returned 0x33 [0261.139] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0261.139] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0261.139] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0261.139] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0261.139] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc114b600, ftCreationTime.dwHighDateTime=0x1c307de, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc114b600, ftLastWriteTime.dwHighDateTime=0x1c307de, nFileSizeHigh=0x0, nFileSizeLow=0x1d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVSAMP.XLS", cAlternateFileName="")) returned 1 [0261.139] SysReAllocStringLen (in: pbstr=0x6a0ee10*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS", len=0x3f | out: pbstr=0x6a0ee10*="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS") returned 1 [0261.139] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\SOLVSAMP.XLS", cchLength=0x3f | out: lpsz="c:\\program files\\microsoft office\\office14\\samples\\solvsamp.xls") returned 0x3f [0261.139] SysReAllocStringLen (in: pbstr=0x6a0edb0*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0edb0*="_RESTORE FILES_.txt") returned 1 [0261.139] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0eb1c | out: lpFindFileData=0x6a0eb1c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0xfa671530, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b9730 [0261.140] FindClose (in: hFindFile=0x5b9730 | out: hFindFile=0x5b9730) returned 1 [0261.140] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\samples\\_restore files_.txt"), bFailIfExists=0) returned 1 [0261.142] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2070) returned 0x72e5948 [0261.142] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0261.142] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0261.142] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0261.142] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\saext.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL") returned 1 [0261.142] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAVASWEB.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\savasweb.dll") returned 0x37 [0261.142] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.142] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.142] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd664fb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x27ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBHF.DLL", cAlternateFileName="")) returned 1 [0261.143] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\savasweb.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL") returned 1 [0261.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBHF.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\savwbhf.dll") returned 0x36 [0261.143] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.143] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x40f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBRAS.DLL", cAlternateFileName="")) returned 1 [0261.143] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\savwbhf.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL") returned 1 [0261.143] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBRAS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\savwbras.dll") returned 0x37 [0261.143] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0261.143] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0261.143] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3df88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBVML.DLL", cAlternateFileName="")) returned 1 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\savwbras.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL") returned 1 [0262.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBVML.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\savwbvml.dll") returned 0x37 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.877] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.877] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd670e260, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29388, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBXAML.DLL", cAlternateFileName="SAVWBX~1.DLL")) returned 1 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\savwbvml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL", len=0x38 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL") returned 1 [0262.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SAVWBXAML.DLL", cchLength=0x38 | out: lpsz="c:\\program files\\microsoft office\\office14\\savwbxaml.dll") returned 0x38 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.877] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.877] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xb7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCANPST.EXE", cAlternateFileName="")) returned 1 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\savwbxaml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE") returned 1 [0262.877] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SCANPST.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\scanpst.exe") returned 0x36 [0262.877] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.877] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.877] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST32.DLL", cAlternateFileName="")) returned 1 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\scanpst.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL") returned 1 [0262.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST32.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\scnpst32.dll") returned 0x37 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.878] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.878] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST64.DLL", cAlternateFileName="")) returned 1 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\scnpst32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL") returned 1 [0262.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SCNPST64.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\scnpst64.dll") returned 0x37 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.878] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.878] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1e8f00, ftCreationTime.dwHighDateTime=0x1c74a41, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf1e8f00, ftLastWriteTime.dwHighDateTime=0x1c74a41, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SegoeChess.ttf", cAlternateFileName="SEGOEC~1.TTF")) returned 1 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\scnpst64.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf", len=0x39 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf") returned 1 [0262.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\segoechess.ttf") returned 0x39 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.878] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.878] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x205c) returned 0x72e5948 [0262.878] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7d4f800, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdd891b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf7d4f800, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x94590, dwReserved0=0x0, dwReserved1=0x0, cFileName="SELFCERT.EXE", cAlternateFileName="")) returned 1 [0262.878] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\segoechess.ttf", psz="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE") returned 1 [0262.878] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SELFCERT.EXE", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\selfcert.exe") returned 0x37 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.879] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6970, dwReserved0=0x0, dwReserved1=0x0, cFileName="SENDTO.DLL", cAlternateFileName="")) returned 1 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\selfcert.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL") returned 1 [0262.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SENDTO.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\sendto.dll") returned 0x35 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.879] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45887700, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45887700, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEQCHK10.DLL", cAlternateFileName="")) returned 1 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\sendto.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL") returned 1 [0262.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SEQCHK10.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\seqchk10.dll") returned 0x37 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.879] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.EXE", cAlternateFileName="")) returned 1 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\seqchk10.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE") returned 1 [0262.879] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SETLANG.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\setlang.exe") returned 0x36 [0262.879] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.879] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.880] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0af6f40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x222b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SG.DLL", cAlternateFileName="")) returned 1 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\setlang.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL", len=0x31 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL") returned 1 [0262.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL", cchLength=0x31 | out: lpsz="c:\\program files\\microsoft office\\office14\\sg.dll") returned 0x31 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.880] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67343c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x52b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.DLL", cAlternateFileName="")) returned 1 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\sg.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL") returned 1 [0262.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SHAPNUM.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\shapnum.dll") returned 0x36 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.880] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x46f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAREPOINTPROVIDER.DLL", cAlternateFileName="SHAREP~1.DLL")) returned 1 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\shapnum.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL", len=0x41 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL") returned 1 [0262.880] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SHAREPOINTPROVIDER.DLL", cchLength=0x41 | out: lpsz="c:\\program files\\microsoft office\\office14\\sharepointprovider.dll") returned 0x41 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.880] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.880] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a0f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd84a0f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchPadTestSchema.xml", cAlternateFileName="SKETCH~1.XML")) returned 1 [0262.880] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\sharepointprovider.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", len=0x42 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml") returned 1 [0262.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml", cchLength=0x42 | out: lpsz="c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml") returned 0x42 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2060) returned 0x72e5948 [0262.881] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861bf100, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x861bf100, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x80fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\sketchpadtestschema.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML") returned 1 [0262.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\slerror.xml") returned 0x36 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.881] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2064) returned 0x72e5948 [0262.881] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebbec00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x84cd39e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebbec00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x37d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.DLL", cAlternateFileName="")) returned 1 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\slerror.xml", psz="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL") returned 1 [0262.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SMIGRATE.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\smigrate.dll") returned 0x37 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.881] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.881] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0xa8b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOA.DLL", cAlternateFileName="")) returned 1 [0262.881] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\smigrate.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL") returned 1 [0262.881] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SOA.DLL", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\soa.dll") returned 0x32 [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.882] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x264780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALCONNECTOR.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\soa.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL") returned 1 [0262.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\socialconnector.dll") returned 0x3e [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.882] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66555a00, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66555a00, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x8fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALPROVIDER.DLL", cAlternateFileName="SOCIAL~2.DLL")) returned 1 [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\socialconnector.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL", len=0x3d | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL") returned 1 [0262.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALPROVIDER.DLL", cchLength=0x3d | out: lpsz="c:\\program files\\microsoft office\\office14\\socialprovider.dll") returned 0x3d [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.882] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd675a520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x57f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLUTILS.DLL", cAlternateFileName="")) returned 1 [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\socialprovider.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL") returned 1 [0262.882] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SOLUTILS.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\solutils.dll") returned 0x37 [0262.882] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.882] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.883] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11e7f00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd11e7f00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x597e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPANISH.LNG", cAlternateFileName="")) returned 1 [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\solutils.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG") returned 1 [0262.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\spanish.lng") returned 0x36 [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.883] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2068) returned 0x72e5948 [0262.883] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd718e200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd718e200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\spanish.lng", psz="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp") returned 1 [0262.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\splashscreen.bmp") returned 0x3b [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.883] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.883] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0262.883] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6780680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLSHARE.DLL", cAlternateFileName="")) returned 1 [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\splashscreen.bmp", psz="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL") returned 1 [0262.883] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SQLSHARE.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\sqlshare.dll") returned 0x37 [0262.883] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.883] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.883] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef96c00, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaef96c00, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0x24748, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGEN.DLL", cAlternateFileName="")) returned 1 [0262.884] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\sqlshare.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL") returned 1 [0262.884] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SSGEN.DLL", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\ssgen.dll") returned 0x34 [0262.884] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.884] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.884] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0262.884] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", len=0x33 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\") returned 1 [0262.884] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\", cchLength=0x33 | out: lpsz="c:\\program files\\microsoft office\\office14\\startup\\") returned 0x33 [0262.884] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0262.884] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0262.884] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0262.906] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.907] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0 [0262.907] FindClose (in: hFindFile=0x5b9630 | out: hFindFile=0x5b9630) returned 1 [0262.907] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\ssgen.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL") returned 1 [0262.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\stslist.dll") returned 0x36 [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.907] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67a67e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x20588, dwReserved0=0x0, dwReserved1=0x0, cFileName="STYLEMGR.DLL", cAlternateFileName="")) returned 1 [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\stslist.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL") returned 1 [0262.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\STYLEMGR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\stylemgr.dll") returned 0x37 [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.907] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.907] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ca3000, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x694b6370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12ca3000, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x15f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="subscription.xsd", cAlternateFileName="SUBSCR~1.XSD")) returned 1 [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\stylemgr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd", len=0x3b | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd") returned 1 [0262.907] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd", cchLength=0x3b | out: lpsz="c:\\program files\\microsoft office\\office14\\subscription.xsd") returned 0x3b [0262.907] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x206c) returned 0x72e5948 [0262.908] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xef98, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMINFO.DLL", cAlternateFileName="")) returned 1 [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\subscription.xsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL") returned 1 [0262.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\SUMINFO.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\suminfo.dll") returned 0x36 [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.908] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f200, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a54f200, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d360, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaxonomyControl.dll", cAlternateFileName="TAXONO~1.DLL")) returned 1 [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\suminfo.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll", len=0x3e | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll") returned 1 [0262.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TaxonomyControl.dll", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\taxonomycontrol.dll") returned 0x3e [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.908] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb7df00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5ad5e950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb7df00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x46c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCR.PSP", cAlternateFileName="")) returned 1 [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\taxonomycontrol.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP", len=0x34 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP") returned 1 [0262.908] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP", cchLength=0x34 | out: lpsz="c:\\program files\\microsoft office\\office14\\thocr.psp") returned 0x34 [0262.908] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.908] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.908] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2070) returned 0x72e5948 [0262.909] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe33c4660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x8958, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCRAPI.DLL", cAlternateFileName="")) returned 1 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\thocr.psp", psz="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL") returned 1 [0262.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\THOCRAPI.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\thocrapi.dll") returned 0x37 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.909] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0b43200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x195780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.DLL", cAlternateFileName="")) returned 1 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\thocrapi.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL") returned 1 [0262.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\timesoln.dll") returned 0x37 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.909] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14380, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLIMPT.EXE", cAlternateFileName="")) returned 1 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\timesoln.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE") returned 1 [0262.909] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TLIMPT.EXE", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\tlimpt.exe") returned 0x35 [0262.909] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.909] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.909] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe3410920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x28b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTCHR.DLL", cAlternateFileName="")) returned 1 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\tlimpt.exe", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL") returned 1 [0262.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTCHR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\twcutchr.dll") returned 0x37 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.910] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1cd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTLIN.DLL", cAlternateFileName="")) returned 1 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twcutchr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL") returned 1 [0262.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWCUTLIN.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\twcutlin.dll") returned 0x37 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.910] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x12378, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWLAY32.DLL", cAlternateFileName="")) returned 1 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twcutlin.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL") returned 1 [0262.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWLAY32.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\twlay32.dll") returned 0x36 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.910] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.910] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x6d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWORIENT.DLL", cAlternateFileName="")) returned 1 [0262.910] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twlay32.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL") returned 1 [0262.910] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWORIENT.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\tworient.dll") returned 0x37 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.911] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECC.DLL", cAlternateFileName="")) returned 1 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\tworient.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL") returned 1 [0262.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECC.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\twrecc.dll") returned 0x35 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.911] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECE.DLL", cAlternateFileName="")) returned 1 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twrecc.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL") returned 1 [0262.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECE.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\twrece.dll") returned 0x35 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.911] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECS.DLL", cAlternateFileName="")) returned 1 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twrece.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL") returned 1 [0262.911] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWRECS.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\twrecs.dll") returned 0x35 [0262.911] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.911] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.911] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1e798, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWSTRUCT.DLL", cAlternateFileName="")) returned 1 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twrecs.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL") returned 1 [0262.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\TWSTRUCT.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\twstruct.dll") returned 0x37 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.912] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0c4dba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x273970, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.DLL", cAlternateFileName="")) returned 1 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\twstruct.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL", len=0x32 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL") returned 1 [0262.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL", cchLength=0x32 | out: lpsz="c:\\program files\\microsoft office\\office14\\uml.dll") returned 0x32 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.912] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc5750, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLSYS.DLL", cAlternateFileName="")) returned 1 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\uml.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL") returned 1 [0262.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\UMLSYS.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\umlsys.dll") returned 0x35 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.912] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.912] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5b8400, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xdd86ba20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3f5b8400, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xa8390, dwReserved0=0x0, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0262.912] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\umlsys.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL") returned 1 [0262.912] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\URLREDIR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\urlredir.dll") returned 0x37 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.913] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6b388e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1f570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VAOSOLX.DLL", cAlternateFileName="")) returned 1 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\urlredir.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL") returned 1 [0262.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VAOSOLX.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\vaosolx.dll") returned 0x36 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.913] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x22dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0007.TLL", cAlternateFileName="")) returned 1 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vaosolx.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL") returned 1 [0262.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vblz0007.tll") returned 0x37 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.913] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2074) returned 0x72e5948 [0262.913] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0009.TLL", cAlternateFileName="")) returned 1 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vblz0007.tll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL") returned 1 [0262.913] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vblz0009.tll") returned 0x37 [0262.913] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.913] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.914] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2078) returned 0x72e5948 [0262.914] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x29bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ000C.TLL", cAlternateFileName="")) returned 1 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vblz0009.tll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL") returned 1 [0262.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vblz000c.tll") returned 0x37 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.914] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x207c) returned 0x72e5948 [0262.914] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0011.TLL", cAlternateFileName="")) returned 1 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vblz000c.tll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL") returned 1 [0262.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vblz0011.tll") returned 0x37 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.914] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2080) returned 0x72e5948 [0262.914] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2EXCL.XSL", cAlternateFileName="")) returned 1 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vblz0011.tll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL") returned 1 [0262.914] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vbs2excl.xsl") returned 0x37 [0262.914] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.914] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.915] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2084) returned 0x72e5948 [0262.915] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x189d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2WORD.XSL", cAlternateFileName="")) returned 1 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vbs2excl.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL") returned 1 [0262.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\vbs2word.xsl") returned 0x37 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.915] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.915] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2088) returned 0x72e5948 [0262.915] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6bf6fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x24380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VERBWIND.DLL", cAlternateFileName="")) returned 1 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\vbs2word.xsl", psz="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL") returned 1 [0262.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VERBWIND.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\verbwind.dll") returned 0x37 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.915] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.915] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x22558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEWMODL.DLL", cAlternateFileName="")) returned 1 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\verbwind.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL") returned 1 [0262.915] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VIEWMODL.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\viewmodl.dll") returned 0x37 [0262.915] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.915] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.915] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50bfc800, ftCreationTime.dwHighDateTime=0x1cbb888, ftLastAccessTime.dwLowDateTime=0xd102bf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50bfc800, ftLastWriteTime.dwHighDateTime=0x1cbb888, nFileSizeHigh=0x0, nFileSizeLow=0xefa180, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRGR.DLL", cAlternateFileName="")) returned 1 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\viewmodl.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL") returned 1 [0262.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\visbrgr.dll") returned 0x36 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.916] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.916] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd10520c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x4b370, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.DLL", cAlternateFileName="")) returned 1 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\visbrgr.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL", len=0x37 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL") returned 1 [0262.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VISCOLOR.DLL", cchLength=0x37 | out: lpsz="c:\\program files\\microsoft office\\office14\\viscolor.dll") returned 0x37 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.916] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.916] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd109e380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x38560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISDLGU.DLL", cAlternateFileName="")) returned 1 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\viscolor.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL") returned 1 [0262.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VISDLGU.DLL", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\visdlgu.dll") returned 0x36 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.916] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.916] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c480800, ftCreationTime.dwHighDateTime=0x1cba5d6, ftLastAccessTime.dwLowDateTime=0xd11107a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5c480800, ftLastWriteTime.dwHighDateTime=0x1cba5d6, nFileSizeHigh=0x0, nFileSizeLow=0xd5760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISGRF.DLL", cAlternateFileName="")) returned 1 [0262.916] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\visdlgu.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL", len=0x35 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL") returned 1 [0262.916] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VISGRF.DLL", cchLength=0x35 | out: lpsz="c:\\program files\\microsoft office\\office14\\visgrf.dll") returned 0x35 [0262.917] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.917] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.917] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2284b00, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd115ca60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf2284b00, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x11bd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISICON.EXE", cAlternateFileName="")) returned 1 [0262.917] SysReAllocStringLen (in: pbstr=0x6a0f0d8*="c:\\program files\\microsoft office\\office14\\visgrf.dll", psz="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE", len=0x36 | out: pbstr=0x6a0f0d8*="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE") returned 1 [0262.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\VISICON.EXE", cchLength=0x36 | out: lpsz="c:\\program files\\microsoft office\\office14\\visicon.exe") returned 0x36 [0262.917] SysReAllocStringLen (in: pbstr=0x6a0f078*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0f078*="_RESTORE FILES_.txt") returned 1 [0262.917] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.917] FindNextFileW (in: hFindFile=0x5b9670, lpFindFileData=0x6a0f0e4 | out: lpFindFileData=0x6a0f0e4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Content", cAlternateFileName="VISIOC~1")) returned 1 [0262.917] SysReAllocStringLen (in: pbstr=0x6a0ee18*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", len=0x39 | out: pbstr=0x6a0ee18*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\") returned 1 [0262.917] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\", cchLength=0x39 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\") returned 0x39 [0262.917] SysReAllocStringLen (in: pbstr=0x6a0edc0*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0edc0*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0262.917] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0262.917] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\*.*", lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9630 [0262.918] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.918] FindNextFileW (in: hFindFile=0x5b9630, lpFindFileData=0x6a0ee1c | out: lpFindFileData=0x6a0ee1c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0262.918] SysReAllocStringLen (in: pbstr=0x6a0eb50*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", len=0x3e | out: pbstr=0x6a0eb50*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\") returned 1 [0262.918] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\", cchLength=0x3e | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\") returned 0x3e [0262.918] SysReAllocStringLen (in: pbstr=0x6a0eaf8*=0x0, psz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", len=0x26 | out: pbstr=0x6a0eaf8*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned 1 [0262.918] CharLowerBuffW (in: lpsz="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", cchLength=0x26 | out: lpsz="c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\") returned 0x26 [0262.918] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\*.*", lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5b9730 [0262.920] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x52203420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52203420, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0262.921] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6e4b00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6e4b00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_M.VST", cAlternateFileName="")) returned 1 [0262.921] SysReAllocStringLen (in: pbstr=0x6a0eb48*=0x0, psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST") returned 1 [0262.921] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_M.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_m.vst") returned 0x4a [0262.921] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0262.921] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0262.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT", lpFindFileData=0x6a0e854 | out: lpFindFileData=0x6a0e854*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58e321c0, ftCreationTime.dwHighDateTime=0x1d536f7, ftLastAccessTime.dwLowDateTime=0x58e321c0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x58e58320, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x504da6a0, cFileName="RWQPVNTDBOCP8XPUT", cAlternateFileName="RWQPVN~1")) returned 0x5b96f0 [0262.921] FindClose (in: hFindFile=0x5b96f0 | out: hFindFile=0x5b96f0) returned 1 [0262.922] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RWQPVNTDBOCP8XPUT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rwqpvntdbocp8xput"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\_RESTORE FILES_.txt" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\_restore files_.txt"), bFailIfExists=0) returned 1 [0263.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x208c) returned 0x72e5948 [0263.410] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2101d200, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50526960, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2101d200, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTDIR_U.VST", cAlternateFileName="")) returned 1 [0263.410] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_U.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_U.VST") returned 1 [0263.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ACTDIR_U.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_u.vst") returned 0x4a [0263.410] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.410] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.410] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2090) returned 0x72e5948 [0263.410] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf591600, ftCreationTime.dwHighDateTime=0x1ca4725, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdf591600, ftLastWriteTime.dwHighDateTime=0x1ca4725, nFileSizeHigh=0x0, nFileSizeLow=0x5bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO_M.VSS", cAlternateFileName="")) returned 1 [0263.410] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\actdir_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_M.VSS", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_M.VSS") returned 1 [0263.410] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_M.VSS", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_m.vss") returned 0x47 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2094) returned 0x72e5948 [0263.411] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ce4000, ftCreationTime.dwHighDateTime=0x1ca4725, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf4ce4000, ftLastWriteTime.dwHighDateTime=0x1ca4725, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO_U.VSS", cAlternateFileName="")) returned 1 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_U.VSS", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_U.VSS") returned 1 [0263.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADO_U.VSS", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_u.vss") returned 0x47 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2098) returned 0x72e5948 [0263.411] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf54e00, ftCreationTime.dwHighDateTime=0x1ca4725, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfbf54e00, ftLastWriteTime.dwHighDateTime=0x1ca4725, nFileSizeHigh=0x0, nFileSizeLow=0x21200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADS_M.VSS", cAlternateFileName="")) returned 1 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ado_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_M.VSS", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_M.VSS") returned 1 [0263.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_M.VSS", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_m.vss") returned 0x47 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.411] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.411] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x209c) returned 0x72e5948 [0263.411] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31c5c00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x31c5c00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x20600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADS_U.VSS", cAlternateFileName="")) returned 1 [0263.411] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_U.VSS", len=0x47 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_U.VSS") returned 1 [0263.411] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ADS_U.VSS", cchLength=0x47 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_u.vss") returned 0x47 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.412] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a0) returned 0x72e5948 [0263.412] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9123d00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9123d00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x16800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM_M.VSS", cAlternateFileName="")) returned 1 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\ads_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_M.VSS") returned 1 [0263.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_m.vss") returned 0x49 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.412] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a4) returned 0x72e5948 [0263.412] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10394b00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x10394b00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x16400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALARM_U.VSS", cAlternateFileName="")) returned 1 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_U.VSS") returned 1 [0263.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ALARM_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_u.vss") returned 0x49 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.412] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.412] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20a8) returned 0x72e5948 [0263.412] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19c2b300, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x19c2b300, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x2c200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANNOT_M.VSS", cAlternateFileName="")) returned 1 [0263.412] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\alarm_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_M.VSS") returned 1 [0263.412] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_m.vss") returned 0x49 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20ac) returned 0x72e5948 [0263.413] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x221aee00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x221aee00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x26800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANNOT_U.VSS", cAlternateFileName="")) returned 1 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_U.VSS") returned 1 [0263.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ANNOT_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_u.vss") returned 0x49 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b0) returned 0x72e5948 [0263.413] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30690a00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x30690a00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x1f600, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPL_M.VSS", cAlternateFileName="")) returned 1 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\annot_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_M.VSS", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_M.VSS") returned 1 [0263.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_M.VSS", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_m.vss") returned 0x48 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.413] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.413] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b4) returned 0x72e5948 [0263.413] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe85300, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3fe85300, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x20a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="APPL_U.VSS", cAlternateFileName="")) returned 1 [0263.413] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_U.VSS", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_U.VSS") returned 1 [0263.413] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\APPL_U.VSS", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_u.vss") returned 0x48 [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20b8) returned 0x72e5948 [0263.414] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424aad00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x424aad00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARROWS_M.VSS", cAlternateFileName="")) returned 1 [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\appl_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS") returned 1 [0263.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss") returned 0x4a [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20bc) returned 0x72e5948 [0263.414] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x437bda00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50572c20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x437bda00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARROWS_U.VSS", cAlternateFileName="")) returned 1 [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS") returned 1 [0263.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss") returned 0x4a [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.414] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.414] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c0) returned 0x72e5948 [0263.414] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecea600, ftCreationTime.dwHighDateTime=0x1ca1c68, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9ecea600, ftLastWriteTime.dwHighDateTime=0x1ca1c68, nFileSizeHigh=0x0, nFileSizeLow=0x4200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASTMGT.XLS", cAlternateFileName="")) returned 1 [0263.414] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS") returned 1 [0263.414] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls") returned 0x48 [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.415] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c4) returned 0x72e5948 [0263.415] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x408bd200, ftCreationTime.dwHighDateTime=0x1ca5b8a, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x408bd200, ftLastWriteTime.dwHighDateTime=0x1ca5b8a, nFileSizeHigh=0x0, nFileSizeLow=0x120000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASTMGT_M.VST", cAlternateFileName="")) returned 1 [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST") returned 1 [0263.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst") returned 0x4a [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.415] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20c8) returned 0x72e5948 [0263.415] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d13d00, ftCreationTime.dwHighDateTime=0x1ca5b8a, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d13d00, ftLastWriteTime.dwHighDateTime=0x1ca5b8a, nFileSizeHigh=0x0, nFileSizeLow=0x11c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASTMGT_U.VST", cAlternateFileName="")) returned 1 [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST") returned 1 [0263.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst") returned 0x4a [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.415] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.415] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20cc) returned 0x72e5948 [0263.415] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d054200, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4d054200, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x26c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIT_M.VSS", cAlternateFileName="")) returned 1 [0263.415] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VSS") returned 1 [0263.415] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vss") returned 0x49 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.416] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d0) returned 0x72e5948 [0263.416] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3414a200, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3414a200, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIT_M.VST", cAlternateFileName="")) returned 1 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VST", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VST") returned 1 [0263.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_M.VST", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vst") returned 0x49 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.416] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d4) returned 0x72e5948 [0263.416] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57bfd700, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57bfd700, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x24800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIT_U.VSS", cAlternateFileName="")) returned 1 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VSS") returned 1 [0263.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vss") returned 0x49 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.416] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.416] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20d8) returned 0x72e5948 [0263.416] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37a82900, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x37a82900, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x6600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIT_U.VST", cAlternateFileName="")) returned 1 [0263.416] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VST", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VST") returned 1 [0263.416] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\AUDIT_U.VST", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vst") returned 0x49 [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.417] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20dc) returned 0x72e5948 [0263.417] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdaa96600, ftCreationTime.dwHighDateTime=0x1ca47e8, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdaa96600, ftLastWriteTime.dwHighDateTime=0x1ca47e8, nFileSizeHigh=0x0, nFileSizeLow=0xfa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASFLO_M.VSS", cAlternateFileName="")) returned 1 [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\audit_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VSS") returned 1 [0263.417] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vss") returned 0x4a [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.417] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e0) returned 0x72e5948 [0263.417] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x481e500, ftCreationTime.dwHighDateTime=0x1ca6bfd, ftLastAccessTime.dwLowDateTime=0x505beee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x481e500, ftLastWriteTime.dwHighDateTime=0x1ca6bfd, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASFLO_M.VST", cAlternateFileName="")) returned 1 [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VST") returned 1 [0263.417] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_M.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vst") returned 0x4a [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.417] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.417] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e4) returned 0x72e5948 [0263.417] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d6b3e00, ftCreationTime.dwHighDateTime=0x1ca47e9, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1d6b3e00, ftLastWriteTime.dwHighDateTime=0x1ca47e9, nFileSizeHigh=0x0, nFileSizeLow=0xf400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASFLO_U.VSS", cAlternateFileName="")) returned 1 [0263.417] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VSS") returned 1 [0263.417] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vss") returned 0x4a [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.418] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20e8) returned 0x72e5948 [0263.418] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa33ec600, ftCreationTime.dwHighDateTime=0x1ca4889, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa33ec600, ftLastWriteTime.dwHighDateTime=0x1ca4889, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASFLO_U.VST", cAlternateFileName="")) returned 1 [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VST") returned 1 [0263.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASFLO_U.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vst") returned 0x4a [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.418] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20ec) returned 0x72e5948 [0263.418] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b3bb000, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3b3bb000, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASICD_M.VST", cAlternateFileName="")) returned 1 [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basflo_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_M.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_M.VST") returned 1 [0263.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_M.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_m.vst") returned 0x4a [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.418] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.418] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20f0) returned 0x72e5948 [0263.418] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9e0a00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d9e0a00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASICD_U.VST", cAlternateFileName="")) returned 1 [0263.418] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_U.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_U.VST") returned 1 [0263.418] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASICD_U.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_u.vst") returned 0x4a [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.419] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20f4) returned 0x72e5948 [0263.419] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68704d00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x68704d00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x18400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC_M.VSS", cAlternateFileName="")) returned 1 [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basicd_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_M.VSS") returned 1 [0263.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_m.vss") returned 0x49 [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.419] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20f8) returned 0x72e5948 [0263.419] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e662e00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6e662e00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC_U.VSS", cAlternateFileName="")) returned 1 [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_U.VSS") returned 1 [0263.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BASIC_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_u.vss") returned 0x49 [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.419] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.419] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x20fc) returned 0x72e5948 [0263.419] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd271e600, ftCreationTime.dwHighDateTime=0x1ca5086, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd271e600, ftLastWriteTime.dwHighDateTime=0x1ca5086, nFileSizeHigh=0x0, nFileSizeLow=0x33400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCKGRN_M.VSS", cAlternateFileName="")) returned 1 [0263.419] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\basic_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_M.VSS") returned 1 [0263.419] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_m.vss") returned 0x4a [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.420] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2100) returned 0x72e5948 [0263.420] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd271e600, ftCreationTime.dwHighDateTime=0x1ca5086, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd271e600, ftLastWriteTime.dwHighDateTime=0x1ca5086, nFileSizeHigh=0x0, nFileSizeLow=0x30600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCKGRN_U.VSS", cAlternateFileName="")) returned 1 [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_U.VSS") returned 1 [0263.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BCKGRN_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_u.vss") returned 0x4a [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.420] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2104) returned 0x72e5948 [0263.420] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e95ed00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e95ed00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x51000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLDCOR_M.VSS", cAlternateFileName="")) returned 1 [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bckgrn_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_M.VSS") returned 1 [0263.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_m.vss") returned 0x4a [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.420] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.420] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2108) returned 0x72e5948 [0263.420] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40b1700, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa40b1700, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x4fc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLDCOR_U.VSS", cAlternateFileName="")) returned 1 [0263.420] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_U.VSS") returned 1 [0263.420] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDCOR_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_u.vss") returned 0x4a [0263.421] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.421] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.421] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x210c) returned 0x72e5948 [0263.421] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa02a100, ftCreationTime.dwHighDateTime=0x1c33f6c, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfa02a100, ftLastWriteTime.dwHighDateTime=0x1c33f6c, nFileSizeHigh=0x0, nFileSizeLow=0x72a6d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLDGPLAN.DWG", cAlternateFileName="")) returned 1 [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldcor_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG") returned 1 [0263.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.DWG", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg") returned 0x4a [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.423] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2110) returned 0x72e5948 [0263.423] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47737900, ftCreationTime.dwHighDateTime=0x1c2ef4f, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47737900, ftLastWriteTime.dwHighDateTime=0x1c2ef4f, nFileSizeHigh=0x0, nFileSizeLow=0xd9ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLDGPLAN.JPG", cAlternateFileName="")) returned 1 [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.dwg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG") returned 1 [0263.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLDGPLAN.JPG", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg") returned 0x4a [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.423] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2114) returned 0x72e5948 [0263.423] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c5b200, ftCreationTime.dwHighDateTime=0x1c90742, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x82c5b200, ftLastWriteTime.dwHighDateTime=0x1c90742, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLNKDG_M.VSD", cAlternateFileName="")) returned 1 [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bldgplan.jpg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD") returned 1 [0263.423] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_M.VSD", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd") returned 0x4a [0263.423] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.423] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.423] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2118) returned 0x72e5948 [0263.424] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4269e00, ftCreationTime.dwHighDateTime=0x1c90742, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4269e00, ftLastWriteTime.dwHighDateTime=0x1c90742, nFileSizeHigh=0x0, nFileSizeLow=0x3e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLNKDG_U.VSD", cAlternateFileName="")) returned 1 [0263.424] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_m.vsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD") returned 1 [0263.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLNKDG_U.VSD", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd") returned 0x4a [0263.424] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.424] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x211c) returned 0x72e5948 [0263.424] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab322500, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xab322500, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x21a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK3_M.VSS", cAlternateFileName="")) returned 1 [0263.424] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blnkdg_u.vsd", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_M.VSS") returned 1 [0263.424] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_m.vss") returned 0x4a [0263.424] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.424] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.424] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2120) returned 0x72e5948 [0263.426] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbe29b00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbbe29b00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x20200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK3_U.VSS", cAlternateFileName="")) returned 1 [0263.426] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_U.VSS") returned 1 [0263.426] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK3_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_u.vss") returned 0x4a [0263.426] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.426] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.426] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2124) returned 0x72e5948 [0263.426] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc43ad600, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc43ad600, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x2e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCKP_M.VSS", cAlternateFileName="")) returned 1 [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block3_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VSS") returned 1 [0263.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vss") returned 0x4a [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2128) returned 0x72e5948 [0263.427] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41319100, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x41319100, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x5e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCKP_M.VST", cAlternateFileName="")) returned 1 [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VST") returned 1 [0263.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_M.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vst") returned 0x4a [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x212c) returned 0x72e5948 [0263.427] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdc43e00, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x50631300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcdc43e00, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x2b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCKP_U.VSS", cAlternateFileName="")) returned 1 [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VSS") returned 1 [0263.427] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vss") returned 0x4a [0263.427] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.427] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.427] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2130) returned 0x72e5948 [0263.427] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4393eb00, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x50631300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4393eb00, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x5c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCKP_U.VST", cAlternateFileName="")) returned 1 [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VST", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VST") returned 1 [0263.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKP_U.VST", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vst") returned 0x4a [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2134) returned 0x72e5948 [0263.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21f71500, ftCreationTime.dwHighDateTime=0x1c635ed, ftLastAccessTime.dwLowDateTime=0x50631300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21f71500, ftLastWriteTime.dwHighDateTime=0x1c635ed, nFileSizeHigh=0x0, nFileSizeLow=0xf1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCKS.DWG", cAlternateFileName="")) returned 1 [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blockp_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG") returned 1 [0263.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCKS.DWG", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg") returned 0x48 [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2138) returned 0x72e5948 [0263.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd61c7900, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd61c7900, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK_M.VSS", cAlternateFileName="")) returned 1 [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\blocks.dwg", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VSS") returned 1 [0263.428] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vss") returned 0x49 [0263.428] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.428] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.428] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x213c) returned 0x72e5948 [0263.428] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47277200, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x47277200, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK_M.VST", cAlternateFileName="")) returned 1 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VST", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VST") returned 1 [0263.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_M.VST", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vst") returned 0x49 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2140) returned 0x72e5948 [0263.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde74b400, ftCreationTime.dwHighDateTime=0x1ca4726, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xde74b400, ftLastWriteTime.dwHighDateTime=0x1ca4726, nFileSizeHigh=0x0, nFileSizeLow=0x21c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK_U.VSS", cAlternateFileName="")) returned 1 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VSS") returned 1 [0263.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vss") returned 0x49 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2144) returned 0x72e5948 [0263.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4abaf900, ftCreationTime.dwHighDateTime=0x1ca4888, ftLastAccessTime.dwLowDateTime=0x5060b1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4abaf900, ftLastWriteTime.dwHighDateTime=0x1ca4888, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BLOCK_U.VST", cAlternateFileName="")) returned 1 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VST", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VST") returned 1 [0263.429] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BLOCK_U.VST", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vst") returned 0x49 [0263.429] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.429] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.429] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2148) returned 0x72e5948 [0263.429] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b0dc600, ftCreationTime.dwHighDateTime=0x1ca5e7e, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5b0dc600, ftLastWriteTime.dwHighDateTime=0x1ca5e7e, nFileSizeHigh=0x0, nFileSizeLow=0x21c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDRS_M.VSS", cAlternateFileName="")) returned 1 [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\block_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_M.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_M.VSS") returned 1 [0263.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_M.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_m.vss") returned 0x4a [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x214c) returned 0x72e5948 [0263.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b0dc600, ftCreationTime.dwHighDateTime=0x1ca5e7e, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5b0dc600, ftLastWriteTime.dwHighDateTime=0x1ca5e7e, nFileSizeHigh=0x0, nFileSizeLow=0x21a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDRS_U.VSS", cAlternateFileName="")) returned 1 [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_U.VSS", len=0x4a | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_U.VSS") returned 1 [0263.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BORDRS_U.VSS", cchLength=0x4a | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_u.vss") returned 0x4a [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2150) returned 0x72e5948 [0263.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f0d8600, ftCreationTime.dwHighDateTime=0x1ca4e35, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4f0d8600, ftLastWriteTime.dwHighDateTime=0x1ca4e35, nFileSizeHigh=0x0, nFileSizeLow=0x8ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNA_M.VSS", cAlternateFileName="")) returned 1 [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bordrs_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_M.VSS") returned 1 [0263.430] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_m.vss") returned 0x49 [0263.430] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.430] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.430] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2154) returned 0x72e5948 [0263.430] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89772300, ftCreationTime.dwHighDateTime=0x1ca4e35, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x89772300, ftLastWriteTime.dwHighDateTime=0x1ca4e35, nFileSizeHigh=0x0, nFileSizeLow=0x8da00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNA_U.VSS", cAlternateFileName="")) returned 1 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_U.VSS") returned 1 [0263.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNA_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_u.vss") returned 0x49 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2158) returned 0x72e5948 [0263.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fb46700, ftCreationTime.dwHighDateTime=0x1ca4727, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4fb46700, ftLastWriteTime.dwHighDateTime=0x1ca4727, nFileSizeHigh=0x0, nFileSizeLow=0xe800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNC_M.VSS", cAlternateFileName="")) returned 1 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmna_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_M.VSS") returned 1 [0263.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_m.vss") returned 0x49 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x215c) returned 0x72e5948 [0263.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54791b00, ftCreationTime.dwHighDateTime=0x1ca4727, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x54791b00, ftLastWriteTime.dwHighDateTime=0x1ca4727, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNC_U.VSS", cAlternateFileName="")) returned 1 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_U.VSS") returned 1 [0263.431] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNC_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_u.vss") returned 0x49 [0263.431] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.431] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.431] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2160) returned 0x72e5948 [0263.431] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd609300, ftCreationTime.dwHighDateTime=0x1ca4727, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbd609300, ftLastWriteTime.dwHighDateTime=0x1ca4727, nFileSizeHigh=0x0, nFileSizeLow=0xb2a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNE_M.VSS", cAlternateFileName="")) returned 1 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmnc_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_M.VSS") returned 1 [0263.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_m.vss") returned 0x49 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2164) returned 0x72e5948 [0263.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6990300, ftCreationTime.dwHighDateTime=0x1ca4727, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6990300, ftLastWriteTime.dwHighDateTime=0x1ca4727, nFileSizeHigh=0x0, nFileSizeLow=0xb0600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNE_U.VSS", cAlternateFileName="")) returned 1 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_U.VSS") returned 1 [0263.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNE_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_u.vss") returned 0x49 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2168) returned 0x72e5948 [0263.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eec4d00, ftCreationTime.dwHighDateTime=0x1ca4e35, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9eec4d00, ftLastWriteTime.dwHighDateTime=0x1ca4e35, nFileSizeHigh=0x0, nFileSizeLow=0x1a800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNG_M.VSS", cAlternateFileName="")) returned 1 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmne_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_M.VSS") returned 1 [0263.432] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_m.vss") returned 0x49 [0263.432] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.432] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.432] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x216c) returned 0x72e5948 [0263.432] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaad80f00, ftCreationTime.dwHighDateTime=0x1ca4e35, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xaad80f00, ftLastWriteTime.dwHighDateTime=0x1ca4e35, nFileSizeHigh=0x0, nFileSizeLow=0x1a200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMNG_U.VSS", cAlternateFileName="")) returned 1 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_U.VSS") returned 1 [0263.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMNG_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_u.vss") returned 0x49 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2170) returned 0x72e5948 [0263.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6188000, ftCreationTime.dwHighDateTime=0x1ca5d07, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe6188000, ftLastWriteTime.dwHighDateTime=0x1ca5d07, nFileSizeHigh=0x0, nFileSizeLow=0x4d200, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMN_M.VSS", cAlternateFileName="")) returned 1 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmng_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VSS", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VSS") returned 1 [0263.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VSS", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vss") returned 0x48 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2174) returned 0x72e5948 [0263.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57f43300, ftCreationTime.dwHighDateTime=0x1ca6bfd, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57f43300, ftLastWriteTime.dwHighDateTime=0x1ca6bfd, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMN_M.VST", cAlternateFileName="")) returned 1 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VST", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VST") returned 1 [0263.433] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_M.VST", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vst") returned 0x48 [0263.433] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.433] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.433] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2178) returned 0x72e5948 [0263.433] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fea8600, ftCreationTime.dwHighDateTime=0x1ca5d0a, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1fea8600, ftLastWriteTime.dwHighDateTime=0x1ca5d0a, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMN_U.VSS", cAlternateFileName="")) returned 1 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_m.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VSS", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VSS") returned 1 [0263.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VSS", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vss") returned 0x48 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x217c) returned 0x72e5948 [0263.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91849200, ftCreationTime.dwHighDateTime=0x1ca4e38, ftLastAccessTime.dwLowDateTime=0x50657460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x91849200, ftLastWriteTime.dwHighDateTime=0x1ca4e38, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPMN_U.VST", cAlternateFileName="")) returned 1 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VST", len=0x48 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VST") returned 1 [0263.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPMN_U.VST", cchLength=0x48 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vst") returned 0x48 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2180) returned 0x72e5948 [0263.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x395adb00, ftCreationTime.dwHighDateTime=0x1ca4728, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x395adb00, ftLastWriteTime.dwHighDateTime=0x1ca4728, nFileSizeHigh=0x0, nFileSizeLow=0x19c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPRES_M.VSS", cAlternateFileName="")) returned 1 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpmn_u.vst", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_M.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_M.VSS") returned 1 [0263.434] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_M.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_m.vss") returned 0x49 [0263.434] SysReAllocStringLen (in: pbstr=0x6a0eae8*=0x0, psz="_RESTORE FILES_.txt", len=0x13 | out: pbstr=0x6a0eae8*="_RESTORE FILES_.txt") returned 1 [0263.434] CharLowerBuffW (in: lpsz="_RESTORE FILES_.txt", cchLength=0x13 | out: lpsz="_restore files_.txt") returned 0x13 [0263.434] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2184) returned 0x72e5948 [0263.434] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f50bc00, ftCreationTime.dwHighDateTime=0x1ca4728, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3f50bc00, ftLastWriteTime.dwHighDateTime=0x1ca4728, nFileSizeHigh=0x0, nFileSizeLow=0x18e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="BPRES_U.VSS", cAlternateFileName="")) returned 1 [0263.435] SysReAllocStringLen (in: pbstr=0x6a0eb48*="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_m.vss", psz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_U.VSS", len=0x49 | out: pbstr=0x6a0eb48*="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_U.VSS") returned 1 [0263.435] CharLowerBuffW (in: lpsz="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\BPRES_U.VSS", cchLength=0x49 | out: lpsz="c:\\program files\\microsoft office\\office14\\visio content\\1033\\bpres_u.vss") returned 0x49 [0263.435] RtlReAllocateHeap (Heap=0x580000, Flags=0x0, Ptr=0x72e5948, Size=0x2188) returned 0x72e5948 [0263.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3d8300, ftCreationTime.dwHighDateTime=0x1c32fa0, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xff3d8300, ftLastWriteTime.dwHighDateTime=0x1c32fa0, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRAINSTM.XML", cAlternateFileName="")) returned 1 [0263.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41b31600, ftCreationTime.dwHighDateTime=0x1ca4728, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x41b31600, ftLastWriteTime.dwHighDateTime=0x1ca4728, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM_M.VSS", cAlternateFileName="")) returned 1 [0263.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8eb7f900, ftCreationTime.dwHighDateTime=0x1ca489c, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8eb7f900, ftLastWriteTime.dwHighDateTime=0x1ca489c, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM_M.VST", cAlternateFileName="")) returned 1 [0263.435] FindNextFileW (in: hFindFile=0x5b9730, lpFindFileData=0x6a0eb54 | out: lpFindFileData=0x6a0eb54*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44157000, ftCreationTime.dwHighDateTime=0x1ca4728, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x44157000, ftLastWriteTime.dwHighDateTime=0x1ca4728, nFileSizeHigh=0x0, nFileSizeLow=0x8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM_U.VSS", cAlternateFileName="")) returned 1 Thread: id = 64 os_tid = 0xb14 Thread: id = 79 os_tid = 0xb84 Thread: id = 80 os_tid = 0x790 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4cb60000" os_pid = "0x9ec" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x9f0 [0039.288] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x35f8cc | out: lpSystemTimeAsFileTime=0x35f8cc*(dwLowDateTime=0x508e51c0, dwHighDateTime=0x1d536f7)) [0039.289] GetCurrentProcessId () returned 0x9ec [0039.289] GetCurrentThreadId () returned 0x9f0 [0039.289] GetTickCount () returned 0x18a44 [0039.289] QueryPerformanceCounter (in: lpPerformanceCount=0x35f8c4 | out: lpPerformanceCount=0x35f8c4*=15958835729) returned 1 [0039.289] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa10000 [0039.289] __set_app_type (_Type=0x1) [0039.289] __p__fmode () returned 0x74eb31f4 [0039.290] __p__commode () returned 0x74eb31fc [0039.290] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa321a6) returned 0x0 [0039.291] __getmainargs (in: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c, _DoWildCard=0, _StartInfo=0x4aa34140 | out: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c) returned 0 [0039.291] GetCurrentThreadId () returned 0x9f0 [0039.291] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9f0) returned 0x60 [0039.291] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.291] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0039.291] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.291] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.291] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x35f85c | out: phkResult=0x35f85c*=0x0) returned 0x2 [0039.292] VirtualQuery (in: lpAddress=0x35f893, lpBuffer=0x35f82c, dwLength=0x1c | out: lpBuffer=0x35f82c*(BaseAddress=0x35f000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.292] VirtualQuery (in: lpAddress=0x260000, lpBuffer=0x35f82c, dwLength=0x1c | out: lpBuffer=0x35f82c*(BaseAddress=0x260000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.292] VirtualQuery (in: lpAddress=0x261000, lpBuffer=0x35f82c, dwLength=0x1c | out: lpBuffer=0x35f82c*(BaseAddress=0x261000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.292] VirtualQuery (in: lpAddress=0x263000, lpBuffer=0x35f82c, dwLength=0x1c | out: lpBuffer=0x35f82c*(BaseAddress=0x263000, AllocationBase=0x260000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.292] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x35f82c, dwLength=0x1c | out: lpBuffer=0x35f82c*(BaseAddress=0x360000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x70000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.292] GetConsoleOutputCP () returned 0x1b5 [0039.292] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.292] SetConsoleCtrlHandler (HandlerRoutine=0x4aa2e72a, Add=1) returned 1 [0039.292] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.292] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.292] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.292] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0039.293] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.293] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.293] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.293] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0039.294] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.294] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.294] GetEnvironmentStringsW () returned 0x3e2070* [0039.294] GetProcessHeap () returned 0x3d0000 [0039.294] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xaca) returned 0x3e2b48 [0039.294] FreeEnvironmentStringsW (penv=0x3e2070) returned 1 [0039.294] GetProcessHeap () returned 0x3d0000 [0039.294] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4) returned 0x3e0ca8 [0039.294] GetEnvironmentStringsW () returned 0x3e2070* [0039.294] GetProcessHeap () returned 0x3d0000 [0039.294] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xaca) returned 0x3e3620 [0039.295] FreeEnvironmentStringsW (penv=0x3e2070) returned 1 [0039.295] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35e7cc | out: phkResult=0x35e7cc*=0x68) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x0, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x1, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x1, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x0, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x40, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x40, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x40, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.295] RegCloseKey (hKey=0x68) returned 0x0 [0039.295] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x35e7cc | out: phkResult=0x35e7cc*=0x68) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x40, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x1, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x1, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x0, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.295] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x9, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.296] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x4, lpData=0x35e7d8*=0x9, lpcbData=0x35e7d0*=0x4) returned 0x0 [0039.296] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x35e7d4, lpData=0x35e7d8, lpcbData=0x35e7d0*=0x1000 | out: lpType=0x35e7d4*=0x0, lpData=0x35e7d8*=0x9, lpcbData=0x35e7d0*=0x1000) returned 0x2 [0039.296] RegCloseKey (hKey=0x68) returned 0x0 [0039.296] time (in: timer=0x0 | out: timer=0x0) returned 0x5d259e17 [0039.296] srand (_Seed=0x5d259e17) [0039.296] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" [0039.296] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"vssadmin.exe delete shadows /all /quiet\"" [0039.375] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.375] GetProcessHeap () returned 0x3d0000 [0039.375] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x210) returned 0x3e2070 [0039.375] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x3e2078, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.375] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.375] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.376] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.376] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.376] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.376] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.376] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.376] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.376] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.376] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.376] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.376] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.376] GetProcessHeap () returned 0x3d0000 [0039.376] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e2b48 | out: hHeap=0x3d0000) returned 1 [0039.376] GetEnvironmentStringsW () returned 0x3e2288* [0039.376] GetProcessHeap () returned 0x3d0000 [0039.376] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xae2) returned 0x3e4be8 [0039.376] FreeEnvironmentStringsW (penv=0x3e2288) returned 1 [0039.376] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.376] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.376] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.376] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.376] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.376] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.376] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.376] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.376] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.376] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.376] GetProcessHeap () returned 0x3d0000 [0039.376] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x54) returned 0x3e56d8 [0039.376] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x35f598 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x35f598, lpFilePart=0x35f594 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x35f594*="Desktop") returned 0x25 [0039.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.377] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x35f314 | out: lpFindFileData=0x35f314*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x3e1ef0 [0039.377] FindClose (in: hFindFile=0x3e1ef0 | out: hFindFile=0x3e1ef0) returned 1 [0039.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x35f314 | out: lpFindFileData=0x35f314*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x3e1ef0 [0039.377] FindClose (in: hFindFile=0x3e1ef0 | out: hFindFile=0x3e1ef0) returned 1 [0039.377] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x35f314 | out: lpFindFileData=0x35f314*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4a1c1ca0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x4a1c1ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x3e1ef0 [0039.377] FindClose (in: hFindFile=0x3e1ef0 | out: hFindFile=0x3e1ef0) returned 1 [0039.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.377] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.377] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.377] GetProcessHeap () returned 0x3d0000 [0039.377] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e4be8 | out: hHeap=0x3d0000) returned 1 [0039.377] GetEnvironmentStringsW () returned 0x3e40f8* [0039.377] GetProcessHeap () returned 0x3d0000 [0039.377] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb36) returned 0x3e5f38 [0039.378] FreeEnvironmentStringsW (penv=0x3e40f8) returned 1 [0039.378] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.378] GetProcessHeap () returned 0x3d0000 [0039.378] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e56d8 | out: hHeap=0x3d0000) returned 1 [0039.378] GetProcessHeap () returned 0x3d0000 [0039.378] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x400e) returned 0x3e6a78 [0039.378] GetProcessHeap () returned 0x3d0000 [0039.378] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x60) returned 0x3e2dc8 [0039.378] GetProcessHeap () returned 0x3d0000 [0039.378] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4008) returned 0x3eaa90 [0039.378] GetProcessHeap () returned 0x3d0000 [0039.378] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x4008) returned 0x3eeaa0 [0039.380] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0039.380] GetProcessHeap () returned 0x3d0000 [0039.380] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x418) returned 0x3e2e30 [0039.380] SetErrorMode (uMode=0x0) returned 0x0 [0039.380] SetErrorMode (uMode=0x1) returned 0x0 [0039.381] GetFullPathNameW (in: lpFileName="vssadmin.exe delete shadows \\all \\.", nBufferLength=0x208, lpBuffer=0x3e2e38, lpFilePart=0x35f510 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe delete shadows \\all", lpFilePart=0x35f510*="all") returned 0x46 [0039.381] SetErrorMode (uMode=0x0) returned 0x1 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e2e30, Size=0xa2) returned 0x3e2e30 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e2e30) returned 0xa2 [0039.381] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe delete shadows \\all \\.") returned 1 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x9c) returned 0x3e2ee0 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x12c) returned 0x3e2f88 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e2f88, Size=0x9c) returned 0x3e2f88 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e2f88) returned 0x9c [0039.381] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.381] GetProcessHeap () returned 0x3d0000 [0039.381] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe0) returned 0x3e3030 [0039.384] GetProcessHeap () returned 0x3d0000 [0039.384] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3e3030, Size=0x76) returned 0x3e3030 [0039.384] GetProcessHeap () returned 0x3d0000 [0039.384] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3e3030) returned 0x76 [0039.384] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.384] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe delete shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x35f28c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35f28c) returned 0xffffffff [0039.384] GetLastError () returned 0x3 [0039.384] GetProcessHeap () returned 0x3d0000 [0039.384] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eaa90 | out: hHeap=0x3d0000) returned 1 [0039.385] GetProcessHeap () returned 0x3d0000 [0039.385] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3eeaa0 | out: hHeap=0x3d0000) returned 1 [0039.385] GetProcessHeap () returned 0x3d0000 [0039.385] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6a78 | out: hHeap=0x3d0000) returned 1 [0039.385] GetConsoleOutputCP () returned 0x1b5 [0039.386] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.386] GetUserDefaultLCID () returned 0x409 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa34950, cchData=8 | out: lpLCData=":") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x35f6d8, cchData=128 | out: lpLCData="0") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x35f6d8, cchData=128 | out: lpLCData="0") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x35f6d8, cchData=128 | out: lpLCData="1") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa34940, cchData=8 | out: lpLCData="/") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa34d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa34d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa34d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa34cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa34c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa34c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa34c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa34930, cchData=8 | out: lpLCData=".") returned 2 [0039.387] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa34920, cchData=8 | out: lpLCData=",") returned 2 [0039.387] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.388] GetProcessHeap () returned 0x3d0000 [0039.388] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x20c) returned 0x3e30b0 [0039.388] GetConsoleTitleW (in: lpConsoleTitle=0x3e30b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.389] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.389] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0039.389] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0039.389] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0039.389] GetProcessHeap () returned 0x3d0000 [0039.389] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x400a) returned 0x3e6a78 [0039.389] GetProcessHeap () returned 0x3d0000 [0039.389] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e6a78 | out: hHeap=0x3d0000) returned 1 [0039.390] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77 [0039.390] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16 [0039.390] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16 [0039.390] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13 [0039.390] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13 [0039.390] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4 [0039.390] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4 [0039.390] GetProcessHeap () returned 0x3d0000 [0039.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x58) returned 0x3e32c8 [0039.390] GetProcessHeap () returned 0x3d0000 [0039.390] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x22) returned 0x3e3328 [0039.391] GetProcessHeap () returned 0x3d0000 [0039.391] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x40) returned 0x3e3358 [0039.392] GetConsoleTitleW (in: lpConsoleTitle=0x35f3d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.392] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff [0039.392] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0039.392] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0039.392] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0039.392] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0039.392] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0039.392] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0039.392] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0039.392] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0039.392] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0039.392] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0039.392] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0039.392] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0039.392] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0039.392] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0039.393] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0039.393] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0039.393] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0039.393] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0039.393] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0039.393] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0039.393] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0039.393] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0039.393] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0039.393] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0039.393] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0039.393] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0039.393] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0039.393] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0039.393] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0039.393] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0039.393] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0039.393] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0039.393] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0039.393] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0039.393] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0039.393] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0039.393] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0039.393] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0039.393] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0039.393] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0039.393] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0039.393] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0039.393] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0039.393] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0039.393] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0039.393] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0039.393] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0039.393] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0039.394] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0039.394] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0039.394] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0039.394] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0039.394] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0039.394] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0039.394] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0039.394] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0039.394] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0039.394] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0039.394] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0039.394] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0039.394] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0039.394] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0039.394] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0039.394] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0039.394] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0039.394] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0039.394] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0039.394] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0039.394] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0039.394] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0039.394] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0039.394] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0039.394] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0039.394] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0039.394] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0039.394] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0039.394] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0039.394] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0039.394] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0039.394] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0039.394] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0039.394] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0039.395] GetProcessHeap () returned 0x3d0000 [0039.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x210) returned 0x3e33a0 [0039.395] GetProcessHeap () returned 0x3d0000 [0039.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x5a) returned 0x3e35b8 [0039.395] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0039.395] GetProcessHeap () returned 0x3d0000 [0039.395] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x418) returned 0x3d07f0 [0039.395] SetErrorMode (uMode=0x0) returned 0x0 [0039.395] SetErrorMode (uMode=0x1) returned 0x0 [0039.395] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3d07f8, lpFilePart=0x35eef0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x35eef0*="Desktop") returned 0x25 [0039.395] SetErrorMode (uMode=0x0) returned 0x1 [0039.395] GetProcessHeap () returned 0x3d0000 [0039.395] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3d07f0, Size=0x6e) returned 0x3d07f0 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d07f0) returned 0x6e [0039.396] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.396] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x120) returned 0x3d0868 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x238) returned 0x3d0990 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3d0990, Size=0x122) returned 0x3d0990 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d0990) returned 0x122 [0039.396] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.396] GetProcessHeap () returned 0x3d0000 [0039.396] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xe0) returned 0x3d0ac0 [0039.397] GetProcessHeap () returned 0x3d0000 [0039.397] RtlReAllocateHeap (Heap=0x3d0000, Flags=0x0, Ptr=0x3d0ac0, Size=0x76) returned 0x3d0ac0 [0039.397] GetProcessHeap () returned 0x3d0000 [0039.397] RtlSizeHeap (HeapHandle=0x3d0000, Flags=0x0, MemoryPointer=0x3d0ac0) returned 0x76 [0039.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x35ec8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35ec8c) returned 0xffffffff [0039.397] GetLastError () returned 0x2 [0039.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x35ec6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35ec6c) returned 0xffffffff [0039.397] GetLastError () returned 0x2 [0039.397] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x35ec6c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35ec6c) returned 0xffffffff [0039.397] GetLastError () returned 0x2 [0039.397] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.397] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x35ec8c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x35ec8c) returned 0x3d0b40 [0039.397] GetProcessHeap () returned 0x3d0000 [0039.397] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x0, Size=0x14) returned 0x3d0b80 [0039.397] FindClose (in: hFindFile=0x3d0b40 | out: hFindFile=0x3d0b40) returned 1 [0039.397] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2 [0039.397] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3 [0039.398] GetConsoleTitleW (in: lpConsoleTitle=0x35f164, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.398] InitializeProcThreadAttributeList (in: lpAttributeList=0x35efec, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x35f0b4 | out: lpAttributeList=0x35efec, lpSize=0x35f0b4) returned 1 [0039.398] UpdateProcThreadAttribute (in: lpAttributeList=0x35efec, dwFlags=0x0, Attribute=0x60001, lpValue=0x35f0ac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x35efec, lpPreviousValue=0x0) returned 1 [0039.398] GetStartupInfoW (in: lpStartupInfo=0x35efa8 | out: lpStartupInfo=0x35efa8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0039.398] GetProcessHeap () returned 0x3d0000 [0039.398] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0x18) returned 0x3d0b40 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0039.398] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.399] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0039.399] GetProcessHeap () returned 0x3d0000 [0039.399] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3d0b40 | out: hHeap=0x3d0000) returned 1 [0039.399] GetProcessHeap () returned 0x3d0000 [0039.399] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xa) returned 0x3dff48 [0039.399] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1 [0039.400] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x35f048*(cb=0x48, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x35f094 | out: lpCommandLine="vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x35f094*(hProcess=0x78, hThread=0x74, dwProcessId=0xb08, dwThreadId=0xb0c)) returned 1 [0039.574] CloseHandle (hObject=0x74) returned 1 [0039.574] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0039.574] GetProcessHeap () returned 0x3d0000 [0039.574] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e5f38 | out: hHeap=0x3d0000) returned 1 [0039.574] GetEnvironmentStringsW () returned 0x3e5f38* [0039.574] GetProcessHeap () returned 0x3d0000 [0039.574] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb36) returned 0x3e40f8 [0039.574] FreeEnvironmentStringsW (penv=0x3e5f38) returned 1 [0039.574] WaitForSingleObject (hHandle=0x78, dwMilliseconds=0xffffffff) returned 0x0 [0042.516] GetExitCodeProcess (in: hProcess=0x78, lpExitCode=0x35ef88 | out: lpExitCode=0x35ef88*=0x2) returned 1 [0042.516] CloseHandle (hObject=0x78) returned 1 [0042.516] _vsnwprintf (in: _Buffer=0x35f0d0, _BufferCount=0x13, _Format="%08X", _ArgList=0x35ef94 | out: _Buffer="00000002") returned 8 [0042.516] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0042.516] GetProcessHeap () returned 0x3d0000 [0042.516] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e40f8 | out: hHeap=0x3d0000) returned 1 [0042.516] GetEnvironmentStringsW () returned 0x3e40f8* [0042.516] GetProcessHeap () returned 0x3d0000 [0042.516] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb5c) returned 0x3e95e0 [0042.516] FreeEnvironmentStringsW (penv=0x3e40f8) returned 1 [0042.516] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0042.516] GetProcessHeap () returned 0x3d0000 [0042.517] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3e95e0 | out: hHeap=0x3d0000) returned 1 [0042.517] GetEnvironmentStringsW () returned 0x3e40f8* [0042.517] GetProcessHeap () returned 0x3d0000 [0042.517] RtlAllocateHeap (HeapHandle=0x3d0000, Flags=0x8, Size=0xb5c) returned 0x3e95e0 [0042.517] FreeEnvironmentStringsW (penv=0x3e40f8) returned 1 [0042.517] GetProcessHeap () returned 0x3d0000 [0042.517] HeapFree (in: hHeap=0x3d0000, dwFlags=0x0, lpMem=0x3dff48 | out: hHeap=0x3d0000) returned 1 [0042.517] DeleteProcThreadAttributeList (in: lpAttributeList=0x35efec | out: lpAttributeList=0x35efec) [0042.517] _get_osfhandle (_FileHandle=1) returned 0x7 [0042.517] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0042.517] _get_osfhandle (_FileHandle=1) returned 0x7 [0042.517] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0042.517] _get_osfhandle (_FileHandle=0) returned 0x3 [0042.517] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0042.518] SetConsoleInputExeNameW () returned 0x1 [0042.518] GetConsoleOutputCP () returned 0x1b5 [0042.518] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0042.518] SetThreadUILanguage (LangId=0x0) returned 0x409 [0042.518] exit (_Code=2) Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4c88e000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0x9fc [0039.290] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x45fa10 | out: lpSystemTimeAsFileTime=0x45fa10*(dwLowDateTime=0x508e51c0, dwHighDateTime=0x1d536f7)) [0039.290] GetCurrentProcessId () returned 0x9f8 [0039.293] GetCurrentThreadId () returned 0x9fc [0039.296] GetTickCount () returned 0x18a44 [0039.296] QueryPerformanceCounter (in: lpPerformanceCount=0x45fa08 | out: lpPerformanceCount=0x45fa08*=15959598163) returned 1 [0039.297] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa10000 [0039.297] __set_app_type (_Type=0x1) [0039.297] __p__fmode () returned 0x74eb31f4 [0039.297] __p__commode () returned 0x74eb31fc [0039.298] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa321a6) returned 0x0 [0039.298] __getmainargs (in: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c, _DoWildCard=0, _StartInfo=0x4aa34140 | out: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c) returned 0 [0039.298] GetCurrentThreadId () returned 0x9fc [0039.298] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x9fc) returned 0x60 [0039.298] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.298] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0039.298] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.298] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.299] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x45f9a0 | out: phkResult=0x45f9a0*=0x0) returned 0x2 [0039.299] VirtualQuery (in: lpAddress=0x45f9d7, lpBuffer=0x45f970, dwLength=0x1c | out: lpBuffer=0x45f970*(BaseAddress=0x45f000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.299] VirtualQuery (in: lpAddress=0x360000, lpBuffer=0x45f970, dwLength=0x1c | out: lpBuffer=0x45f970*(BaseAddress=0x360000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.299] VirtualQuery (in: lpAddress=0x361000, lpBuffer=0x45f970, dwLength=0x1c | out: lpBuffer=0x45f970*(BaseAddress=0x361000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.299] VirtualQuery (in: lpAddress=0x363000, lpBuffer=0x45f970, dwLength=0x1c | out: lpBuffer=0x45f970*(BaseAddress=0x363000, AllocationBase=0x360000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.299] VirtualQuery (in: lpAddress=0x460000, lpBuffer=0x45f970, dwLength=0x1c | out: lpBuffer=0x45f970*(BaseAddress=0x460000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0xb0000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.299] GetConsoleOutputCP () returned 0x1b5 [0039.299] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.299] SetConsoleCtrlHandler (HandlerRoutine=0x4aa2e72a, Add=1) returned 1 [0039.299] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.299] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.299] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.299] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0039.300] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.300] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.300] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.300] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0039.300] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.300] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.300] GetEnvironmentStringsW () returned 0x522080* [0039.300] GetProcessHeap () returned 0x510000 [0039.300] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xaca) returned 0x522b58 [0039.301] FreeEnvironmentStringsW (penv=0x522080) returned 1 [0039.301] GetProcessHeap () returned 0x510000 [0039.301] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4) returned 0x520cb8 [0039.301] GetEnvironmentStringsW () returned 0x522080* [0039.301] GetProcessHeap () returned 0x510000 [0039.301] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xaca) returned 0x523630 [0039.301] FreeEnvironmentStringsW (penv=0x522080) returned 1 [0039.301] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e910 | out: phkResult=0x45e910*=0x68) returned 0x0 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x0, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x1, lpcbData=0x45e914*=0x4) returned 0x0 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x1, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x0, lpcbData=0x45e914*=0x4) returned 0x0 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x40, lpcbData=0x45e914*=0x4) returned 0x0 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x40, lpcbData=0x45e914*=0x4) returned 0x0 [0039.301] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x40, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.301] RegCloseKey (hKey=0x68) returned 0x0 [0039.301] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x45e910 | out: phkResult=0x45e910*=0x68) returned 0x0 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x40, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x1, lpcbData=0x45e914*=0x4) returned 0x0 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x1, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x0, lpcbData=0x45e914*=0x4) returned 0x0 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x9, lpcbData=0x45e914*=0x4) returned 0x0 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x4, lpData=0x45e91c*=0x9, lpcbData=0x45e914*=0x4) returned 0x0 [0039.302] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x45e918, lpData=0x45e91c, lpcbData=0x45e914*=0x1000 | out: lpType=0x45e918*=0x0, lpData=0x45e91c*=0x9, lpcbData=0x45e914*=0x1000) returned 0x2 [0039.302] RegCloseKey (hKey=0x68) returned 0x0 [0039.302] time (in: timer=0x0 | out: timer=0x0) returned 0x5d259e17 [0039.302] srand (_Seed=0x5d259e17) [0039.302] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" [0039.302] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} recoveryenabled no\"" [0039.309] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.309] GetProcessHeap () returned 0x510000 [0039.309] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x522080 [0039.309] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x522088, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.314] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.314] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.314] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.314] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.314] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.314] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.314] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.314] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.314] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.314] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.314] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.314] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.314] GetProcessHeap () returned 0x510000 [0039.314] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x522b58 | out: hHeap=0x510000) returned 1 [0039.314] GetEnvironmentStringsW () returned 0x522298* [0039.314] GetProcessHeap () returned 0x510000 [0039.314] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xae2) returned 0x524bf8 [0039.315] FreeEnvironmentStringsW (penv=0x522298) returned 1 [0039.315] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.315] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.315] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.315] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.315] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.315] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.315] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.315] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.315] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.315] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.315] GetProcessHeap () returned 0x510000 [0039.315] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x54) returned 0x5256e8 [0039.315] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x45f6dc | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x45f6dc, lpFilePart=0x45f6d8 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f6d8*="Desktop") returned 0x25 [0039.315] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.315] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x45f458 | out: lpFindFileData=0x45f458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x521f00 [0039.315] FindClose (in: hFindFile=0x521f00 | out: hFindFile=0x521f00) returned 1 [0039.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x45f458 | out: lpFindFileData=0x45f458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x521f00 [0039.315] FindClose (in: hFindFile=0x521f00 | out: hFindFile=0x521f00) returned 1 [0039.316] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x45f458 | out: lpFindFileData=0x45f458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4a1c1ca0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x4a1c1ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x521f00 [0039.316] FindClose (in: hFindFile=0x521f00 | out: hFindFile=0x521f00) returned 1 [0039.316] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.316] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.316] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.316] GetProcessHeap () returned 0x510000 [0039.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x524bf8 | out: hHeap=0x510000) returned 1 [0039.316] GetEnvironmentStringsW () returned 0x524108* [0039.316] GetProcessHeap () returned 0x510000 [0039.316] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xb36) returned 0x525f48 [0039.316] FreeEnvironmentStringsW (penv=0x524108) returned 1 [0039.316] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.316] GetProcessHeap () returned 0x510000 [0039.316] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x5256e8 | out: hHeap=0x510000) returned 1 [0039.316] GetProcessHeap () returned 0x510000 [0039.316] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400e) returned 0x526a88 [0039.317] GetProcessHeap () returned 0x510000 [0039.317] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x6c) returned 0x522dd8 [0039.317] GetProcessHeap () returned 0x510000 [0039.317] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4008) returned 0x52aaa0 [0039.317] GetProcessHeap () returned 0x510000 [0039.317] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4008) returned 0x52eab0 [0039.326] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x522e50 [0039.327] SetErrorMode (uMode=0x0) returned 0x0 [0039.327] SetErrorMode (uMode=0x1) returned 0x0 [0039.327] GetFullPathNameW (in: lpFileName="bcdedit.exe \\.", nBufferLength=0x208, lpBuffer=0x522e58, lpFilePart=0x45f654 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", lpFilePart=0x45f654*="bcdedit.exe") returned 0x31 [0039.327] SetErrorMode (uMode=0x0) returned 0x1 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x522e50, Size=0xae) returned 0x522e50 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x522e50) returned 0xae [0039.327] NeedCurrentDirectoryForExePathW (ExeName="bcdedit.exe \\.") returned 1 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x72) returned 0x532ad8 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xd8) returned 0x522f08 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x522f08, Size=0x72) returned 0x522f08 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x522f08) returned 0x72 [0039.327] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.327] GetProcessHeap () returned 0x510000 [0039.327] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x522f88 [0039.331] GetProcessHeap () returned 0x510000 [0039.331] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x522f88, Size=0x76) returned 0x522f88 [0039.331] GetProcessHeap () returned 0x510000 [0039.331] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x522f88) returned 0x76 [0039.331] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.331] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe\\set {default} recoveryenabled no.*", fInfoLevelId=0x1, lpFindFileData=0x45f3d0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45f3d0) returned 0xffffffff [0039.331] GetLastError () returned 0x3 [0039.331] GetProcessHeap () returned 0x510000 [0039.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52aaa0 | out: hHeap=0x510000) returned 1 [0039.331] GetProcessHeap () returned 0x510000 [0039.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x52eab0 | out: hHeap=0x510000) returned 1 [0039.331] GetProcessHeap () returned 0x510000 [0039.331] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526a88 | out: hHeap=0x510000) returned 1 [0039.331] GetConsoleOutputCP () returned 0x1b5 [0039.332] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.332] GetUserDefaultLCID () returned 0x409 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa34950, cchData=8 | out: lpLCData=":") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x45f81c, cchData=128 | out: lpLCData="0") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x45f81c, cchData=128 | out: lpLCData="0") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x45f81c, cchData=128 | out: lpLCData="1") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa34940, cchData=8 | out: lpLCData="/") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa34d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa34d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa34d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa34cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa34c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa34c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa34c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa34930, cchData=8 | out: lpLCData=".") returned 2 [0039.335] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa34920, cchData=8 | out: lpLCData=",") returned 2 [0039.335] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.336] GetProcessHeap () returned 0x510000 [0039.336] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x0, Size=0x20c) returned 0x523008 [0039.336] GetConsoleTitleW (in: lpConsoleTitle=0x523008, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.337] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.337] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0039.337] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0039.338] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0039.341] GetProcessHeap () returned 0x510000 [0039.341] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x400a) returned 0x526a88 [0039.341] GetProcessHeap () returned 0x510000 [0039.341] HeapFree (in: hHeap=0x510000, dwFlags=0x0, lpMem=0x526a88 | out: hHeap=0x510000) returned 1 [0039.341] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0039.341] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0039.342] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0039.342] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0039.342] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0039.342] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0039.342] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0039.342] GetProcessHeap () returned 0x510000 [0039.342] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x58) returned 0x523220 [0039.342] GetProcessHeap () returned 0x510000 [0039.342] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x20) returned 0x525788 [0039.342] GetProcessHeap () returned 0x510000 [0039.342] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x4e) returned 0x523280 [0039.343] GetConsoleTitleW (in: lpConsoleTitle=0x45f514, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.360] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcdedit.exe")) returned 0xffffffff [0039.360] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.360] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.360] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.360] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.360] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.360] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.360] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.360] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.360] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.360] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.360] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.360] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.360] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.360] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.360] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.360] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.360] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.360] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.360] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.360] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.361] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.361] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.361] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.361] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.361] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.361] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.361] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.361] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.361] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.361] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.361] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.361] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.361] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.361] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.361] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.361] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.361] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.361] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.361] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.361] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.361] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.361] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.361] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.361] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.361] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.361] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.361] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.361] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.361] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.361] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.361] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.361] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.361] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.362] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.362] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.362] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.362] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.362] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.362] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.362] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.362] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.362] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.362] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.362] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.362] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.362] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.362] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.362] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.362] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.362] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.362] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.362] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.362] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.362] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.362] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.362] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.362] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.362] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.362] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0039.362] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0039.362] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x210) returned 0x5232d8 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x66) returned 0x5234f0 [0039.363] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x418) returned 0x5107f0 [0039.363] SetErrorMode (uMode=0x0) returned 0x0 [0039.363] SetErrorMode (uMode=0x1) returned 0x0 [0039.363] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x5107f8, lpFilePart=0x45f034 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x45f034*="Desktop") returned 0x25 [0039.363] SetErrorMode (uMode=0x0) returned 0x1 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x5107f0, Size=0x6c) returned 0x5107f0 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x5107f0) returned 0x6c [0039.363] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.363] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.363] GetProcessHeap () returned 0x510000 [0039.363] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x120) returned 0x510868 [0039.363] GetProcessHeap () returned 0x510000 [0039.364] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0x238) returned 0x510990 [0039.365] GetProcessHeap () returned 0x510000 [0039.365] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x510990, Size=0x122) returned 0x510990 [0039.365] GetProcessHeap () returned 0x510000 [0039.365] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x510990) returned 0x122 [0039.365] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.365] GetProcessHeap () returned 0x510000 [0039.365] RtlAllocateHeap (HeapHandle=0x510000, Flags=0x8, Size=0xe0) returned 0x510ac0 [0039.365] GetProcessHeap () returned 0x510000 [0039.365] RtlReAllocateHeap (Heap=0x510000, Flags=0x0, Ptr=0x510ac0, Size=0x76) returned 0x510ac0 [0039.365] GetProcessHeap () returned 0x510000 [0039.365] RtlSizeHeap (HeapHandle=0x510000, Flags=0x0, MemoryPointer=0x510ac0) returned 0x76 [0039.365] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edd0) returned 0xffffffff [0039.365] GetLastError () returned 0x2 [0039.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.365] GetLastError () returned 0x2 [0039.365] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edd0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edd0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.366] GetLastError () returned 0x2 [0039.366] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.367] GetLastError () returned 0x2 [0039.367] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.367] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edd0) returned 0xffffffff [0039.368] GetLastError () returned 0x2 [0039.368] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.369] GetLastError () returned 0x2 [0039.369] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.371] GetLastError () returned 0x2 [0039.371] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.371] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edd0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edd0) returned 0xffffffff [0039.372] GetLastError () returned 0x2 [0039.372] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.373] GetLastError () returned 0x2 [0039.373] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x45edb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x45edb0) returned 0xffffffff [0039.375] GetLastError () returned 0x2 [0039.613] _get_osfhandle (_FileHandle=2) returned 0xb [0039.613] GetFileType (hFile=0xb) returned 0x2 [0039.613] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.614] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x45f204 | out: lpMode=0x45f204) returned 1 [0039.614] _get_osfhandle (_FileHandle=2) returned 0xb [0039.614] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x45f238 | out: lpConsoleScreenBufferInfo=0x45f238) returned 1 [0039.614] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa44640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0039.614] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa44640, nSize=0x2000, Arguments=0x45f278 | out: lpBuffer="'bcdedit.exe' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x66 [0039.614] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4aa44640*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x45f25c, lpReserved=0x0 | out: lpBuffer=0x4aa44640*, lpNumberOfCharsWritten=0x45f25c*=0x66) returned 1 [0039.615] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.615] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.615] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.615] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0039.615] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.615] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0039.616] SetConsoleInputExeNameW () returned 0x1 [0039.616] GetConsoleOutputCP () returned 0x1b5 [0039.616] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.616] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.616] exit (_Code=1) Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\syswow64\\cmd.exe" page_root = "0x4eba4000" os_pid = "0xa14" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10 os_tid = 0xa18 [0039.302] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2ff87c | out: lpSystemTimeAsFileTime=0x2ff87c*(dwLowDateTime=0x5090b320, dwHighDateTime=0x1d536f7)) [0039.302] GetCurrentProcessId () returned 0xa14 [0039.302] GetCurrentThreadId () returned 0xa18 [0039.302] GetTickCount () returned 0x18a54 [0039.302] QueryPerformanceCounter (in: lpPerformanceCount=0x2ff874 | out: lpPerformanceCount=0x2ff874*=15960204164) returned 1 [0039.303] GetModuleHandleA (lpModuleName=0x0) returned 0x4aa10000 [0039.303] __set_app_type (_Type=0x1) [0039.303] __p__fmode () returned 0x74eb31f4 [0039.303] __p__commode () returned 0x74eb31fc [0039.303] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4aa321a6) returned 0x0 [0039.304] __getmainargs (in: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c, _DoWildCard=0, _StartInfo=0x4aa34140 | out: _Argc=0x4aa34238, _Argv=0x4aa34240, _Env=0x4aa3423c) returned 0 [0039.304] GetCurrentThreadId () returned 0xa18 [0039.304] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa18) returned 0x60 [0039.304] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.304] GetProcAddress (hModule=0x76c20000, lpProcName="SetThreadUILanguage") returned 0x76c4a84f [0039.304] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.304] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0039.304] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ff80c | out: phkResult=0x2ff80c*=0x0) returned 0x2 [0039.305] VirtualQuery (in: lpAddress=0x2ff843, lpBuffer=0x2ff7dc, dwLength=0x1c | out: lpBuffer=0x2ff7dc*(BaseAddress=0x2ff000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.305] VirtualQuery (in: lpAddress=0x200000, lpBuffer=0x2ff7dc, dwLength=0x1c | out: lpBuffer=0x2ff7dc*(BaseAddress=0x200000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000)) returned 0x1c [0039.305] VirtualQuery (in: lpAddress=0x201000, lpBuffer=0x2ff7dc, dwLength=0x1c | out: lpBuffer=0x2ff7dc*(BaseAddress=0x201000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0x2000, State=0x1000, Protect=0x104, Type=0x20000)) returned 0x1c [0039.305] VirtualQuery (in: lpAddress=0x203000, lpBuffer=0x2ff7dc, dwLength=0x1c | out: lpBuffer=0x2ff7dc*(BaseAddress=0x203000, AllocationBase=0x200000, AllocationProtect=0x4, RegionSize=0xfd000, State=0x1000, Protect=0x4, Type=0x20000)) returned 0x1c [0039.305] VirtualQuery (in: lpAddress=0x300000, lpBuffer=0x2ff7dc, dwLength=0x1c | out: lpBuffer=0x2ff7dc*(BaseAddress=0x300000, AllocationBase=0x0, AllocationProtect=0x0, RegionSize=0x150000, State=0x10000, Protect=0x1, Type=0x0)) returned 0x1c [0039.305] GetConsoleOutputCP () returned 0x1b5 [0039.305] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.305] SetConsoleCtrlHandler (HandlerRoutine=0x4aa2e72a, Add=1) returned 1 [0039.305] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.305] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1 [0039.305] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.305] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0039.306] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.306] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.306] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.306] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0039.306] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.306] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1 [0039.306] GetEnvironmentStringsW () returned 0x6320c0* [0039.306] GetProcessHeap () returned 0x620000 [0039.306] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xaca) returned 0x632b98 [0039.307] FreeEnvironmentStringsW (penv=0x6320c0) returned 1 [0039.307] GetProcessHeap () returned 0x620000 [0039.307] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4) returned 0x631860 [0039.307] GetEnvironmentStringsW () returned 0x6320c0* [0039.307] GetProcessHeap () returned 0x620000 [0039.307] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xaca) returned 0x633670 [0039.307] FreeEnvironmentStringsW (penv=0x6320c0) returned 1 [0039.307] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2fe77c | out: phkResult=0x2fe77c*=0x68) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x0, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x1, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x1, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x0, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x40, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x40, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x40, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.307] RegCloseKey (hKey=0x68) returned 0x0 [0039.307] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2fe77c | out: phkResult=0x2fe77c*=0x68) returned 0x0 [0039.307] RegQueryValueExW (in: hKey=0x68, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x40, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x1, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x1, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x0, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x9, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x4, lpData=0x2fe788*=0x9, lpcbData=0x2fe780*=0x4) returned 0x0 [0039.308] RegQueryValueExW (in: hKey=0x68, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2fe784, lpData=0x2fe788, lpcbData=0x2fe780*=0x1000 | out: lpType=0x2fe784*=0x0, lpData=0x2fe788*=0x9, lpcbData=0x2fe780*=0x1000) returned 0x2 [0039.308] RegCloseKey (hKey=0x68) returned 0x0 [0039.308] time (in: timer=0x0 | out: timer=0x0) returned 0x5d259e17 [0039.308] srand (_Seed=0x5d259e17) [0039.308] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" [0039.308] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /c \"bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures\"" [0039.308] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.308] GetProcessHeap () returned 0x620000 [0039.308] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x210) returned 0x6320c0 [0039.308] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6320c8, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\cmd.exe" (normalized: "c:\\windows\\syswow64\\cmd.exe")) returned 0x1b [0039.309] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.309] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.309] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.309] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0039.310] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0039.310] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0039.310] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0039.310] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0039.310] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0039.310] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0039.310] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0039.310] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0039.310] GetProcessHeap () returned 0x620000 [0039.310] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x632b98 | out: hHeap=0x620000) returned 1 [0039.310] GetEnvironmentStringsW () returned 0x6322d8* [0039.310] GetProcessHeap () returned 0x620000 [0039.310] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xae2) returned 0x634c38 [0039.310] FreeEnvironmentStringsW (penv=0x6322d8) returned 1 [0039.310] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0039.310] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0039.310] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0039.310] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0039.310] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0039.310] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0039.310] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0039.310] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0039.310] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0039.310] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0039.310] GetProcessHeap () returned 0x620000 [0039.310] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x54) returned 0x631790 [0039.310] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2ff548 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2ff548, lpFilePart=0x2ff544 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ff544*="Desktop") returned 0x25 [0039.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.311] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ff2c4 | out: lpFindFileData=0x2ff2c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x635728 [0039.311] FindClose (in: hFindFile=0x635728 | out: hFindFile=0x635728) returned 1 [0039.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2ff2c4 | out: lpFindFileData=0x2ff2c4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x635728 [0039.311] FindClose (in: hFindFile=0x635728 | out: hFindFile=0x635728) returned 1 [0039.311] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0039.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2ff2c4 | out: lpFindFileData=0x2ff2c4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4a1c1ca0, ftLastAccessTime.dwHighDateTime=0x1d536f7, ftLastWriteTime.dwLowDateTime=0x4a1c1ca0, ftLastWriteTime.dwHighDateTime=0x1d536f7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x635728 [0039.311] FindClose (in: hFindFile=0x635728 | out: hFindFile=0x635728) returned 1 [0039.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0039.311] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0039.311] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0039.311] GetProcessHeap () returned 0x620000 [0039.311] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x634c38 | out: hHeap=0x620000) returned 1 [0039.311] GetEnvironmentStringsW () returned 0x634148* [0039.311] GetProcessHeap () returned 0x620000 [0039.311] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xb36) returned 0x635f68 [0039.312] FreeEnvironmentStringsW (penv=0x634148) returned 1 [0039.312] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4aa35260 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0039.312] GetProcessHeap () returned 0x620000 [0039.312] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x631790 | out: hHeap=0x620000) returned 1 [0039.312] GetProcessHeap () returned 0x620000 [0039.312] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x400e) returned 0x636aa8 [0039.312] GetProcessHeap () returned 0x620000 [0039.312] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x8c) returned 0x632e18 [0039.312] GetProcessHeap () returned 0x620000 [0039.312] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4008) returned 0x63aac0 [0039.312] GetProcessHeap () returned 0x620000 [0039.312] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x4008) returned 0x63ead0 [0039.321] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x418) returned 0x632eb0 [0039.322] SetErrorMode (uMode=0x0) returned 0x0 [0039.322] SetErrorMode (uMode=0x1) returned 0x0 [0039.322] GetFullPathNameW (in: lpFileName="bcdedit.exe \\.", nBufferLength=0x208, lpBuffer=0x632eb8, lpFilePart=0x2ff4c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", lpFilePart=0x2ff4c0*="bcdedit.exe") returned 0x31 [0039.322] SetErrorMode (uMode=0x0) returned 0x1 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x632eb0, Size=0xce) returned 0x632eb0 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x632eb0) returned 0xce [0039.322] NeedCurrentDirectoryForExePathW (ExeName="bcdedit.exe \\.") returned 1 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x72) returned 0x642af8 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xd8) returned 0x632f88 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x632f88, Size=0x72) returned 0x632f88 [0039.322] GetProcessHeap () returned 0x620000 [0039.322] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x632f88) returned 0x72 [0039.322] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.322] GetProcessHeap () returned 0x620000 [0039.323] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xe0) returned 0x633008 [0039.325] GetProcessHeap () returned 0x620000 [0039.325] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x633008, Size=0x76) returned 0x633008 [0039.326] GetProcessHeap () returned 0x620000 [0039.326] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x633008) returned 0x76 [0039.326] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.326] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe\\set {default} bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x2ff23c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ff23c) returned 0xffffffff [0039.326] GetLastError () returned 0x3 [0039.326] GetProcessHeap () returned 0x620000 [0039.326] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x63aac0 | out: hHeap=0x620000) returned 1 [0039.326] GetProcessHeap () returned 0x620000 [0039.326] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x63ead0 | out: hHeap=0x620000) returned 1 [0039.326] GetProcessHeap () returned 0x620000 [0039.326] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x636aa8 | out: hHeap=0x620000) returned 1 [0039.326] GetConsoleOutputCP () returned 0x1b5 [0039.331] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.332] GetUserDefaultLCID () returned 0x409 [0039.332] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4aa34950, cchData=8 | out: lpLCData=":") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2ff688, cchData=128 | out: lpLCData="0") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2ff688, cchData=128 | out: lpLCData="0") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2ff688, cchData=128 | out: lpLCData="1") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4aa34940, cchData=8 | out: lpLCData="/") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4aa34d80, cchData=32 | out: lpLCData="Mon") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4aa34d40, cchData=32 | out: lpLCData="Tue") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4aa34d00, cchData=32 | out: lpLCData="Wed") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4aa34cc0, cchData=32 | out: lpLCData="Thu") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4aa34c80, cchData=32 | out: lpLCData="Fri") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4aa34c40, cchData=32 | out: lpLCData="Sat") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4aa34c00, cchData=32 | out: lpLCData="Sun") returned 4 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4aa34930, cchData=8 | out: lpLCData=".") returned 2 [0039.333] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4aa34920, cchData=8 | out: lpLCData=",") returned 2 [0039.333] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0039.334] GetProcessHeap () returned 0x620000 [0039.334] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x0, Size=0x20c) returned 0x633088 [0039.334] GetConsoleTitleW (in: lpConsoleTitle=0x633088, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.337] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c20000 [0039.337] GetProcAddress (hModule=0x76c20000, lpProcName="CopyFileExW") returned 0x76c53b92 [0039.337] GetProcAddress (hModule=0x76c20000, lpProcName="IsDebuggerPresent") returned 0x76c34a5d [0039.337] GetProcAddress (hModule=0x76c20000, lpProcName="SetConsoleInputExeNameW") returned 0x76c4a79d [0039.338] GetProcessHeap () returned 0x620000 [0039.338] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x400a) returned 0x636aa8 [0039.338] GetProcessHeap () returned 0x620000 [0039.338] HeapFree (in: hHeap=0x620000, dwFlags=0x0, lpMem=0x636aa8 | out: hHeap=0x620000) returned 1 [0039.339] _wcsicmp (_String1="bcdedit.exe", _String2=")") returned 57 [0039.339] _wcsicmp (_String1="FOR", _String2="bcdedit.exe") returned 4 [0039.339] _wcsicmp (_String1="FOR/?", _String2="bcdedit.exe") returned 4 [0039.339] _wcsicmp (_String1="IF", _String2="bcdedit.exe") returned 7 [0039.339] _wcsicmp (_String1="IF/?", _String2="bcdedit.exe") returned 7 [0039.339] _wcsicmp (_String1="REM", _String2="bcdedit.exe") returned 16 [0039.339] _wcsicmp (_String1="REM/?", _String2="bcdedit.exe") returned 16 [0039.339] GetProcessHeap () returned 0x620000 [0039.339] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x58) returned 0x6332a0 [0039.339] GetProcessHeap () returned 0x620000 [0039.339] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x20) returned 0x6357a8 [0039.340] GetProcessHeap () returned 0x620000 [0039.340] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x6e) returned 0x633300 [0039.340] GetConsoleTitleW (in: lpConsoleTitle=0x2ff380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b [0039.344] GetFileAttributesW (lpFileName="bcdedit.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\bcdedit.exe")) returned 0xffffffff [0039.344] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.344] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.344] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.344] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.344] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.344] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.344] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.344] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.345] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.345] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.345] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.345] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.345] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.345] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.345] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.345] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.345] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.345] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.345] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.345] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.345] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.345] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.345] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.345] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.345] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.345] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.345] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.345] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.345] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.345] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.345] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.345] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.345] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.345] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.345] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.345] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.345] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.345] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.345] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.345] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.345] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.345] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.345] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0039.345] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0039.345] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0039.345] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0039.345] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0039.346] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0039.346] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0039.346] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0039.346] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0039.346] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0039.346] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0039.346] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0039.346] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0039.346] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0039.346] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0039.346] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0039.346] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0039.346] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0039.346] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0039.346] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0039.346] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0039.346] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0039.346] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0039.346] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0039.346] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0039.346] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0039.346] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0039.346] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0039.346] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0039.346] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0039.346] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0039.346] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0039.346] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0039.346] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0039.346] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0039.346] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0039.346] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0039.346] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0039.347] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0039.347] GetProcessHeap () returned 0x620000 [0039.347] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x210) returned 0x633378 [0039.347] GetProcessHeap () returned 0x620000 [0039.347] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x86) returned 0x633590 [0039.347] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0039.347] GetProcessHeap () returned 0x620000 [0039.347] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x418) returned 0x6207f0 [0039.347] SetErrorMode (uMode=0x0) returned 0x0 [0039.347] SetErrorMode (uMode=0x1) returned 0x0 [0039.348] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x6207f8, lpFilePart=0x2feea0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2feea0*="Desktop") returned 0x25 [0039.348] SetErrorMode (uMode=0x0) returned 0x1 [0039.348] GetProcessHeap () returned 0x620000 [0039.348] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x6207f0, Size=0x6c) returned 0x6207f0 [0039.348] GetProcessHeap () returned 0x620000 [0039.348] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x6207f0) returned 0x6c [0039.348] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0039.348] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0039.348] GetProcessHeap () returned 0x620000 [0039.348] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x120) returned 0x620868 [0039.348] GetProcessHeap () returned 0x620000 [0039.348] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0x238) returned 0x620990 [0039.349] GetProcessHeap () returned 0x620000 [0039.349] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x620990, Size=0x122) returned 0x620990 [0039.349] GetProcessHeap () returned 0x620000 [0039.349] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x620990) returned 0x122 [0039.349] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4aa40640, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0039.349] GetProcessHeap () returned 0x620000 [0039.349] RtlAllocateHeap (HeapHandle=0x620000, Flags=0x8, Size=0xe0) returned 0x620ac0 [0039.349] GetProcessHeap () returned 0x620000 [0039.349] RtlReAllocateHeap (Heap=0x620000, Flags=0x0, Ptr=0x620ac0, Size=0x76) returned 0x620ac0 [0039.349] GetProcessHeap () returned 0x620000 [0039.349] RtlSizeHeap (HeapHandle=0x620000, Flags=0x0, MemoryPointer=0x620ac0) returned 0x76 [0039.349] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.349] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec3c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec3c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.350] GetLastError () returned 0x2 [0039.350] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec3c) returned 0xffffffff [0039.351] GetLastError () returned 0x2 [0039.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.351] GetLastError () returned 0x2 [0039.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.351] GetLastError () returned 0x2 [0039.351] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.351] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec3c) returned 0xffffffff [0039.353] GetLastError () returned 0x2 [0039.353] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.354] GetLastError () returned 0x2 [0039.354] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.355] GetLastError () returned 0x2 [0039.355] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0039.355] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec3c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec3c) returned 0xffffffff [0039.356] GetLastError () returned 0x2 [0039.356] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.357] GetLastError () returned 0x2 [0039.358] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bcdedit.exe", fInfoLevelId=0x1, lpFindFileData=0x2fec1c, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2fec1c) returned 0xffffffff [0039.359] GetLastError () returned 0x2 [0039.584] _get_osfhandle (_FileHandle=2) returned 0xb [0039.584] GetFileType (hFile=0xb) returned 0x2 [0039.584] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb [0039.584] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x2ff070 | out: lpMode=0x2ff070) returned 1 [0039.584] _get_osfhandle (_FileHandle=2) returned 0xb [0039.584] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x2ff0a4 | out: lpConsoleScreenBufferInfo=0x2ff0a4) returned 1 [0039.584] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa44640, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d [0039.585] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4aa44640, nSize=0x2000, Arguments=0x2ff0e4 | out: lpBuffer="'bcdedit.exe' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x66 [0039.585] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4aa44640*, nNumberOfCharsToWrite=0x66, lpNumberOfCharsWritten=0x2ff0c8, lpReserved=0x0 | out: lpBuffer=0x4aa44640*, lpNumberOfCharsWritten=0x2ff0c8*=0x66) returned 1 [0039.586] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.586] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1 [0039.586] _get_osfhandle (_FileHandle=1) returned 0x7 [0039.586] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4aa341ac | out: lpMode=0x4aa341ac) returned 1 [0039.586] _get_osfhandle (_FileHandle=0) returned 0x3 [0039.586] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4aa341b0 | out: lpMode=0x4aa341b0) returned 1 [0039.587] SetConsoleInputExeNameW () returned 0x1 [0039.587] GetConsoleOutputCP () returned 0x1b5 [0039.587] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4aa34260 | out: lpCPInfo=0x4aa34260) returned 1 [0039.587] SetThreadUILanguage (LangId=0x0) returned 0x409 [0039.587] exit (_Code=1) Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\syswow64\\vssadmin.exe" page_root = "0x4c040000" os_pid = "0xb08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x9ec" cmd_line = "vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 62 os_tid = 0xb0c Thread: id = 63 os_tid = 0xb10 Thread: id = 65 os_tid = 0xb18 Thread: id = 66 os_tid = 0xb1c Thread: id = 67 os_tid = 0xb20 Process: id = "6" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x4c75d000" os_pid = "0xb2c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9a0" cmd_line = "\"C:\\Windows\\system32\\NOTEPAD.EXE\" C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\temp000000.txt" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0xb30 Thread: id = 78 os_tid = 0xb80 Process: id = "7" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4dc66000" os_pid = "0xb24" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xb08" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0007c846" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 69 os_tid = 0xb48 Thread: id = 70 os_tid = 0xb44 Thread: id = 71 os_tid = 0xb40 Thread: id = 72 os_tid = 0xb3c [0042.478] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf0d930 | out: lpSystemTimeAsFileTime=0xf0d930*(dwLowDateTime=0x5147fd00, dwHighDateTime=0x1d536f7)) [0042.479] GetCurrentProcessId () returned 0xb24 [0042.479] GetCurrentThreadId () returned 0xb3c [0042.479] GetTickCount () returned 0x18f05 [0042.479] QueryPerformanceCounter (in: lpPerformanceCount=0xf0d938 | out: lpPerformanceCount=0xf0d938*=16277838722) returned 1 [0042.479] malloc (_Size=0x100) returned 0x5f8e80 [0238.557] free (_Block=0x5f8e80) Thread: id = 73 os_tid = 0xb38 Thread: id = 74 os_tid = 0xb34 Thread: id = 75 os_tid = 0xb28 Thread: id = 76 os_tid = 0xb50 Thread: id = 77 os_tid = 0xb7c Thread: id = 81 os_tid = 0x9d0 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "7" os_parent_pid = "0xb24" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 82 os_tid = 0x9f0 Thread: id = 83 os_tid = 0x8d8 Thread: id = 84 os_tid = 0xbe8 Thread: id = 85 os_tid = 0x76c Thread: id = 86 os_tid = 0x758 Thread: id = 87 os_tid = 0x72c Thread: id = 88 os_tid = 0x71c Thread: id = 89 os_tid = 0x718 Thread: id = 90 os_tid = 0x154 Thread: id = 91 os_tid = 0x120 Thread: id = 92 os_tid = 0x3fc Thread: id = 93 os_tid = 0x974 Thread: id = 94 os_tid = 0xb74